book

Bruce Schneier just posted a really good explanation about "the difference between feeling and reality in security". It is one of those articles I wish I'd written. Not because there is a great new nugget of insight in it but because it explains some very basic problems in thinking about security so very well.

The gist of the article is that as people living in modern environments we can have a hard time accurately estimating realistic trade offs between risks and reward. When the world was closely resembling the world we had developed in as a species we were better at it. Our brains were supported by millions of years of evolution in correctly estimating the risk versus rewards of certain actions. There's food here and a lion, should I stay or run? The specimens who made bad trade-off calls died of hunger or lions. The ones making good calls had many babies.

Bruce Schneier just posted a really good explanation about "the difference between feeling and reality in security". It is one of those articles I wish I'd written. Not because there is a great new nugget of insight in it but because it explains some very basic problems in thinking about security so very well.

The gist of the article is that as people living in modern environments we can have a hard time accurately estimating realistic trade offs between risks and reward. When the world was closely resembling the world we had developed in as a species we were better at it. Our brains were supported by millions of years of evolution in correctly estimating the risk versus rewards of certain actions. There's food here and a lion, should I stay or run? The specimens who made bad trade-off calls died of hunger or lions. The ones making good calls had many babies.