You can check out a blog post I wrote on a similar attack that could be used against Linux (and other POSIX-alikes):

http://www.nth-dimension.org.uk/blog.php?id=87

The two big differences are that in this attack I can't exploit it as easily over the network and that the default case is secure on Linux so developer have to go out of their way to make themselves insecure (although a lot do, because it is the most "obvious" way to change the location from which libraries are loaded).

Disclosure: I am an OpenVAS developer...

Nmap does what it does very well. It would be a strange day that I stop using it for pentesting, in fact more likely I'll adopt some of the other tools the project has developed. Ncat in particular sounds great simply because it unifies multiple functions I currently use from other tools. The other thing I like is the NSE, great for quickly cooking up a scanner for 0day threats as we saw with Conficker check they produced.

If you want a Free Software vulnerability scanner, then support OpenVAS. The project is making quiet progress (cleaning up the code base, redesigning the architecture and most importantly adding new NVTs) and has just had a second DevCon in Germany with 16 developers from 4 continents making the trip. Nothings ever perfect but it now has NVT that are not in Nessus so if you're not using it, you're probably missing out. It's worth noting that we at OpenVAS like the nmap developments so much that a couple of the OpenVAS developers are looking to actively contribute and we're considering libnmap as a replacement for the rather fragile port / service discovery functionality we inherited.

Imagine if /. servers got seized everytime someone saw fit to post comments with the addresses related to the "bad guy" in response to a story. Indymedia had already pulled said comments, does /. even have such a facility? I find some of what gets put on Indymedia to be massively disagreeable, OTOH I'm not a big fan of servers being pulled at random either.