You're absolutely correct. And I completely understand the author's point of view. By disclosing the vulnerability, I'd be taking a risk of a criminal investig

You're absolutely correct. And I completely understand the author's point of view. By disclosing the vulnerability, I'd be taking a risk of a criminal investigation. This is not a joke. This has already happened at least once in Lithuania. I have a job, one that has nothing to do with infosec, but I'd be risking that job if I had an ongoing criminal investigation.