No. You cannot come to my home or business while I'm away and try to break in to protect me unless I ask, full stop. Same goes for my servers and network. It's my responsibility, not anyone else's. We have laws in place already for burgers and hackers. Just because they continue to do it doesn't give anyone else the right to do it for the children or whatever reasoning you come up with.

But you would like to be notifiedby your neighbours if you have left your window open while away, right? Or are you going to sue them for attempted break-in?

The issue is not that its illegal to put on a white hat, break into the user database and steal 125 million accounts as proof of security issue.

The problem is people getting sued for saying "Hey, I stumbled upon the fact that you can log into any account by appending the account-number to the url of your website.".

There certainly is a line seperating ethical hacking (if you can even call it hacking in some cases) and prodding and probing at random targets in the name of mischief and chaos.

Adding "full stop" doesn't strengthen your case, it just makes it sound like you are boiling the world down to be simple enough for your case to make any sense.

There are a lot of shades of grey that you are ignoring.

You claim sole responsibility. Do you accept sole legal and financial liability?

I think allowing red-teams to run wild is a better solution, but I can agree with other solutions too.

If those who claim sole responsibility want to be responsible, I'm okay with that too. I really just want us to pick a lane.

So again, are you willing to accept sole legal and financial liability?

It seems like passing legislation that imposes harsher penalties for data breaches is the way to go.

username checks out