What grace period is appropriate for a 0 day root login vulnerability?

This guy is, with all probability, not the first one to have found it.

If there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it.

I'm not sure what length grace period is appropriate, though.

If there was a vulnerability that allowed anyone to open my car, I'd want to known ASAP, because I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

Same applies for Apple. No reason to believe this guy was the first one to find this exploit, we only know he was the first one to publicize it.

> I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

True, and this is where the analogy breaks down, since they would not be able to remotely send over a fix. But Apple would, and apparently now has.

To be pedantic, this isn't a 0day root login vuln, but a priv escalation vuln.