Firewall Wizards: Re: chroot useful?

["C. Harald Koch" <chk () utcc utoronto ca>]

In message <199711172327.RAA23555 () argus-systems com>, Paul McNabb writes:
>  
> 1) protecting against daemon/proxy flaws, such as stack overwrite bugs,
> that would allow an attacker to get a daemon/proxy to do something it
> wasn't designed to do,
Programmers make mistakes. Vendors run third-party software that wasn't
necessarily *designed* with security in mind. New security vulnerabilities
are found even in software designed for security. For all these reasons, I
believe that protecting against software flaws is very important, *even* in
environments where you control all of the software.

It's true that adding multiple protection layers, such as those in a
hardened OS, *can* increase complexity. Done right, however, it actually
*reduces* the amount of code you have to trust implicitly, which is a good
thing.

-- 
Harald