Why Firewalls Alone Fall Short: The Case for Defence in Depth

·3 views

A firewall is a filter placed at a network boundary that decides whether each piece of traffic is allowed through or blocked based on a set of rules. A key design choice is default-deny, which blocks everything not explicitly permitted and fails safely, versus default-allow, which permits everything not explicitly forbidden. Firewalls have developed through three generations, with each able to inspect traffic more deeply than the last, from judging packet headers alone to examining the content of connections. The article argues that no single wall is ever enough, because any barrier can fail, so security should assume failure and layer multiple protections. This principle, defence in depth, shifts the goal from building one strong barrier to planning for breaches.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why LLM eval score gains may be noise, and how paired bootstrap tests can gate changes

Teams often approve prompt or model changes based on small average eval score gains that turn out to be statistical noise, leading to production regressions. Eval results are affected by sampling noise in small golden sets, judge variability, and task-level factors like temperature and retrieval drift. Comparing baseline and candidate configurations on the same examples, rather than comparing raw averages, cancels out example difficulty and isolates the real change. The article explains that the required sample size depends on how often the two configurations disagree per example, and that small gains are often undetectable with a 200-example set. It proposes a simple stdlib Python paired bootstrap gate that ships a change only when the confidence interval of the difference clears zero.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

msiexec repair mode can resolve source paths from user-writable installer directories

A DEV Community article explains how Windows Installer's repair operation restores missing or modified files using source locations recorded in the installation database. When original media is unavailable, msiexec may fall back to cached package data or directories derived from the installation context. The author notes that per-user installs write into user-writable profile directories, while per-machine installs typically use administrative resolution paths. The piece advises checking whether affected products run services or tasks as SYSTEM and verifying resulting paths after deployment. It stresses that exploitability depends on each product's component registration, install scope, and source directory permissions, and makes no claim about any specific vendor.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Handling Failures in Healthcare AI Agent Workflows

Agentic healthcare systems coordinate several dependent operations, so a failure in one step can stop an entire workflow from reaching its goal. Common examples include rejected referrals, unavailable services, missing authorizations, incomplete records, and repeated communication breakdowns. The article argues that robust architectures should separate transient errors, which may warrant bounded retries with backoff, from recoverable failures needing more information or an alternative pathway, and from persistent or clinically serious failures that should be escalated. It stresses keeping workflow state observable by logging completed steps, failed operations, outstanding requirements, and attempted actions, which helps prevent duplicate execution and informs the receiving professional. Crucially, a technical failure should not be treated as resolving the underlying clinical task, so unresolved referrals must retain their status and be routed appropriately. The author closes by asking healthcare AI engineers and clinical informaticians which failure-handling patterns have proven effective.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code Deploys a Project, and a Live Console Shows It Update Without Refresh

A 26-second unedited recording shows an AI coding agent, Claude Code, deploying a Postgres database, an API, and a web service. On the adjacent screen, a live console updates on its own as each component restarts and turns green. The console receives no manual refresh and no pushed feed, since it re-reads status on a timer. The author says the motion was deliberately designed so developers can watch the deployment progress. The post is promotional for the gagarin.cloud platform, which lets users hand over a repository for deployment.

0 comments Read more at DEV Community