Stéphane Chazelas: How *DID* you find Shellshock?

["David A. Wheeler" <dwheeler () dwheeler com>]

This is a question for Stéphane Chazelas, but I'm "cc"ing oss-security because I think many of us want to know the 
answer.

Stéphane: How *DID* you find Shellshock, in as much detail as you can recall?

I'm told you found the bug after "reflecting on an earlier bug" you found in bash "a few months earlier." 
(http://www.smh.com.au/it-pro/security-it/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-security-bug-20140927-10mixr.html)

What I'm hoping is that we can learn some lessons and re-apply them elsewhere.

--- David A. Wheeler