Security quotes of the week

Security quotes of the week

One should read Mackall's follow-up, which is Quote-of-the-week stuff in its own right:

The thing is, when I said no to this yesterday, I personally did NOT know an attack was possible, because even I don't have the level of expertise necessary to fully evaluate it. But I did know enough to know that there were things to be worried about.

The bar for introducing security checks is low - you just need to be a paranoid.

The bar for removing security checks is VERY high - you need to be a paranoid AND a subject-matter expert.