I read it as "fixing the symptom" vs. "fixing the underlying problem". Suppose a remote attacker can trigger a buffer overflow by sending a malformed packet to

I read it as "fixing the symptom" vs. "fixing the underlying problem". Suppose a remote attacker can trigger a buffer overflow by sending a malformed packet to your software. Your response might be to simply patch in a regex that checks for malformed packets, which fixes the immediate problem, but ignores possible deeper issues with memory management, remote access, etc.