Copyright © 2009 What The Hell? Security
Of course it we must kill it. But not why you think.
Nearly everybody hates security. People that use FileVault on their Mac, and have ever had to perform a hard reset, hate it. People that perform encrypted backups, and have ever had to perform a restore, hate it. People that use OS update + firewall + ad blocker + anti-virus + anti-malware + anti-phishing, all on the same laptop, hate it. People that have configured five home computers and a TiVO and a Wii and two networked printers and a wireless router with WPA-PSK encryption hate it.
What’s there to like about any of this? Nothing, nicht, nada. And this from a guy who makes a living on security. (Don’t get me wrong — I love what I do, enough that I’d do it for free if I didn’t need to work for money. For me, these two things are reconcilable.)
The reason we have to kill security is not because it pisses us off. We have to kill it because it’s a big fat red herring.
See, security is a stand-in for something else. The FileVault problem isn’t about security. It’s about reliability. It’s about requirements. It’s about priorities. It’s about business decisions. Whining about Apple’s crappy product does nobody any good, least of all me, but I did it for years. Then one day I thought objectively about it for half a minute, and realized that fixing FileVault would come at the cost of iPhone development, and I saw Apple’s wisdom in keeping FileVault crappy. That was one step from realizing I needed a product from a company whose sole business priority is encrypting files. Apple made a wise choice, and I was inspired to right action, and the word security didn’t even come up. Whereas so long as I saw it as a security problem, Apple made a maddening choice and I allowed myself to be trapped in being mad about it.
I’m not arguing semantics. I’m arguing mindset, for the sole reason that everything we see and do and create is a function of our mindset. The security mindset does nobody any good. It does everybody wrong.
Filed under: Uncategorized | Tagged: security soapbox
