Uh, did you guys read the same story I did? He did NOT break in through the hole that he discovered (and tried to get Tornado to fix). He sent Email warning the customers of the vulnerability.
That seems to be a pretty freaking reasonable facsimile of "responsible disclosure" to me: tell the company and they do nothing, then tell the people at risk.
As to the "break into the house to prove the deadbolt is broken" argument, that's bogus. More like "sent him an email to tell him the deabolt is defective". Most normal people would consider that a favor, not cause for 18 months in jail. I hope he sues the pants off of the company *and* especially the prosecutor.
My $0.02.
Surreal

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/179/21536#21536