OpenBSD and the latest OpenSSL bugs

No it is not only for openssl. That's for various vendors, to organize big updates. The idea of embargo is a often debated one, but so far, it seems to work fine in practice. The list access is controlled, and you kinda have to show you are responsible of a product/distro security to be there.

And having a few weeks to work on the patch bring some benefit in term of testing, etc. For example, the first patches for openssl were indeed wrong and were corrected by Canonical and Red Hat, so we can see the power of collaboration. In turn, it avoid the rush of having to update twice in a row ( openssh 3.6 for example ). And funnily enough, openssh 5.0 release note do ask for responsible disclosure ( http://www.openssh.com/txt/release-5.0 ) due to a CVE found just after the 4.9 release. As they request the use of a private mailing list, I guess the team behind openssh have a more nuanced view on what is exactly "responsible disclosure" than Theo who seems to want to commit and release.