Point of order - upstream what is being discussed is 'whitehat' behaviors and tendencies, and whether a behavior is reasonable. This got transmuted to a question of legality by some one downstream, and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised. It seemed like there was some talking past each other going on and I think that is the core of it.

I think I keyed off of "I agree with a parent comment in that someone dropped the ball here and threw him under the bus to protect reputations and prevent any nastiness between the two companies."

>...and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised.

True, but it was not somehow 'out of order' because it was not a rebuttal of the 'whitehat' claims. Given that the article is not primarily about how the author discovered the vulnerability, but the legal problems that ensued, it was not at all unreasonable to point out that acting in accordance with 'whitehat' behaviors and intent is not enough to shield oneself from legal scrutiny. Furthermore, the ensuing discussion, in which various attempts were made to deny this distinction, shows that the point needed to be made!

Objection sustained!

> poking around to see what kind of data is exposed by a bug is reasonable testing and not illegal

Poking around to see what kind of data is exposed by a bug is reasonable.

I’d stop there, and I’d suggest people do that, because it makes for a better society for all of us, regardless of the law. What’s that called? Civil disobedience?

Why bother stopping there? You'll already have committed a felony. Go as far as you want from there! It's civil disobedience, after all!

Real issues arrive when people use "illegal" and "immoral" as if they were interchangeable.