Comment by ribosometronome

It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.

Is this considered normal or ethical behavior for a security researcher?