Java vulnerability report strains responsible disclosure
in Search Security by Peter Loshin