Hacker News Reader

They did not, in fact, botch anything. They notified the responsible party and followed a practice that is pretty much the accepted norm (and for good reason).

How recursive should their notifications be? Just the tip three distros? The top dozen? Every embedded Linux router company? How about every hosting provider?

They did what they're supposed to without being paid for it. The only other good source of funding for security research besides marketing budgets for security companies will NOT result in a disclosure timeline you'd be happier with. ;-)

But they most probably did get paid for it, they have ads for their shit all over the website.

strategically botched ;)

How did they botch the disclosure to distros?

They did not make a disclosure to the distros