<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="GENERATOR" content="MSHTML 9.00.8112.16446">
<style id="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
</head>
<body fPStyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Dear
Sir/Madam, </span>
<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
<o:p></o:p></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">We
are two graduate students from Auburn University, working with Professor Munawar Hafiz.
<span style="mso-spacerun: yes"> </span>We are working on an empirical study project to understand the software engineering practices that go in companies that produce secure software; in particular, we are concentrating on how developers write code to prevent
buffer overflow and integer overflow vulnerabilities. We are interested in the software development process: how you develop software, how you test and analyze programs to detect vulnerabilities, and what processes you follow to remove bugs. In particular,
we are interested about automated tools that software developers use. We are expecting that there is a common insight in the security engineering process that can be reusable.
</span><o:p></o:p></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">We
request your assistance by participating in this research study. <span style="COLOR: black">
<span style="mso-spacerun: yes"> </span>We would greatly appreciate it if you would share with us your experience by answering the questions at the end of this email. Please send the answers to SSE@auburn.edu
</span></span><span style="FONT-FAMILY: 'Times New Roman','serif'; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">You
can reply back with the answers, or send a text/doc/pdf attachment. We may send some follow up questions based on your response in future. Your response(s) will be kept confidential, and will only be aggregated with those of other reporters. Please let us
know if you have any questions/concerns regarding the study. </span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Thanks
in advance for your support.</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">X.
Li and Y. Rawajfih</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Software
Analysis, Transformations and Security Group</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">Auburn
University<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Working
under the supervision of:</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Dr.
Munawar Hafiz</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Assistant
Professor</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Dept.
of Computer Science and Software Engineering</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Auburn
University</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Auburn,
AL</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 0pt" class="MsoNormal"><a href="http://munawarhafiz.com/"><span style="FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font color="#0000ff" face="Calibri">http://munawarhafiz.com/</font></span></a><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">Questions:</span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri"><span style="mso-spacerun: yes"> </span>(There
are twelve questions.)<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">There
was a vulnerability reported in SecurityFocus vulnerability list: [BID: 52284]: “<span style="LINE-HEIGHT: 115%; FONT-FAMILY: 'Calibri','sans-serif'; FONT-SIZE: 11pt; mso-fareast-font-family: Calibri; mso-ascii-theme-font: minor-latin; mso-fareast-theme-font: minor-latin; mso-hansi-theme-font: minor-latin; mso-bidi-theme-font: minor-latin; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">taglib
Buffer Overflow and Divide-By-Zero Denial of Service Vulnerabilities</span><span style="LINE-HEIGHT: 115%; FONT-FAMILY: 'Calibri','sans-serif'; FONT-SIZE: 11pt; mso-fareast-font-family: Calibri; mso-bidi-font-family: 'Times New Roman'; mso-ascii-theme-font: minor-latin; mso-fareast-theme-font: minor-latin; mso-hansi-theme-font: minor-latin; mso-bidi-theme-font: minor-bidi; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">
</span>”.<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri">For
questions 3-10, please try to refer to the development practices before the vulnerability was reported? Also, please refer to any changes in the corresponding practices as a result of the reported vulnerability.</span></font></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><font face="Calibri"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"></span><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: black; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p></o:p></span></font> </p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">1.
How long have you been a software developer? How long have you been affiliated with this software?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">2.
What is the size of the current code base?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">3.
Do you follow a coding standard? Is it a standard determined by your group? <o:p>
</o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt 0.25in" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">4.
What do you do manage and correct bugs in your software?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt 0.25in" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">5.
Do you use any automated tools to detect buffer overflow or integer overflow or any other bugs? Describe the tools. Are these static or dynamic analysis tools?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt 0.25in" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">6.
Do you use fuzzing? Which tools do you use?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">7.
Do you have a test suite? Unit Tests? What about regression tests?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">8.
Do you have a beta testing or alpha testing phase? How many people (approximately) were involved?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">9.
Buffer overflows often result from the use of unsafe function, such as strcpy. Do your software use those? Which string library do you use?
<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">10.
Did you use any compiler options to detect integer overflow vulnerabilities?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">11.
Did you have specific phases during development when you concentrated on fixing security issues?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><o:p><font face="Calibri"> </font></o:p></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="COLOR: black; FONT-SIZE: 12pt; mso-ascii-font-family: Calibri; mso-fareast-font-family: 'Times New Roman'; mso-hansi-font-family: Calibri; mso-bidi-font-family: Calibri"><font face="Calibri">12.
Were you part of the original development team? How big was the core team? How big is it now?<o:p></o:p></font></span></p>
<p style="LINE-HEIGHT: normal; MARGIN: 0in 0in 10pt" class="MsoNormal"><span style="FONT-FAMILY: 'Times New Roman','serif'; COLOR: red; FONT-SIZE: 12pt; mso-fareast-font-family: 'Times New Roman'"><o:p> </o:p></span></p>
<p style="MARGIN: 0in 0in 10pt" class="MsoNormal"><o:p><font size="3" face="Calibri"> </font></o:p></p>
</div>
</body>
</html>