Hacker Newsnew | past | comments | ask | show | jobs | submit | senkora's commentslogin

Security = Confidentiality + Integrity + Availability

or alternatively,

Security = (exclude unauth'd reads) + (exclude unauth'd writes) + (include auth'd reads and auth'd writes)

Gotta satisfy all parts in order to have security.


If you squint at it, you can convert all three to just availability.

    Confidentiality = available to us, but nobody else.

    Integrity = available to us in a pristine condition.
It's a bit reductive, I'll admit, but it can be a useful exercise in the same way that everything in an economy can be reduce to units of either: "human time", "money" or "energy". Roughly speaking they're interchangeable.

E.g.: What's the benefit to you if your data is so confidential that you can't read it either? This is a real problem with some health information systems, where I can't access my own health records! Ditto with many government bureaucracies that keep my records safe and secure from me.


That squint loses too much nuance. I don't think of a site data leak as an availiability problem.

Bad UX and bugs are in general not always an availiability problem.

If it hard to get what you want due to bad design but the site is up, the site is still up.


I once heard "creepiness" defined as "becoming invested in advance in a particular outcome to a social interaction".

In that sense, trying tricks in order to have a "successful conversation" will always fail so long as you are emotionally invested in advance in the conversation being "successful".

It's far better to be genuine and accept that you have only so much control over how things will go.


It's ok to sort of passively want things, everyone does, but the real problem is when you try to try to subtly force an outcome that isn't natural. That's when people get uncomfortable.

If a stranger is light and friendly and asks to hang out, no problem. If they start getting subtly frustrated about your response, your spider sense goes off.


I applaud your commitment to statistical rigor.

On a related note, “sequential analysis” is the keyword in stats for experimental designs that allow for stopping the experiment early in the face of clear results: https://en.wikipedia.org/wiki/Sequential_analysis#


haha... I'm slow..needed the dozen years of data.

I don’t know, but I’ve thought for a while that a browser version of “pledge” to permanently restrict uploads from a webpage after it is called would be a great idea.


Pretty good name for it tbh.

    % echo -n svalbard | sha256sum -
    86a7b126fea03dd57e6a3c9c9b7951b5318d33029cef0547ff441862174682f5


+1. It works perfectly if your mental model is:

“Every file is only ever written to from a single client, and will be asynchronously made available to all other clients, and after some period of time has elapsed you can safely switch to always writing to the file from a different client”.


Bidirectional file sync is also in hot demand from people who don't know the words, "file", "client", "write", "async", "available", or "time"

:P


The fact that lay people can and will use a tool incorrectly does not mean said tool is not useful


Yep. See e.g. steam cloud saves, which is literally just Dropbox for your video game save files. Bidi sync is a super common pattern if you look for it, I'm surprised at all the hate it's getting here.


The poems are pretty good too.


+1. Think of it like a consulting shop that can deliver customized software instead of just slide decks and excel workbooks.


And going the other direction, if you want your C++ binaries to benefit from statistics about how to optimize the steady-state behavior of a long-running process, the analogous technique is profile-guided optimization (PGO).


You may know this already, but the different FreeCiv clients are pretty different from each other. It's been a couple of years since I've played FreeCiv, but IIRC the QT client was the nicest at that time.


Yeah, so that's another lesson I learnt during the early phases. I've been using the gtk4 client personally, but someone else suggested the QT client. I do think the QT client is a bit better, but it is broken in different ways too.

It's really confusing to me why there's so many frontends for this one app. I'm tempted to switch to the web interface next time, but figured for now figuring out how to mange the server was enough of a problem without taking on the responsibility for the client people were using at the same time.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: