Re: Regular Expression Denial of Service

[hackerwebzine@xxxxxxxxx]

Alex, it isn't a new technique in web-application security. If you queried 
Google, or did some research on recent (2007) Blackhat talks, you'll probably 
noticed that this is very well known and understood technique. Even Charles 
Miller talked about it (on the OSX Safari exploits). So the claim that security 
researchers are not aware of it, it somewhat misleading. I personally (and many 
others too) used the same techniques, albeit slightly different for over 8 
years when auditing applications. Since you seem to propose a serious "new" 
research area, i expect you to research it's history first before claiming 
"new" research, at least I would appreciate it.