While security researchers are freely able to find bugs in operating systems, device drivers, and other applications on their own machines, Web researchers trying to find bugs on Web servers are dangerously close to violating laws designed to prevent hackers from tampering with Web servers' machines, and are afraid of the repercussions.