4 ms·
I want perfect security, but I don't want perfect "security". Please allow me to explain. I find it particularly frustrating that in conversations about securi
by Reelin 7y ago
I want perfect security, but I don't want perfect "security". Please allow me to explain.
I find it particularly frustrating that in conversations about security it's difficult to differentiate between the different uses of the word.
There's user security against other users (same system), criminals (remote), criminals (physical access), large entities (ie governments and corporations), and probably a few others.
Then there's owner (or admin?) security, for example IT vs employees who do dumb things and other similar scenarios.
There's also vendor security against user control of devices. Sometimes this is to protect a walled garden, but other times it's just a cheap way to prevent damage to their brand if clueless users do dumb things and then publicly blame the company for their own negligence.
Arguably the first category (user security) is a good thing, but those designing the devices fall almost exclusively into the second two (I would argue mostly bad) categories.
- cameronbrown 7y ago> Then there's owner (or admin?) security, for example IT vs employees who do dumb things and other similar scenarios. I think the best way to balance this vs. security is something analogous to sudo. Design for people who don't know what they're doing by default and don't say you didn't warn them if they break their system with superuser control.
- simion314 7y ago>Then there's owner (or admin?) security, for example IT vs employees who do dumb things and other similar scenarios. I only see this argument made by Apple fans, it is always related with branding, something like "we don't want someone phone or laptop to catch fire and destroy Apples perfect brand" . the ironic thing was that after we had this discussion on HN a few days back we had the news that genuine Apple laptops catch fire anyway. Would Microsoft like not to be able to repair the servers they run on their cloud? not to be able ro run whatever code then want on the server? be forced to run the server hardware manufacturer code so they make sure MS is not running the servers incorrectly and make them explode?