Here is a thesis that I have been mulling over lately:

One reason that security bugs are hard is that they aren't bugs. Inregular bugs, your code doesn't do things that you want it to. Insecurity bugs, the end result is that your code does extra things,things that let an attacker in. Ergo, security bugs are actuallyfeatures that you didn't intend your code to have.

(Often security bugs are created by low-level mistakes that are regularbugs.

Here's a sensible question about the lost+found directories thatvarious Unix filesystems stick in the top directory: why do they have toexist all the time? Yes, clearly fsck needs somewhere to put recoveredfiles, but in theory it could just create a lost+found directory whenneeded, and otherwise you wouldn't have it cluttering up the filesystem.

Part of the answer is that lost+found isn't just a normal emptydirectory; instead, it's usually substantially bigger, despite having

Like many Internet people of a certain generation, I don't like top-posting (and often have a semi-visceral reaction to it). For a long time Iavoided it almost entirely but these days I'm in an environment whereI'm reasonably exposed to it, and I've come to realize something aboutit.

Ultimately, the purpose of all quoting in email is to provide context,to remind people of the previous discussion if they don't remember itoff the top of