I never, ever gloat or make fun of others when it comes to security. It seems like a no-win situation. If you go to someone privately with security concerns, you're generally seen as helpful. If I publicly oust somebody, there are all sorts of people like the author (but far less scrupulous) who might consider it their duty to knock me down a peg... and I'm no security expert.

Using "password" for a password is really stupid, but "really stupid" is relative to the knowledge level of the person pointing it out, in most cases. I'd prefer not to find out what really stupid thing I've done to allow some script kiddie access to my servers (or whatever the case may be).