The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or

The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.