3 ms·

I believe that they (government) are just in a business where it's better to overclasify 100 documents than underclasify one. Think of it from web development

by racbart 14y ago

I believe that they (government) are just in a business where it's better to overclasify 100 documents than underclasify one. Think of it from web development perspective. Years ago SSL were used only for financial transactions, then for e-commerce transactions. Nowadays it's considered a good practice to use it anywhere you transfer any user data or session. Isn't that our industry's equivalent of their over-classification routine? I think they basically do the same what we do with SSL - they apply their security layer to all content produced by all their users. It's exactly what we do with our security layers in software development.

jkimmel 14y ago
I enjoy this analog, and it works very well from a purely developer/intel analyst perspective. It seems to me that the key difference here would be that no one is harmed by overuse of SSL, whereas over classification of information can have far-reaching negative effects. Failure by the intelligence community to realize such, or a systemic issue that incentivizes over classification, lead to our current situation where a FOIA is required to read a parking ticket.
- derefr 14y ago
  > no one is harmed by overuse of SSL Serving everything over SSL has removed HTTP's whole notion of "caching proxies." Now a website can be cached by your browser, or by the remote (i.e. through a CDN which they'll hand their X.509 cert to), but never by, say, your ISP. And this is a shame, because HTTP's method idempotency semantics and Expire headers allowed intermediary caching to work perfectly--when something was set to expire from your local cache, it would also expire from any intermediary caches at the same time. Sadly, some ISPs overreached and started modifying the content they proxied, at which point SSL-everything became the clear winner. Additionally, that kind of caching kind of screws things up when you serve any HTML that has been customized per-user on a generic cacheable endpoint (say "GET /timeline")--even though proper HATEOAS strongly indicates against this.
  - mseebach 14y ago
    CDNs have really assumed the role of ISP-level caching - the good CDNs are co-located with the big ISPs anyway, so the effect is the same. IMO, it's a better solution because it allows the content-server much better control over the exact details of the caching and allows stuff like partial caches. The problem with ISP-level caching is just what you suggest: they screw it up.
- justinsteele 14y ago
  There is a time cost using SSL. So, maybe not on the same level of impact as over classification of documents.. but still there!
  - jjoonathan 14y ago
    My guess is that the cumulative time cost of SSL doesn't exceed millions of dollars. On the other hand, if you believe that over-classification undermines the democratic process to the extent that wars have consequently been fought against the USA's self interest, the cost of over-classification could easily wander into the trillions of dollars (and tens to hundreds of thousands of lives). I think it's reasonable to neglect the time cost of SSL in this comparison.

by racbart 14y ago

jkimmel 14y ago

I enjoy this analog, and it works very well from a purely developer/intel analyst perspective. It seems to me that the key difference here would be that no one is harmed by overuse of SSL, whereas over classification of information can have far-reaching negative effects. Failure by the intelligence community to realize such, or a systemic issue that incentivizes over classification, lead to our current situation where a FOIA is required to read a parking ticket.

derefr 14y ago
> no one is harmed by overuse of SSL Serving everything over SSL has removed HTTP's whole notion of "caching proxies." Now a website can be cached by your browser, or by the remote (i.e. through a CDN which they'll hand their X.509 cert to), but never by, say, your ISP. And this is a shame, because HTTP's method idempotency semantics and Expire headers allowed intermediary caching to work perfectly--when something was set to expire from your local cache, it would also expire from any intermediary caches at the same time. Sadly, some ISPs overreached and started modifying the content they proxied, at which point SSL-everything became the clear winner. Additionally, that kind of caching kind of screws things up when you serve any HTML that has been customized per-user on a generic cacheable endpoint (say "GET /timeline")--even though proper HATEOAS strongly indicates against this.
- mseebach 14y ago
  CDNs have really assumed the role of ISP-level caching - the good CDNs are co-located with the big ISPs anyway, so the effect is the same. IMO, it's a better solution because it allows the content-server much better control over the exact details of the caching and allows stuff like partial caches. The problem with ISP-level caching is just what you suggest: they screw it up.
justinsteele 14y ago
There is a time cost using SSL. So, maybe not on the same level of impact as over classification of documents.. but still there!
- jjoonathan 14y ago
  My guess is that the cumulative time cost of SSL doesn't exceed millions of dollars. On the other hand, if you believe that over-classification undermines the democratic process to the extent that wars have consequently been fought against the USA's self interest, the cost of over-classification could easily wander into the trillions of dollars (and tens to hundreds of thousands of lives). I think it's reasonable to neglect the time cost of SSL in this comparison.