[maratd]

> These attitudes haven't changed much since 1990 at least.

Why would they?

A blatant oversight is a sign of incompetence and by making such incompetence public, you're threatening their job security. Why would anyone react positively?

You're better off making the disclosure anonymously.

[genwin]

> You're better off making the disclosure anonymously.

When the info comes from an anonymous source they can't take their frustration out on the messenger. (Instead of thanking the messenger as they should.) I don't get why these hackers often give up their anonymity.

[TeMPOraL]

> I don't get why these hackers often give up their anonymity.

My guess is that it's because they're hackers, and they don't expect that the other side consist mostly of boring incompetents with zero sense of humour or professional pride. Geez, if I were to ever be responsible for ITSEC in a school, I'd take such hacker for a beer and dare him to try and break some more stuff. The state of mind which leads people to prosecute hackers is a very sad one.