I've been trying to figure that out too. Part of it is certainly some kind of bug hunter fame that is being played for. That just seems like bad architecture,

I've been trying to figure that out too. Part of it is certainly some kind of bug hunter fame that is being played for. That just seems like bad architecture, period. Now if this can be exploited with RMI or something, I wouldn't be too shocked to see some client/server type applications using that as an interface. are there session cookies that are serialized objects or something?