>But I can imagine that a big company doesn't want every Tom, Dick, and Harry poking at their sensitive bits. I think they'd prefer whitehats over blackhats po

>But I can imagine that a big company doesn't want every Tom, Dick, and Harry poking at their sensitive bits. I think they'd prefer whitehats over blackhats poking at their sensitive bits. >What about it? Situations like this can make the news. They can cause a big hubbub. They can raise awareness. Not always (this case seems like it definitely won't) - but doing these greyhat sort of pranks has a larger chance than never talking about it at all. >That would most likely be in the compensation agreement, lots of legaleese. I meant if it was anonymously reported (unless this is optional) - they would not be able to be contacted for compensation. I'm all for emailing/anonymous tips without expectations of compensation. Should we really be defending companies because "they shouldn't have to pay out money to improve their security of OUR PERSONAL DATA"? I don't care if every Tom, Dick, Jane, and Harry is poking around sensitive areas. If they're getting into 'secured' areas or stealing personal information - that's a problem for people and it's the companies job to have tighter security.