This realization struck me after writing yesterday's entry :

One consequence of the security paranoia way of thinking (or if youwant to use the polite term, of the mathematically correct security way of thinking) is that false negatives areconsidered unacceptable. Either they are flaws in the implementationor they are flaws in the theory underlying the security system, and ineither case they must be eliminated; it is incorrect to allow one toremain.

(By false negatives here I mean situations where the security systemfails to detect