If a system is going to be structured in a manner that doesn't fully allow people investigating vulnerabilites to actually find them (unless it's through unethcial, legal means) then what's the point? It's not like hackers aren't going to cross over to other servers!

If you really want to try to plug up security holes, a more flexible solution is going to be needed with all the different software researchers are using, like encryption.

http://seattletimes.nwsource.com/html/personaltechnology/2003209737_ptinbo19.html

That way, each researher is responsible for protecting his/her own data. Not to mention the vulnerabilities that come with the transfer of such data.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11411/34065#34065