> I can't downvote but this is a terrible attitude.

While I'm not down with selling the hack, not interacting with police is always good advice.

It's shown over and over again that official contact with the police rarely has good results, at best has neutral results, and sometimes has VERY bad results.

I was referring to the 'the kid who did a good thing should have made himself explicitly a criminal' part.

To be fair, I can sympathize with OP's sentiment; why offer help to someone who not only doesn't want but will actively prosecute you for it?

I don't agree, but I could imagine feeling this way in another universe.

Not offering help is one thing. Selling a hack against someone is actively hurting them.

Why is this being criticized (by downvoting)? This absolutely is a wrong attitude.

The path of least resistance is mutely accepting that it's a bad idea to talk to police, or otherwise engage with authorities.

Those who hold so much power over our lives must be held to much higher standards: of responsibility, ethics, and behavior. If you want change, take the path of maximum resistance.

It's also a reprehensible response from the authorities, too. IMO they're in the wrong much more so than the one who discovered the vulnerability.

Both sides can be wrong. I was simply pointing out that harming them by selling the hack because they would react poorly if you told them about it is a terrible plan.