Also "Oh, you hacked us? We'll call the police right away. You're going to jail." - followed by you actually going to jail for many years. Sometimes, anonymous, public, uncoordinated disclosure actually leads to the best security outcome in the long run, since security researchers in jail isn't that.

Yes. I live in a state where a journalist reported a Department of Education system leaking teacher SSNs and the governor sent state troopers after him.

Doing the right thing can be awfully unpleasant.

> This seems to presume the company is ready and willing to take feedback.

Near the bottom of the blog post it says:

> When | What Happened

> Day 1, same day | RBI fixes everything faster than you can say "code red"

> Credit where it's due – RBI's response time was impressive.

Oops. I mean that generally my experiences have been less good