<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2523" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>Hey all, DJB,<BR><BR>>> Is the class on responsible disclosure next
semester perhaps?<BR><BR>Responsible disclosure is a euphemism creating by
industry lobby groups<BR>like OIS, which never had much support in the security
scene in the first <BR>place.<BR><BR>> The reason that the 16 students sent
their 91 reports to me privately is<BR>> so that they wouldn't have to deal
with people like you. It was entirely<BR>> my decision to send out these 44
public notices.<BR><BR>If I am allowed to suggest something for a possible
re-run of the same <BR>course:<BR>It would probably be more interesting to set a
lower bar on the number of<BR>vulnerabilities but to restrict the focus a bit
more -- e.g. asking for 1 <BR>remotely<BR>exploitable bug in a list of widely
used software (Bind/OpenSSH/ProFTPd (or <BR>even QMail :-)<BR>would focus
students on larger pieces of software that are a bit more <BR>critical
than<BR>e.g. nasm. This would lead to the students searching for less
"standardized" <BR>problems,<BR>as well.<BR><BR>Then again, it sounds like a
really fun course :)<BR><BR>Cheers,<BR>Thomas Dullien <BR></DIV></BODY></HTML>