I agree proper disclosure take effort but even if he was to send them the very same text privately instead of posting it to the bug tracker it would have been better.
I'm sure we can come up with a best way to go about things. I'm not really cool with the "oh Mike" part of it. But I think it's mostly okayish. Certainly a lot more okay than the bug.