I have a kind of off-topic NASM story. I think I was using it circa 2004 for a class, and was taking another class that required us to find 10 exploitable secu

I have a kind of off-topic NASM story. I think I was using it circa 2004 for a class, and was taking another class that required us to find 10 exploitable security holes in existing software. (This was DJB's "Unix Security Holes" class. Best class I ever took.) NASM was the first place I looked (my thought process was, it takes untrusted input and it's written in C), and indeed I found one: https://lists.debian.org/debian-security-announce/2005/msg00001.html https://lists.debian.org/debian-security-announce/2005/msg00... Incidentally, the other holes I found for that class were various XSS vulnerabilities in our course registration software. The administration was furious with me (I didn't exploit them, only proved that they existed), and banned me from using any computers at the University. DJB stuck up for me, though, and the vendor sent me a new iPod as a thank you. It was pretty stressful for a first-year student in 2004 though. My parents really didn't want me being involved in any security-related fields, so I ended up not really touching it again. My take these days is that security is a subset of correctness; design for security, and make sure you implement it correctly, just like you do for any other feature. I also write a LOT of fuzz tests ;) But yeah, NASM was the beginning and end of my software security career, which I still find kind of amusing.