> The takeaway, happy or not, is that most companies see no disclosure as the only right disclosure and will punish you beyond reason if you're even connected to something that hurts them a little - even if they're the ones who caused themselves the hurt.

But we don't know this is true for Apple because Weev didn't try to responsibly/ethically disclose his findings. He boasted about it on IRC and then to a reporter.

So maybe Apple would have sued him if he tried to bring it to their attention. Still, he could have disclosed it to them anonymously.

> Because the fastest way to guarantee this stops sooner than later is leak every address publicly with information about every error AT&T made and let civil suits from pissed-off customers fry them.

I don't know whether you're a programmer or not, but one thing you learn very quickly when you are one is that programmers are humans and humans make mistakes. Bugs happen all the time, and no one wants to be on the receiving end of some kid who finds ones and takes rubbing it in your face as his divine mandate. Dumping all the info you pull from a hack is neither responsible nor ethical. Doing so dons you with the blackest of hats and destroys your reputation to all except like-minded sociopaths.

> No, then it'd still be broken and nobody would know.

If it's broken and nobody knows, is it still broken? I do understand where you're coming from though.