Hacker News Reader

I agree. As per Taleb (Antifragile) if you adopt conventional perspective of "probability" you will be bitten by the occurrence of the apparently improbable. Downside (here called "impact") is much easier to assess/predict, and compare against "upside", which in the case of taking infosec risks could be e.g. saved implementation cost.

Probability is more of a distraction. Probably.

View on HN

I haven't read antifragile, and its been a while since he's made the book interview rounds. If I recall his point correctly, it's that antifragile systems need to be able to fail, and grow from them. If we design to minimize the impact of any such failures, the system as a whole is considered reliable.

The problem with applying this to IT security is that I see no way to lower the impact. With hard drives, we use RAID to build a more resilient system from unreliable components. It seems harder to do that with the concept of customer passwords, credit card numbers and SSNs and still have a system the accountants can use to reliably file earnings reports.

Reply on news.ycombinator.com