Sounds to me like his phrasing was poor and its a bit out of context. I think what he is getting at is he doesn't like it when people confuse minimisation of da

Sounds to me like his phrasing was poor and its a bit out of context. I think what he is getting at is he doesn't like it when people confuse minimisation of damage from security breaches with prevention of security breaches. Obviously you should have both, but don't pretend one is a substitute for the other. The way I read it, privilege minimisation is almost isomorphic with his actual principle "eliminating trusted code" ... if the code doesn't have access to a resource then it doesn't need to be trusted with that access. So perhaps he is railing against people who want to deploy code into fundamentally insecure contexts and then claim its OK because of protection through limits on privileges .... but he's saying it is always better to improve the fundamental architectural security and not put it in that context in the first place.