[dotps1]

The attackers would have to know the distributions used by the company they are targeting, that connections are open to the internet, that the company won't change their setup over the course of several years.

Everything you are saying is so far out of the realm of possibility that it makes me wonder if you follow this stuff at all.

If you had 2+ years of spare time, and these type of skills, the attacker would be far better off just trying to get a job inside the organization they are targeting.

[someotherperson]

> If you had 2+ years of spare time, and these type of skills, the attacker would be far better off just trying to get a job inside the organization they are targeting.

Who says they don't? :-)