It would be nice if they did so, but I don't think companies should be obligated to pay for bug reports from researchers that have no association whatsoever wit

It would be nice if they did so, but I don't think companies should be obligated to pay for bug reports from researchers that have no association whatsoever with them. Those that pay seem to get more reports, both in numbers and in quality, at least that's what Google says. Also, I think that a consumer should have the right to speak up when personal data is at risk, but that's a whole other story. In this case, I'm more worried about the "lots to lose" part than about the "nothing to win" one. For some reason I'm even fine with doing charity work for the benefit of billion-dollar corporations from time to time [1]. But not if there's the risk of them coming after me in the future... [1] http://technet.microsoft.com/en-us/security/cc308589.aspx http://technet.microsoft.com/en-us/security/cc308589.aspx