Hacker News Reader

Also it's fencepost security. Doing the exact same thing because "more is better" without a concrete reason why the additional copies would change the outcome. If the outer sandbox is the same as the inner one, why wouldn't the malware break through immediately? If it's different in some way, why not apply those additional mitigations to the inner one?

View on HN

Have you ever heard of the `swiss cheese method of security`, where each slice of cheese has a hole in it? The idea being: each slice may have a hole, but when sandwiched together, the route of entry is blocked. I've heard the adage: 'complexity enlarges the attack surface' before, but not in all cases especially. Sometimes security 'maxims' get in the way of security.

Reply on news.ycombinator.com