Oh, the stupidity

[MattR]

My point was that if you intended on going through plugins to find issues, contacting the author would be a better approach because you've already spent time finding the issues and contacting them directly would require no extra effort. You said "I fail to understand why I should go to the effort of reporting someone else's issue" which is fair enough, you don't, but if you'd stated you were going to find vulnerabilities and just post them here, you could quite easily spend 30 seconds more contacting the author first, seeing as you'd already done the main job of finding the issues, and if they failed to listen nobody could stop you posting it publicly. I mean it was your idea to go through them in the first place, to do that and then say it's not your job to report the issues directly to the author instead of publicly doesn't make sense as you've already put the work in.

Anyway, I'm not arguing, I'm just saying

If you were to find any vulnerabilities in any of my code, whether you posted them publicly or told me personally, I'd still be grateful for it, but I'd be a bit pissed if it was posted publicly and people got hacked, before I'd even been given a chance to fix it. Just because some people don't listen doesn't mean everybody'll be like that; some people will really appreciate it and act on it straight away.