On the conceptual level, ROP and return into libc are the same thing. You need to start them by overwriting an address somewhere, and the return address is a natural candidate.

Yes, the Security talk will cover ROP too :). Stay tuned.

The Mill is far from exploit-free, but vast swathes of attacks can be stopped or mitigated and we do our best.