diff --git a/docs/lab/handout/handout.pdf b/docs/lab/handout/handout.pdf
index c5a17a8..305d2e0 100644
Binary files a/docs/lab/handout/handout.pdf and b/docs/lab/handout/handout.pdf differ
diff --git a/docs/lab/handout/handout.tex b/docs/lab/handout/handout.tex
index 706552c..d56aa9e 100644
--- a/docs/lab/handout/handout.tex
+++ b/docs/lab/handout/handout.tex
@@ -10,6 +10,7 @@
 \usepackage{amssymb}
 \usepackage{listings}
 \usepackage{tikz}
+\usepackage[bitstream-charter]{mathdesign}
 \usetikzlibrary{positioning,arrows.meta}
 \PassOptionsToPackage{hyphens}{url}
 \usepackage[hidelinks]{hyperref}
@@ -21,12 +22,11 @@
 \setlength{\belowcaptionskip}{0pt}
 
 % ---- things to change per class -------------------------------------------
-\newcommand{\laburl}{https://bgplab.rayhaan.net/statusz}
+\newcommand{\laburl}{https://bgplab.rayhaan.net/}
 \newcommand{\myprefix}{\texttt{2a0d:d741:}\underline{\texttt{\,n\,}}\texttt{::/48}}
 
 % ---- exercise machinery ------------------------------------------------------
 \lstset{basicstyle=\ttfamily\small,columns=fullflexible,keepspaces=true,
-  frame=single,framerule=0.3pt,xleftmargin=1.2em,xrightmargin=0.4em,
   aboveskip=0.5em,belowskip=0.3em}
 \newcounter{task}[section]
 \renewcommand{\thetask}{\thesection.\arabic{task}}
@@ -34,55 +34,52 @@
   \textbf{Task \thetask}\enspace\textit{#1}\enspace\ignorespaces}
 \newcommand{\answer}[1][1]{\par\nobreak
   \foreach \i in {1,...,#1}{\vspace{1.0em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip}
-\newcommand{\fillintwo}[2]{\par\nopagebreak\smallskip\noindent
-  \parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.4em}}
-\newcommand{\fillinthree}[3]{\par\nopagebreak\smallskip\noindent
-  \parbox[t]{0.32\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#3~\dotfill}\par\vspace{0.4em}}
+% A labelled answer box: the label on its own line, then #1 dotted lines to
+% write on (default 2). Used side by side by \fillintwo and \fillinthree.
+\newcommand{\writelines}[1]{\foreach \i in {1,...,#1}{\vspace{1.0em}\makebox[\linewidth]{\dotfill}\par}}
+\newcommand{\fillbox}[3][2]{\parbox[t]{#2}{#3\par\nopagebreak\writelines{#1}}}
+\newcommand{\fillintwo}[3][2]{\par\nopagebreak\smallskip\noindent
+  \fillbox[#1]{0.485\linewidth}{#2}\hfill\fillbox[#1]{0.485\linewidth}{#3}\par\vspace{0.4em}}
+\newcommand{\fillinthree}[4][2]{\par\nopagebreak\smallskip\noindent
+  \fillbox[#1]{0.32\linewidth}{#2}\hfill\fillbox[#1]{0.32\linewidth}{#3}\hfill\fillbox[#1]{0.32\linewidth}{#4}\par\vspace{0.4em}}
 \newcommand{\cbox}{$\square$\;}
 \newcommand{\reach}{\par\nopagebreak\smallskip\noindent
   Reachable from:\hspace{1.2em}\cbox laptop on the university network\hspace{2em}\cbox phone on mobile data\par\smallskip}
 
 \begin{document}
 
-\title{Hands-on BGP: Announcing and Steering a Prefix}
+\title{Hands on BGP: Announcing and Steering an IPv6 Prefix}
 \author{Rayhaan Jaufeerally}
-\institute{Network Security, ETH Z\"urich \qquad Lab page: \url{\laburl}}
+\institute{Network Security, ETHZ\\ Lab page: \url{\laburl} (username ``netsec'', password ``perrig'')}
 \maketitle
 
-\begin{abstract}
-You look up who announces the address you are using right now, announce an
-IPv6 prefix of your own to the real Internet with BGP, and then use BGP
-communities to decide which networks may learn it. By the end your prefix
-should be reachable from the university network and from nowhere else.
-\end{abstract}
-
 \medskip\noindent
 \parbox[t]{0.44\linewidth}{Name:~\dotfill}\hfill
-\parbox[t]{0.24\linewidth}{Student no.\ $n$:~\dotfill}\hfill
 \parbox[t]{0.27\linewidth}{Prefix: \myprefix}
 
 \smallskip\noindent
-Your prefix is \myprefix, where \texttt{n} is your student number \emph{in
-hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 26 has
+Your prefix is \myprefix, where \texttt{n} is your number \emph{in
+hexadecimal}.\par\noindent
+Student 10 has \texttt{2a0d:d741:a::/48} and student 26 has
 \texttt{2a0d:d741:1a::/48}.
 
 % ==============================================================================
 \section{Who Announces the Address You Are Using?}
 
-\task{Find your address.}
-Open \texttt{bgp.tools} in a browser: the top of the page shows the address
+\task{Find your IPv6 address.}
+Open \texttt{https://bgp.tools} in a browser: the top of the page shows the address
 you are connecting from, the prefix it belongs to, and the network that
 announces that prefix.
-\fillinthree{Your address:}{its prefix:}{announced by AS:}
+\fillinthree{Your IPv6 address:}{its prefix:}{announced by AS:}
 
 \task{Ask the registry.}
-The RIPE database~\cite{ripedb} records who holds address space
+The RIPE database  records who holds address space
 (\texttt{inet6num}, or \texttt{inetnum} for IPv4) and who may announce it
-(\texttt{route6}, \texttt{route}). Look up your address, then your lab prefix:
+(\texttt{route6}, \texttt{route}). Look up your IPv6 address, then your lab prefix:
 \begin{lstlisting}
-whois -h whois.ripe.net <your address>        whois -h whois.ripe.net 2a0d:d741:<n>::/48
+whois <your IPv6 address>        whois 2a0d:d741:<n>::/48
 \end{lstlisting}
-\fillintwo{Your address: held by (\texttt{netname})}{\texttt{origin} AS:}
+\fillintwo{Your IPv6 address: held by (\texttt{netname})}{\texttt{origin} AS:}
 \fillintwo{Your lab prefix: \texttt{origin} AS}{is it announced right now?}
 
 % ==============================================================================
@@ -105,26 +102,24 @@ whois -h whois.ripe.net <your address>        whois -h whois.ripe.net 2a0d:d741:
   \draw[bgp] (rs) -- (sw);
   \draw[bgp] (pr) |- (other);
 \end{tikzpicture}
-\caption{The lab. Dashed arrows are BGP sessions~\cite{rfc4271}; everything right of
+\caption{The lab. Dashed arrows are BGP sessions; everything right of
 \texttt{pr01.rue} is the real Internet.}
 \label{fig:lab}
 \end{figure}
 
 \task{Announce.}
-Open \url{\laburl} (credentials are given in class). Enter your name as
-\emph{owner} and your prefix, leave everything else untouched, and press
-\emph{Announce}. Only the owner can withdraw a route, so spell your name the
-same way each time.
+Open \url{\laburl} (username ``netsec'' password ``perrig''). Enter your name as
+\emph{owner} and your prefix, and press \emph{Announce}.
 
 \task{Read what you sent.}
 Click \emph{bytes} next to your route and hover over the coloured segments.
 \fillintwo{AS number(s) in \texttt{AS\_PATH}:}{attribute carrying your prefix:}
 
 \task{See it from outside.}
-Wait two minutes, then look your prefix up on \texttt{bgp.tools}.
+Wait a moment, then look your prefix up on \texttt{bgp.tools}.
 \fillintwo{Origin AS the world sees:}{an AS path you found:}
 \noindent The lab daemon's AS4200000001 is missing from that path. Where did it go, and why?
-\answer[1]
+\answer[2]
 
 \task{Reach it.}
 The router answers for every address in the lab space, so your prefix is
@@ -133,13 +128,11 @@ reachable exactly when your announcement got out:\quad
 \reach
 
 % ==============================================================================
-\section{Steering Your Prefix with Communities}
+\section{Steering Your Prefix with Large Communities}
 
-A community is a tag on a route; it means whatever the network reading it has
-decided it means~\cite{rfc8092}. Two networks act on yours in turn: first our
-router \texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which
-pass routes between the members of the exchange. The page's preset menu has
-all of the communities below.
+A Large Community is a tag added to a route. It can have any meaning that the network
+which issued it decides. In BGP large communities, the first part is the AS number
+and the subsequent two integers are up to the interpretation of that network.
 
 \begin{table}[h]
 \centering
@@ -160,11 +153,11 @@ Large community & Read by & Effect \\
 Announce your prefix again with \texttt{210036:0:0} and
 \texttt{210036:1:42476}; announcing a prefix you own replaces it. Before you
 look: who do you expect to still see it?
-\answer[1]
-\noindent Wait two minutes, then check on \texttt{bgp.tools} and with \texttt{ping}.
+\answer[2]
+\noindent Wait a moment, then check on \texttt{bgp.tools} and with \texttt{ping}.
 \reach
 
-\task{The university only.}
+\task{To SWITCH only.}
 Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have and
 announce again. Our router now tells only the route servers, and they tell
 only SWITCH.
@@ -172,20 +165,12 @@ only SWITCH.
 \noindent Is your prefix still visible on \texttt{bgp.tools}? Explain what you see.
 \answer[2]
 
-\task{Think.}
+\task{Use of large communities.}
 You steered routing in two networks you do not operate, using nothing but
 numbers attached to a route. What stops you from attaching a community that
 one of \emph{their} upstreams acts on?
 \answer[2]
 
-\task{Clean up.} Withdraw your prefix and watch it disappear.
-
-\begin{thebibliography}{4}
-\small
-\bibitem{rfc4271} Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). RFC 4271 (2006)
-\bibitem{rfc8092} Heitz, J., Snijders, J., Patel, K., Bagdonas, I., Hilliard, N.: BGP Large Communities Attribute. RFC 8092 (2017)
-\bibitem{ripedb} RIPE NCC: RIPE Database Query, \url{https://apps.db.ripe.net/db-web-ui/query}
-\bibitem{swissix} SwissIX: Action BGP Communities, \url{https://www.swissix.ch/resources/action-bgp-communities/}
-\end{thebibliography}
+\task{Clean up.} Withdraw your prefix and see how long it takes to go away.
 
 \end{document}