3 ms·

I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are

I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation. Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization. I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.

actually_a_dog 5y ago
> Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. > We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) I don't think I've ever seen a walled garden justified in the name of security. Generally, it seems to be more about keeping the user within your ecosystem, so you can capture the value of their attention (i.e. show them ads).
- juanani 5y ago
  >I don't think I've ever seen a walled garden justified in the name of security. Hmm, have you ever heard of Apple?
- kijin 5y ago
  Apple requires all apps to be installed through the App Store. Google requires all in-app payments to go through Google Play. The obvious reason for these requirements is that it's profitable for them. But how do they justify it to their users? More convenience? A unified experience? No, their most prominent argument is that it's safer that way.
  - actually_a_dog 5y ago
    Those examples are not applicable. The context of the article, and the comment I was quoting from, clearly indicate a web environment.
    - teddyh 5y ago
      Well, you wrote “a walled garden”, which could reasonably be interpreted as any walled garden in software generally. But if we are charitable and limit ourselves to web site “walled gardens”, how do YouTube and Facebook, etc. justify their “oops, you clicked on an external link! If might lead anywhere! Are you really, really sure you want to continue?”, if security is not their argument?
      - actually_a_dog 5y ago
        Ads. They want to introduce friction into the process of leaving their site so they can keep showing you ads.
        kijin 5y ago
        Ad revenue is obviously the motive. Nobody is denying that. The argument they actually present to the user, though, is about security. Both in politics and in online business, security is an extremely convenient excuse for forcing people to do what you want and hiding your true motives. That's the whole point of the current thread.
        actually_a_dog 5y ago

actually_a_dog 5y ago

> Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. > We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) I don't think I've ever seen a walled garden justified in the name of security. Generally, it seems to be more about keeping the user within your ecosystem, so you can capture the value of their attention (i.e. show them ads).

juanani 5y ago
>I don't think I've ever seen a walled garden justified in the name of security. Hmm, have you ever heard of Apple?
kijin 5y ago
Apple requires all apps to be installed through the App Store. Google requires all in-app payments to go through Google Play. The obvious reason for these requirements is that it's profitable for them. But how do they justify it to their users? More convenience? A unified experience? No, their most prominent argument is that it's safer that way.
- actually_a_dog 5y ago
  Those examples are not applicable. The context of the article, and the comment I was quoting from, clearly indicate a web environment.
  - teddyh 5y ago
    Well, you wrote “a walled garden”, which could reasonably be interpreted as any walled garden in software generally. But if we are charitable and limit ourselves to web site “walled gardens”, how do YouTube and Facebook, etc. justify their “oops, you clicked on an external link! If might lead anywhere! Are you really, really sure you want to continue?”, if security is not their argument?
    - actually_a_dog 5y ago
      Ads. They want to introduce friction into the process of leaving their site so they can keep showing you ads.
      - kijin 5y ago
        Ad revenue is obviously the motive. Nobody is denying that. The argument they actually present to the user, though, is about security. Both in politics and in online business, security is an extremely convenient excuse for forcing people to do what you want and hiding your true motives. That's the whole point of the current thread.
        actually_a_dog 5y ago