Similarly, if a newspaper publishes something about how a local company hurt a customer, it's the clout of the newspaper that "did it", not the customer.
FWIW, the disclosure sparked the discussion about a bug bounty program and a strong interest to reorganize their methods of raising security issues. I'm told both will go public, "soon". Whatever that means.
The skillset to find a unknown security issue is rare. The skillset to post to reddit is common. I think you're wrong here. The author deserves the credit, not the site.
>Similarly, if a newspaper publishes something about how a local company hurt a customer, it's the clout of the newspaper that "did it"
Because the reporter is an employee of the newspaper and like all employees is part of the organization, so its easier to credit the organization. How is reddit like a newspaper? They aren't his employer. Its more like publishing something to the classified sections of a paper than being a reporter. It would be crazy to credit the paper for its classifieds.