Take the example of the recent ASP.NET (and Java Server Faces) vulnerability disclosure at a Hacker conference in Brazil.  It's my understanding that the poet tool was demonstrated before Microsoft was even aware of the issue.Are there laws to protect legitimate customers from people who encite the hacker community to start hacking all the ASP.NET servers they can?  Who knows how many legitimate businesses were compromised between when the tool was demoed and the patch was applied to the server.
Are there laws to protect us from hackers who disclose vulnerabilities prior to alerting the vendor?
security;asp.net;hacking;legal
None that I know of, and there probably shouldn't be, either.Who knows how many legitimate businesses were compromised between when the tool was demoed and the patch was applied to the server.Who knows how many legitimate business were compromised before the tool was demoed?  You seem to be making the assumption that because of this demo at a conference in Brazil that that was the first any bad guys heard of it.