I can't help but feel like most of what you're saying doesn't really matter with respect to getting sued or not. Does it really matter whether advertise that t

I can't help but feel like most of what you're saying doesn't really matter with respect to getting sued or not. Does it really matter whether advertise that they are secure or not? If security wasn't listed all of their site, would that have mattered? Does it matter whether they wrote a lessons learned blog post? And as far as communication goes, Drew did respond and I thought the response was pretty good [1]. It was not immediate, nor should it have been. They had to determine the extent of the breach, consult with their lawyers, devise an appropriate strategy, etc. It's not as simple as immediately notifying every account holder. That's what... 30 million people? Less than 100 accounts were actually exploited--why create mass hysteria when you can simply notify the small batch that were actually impacted? As bad as this situation is for them, awareness is mostly confined to the tech elite which in the grand scheme of things is a pretty good outcome. [1] http://techcrunch.com/2011/06/24/dropbox-breach-fewer-than-100-accounts-affected-but-one-person-actively-exploited-it/ http://techcrunch.com/2011/06/24/dropbox-breach-fewer-than-1...