[introvertmac]

True, but people do have bills to pay. So this can't be a full time thing.

[andreyf]

I think Schneier is arguing that if companies were liable for their disregard of even minimal security standards, they might pay you more to help finding vulnerabilities.