With the exception of DDoS attacks, I think what they're doing is a good thing. Malicious hackers don't just take down sites - they go in, and try to get out un

With the exception of DDoS attacks, I think what they're doing is a good thing. Malicious hackers don't just take down sites - they go in, and try to get out undetected. If there is a major vulnerability (especially if it's easy to figure out), they're really doing these sites a favor in pointing it out. Obviously, rendering a free service, it's hard to worry about your client's PR issues... especially if bringing it up in a friendly way would probably take multiple phone calls and countless hours. They may not be doing the companies a favor, but they're definitely doing their clients a favor (Citi for example).