Discuss digest, Vol 1 #700 - 6 msgs

[jc at trillian.mit.edu (John Chambers)]

Rich remarks:
| Derek Martin wrote:
| > Your argument is wrong.
|
| Tone it down a little, please.  I have worked in the industry and have been
| familiar with the issues since 1979, and admit full well where my weaknesses
| as well as strengths are.  I'm not as daft as you're making me out to be.
|
| Would anyone other than Derek care to comment on this topic?

Well, there is the observation  that  "Keep  track  of  all  security
alerts  and  keep  your  system up to date" is not necessarily a very
helpful bit of advice.  This is now much more  than  a  24-hour-a-day
job.  If you attempt it, you will have no time for anything else, not
even eating and sleeping.  Well, I suppose you can eat while reading.
But  unless  it's  your paying job, or you are independently wealthy,
there is really no way you can follow such advice.

So, given that the rest of us are doomed to be forever using  systems
that  haven't  been  properly  maintained  with  respect  to security
issues, what is a reasonable set of compromises?  The idea of keeping
backups,  installing watchdogs, and being prepared to reinstall seems
like a more practical approach for those of us who can't dedicate our
lives to securing our machines.

(Similarly, if one were to follow all advice  from  auto  makers  and
mechanics,  all  our  cars  would  be in the shop full time, and we'd
never have time to drive them.  This would make us all safer drivers,
true, but not many people are going to attempt it.  ;-)