> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy Well no, but they're not off-base either.

> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy Well no, but they're not off-base either. Security is best implemented through a layered approach. Security is also an exercise in risk analysis and mitigation.