It would have been more ethical if the university had not blocked the &quot;researchers&quot; from disclosing the vulnerability at Black Hat. (Though even then they were not following responsible disclosure practices).  The fact that Tor had to guess what the vulnerability was and the &quot;researchers&quot; still have not released their paper is unethical and probably illegal.