Any Internet site exists in a dangerous environment. My server logs show that at least once a day somebody out there attacks the server with a brute-force password guesser, which serves as a constant reminder that I can't let my guard down. I follow industry "best practices", plus I've added a few innovations of my own.

My general paranoia started when I wrote the first line of code for the BBS software and found myself thinking about how it could be hacked and attacked. A BBS is a special security risk because its purpose is to let people modify the content of a Web site, which is fundamentally counter to the universal emphasis on locking-down a server. You have to open holes in your security to run a BBS, and then watch them very closely.

I don't mind admitting that I've tested some of my security ideas against other BBS software, in proof-of-concept forays that stopped short of doing anything with the knowledge thus gained. At one point I figured out how to get administrator access to big sites like the NY Times forums, and others that ran a specific brand of particularly insecure BBS software. Needless to say, those vulnerabilities do not exist in my software. However, I don't focus on specific vulnerabilities, but rather on conceptual defenses: If you can close off a particular class of vulnerability, you're immune to all attacks based on that vulnerability.

Still, I never assume the security is perfect. I've told this story before, but I can inflict it on you since it's been a while. Back in the year 1196, my distant maternal ancestors sided with Richard the Lion-Hearted and constructed the Chateau Gaillard on the Seine north of France, as Richard's forwardmost outpost against the French. It was considered a marvel of military engineering at the time, a mighty fortress impregnable against any attack.

That time lasted about seven whole years. In 1203 a French soldier climbed up the garderobe chute in the outer wall (you know, the latrine holes high up in the outer walls), and walked around and unlocked the front gate to admit the French army. My family castle today is a pile of rubble.

Attackers won't come in where you have defenses. They'll find another way, even if they have to swim through sewage to do it. Thick walls and strong passwords are fine as far as they go, but there's no substitute for constant vigilance. That French soldier couldn't have climbed up the outer wall if the castle's defenders hadn't grown complacent about their mighty fortress. Always keep an eye peeled.