Many technologists fail to appreciate that security is not something which businesses want to provide at all margins.
(Consumers are similar; they're unwilling to literally or figuratively pay for security at all margins, too.)
However, since security is a sacred value, you're not really encouraged to voice aloud the necessary consequence of this, which is that e.g. there's some level of account takeovers or fraudulent claims or bank robberies which are acceptable losses (to be distributed somehow).
"You're being facetious about bank robberies, Patrick"
No I'm not. The direct cost of them is clustered around $8k per, which is less than the minimum buy-in for a lawsuit, which is why Don't Be A Hero is the first thing every bank employee learns at every training about this.
Society distributes the cost of bank robberies thus:
To deter potential scalable robberies, there is a bit of private investment in looking secure and some public investment in making "career bank robber" and "career prisoner" effectively synonymous.
Losses? Bank pays, the end.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
If I can give a slightly more optimistic take on this: much of how commercial software development is done trades some resources for others, in ways that might not be rational for people with very different strengths than e.g. AppAmaGooFaceSoft or BigCo customers.
A lot of AWS services exist so that two teams don't need to have a meeting.
That *is not a criticism of either AWS or those two teams.* That is a preference one can have about time allocation and corporate structure, and capitalism will help you satisfy it.
If you are not constrained on organizational complexity, if meetings with yourself are free, then a lot of the standard stack that BigCo uses is both overkill and underkill at the same time.
So strange that card program managers make such a show of doing this careful balancing act when everyone who reads the Atlantic knows that the real source of rewards is cross-subsidization of elite cardholders by poor people. </sarcasm>
Less sarcastically: it’s a math problem conducted by people who are pretty good at math, and the marching orders they get are “In general and in steady state, all of our card programs should be margin accretive. Make it happen. If you can’t you’ll need a senior signoff.”
(The above is not private information from any particular issuer but rather is a pastiche representing industry standard practice.)
I think the so-called Bitcoin treasury companies have just reinvented exchange tokens: there is an asset with X real world utility but not naturally leverageable. It should flow to place in world where most leverage is bolted onto it; immediately incentive compatible. Repeat 100x
And then “Holy %}*]^ how did so much of it end up in a place with grossly deficient risk management?!”
(I understand that MicroStrategy is the opposite of leveraged exposure from the common shareholder’s perspective but if someone with hands on keyboard believes they are allowed leverage if they hold more exchange tokens then the model happens regardless of whether that is true.)
(n.b. This is extremely well-known among companies which have a business process where you sign things. Most of them use a signature to demonstrate solemnization rather than authorization or authentication.)
As I've mentioned previously, solemnization is a sociolegal tripwire to say "There are many situations in society and in business where you're Just Talking and up until this exact moment we have been Just Talking *and after this point* We Were Not Just Talking. Do you get it?"
People who are unsophisticated about this think that the signature is somehow preventing someone from retroactively changing the terms of the contract. People who are unsophisticated say thinks like "Oh use digital signatures to PROVE that that has not happened. Sounds great."
Apparently Japan Post is debuting the most obvious improvement in addressing for last two decades: address virtualization.
You sign up with them and get a short alphanumeric code. Their DB holds a pointer to physical address. If you move, you tell them, pointer changes.
And then when dealing with an e-commerce merchant instead of doing the traditional laborious address entry (which in Japanese usually requires redundantly providing the pronunciation of the address as well) you just give them the code.
This follows some more limited experiments with address virtualization, like the double blinding of addresses used in e.g. P2P marketplaces, where neither buyer nor seller strictly need to know where other lives if packages can move between them expeditiously.
Listening to @_rossry ‘s new podcast about drug development and the first episode about operational competence issues in clinical trials is giving me flashbacks.
Ross and Meri discuss how clinical research organizations, who are essentially GCs sitting between pharma labs and sites which actually have clinical staff that can see patients, often are other than competent at meat and potatoes execution.