Also consider policy [1]. It's become a dirty word because it's been somewhat hijacked by management-class values and wrapped up in an unthinking "compliance a

Also consider policy [1]. It's become a dirty word because it's been somewhat hijacked by management-class values and wrapped up in an unthinking "compliance and audits" mind-set. Thinking about what you want to allow, where to draw lines, planning in advance and sticking to it (including using tricks that force you to stick to it) is mature security thinking. You only have to be an organisation of one person to have a security policy. https://news.ycombinator.com/context?id=32248506 https://news.ycombinator.com/context?id=32248506