alt Hacker NewsEmbargo should last at most to the moment fix is made and code passes test suite.
Anything longer is putting systems at danger. I can recompile the package with a patch (even if Ubuntu/RHEL takes 3 weeks to do it) myself in a pinch, and I'd like to have a chance for it before the bug gets re-discovered by malicious party
What if the test suite passes in the middle of the night? Should all administrators interrupt their sleep and get up to recompile their servers immediately?