> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. I think that's inverted, but not in

> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. I think that's inverted, but not in the way that you think it is inverted. I think the map that fits looks more like centralized authority builds the systems that serves its needs (and they're identifiable as such because they were built by a centralized authority with no inclination to hide its efforts, and maybe even incentives to advertise them). I'd like to know more about this though: > Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. Because I don't see it (the first part). I don't agree wholly with the second part either, because I do defense in depth and I don't entirely trust my own network. But barring those measures / tastes yes there would be two classes of services, internal and external. This is pretty old school, along with the DMZ third wheel. So what do you mean by that?