vixie's message was perfectly appropriate. He's in the perfect position to be able to confirm the rumor that was posted here of a bug with the answer that "yes, there is a bug." He chose not to explain it. Would you prefer he NOT confirm, letting us go "Gosh, is there a bug?" "Well, I dunno, but I here there's a bug" "What's this about a bug?" for days on end?? I agree wholeheartedly. I'd rather have someone say that there's a bug, and then put their energy into patching it, than to have the same person say that there's a bug, and spend a few days creating a script to exploit it, and only AFTER an exploit script is created and distributed, fix the bug. karyn ps: If you respond, please edit your headers. I am on the bugtraq list, I don't need to be cc'd personally on any replies.