There's a mailbox I worry about more than the others. If you find a hole in something I've published there's an address to send it to, and what turns up there is encrypted, because a vulnerability report is about the only sort of message where being read in transit is the whole disaster. The code that opens those is mine (a small tool called sigillum and two encryption modules underneath it), so when I set a heavyweight review running over the lot of it late one night I was braced to care quite a lot about what came back.

I did care, as it turned out... just not about the findings.

Forty-two notes saying "it's fine"

The findings themselves were fine, in the sense that they were ordinary and fixable and what you run a review to get.…