Perhaps, but at least they can look at themselves in the mirror the next morning.
It's a sad world when you can't send someone who (as far as I can see so far) may just have made an honest mistake or hired the wrong "expert" help a friendly mail, to warn them of something you have (apparently legitimately) discovered that could get them and/or their customers in trouble, all because CYA and Fear The Lawyers.
So I vote for sending the quiet e-mail first, for the same reasons as I'd privately disclose any security vulnerability before making a public song and dance about it. The goal here apparently isn't to screw the other guy, it's to fix the problem. If you can do that by raising awareness courteously with the people who are best placed to apply that fix, isn't that a better strategy than shooting first and dealing with an industry that starts systematically concealing bad practice later?
It's a sad world when you can't send someone who (as far as I can see so far) may just have made an honest mistake or hired the wrong "expert" help a friendly mail, to warn them of something you have (apparently legitimately) discovered that could get them and/or their customers in trouble, all because CYA and Fear The Lawyers.
So I vote for sending the quiet e-mail first, for the same reasons as I'd privately disclose any security vulnerability before making a public song and dance about it. The goal here apparently isn't to screw the other guy, it's to fix the problem. If you can do that by raising awareness courteously with the people who are best placed to apply that fix, isn't that a better strategy than shooting first and dealing with an industry that starts systematically concealing bad practice later?