When you say a "malicious client" you are misunderstanding the purpose of my analogy. A malicious client would be "the enemy". I'm talking about a client that is interested with engaging with the service, not just shutting it down. The client may like to have all the information and resources the server has available to it, (for example, perhaps a facebook user might want to see when people look at their photos, not just like/comment) but the server needs to consider the experience of all the clients and users, not just the one. So there is opposition (but not conflict!) between the two. The client will not be allowed to have this information, even though the server has it. Conflict would be manifested by the user abandoning the service (or attacking it, as in your example) because of this incompatible or insurmountable difference.
Re:The Seven Habits of Highly Depolarizing People
by mfoy_ on Tuesday February 23, 2016 @11:34AM
(#11160052)
I apologize if I'm incorrect, but I believe English is not your first language. There is a difference between opposition and conflict. It's a bit subtle but it's very important in this context.
Than it's not an opposition.
> In a client-server security model the client usually wants as much as it can take and the server wants to provide as little as it has to. Are these opposed, or in conflict?
Now you create a malicious client which will pretent it has little, say, computational power or network capacity. So the server will have to do lots of work. Voila - a good beginning for a DoS attack. :-)
So, yes, these goals are in conflict and such an attack is a falsification of the soundness of your security model.