On Fri, 11 Sep 2009 21:49:00 BST, you said: > would one not rather hire someone *not* well-known and *doesn't* > get owned? Feel free to hire that guy flipping burgers at McD's to do your security assessment. Let me know how it turns out. Also, remember that there is an asymmetric component to this - the sysadmin has to stop *every* attack to remain un-owned, but the attacker only needs one. And there's always the "security is tradeoffs" component - Dan's a smart guy, and knows he can't secure every server perfectly. So he figures out what he has to do to limit the likelyhood, and takes his chances. If you estimate that a server of yours will be hacked once every year, and cost you $1,200 to clean up, then if you're spending more than $100/month in security you're being an idiot. Especially if you can do good PR spin on it: "I'm Dan Kaminsky - hated by hackers the world over. Our systems average 25,392 attacks per day, and in 4 years only one has gotten through. If we can do that when under attack by the worst the world has to offer, imagine what we can do for *your* business." :)
Attachment:
pgpFu4DOSDLc6.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/