The biggest problem when the 911 (and equivalent emergency services) was getting the word out there that it existed. It required a huge, years-long marketing campaign. Perhaps they should have inhouse ads targeted at keywords like "report vulnerability".

I wonder if large companies are willing to advertise to the general public the possibility that they could have vulnerabilities.

I emailed [email protected] when I found a security issue with Google +1 (http://news.ycombinator.com/item?id=2630355) but didn't get any response. I guess it's not really an issue for them.

No, it won't. Trying to contact Google when I was working for a major corporation and TRYING TO GIVE GOOGLE MONEY resulted in the exact same issue as the OP, and this was in 2006, not 2011. The only way to get their attention was create a blog post about how I couldn't contact them.

Hmm, which is more valuable, $1000 or #1 on HN?

$1000

You can get both.

Sometimes (not necessarily in this case) #1 on HN. Being noticed in the right place at a right time may proove to be much better for one's life than a quick money boost.

That was my immediate thought when I read the article. "Wow, this guy just chucked away hundreds of dollars".

Always check for a bounty program before you go and release information like this.

Google should probably still give this guy the bounty

One of the main reasons they have a bounty program is to prevent people releasing information about bugs before they have been fixed. I don't see why they should give him a bounty.