Firewall security: Problems with simple Samba file share 3616

Well, I was arguing using probability, not expectation (risk), but "yes". Probability is risk "without taking into account a varying damage estimate". And yes, this is precisely how one evaluates security.

Exactly. One constructs the attack-defense tree, buttigns prbabilities and damage valuations to it, and constructs the expected loss.

That's risk.

So buttuming that there are 2000 houses in town, the probability of a house fire is 2-2000-57 or 1:57000 per year. buttuming that the average damage is about $50K, you expect to pay just under $1 per year in insurance. Any more than that you pay is profit to the insurance company.

Well, because it's legally required. I buttume. From your point of view, any long odds bet is a win, since you can't do enough experiements to make it into a statistic. You should always bet at long odds - you may get "lucky" once in a lifetime. If not, so what? You're dead.

Ahhh ... so you think there is a cost. Only effort. No - the cost is mre subtle: it's the atbreastude that you don't control what's going on in your box, and need to control it at the IP level becuase you can't do it at the application level.

Try controlling it - it's simple. You don't need a firewall to establish your control.

Peter