4 ms·

> Transactions should be logged to something that can't be tampered with. Then you can go back and recover state by re-running transactions. I believe the tech

by vog 10y ago

> Transactions should be logged to something that can't be tampered with. Then you can go back and recover state by re-running transactions. I believe the technical term for this pattern is Event Sourcing. See also: http://martinfowler.com/eaaDev/EventSourcing.html http://martinfowler.com/eaaDev/EventSourcing.html Event Sourcing describes everything of such a system, except for a mechanism to ensure non-tempering. That's where other technologies such as regularily published hash values come into play - which may be printed in newspapers, cryptographically signed by multiple trusted organizations, agreed on through some blockchain technoloy, or a combination of all.

nickpsecurity 10y ago
The technical terms are "audit logs" written to "append-only" storage on "write-once, read-many" media. What we've used for a decade or so. I know Fowler is popular but unrelated to the basics of this discussion.
- vog 10y ago
  I don't get your point. > What we've used for a decade or so. The linked Fowler article is from 2005, which is also more than a decade old. > Fowler is [...] unrelated to the basics of this discussion While Event Sourcing doesn't describe audit logs and storage systems, it does describe how to build a whole working system based solely on that, with real-world experience warnings about pitfalls and so on.
  - nickpsecurity 10y ago
    It could be useful. What I'm saying is that IT security, which existed before 2005 & governs this topic, calls it those things. By giving the standard terms, I give you or other readers a chance to Google for them to find solutions to the problem. Whereas, people Googling non-security terms and topics will probably miss key info from a security vantage even if there's some good tips out there. Best to not change terms in a risk-related field but the link itself is fine.

by vog 10y ago

nickpsecurity 10y ago

The technical terms are "audit logs" written to "append-only" storage on "write-once, read-many" media. What we've used for a decade or so. I know Fowler is popular but unrelated to the basics of this discussion.

vog 10y ago
I don't get your point. > What we've used for a decade or so. The linked Fowler article is from 2005, which is also more than a decade old. > Fowler is [...] unrelated to the basics of this discussion While Event Sourcing doesn't describe audit logs and storage systems, it does describe how to build a whole working system based solely on that, with real-world experience warnings about pitfalls and so on.
- nickpsecurity 10y ago
  It could be useful. What I'm saying is that IT security, which existed before 2005 & governs this topic, calls it those things. By giving the standard terms, I give you or other readers a chance to Google for them to find solutions to the problem. Whereas, people Googling non-security terms and topics will probably miss key info from a security vantage even if there's some good tips out there. Best to not change terms in a risk-related field but the link itself is fine.