Good point.  It <i>is</i> important to realize that being <i>too</i> obsessive about security is possible, and to know a reasonable point at which to draw the line.<p>But there is a difference between the two types of attack you describe that seems to change the rules on the web at least somewhat.<p>The difference is risk to the attacker.  If I start punching someone on the bus, getting thrown off is the <i>optimistic</i> outcome.  I could reasonably expect to be arrested, or assaulted in return, possibly fatally.<p>But if I post malware on the web, the worst I could reasonably expect is that the offending content is taken down, my account with that host rescinded, and assuming I do nothing to conceal my identity, I may become known as the type of scumbag who does such things.  I grant that much worse results are <i>possible</i>, but it just doesn&#x27;t seem realistic to expect much worse punishment, so long as a government or large corporation wasn&#x27;t a serious victim.<p>Or so it seems to me.  Thoughts?