The Netherlands just released guidelines for how ethical hackers should report security vulnerabilities. Should the U.S. do the same?