7 ms·
Not at all. But if you assume 0 malevolence from any party, there is no need for security in the first place, is there? Security models commonly explicitly assu
by 3np 5y ago
Not at all. But if you assume 0 malevolence from any party, there is no need for security in the first place, is there? Security models commonly explicitly assume the possibility of malicious actors.
For two well-known examples, Bitcoin PoW assumes the possibility that a malicious actor can spin up arbitrary amounts of malicious nodes. TLS assumes that the intermediary nodes in underlying network (e.g. ISPs) can be malicious. The assertions still hold.
- tialaramex 5y agoEven with zero malevolence security isolates systems from mishap. If Jim can't delete the user database then Jim also can't delete the user database by mistake. We accidentally made librarians Owners of Teams associated with courses students were taking where that librarian was subject specialist, so e.g. Modern History librarian finds they are now Owner of dozens of teams full of teenage students. That's annoying, so they click Delete. Are you sure? Says Teams. Of course they're sure. And the Team is deleted. If security prevented them doing that, they'd have complained "Why am I in all these teams?" instead of deleting the teams. No malevolence involved.