"Most of the public domain/shareware software out there is dangerously sloppy when it comes to security. "

Agreed x 1000

"That's where I draw the line--I can justify research that validates my own approaches to security, but then I keep quiet about it."

Agreed x 10000. I like to play around, but always keep it legal and ethical.

"Turns out, if you can inject a little script onto the page in a message, you can read the cookie and send the results off to your own server for recording. Eventually you'll capture an administrator's account, and then it's all over for that site."

Wow. Thats, ummm, really... *really* bad. I have seen some REALLY stupid security in my time (look at Bugzilla), but thats about as dumb as anything else I have heard.

I know jack and squat about VB and asp. I do Java servlets, applets and persistence. I am having to get into EJB/Enterprise as of late, too. I have not done a BBS yet, just a few applets for online education. As soon as my current project is a bit more stable, I'll give you an account and let you play with it sometime. Its largely 7 year old inherited code with some 'unfixable' gui design flaws (Public static classes anyone?), though, but thats about par for what you gotta deal with in the industry.

In anycase, this looks like its worked out pretty darn good.

Davin