I’ve now been working in tech for 25 years, and in that time I’ve developed some wisdom. One theme I’ve discovered and blogged about repeatedly over the years is profound despite its simplicity: In many cases, the best way to know whether something will work is to just try it. I’ve written numerous posts makingContinue reading “Experimentation: Just Try It!”
Category Archives: design
Simple Browser Security Improvements
Security Engineering is all about tradeoffs: Web Browsers attempt to achieve an absolutely bananas goal: Allow safe execution of untrusted content on a user’s device. Browsers are a huge vector for compromise of users’ devices and personal information, owing to the power and complexity. Much of the vulnerability induced by browsers occur where tradeoffs wereContinue reading “Simple Browser Security Improvements”
Guidelines for URL Storage and Comparison
This document contains some thoughts about the storage and comparison of URLs, common operations crucial to the correct function of security software like Microsoft SmartScreen. Importantly, URLs are also displayed on security surfaces to enable the user to make a decision based on their contents. Eight years ago, I wrote the Guidelines for URL Display.Continue reading “Guidelines for URL Storage and Comparison”
Participatory Extensible Security
In the past, I’ve explained how security products combine sensors and throttles with threat intelligence to protect users and devices from attack. I’ve also outlined how the evolution of software, including increased complexity and a focus on privacy, have made it harder than ever for sensors and throttles to function effectively, leading to security andContinue reading “Participatory Extensible Security”
Cybersecurity Metaphors
Uneven Protection Attacks flow like water: if you have a hole in your defenses, attacks will flow through that hole. Unless they’re trying to win a prize or show off, attackers do not bother attacking where your security posture is strongest. Making your tallest wall taller usually isn’t useful. Encryption Security folks love encryption, forContinue reading “Cybersecurity Metaphors”