I've read this post at length, but I believe this question is subtly different.
Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). The authentication protects user data; money is not involved (if that matters).
With the best intentions, Person A publishes an auto-login PHP script with full details of the login procedure (specific URLs, session info in cookies, etc), provided that a user has a valid username and password.
[Edit]: this script uses PHP/cURL. It is not part of a webpage; it is executed from the command-line. It contacts the website URL, establishes a session, and sends an HTTP POST to login. The script may continue to pull user data as appropriate for the domain.
On one hand, the PHP script simply mimics the protocol used by the browser: there are no exploits. The intent is "DIY hacking", my term for "power users doing innovative things". This is not white, grey, or black hat stuff.
However, it is true that the script/info can easily lead to a derivative work that iteratively probes for authentication details: a security hack.
[Edit] as clarification (for commentators and others), consider the following:
- The municipal, non-profit organization does not dedicate many resources toward security. This includes default passwords, login attempt limits, and so on.
- Before publication of the PHP script, if a black hat wanted to compromise an account, s/he would have to automate the browser, use a network sniffer, or research the login details and write the PHP script, etc.
- After the publication of the PHP script and login details, a black hat could reasonably modify the PHP script (a derivative work) so that, given a username, it simply iterates over possible passwords until one is found. It might also probe for other usernames. The work to research login protocol is already done and documented.
My question is: does Person A have an ethical responsibility to alert the organization that the info has been published? does Person A disclose the possibility of the derivative work?
Similarly, if Person B discovers the publication and realizes the potential consequences, is there a burden on Person B to alert the community, even though the derivative work does not exist? That is to say, does s/he proceed as described in this post?