3 ms·

I think I am seeing a real clash of mind-sets in this thread. People from a security mindset like you and I meet a lot of friction with developers who are chir

I think I am seeing a real clash of mind-sets in this thread. People from a security mindset like you and I meet a lot of friction with developers who are chirpy and optimistic (and also more generally with people who want technology to be fluffy and "just work") Not that chirpy optimism is a fault at all, we all need a little more of it, but when it crosses borders into strong beliefs that actually put others at risk I feel discomfort, and a need to challenge those ideas. Now, not understanding complex and subtle security issues is nothing to be ashamed of, and it's wrong (arrogant) if we decry that. What is unacceptable though, is "reckless and dismissive optimism", whether that's in systems, ostensible authorities, technologies or whatever.

namaria 3y ago
Well put. I face a lot of emotional push back when people claim "this is perfectly safe because I don't see how it could be breached". There's probably a component of pride in that people assessed the situation and decided to put trust in what they believe to be sound reasoning. In adversarial dynamics, sound reasoning, as perfect as one can make it, is never enough. Defense takes trade-offs in convenience and imposes costs that people are more then willing to forego by depositing trust in an entity they can hold liable in court later.