Except in that case, he unearthed another completely unrelated vuln.<p>I agree that some actions are u ethical, but does that really matter so much when a black hat is unethical anyways? The fact that he reported meant he was harbored no malicious intent.<p>How is collecting logins better than that? Seriously? This is completely malicious if you ask me.<p>Moreover, we must not judge each case strictly to the same rule, but with a measure of consideration of the circumstances as well.