What happened next is in dispute. Wheeler says that Atrient COO Jessie Gill got in a confrontation with him and yanked off his conference lanyard; Gill insists he did no such thing, and he accused Wheeler of attempted extortion.
The debacle culminated in legal threats and a lot of mudslinging, with live play-by-play commentary as it played out on Twitter.
Ars Technica calls the story “practically a case study in the problems that can arise with vulnerability research and disclosure,” adding “the vast majority of companies have no clear mechanism for outsiders to share information about security gaps.”
A security research director at Rapid7 joked his first reaction was “man, I wish a vendor would punch me for disclosure. Boy, that beats any bug bounty.” But they later warned, “It’s on us as an industry not only to train corporate America on how to take disclosure, but also we need to do a little more training for people who find these bugs — especially today, in an era where bug outings are kind of normal now — to not expect someone to be necessarily grateful when one shows up.”