As a coder, let me just say I HATE when people decide to discuss an exploit publically rather than contacting me. Reason is, by the time we hear about it we don't hear about it from people who actually know how the exploit works, we hear about it from people who are saying "someone crashed my server!!!" I'm not saying that exploits should be hidden from everyone, just saying that sometimes it's better to notify the right people before you go and tell everyone you know, because while you might have the proper ethics to know exploiting other people's software isn't a good thing, the people you told might not feel the same way.
