4 ms·

A check list is pointless when there's 300+ items... Really needs to be extremely short, like 10 items tops. Then when sublists for specific situations.

• nonrandomstring 5y ago
  This list is specific and parochial of course. Rudimentary thematic analysis of the list reveals common patterns fairly well known to security people: - Less is more. - Convenience works for you, and adversaries. - If it's old, maintain it. - Never tell the truth. - Keep moving. - Don't underestimate the enemy. - Have a plan B. In the literature these have fancy names like Dolev-Yeo, Minimal attack surface etc. Interestingly they also correspond to the five-S principles {shape, shine, speed, spacing, silhouette) of stealth and camouflage and many foundations of guerilla craft - maximal mobility, carrying minimal gear, least contact and taciturn communication, knowing the environment, maintaining you equipment.
  • baxtr 5y ago
    Great list! Could you expand on the items a bit?
    • nonrandomstring 5y ago
      > Great list! Could you expand on the items a bit? That would be funny, as the list is an attempt to reduce things. Perhaps you mean - can we elaborate on the principles of reduction somewhat? Maybe. I am wondering. The problem with pithy lists is that, in the limit, they end up as a collection of mutually-contradictory idioms, like; "Many hands make light work" but "Too many cooks spoil the broth". Security is already a mess of theories in tension - "If in doubt don't." versus "Fortune favours the brave" Perhaps we could make a more focused list for our readers, for innovative developers, with items like: "Secure yourself before attempting to secure others." "Don't assume you know what people want" But I fear it would not be gladly received.