As an interesting aside, if Debian randomizes PIDs like I believe OpenBSD does, there would have been an additional (small and almost irrelevant) countermeasure against guessing the correct key.

To your first point: I initially thought the same thing, until I started asking around. I’m not convinced that people need to give up their holiday weekends to address this issue - but I do believe it needs to be addressed as something more than an academic exercise. However, the second part is disconcerting, since I fear it true: the time and money spent addressing this issue is likely to usurp time, money and attention from other areas.

As to Ubuntu - good to know!

Is this mostly an academic vulnerability in many organizations? To put it another way, are many companies doing security so well that insecurely generated keys are going to get attention? Or, will they pay attention to this at the expense of something like the Help Desk using default passwords to reset accounts?

Secondly, Ubuntu did an excellent job of handling this for me. Not only did it give me the update, but it regenerated the affected system keys for me.

We need to continue taking this approach and apply it to things like drivers and perhaps even firmware.