I agree; a problem I often give -- which I will discuss on my blog next week -- is "here's an existing solution to a problem, it is full of security holes and b

I agree; a problem I often give -- which I will discuss on my blog next week -- is "here's an existing solution to a problem, it is full of security holes and bad programming practices, describe to me some techniques you would use to fix this code without changing the public interface". That's problem people face in real-world development all the time: bunch of code, works when callers are benign, badly broken when callers are hostile, the client has shipped so we can't change the interface, fix the problem.