I feel like we're looking at this from completely the wrong angle.
The question we have to ask ourselves is what our disaster recovery strategy if we ever need to disconnect from the internet. The issue is with what we have allowed ourselves to rely on that might be technically hackable. e.g. IOT in power systems. That's the primary attack vector.
Another angle is clamping down on products and services that help people create lab-like environments on the cheap.
> I think I've felt sad because of the disrespect.
How is this to do with AI? When were we ever respected as an profession? My career has given me considerable experience of non-technical people in senior positions having limited respect for those with technical skills and running roughshod over their interests. The exceptions to this rule were mostly either theatre or a fortunate consequence of people like us getting into those senior roles. That's not even beginning to count all the masses incapable of perceiving us. Consider the outpouring of hatred for AI over artists and the scant sympathy for any of us.
The sorrow is mostly the status quo returning in typical money driven orgs. If you read stories of the 80s then technical staff were incredibly poorly treated and paid and those voices will rise again, empowered by their hubris and slop.
The only positive is now its easier to replicate the conditions of those orgs as you don't need to shell out over $100k per annum for a dev, given that these tools are considerably cheaper. This means we could compete with those forces without needing their pockets. We could even collaborate and somewhat destroy all those companies.
However we wont because we're more interested in little puzzle boxes and arguing at great length about what something should be called until finally agreeing upon one of the very worst options.
oh fuck my life, we're back to this circa 2000 default of having incompatible binary UIs frameworks across various different platforms, with different OEMs shitting the bed at various different times and Apple free to arbitrarily force its hardware and OS into CI. I felt we were so close to unification in 2011.
And that's not even discussing the heresy of app stores. Curse smartphones for ever happening.
people still dont understand the difference. "you do iam but what about controllong access" comes in all the time.
words dont really matter all that much. people use them because it makes them sound like they know what it is, and if its important and complex, usually have no clue.
ive seen enough "abac" where the attribute is "your login name"
> ENTI- can you enter, ORI (or ORIZ) what can you do?
I don't mean to quarrel about it, but I understood Authentication to be closer to identification. To provide "adequate proof that you are actually who you claim to be".
Even the "can you enter" question falls under authorization; "does the user have appropriate permissions?" Entering is just one of perhaps many subsequent levels of permissions.
I think you've got the right idea, though in practice the initial "authentication" question (you are who you say you are) is very closely linked to the initial "authorization" evaluation (can you enter).... because in most systems the only "can you enter" authorization required for access is in fact that you are who you say you are.
But not all systems work this way. There are some systems where you can log in successfully, but then are immediately escorted out because the "can you enter" question has secondary considerations or is decided once identity has been established based on a larger criteria. Expired accounts in some systems work exactly like this.
One problem is that treating authentication as a "can you enter" authorization is predicated on the idea of a session-based system with two states, logged in or logged out. But there are many scenarios where e.g. taking some particular action requires authn and authz, regardless of login status. A simple example is performing some destructive action.
The distinction between authentication and authorization allows modeling of many different kind of systems, including the degenerate case where identification is treated as a proxy for authorization.
Btw, the kind of thinking behind that degenerate case is what leads to IDOR security bugs - "this person is logged in, so they can access whatever the URL says... even if it's another customer's data!" It turns out that thinking clearly about security helps be more secure, and unfortunately, vice versa.
Right. The de facto/apparent case that many users encounter shouldn't be considered the correct mental model or implementation pattern... it just explains why some people see it that way.
Not long ago I designed an authentication system which had to be disconnected from authorization pretty fully. The authentication was global in a multi-tenanted system, but access to any tenant was authorized at the tenant level (as well as all other authorization concerns). To be fair, there was some global authorization concerns, but the vast majority of authorizing actions, including tenant access was governed at the tenant level after authentication.
I appreciate its not helpful but its as helpful as imagining some absurd conspiratorial future. In the same vein I could ask if you're the CIA trying to suppress earnest conversation. It just does nothing but hand wring about a bunch of imagined nonsense.
I think the perceived situation is a matter of degree. I would say there's a measurable (almost overwhelming) amount of corporate influence already.
I have no doubt there are agency operatives influencing discussion online, from recorded precedence. Calling the concept 'nonsense' is overly dismissive. Regardless, using that kind of claim to deflect from the premise isn't a compelling reason to invalidate the concept. Ideas can stand on their own.
It's not irrational if you know that the insurance company has mispriced your policy, and filing a claim won't be more trouble than it's worth.
Getting a contents policy in a safe neighborhood where you know that there's little risk is likely not a good deal. Getting a contents policy when you've learned that your neighbors are getting into hard drugs is probably a good deal.
Paying $19/mo for third-party full coverage + theft on your $1,000 mobile phone is probably not a good deal even if you know you are high risk, for the simple reason that at $19, they game must be that they will find any reason to refuse to pay, and will give you a poorly refurbished phone for your troubles if you make them honor the insurance.
Oh I'm so glad it works this way round too. Kinda sick of the web being ruined by http pages that tell you to download a binary. Is anyone bothering trying to narrow that gap between native and web on phones so we can resume the process we were undertaking back in 2010 before smartphones re-promoted binary applications for whatever reason?
Another angle is clamping down on products and services that help people create lab-like environments on the cheap.
reply