There is an important proviso for the first principle of analyzingcompromised machines : in practice, mostattacks are not that good or that thorough. In real life, as opposed tomathematically correct security advice, there is a tradeoff between yourcaution level and the amount of work you have to do (either in analyzinga machine or in reinstalling it) and sometimes it is appropriate to takesome risk in exchange for doing less work.

The truly paranoid will reinstall machines from scratch (and never mindthe disruption) if there

Here is something important: regardless of what people in IT like tothink, we don't really control user desktop machines if the users feelstrongly about it. We can try to dictate hardware and software standardsand we can often get away with it for a while, but in the end if theusers want something badly enough they are going to win.

This has really been the case for quite a while, but it is especiallyacute these days with desktops; the ultimate issue is that the usersjust have

One of the things that the situation with security fixes and the Linuxkernel changelogs illustrates isthe difference between programs and products. With a program, what youget is the program; with a product, what you get is the program and awhole ecology of things surrounding it, ranging from documentation tobackporting security fixes into older versions.

(This is why it takes a significant amount of effortto turn a program into a product, as Fred Brooks and others have noted. Icredit Fred Brooks because I believe The