Good point. It is important to realize that being too obsessive about security is possible, and to know a reasonable point at which to draw the line.

But there is a difference between the two types of attack you describe that seems to change the rules on the web at least somewhat.

The difference is risk to the attacker. If I start punching someone on the bus, getting thrown off is the optimistic outcome. I could reasonably expect to be arrested, or assaulted in return, possibly fatally.

But if I post malware on the web, the worst I could reasonably expect is that the offending content is taken down, my account with that host rescinded, and assuming I do nothing to conceal my identity, I may become known as the type of scumbag who does such things. I grant that much worse results are possible, but it just doesn't seem realistic to expect much worse punishment, so long as a government or large corporation wasn't a serious victim.

Or so it seems to me. Thoughts?