> Being "white hat" gets you in trouble more often than not. Granted. I've lost clients this way, despite having been actually invited to do work on their syst

> Being "white hat" gets you in trouble more often than not. Granted. I've lost clients this way, despite having been actually invited to do work on their systems; such experience has taught me that the political concerns around unsolicited vulnerability reporting dwarf the technical considerations involved, and that trying to navigate such minefields is worthwhile only when the status quo is utterly untenable. > Personally i would have sold it to the highest bidder. Well, that's a wholly different consideration, isn't it? Saying nothing is one thing. Gravely violating the ethics of your profession, and possibly criminal law as well, is quite another.