Somewhere out on the Internet, there is probably someone waxingindignant right now about how companies generally now have to payrelatively substantial bounties for security exploits in their products.After all, why do the security researchers now demand payment for theirresearch work?

I thin that there are two reasons: the obvious reason and the deeperreason.

The obvious reason is that companies are competing for new securityexploits with the criminal groups exploiting security vulnerabilitiesto do various bad things. Said groups pay well for new vulnerabilities,because there is

Unfortunately, our SMTP frontend restarted sometime Friday, so I onlyhave some statistics up until Friday morning. That said, this weekwe:

• got 10,439 messages from 277 different IP addresses.
• handled 18,746 sessions from 1,402 different IP addresses.
• received 137,918 connections from at least 49,448 different IPaddresses up until Friday at 4am.
• hit a highwater of 9 connections being checked at once.

While spam filtering is 'dangerous' in that it can trigger on legitimateemail, incorrectly classifying it as spam, there are different levels ofdangerousness depending on what you do as a result of things triggering.In increasing levels of danger, there are three general things that peopledo:

1. reject the email message during the SMTP conversion.
2. discard the email message.
3. bounce the email message back to the alleged sender.

The danger of the second option is obvious: the sender of a legitimateemail message receives no indication that their

It's not news that if you want work done you usually need to pay peopleto do it; there are not that many selfless volunteers and sooner orlater you stop being able to trick people into doing it for free. Ofcourse, the open source movement is a clear demonstration that you don'thave to pay people in money; people find any number of things rewarding.But you do need to give people a reward that they find meaningful.

(You can argue that a certain amount of open