I’m British and I’m fairly sure disclosing a security bug is permitted in the UK.
Also, the court case in question was filed in the USA, so it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.
> it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.
Yep. And it is totally legitimate to have little sympathy for the case, or to criticize the law that allows this kind of things.
Journalists and newspaper editors also do not work for free. More importantly, speech in a newspaper is still protected, even if a copy of the newspaper costs money.
What is the functional difference between selling a copy of a newspaper costing a lot of money per issue detailing the exploit and selling the exploit some other way?
Moreso selling "information that you would rather not be public but is not considered a secret legally" is completely legal in the US. There are lots of books published and sold containing information that some company or person would rather keep secret.
>Responsible disclosure is a thing.
Not a legal requirement. More of a gentleman's agreement after companies sent the law after security researchers so researchers sold or released anonymous zero days.
Disclosing one, yes. Selling it secretly do that it can result in exploits, certainly not. Responsible disclosure is a thing. I doubt that people selling credit card numbers and fake identities are protected by free speech.