Reactive vs. pro-active kernel security

actually, most of the protections we are talking about adding here are not really relevant to the firewall/jump box type of application. In those applications you severely limit what code you run on the box and test it extensively. these types of protections are mostly aimed at protecting the systems after you allow untrusted people to run arbitrary code on it.

there really are not that many situations where you do that.