| |||||||||||||
Critical Linux security API is still a kludge (Inquirer)Critical Linux security API is still a kludge (Inquirer)Posted Oct 24, 2006 3:15 UTC (Tue) by ringerc (subscriber, #3071)In reply to: Critical Linux security API is still a kludge (Inquirer) by MisterIO Parent article: Critical Linux security API is still a kludge (Inquirer)
The "statistical" approach to security is unworkable, as it presumes that the attacker / threat is independent of your protection measures and is random (in the statistical sense, not to mean of equal probability). This is not the case - as you change your protection measures, the _people_ creating these attacks will simply move on to target other areas. You won't significantly reduce the number of attacks / viruses etc out there, nor will you reduce the harm they do much.
The attacker only needs to find one hole - and they're *actively* *looking* *for* *it*. Blocking 85% of security issues is not sufficient in this context, and it's for this reason that computer security is so hard.
If the attackers didn't respond to security advances, then you argument would make sense.
(Log in to post comments)
|
|||||||||||||