[pseudonym]

If I had 5 cents for every time I've read an article on someone going after the person reporting the hole in their software...I'd probably have at least enough to go get a soda from the company vending machine.

The sad state of affairs is that a lot of companies are more interested in security via cheap obscurity, and will gladly go after the person who dared to publicize their security holes.

[pyre]

The difference here, is that unlike URL-hacking, or some-such, they would have a hard time arguing that a user using their product exactly as intended was doing something against the law.