Re: @ Trevor
It is very naive to think that you can solve every security need.
I think you're missing the general trend of the article by focusing too much on the detail (don't worry, that's normal for IT people). Given enough budget you can come pretty close, especially if you can keep some funds aside to club the bastards who still find a way in (not all solutions are technical, and I have been in some pretty decent setups :) ).
The problem is "enough budget" - there is a prevailing belief that IT people think like political managers, and so get funds slashed because they were too honest, instead of being considered factual and get the funds.
I agree with this article, 100%. The one time I was able to put something together without anyone trying to slash my budget it resulted in a platform that is still running more than a decade later without failure, and without being hacked despite being a pretty juicy target. I've also seen later projects die because they only got 50% of what was needed which drove pretty catastrophic decisions such as the use of cheap coders, a mistake some of these projects and business are STILL paying for in downtime and code maintenance.
I like sleeping at night too, and I have 2 choices to achieve that: (a) no longer caring or (b) making sure it's done right. I'm not wired for option (a), but you don't always have option (b). That is what the article is about.
Biting the hand that feeds IT
