> The same as the fact I did not lock my door do not allow anyone to rob my home, that I did not replace my fire detector batteries is no excuse for anyone to s

> The same as the fact I did not lock my door do not allow anyone to rob my home, that I did not replace my fire detector batteries is no excuse for anyone to set it alight, etc. First, let's fix your analogy: If you don't lock your door, this is generally not an issue for the general public, i.e. it doesn't impact anyone else negatively, just you in case you get robbed. A better analogy for this case here would be that you leave your door unlocked every day on purpose AND have a huge arsenal of guns, rifles, etc. right in your entrance room, all loaded up ready to be used. If I'd encounter that, the least I'd do is call the cops; the only problem here is that if I call the police telling them my neighbor Bob is running an insecure IoT device that can be used for DDoS attacks against anyone on this planet, they won't do shit. So if the police told me they don't care about your publicly accessible arsenal of weaponry then yes, I think it would be a good idea to try and prevent anyone from accessing it. > Only when one had been hold accountable for what he has done should we go after companies for negligence, no? That would mean we shouldn't punish anyone for putting individual people or the general public in danger unless something bad actually happenes. This is not true in other scopes too, there's a lot of things you can get fined/arrested for that don't actually hurt anyone but just have the potential to. > "I discovered this security hole then proceeded to exploit it and damage some random system/workflow for the sake of demonstration" should not be acceptable. My take on this: "I discovered this security hole that others were exploiting to DDoS other parties on the Internet, so I proceeded to exploit it too and damage some random system/workflow to prevent this abuse from continuing"