01 Oct 2018: Notified Intel Security
    26 Oct 2018: Notified openssl-security
    26 Oct 2018: Notified CERT-FI
    26 Oct 2018: Notified oss-security distros list
    01 Nov 2018: Embargo expired

Why even do an embargo if you give hardware people 1 month and software people 1 week?!

Any number of possible reasons.

OpenSSL shipped a patch for it in that interval. Intel isn't going to fix it faster than OpenSSL ships a patch revealing it unless they already had a convenient killbit for the affected things.

I have no idea what the relevant researcher's policies are, but I would assume we'll hear about it if somebody requested a longer embargo and they refused.

(It also appears to be much harder to reproduce in the presence of dynamic clock speeds, so the impact in most smaller environments is going to be low unless someone does further work to make it reproduce well with that.)

Bad experience in the past probably. Also this probably just leads to the official recommendation to disable Hyper-Threading "for security critical applications" or some PR blurb.

Code is up before paper (linked in the article and mailing list discussion), which is rare enough to be praised:

https://github.com/bbbrumley/portsmash