[dlikhten]

They may be non-malicious, but they show that someone with an intent to harm could do far worse and that most are completely unprotected.

Its better to expose problems than live with the false security that none exist. The false security leads to much worse breaches when they happen (see Sony) would be nice if Lulz hacked Sony 3 yrs ago and went public.

[wmf]

It sounds like a reverse lottery of pain to me. If LulzSec looks at you, you get to spend millions beefing up security while your competitors do nothing.

[bxr]

>If LulzSec looks at you, you get to spend millions beefing up security

...or, you know, be competent in the first place.

[wmf]

They can choose when and where to attack, but you have to defend everywhere all the time. I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

[bxr]

>I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

Yup, unfortunately this is true, and half-assing it because of this is what gets us onerous new internet legislation.