These people are using the website with no warranty
I think you will find that a jury will have no trouble telling the difference in value between something that has no warranty, something that has no warranty and is broken thanks to an error by its vendor, and something that is broken because some third party broke it. Warranty law is about the first two cases. It has nothing to do with the third case. If you break a company's product, you are going to be liable, whether the product is under warranty or not.
Incidentally, we have reached the point where it's important to point out that I am not a lawyer.
I'd argue that somebody was just getting creative with their profile!
If you get creative with your own profile, and it brings down your browser, you have found a bug. Indeed, if you get creative with your own profile, and it brings down Twitter, you have merely found a bug. (Though one that could obviously be used to perform a DOS attack on Twitter. If you exploit the bug to bring down Twitter over and over for your own amusement, you're getting into shakier legal ground. The responsible thing to do is report the bug.)
If you "get creative with your profile" to create a XSS attack that deliberately defaces other profiles? Hire a lawyer, pronto.
how responsible do the website owners have to be?
The truthful answer is "not very". You can be convicted for breaking into an account that has little or no actual security on it. You can be convicted for searching for an exploit on your employer's computer, even if you don't exploit it. (Ask Randal Schwartz. You should probably Google up his case. Sounds like you need some legal briefings.)
Don't impersonate other people on computer systems. Even if the system owners are begging for it. (Especially if the system owners are begging for it.) And don't "test" people's security without specifically getting their permission in advance.
Comments
These people are using the website with no warranty
I think you will find that a jury will have no trouble telling the difference in value between something that has no warranty, something that has no warranty and is broken thanks to an error by its vendor, and something that is broken because some third party broke it. Warranty law is about the first two cases. It has nothing to do with the third case. If you break a company's product, you are going to be liable, whether the product is under warranty or not.
Incidentally, we have reached the point where it's important to point out that I am not a lawyer.
I'd argue that somebody was just getting creative with their profile!
If you get creative with your own profile, and it brings down your browser, you have found a bug. Indeed, if you get creative with your own profile, and it brings down Twitter, you have merely found a bug. (Though one that could obviously be used to perform a DOS attack on Twitter. If you exploit the bug to bring down Twitter over and over for your own amusement, you're getting into shakier legal ground. The responsible thing to do is report the bug.)
If you "get creative with your profile" to create a XSS attack that deliberately defaces other profiles? Hire a lawyer, pronto.
how responsible do the website owners have to be?
The truthful answer is "not very". You can be convicted for breaking into an account that has little or no actual security on it. You can be convicted for searching for an exploit on your employer's computer, even if you don't exploit it. (Ask Randal Schwartz. You should probably Google up his case. Sounds like you need some legal briefings.)
Don't impersonate other people on computer systems. Even if the system owners are begging for it. (Especially if the system owners are begging for it.) And don't "test" people's security without specifically getting their permission in advance.