You may be able to bait him into learning how to program by showing him what the effect of a successful exploit is (i.e., remote shell). However, I think it tak

You may be able to bait him into learning how to program by showing him what the effect of a successful exploit is (i.e., remote shell). However, I think it takes too long to learn how to program alone to attempt to teach someone to program for the first time and teach security at the same time. Nonetheless, the reading list for my advisor's graduate-level security course is on its website at http://www.eecs.umich.edu/courses/eecs588/ http://www.eecs.umich.edu/courses/eecs588/, and there's a new undergraduate security course being taught this semester at http://www.eecs.umich.edu/courses/eecs398/ http://www.eecs.umich.edu/courses/eecs398/ . Porting Aleph One's Smashing the Stack for Fun and Profit to AMD64 is a useful exercise. DSPython is a Python port to the Nintendo DS. If he's into that, you might be able to get him to learn to program with the goal of making DS games. I tried this with my younger cousin, but he's too young (under 10) to have the required attention span. My patches to get DSPython working with newer devKitPro are at http://github.com/swolchok/dspython/tree/master http://github.com/swolchok/dspython/tree/master .