>do not blame shoddy security, blame the people who discovered it Discovering shoddy security is one thing, abusing a lax security to cause damages, is a compl

>do not blame shoddy security, blame the people who discovered it Discovering shoddy security is one thing, abusing a lax security to cause damages, is a completely different thing. If you leave your house door unlocked, that does not mean I'm now legally entitled to walk in and steal your shit. Also in regards to discovering weak security, there are rules around that. Intentional pen-testing without explicit consent is still a crime in most jurisdictions, as it should be. I don't have the right to pen-test all the IT systems I like, and start lock-picking at the doors in my neighborhood, just for the noble goal of testing their security, without the explicit permission of the owners of those systems/properties. If I accidentally enter my password in the birthday field and that crashes your system due to special characters, that's an accidental security finding I can report without repercussions, but that doesn't mean I can now start hammering your live system with port scanners and SQL-injections, just to be "thorough".