b19y

White and yellow, kill a fellow.
Purple and blue, good for you.
Red… could be good, could be dead.

Get to Know Your Edible Berries with a Simple Mnemonic [Survival]

People have a natural intuition about risk, and in many ways it’s very good. It fails at times due to a variety of cognitive biases, but for normal risks that people regularly encounter, it works surprisingly well: often better than we give it credit for. This struck me as I listened to yet another conference presenter complaining about security awareness training. He was talking about the difficulty of getting employees at his company to actually follow his security policies: encrypting data on memory sticks, not sharing passwords, not logging in from untrusted wireless networks. “We have to make people understand the risks,” he said.

It seems to me that his co-workers understand the risks better than he does. They know what the real risks are at work, and that they all revolve around not getting the job done. Those risks are real and tangible, and employees feel them all the time. The risks of not following security procedures are much less real. Maybe the employee will get caught, but probably not. And even if he does get caught, the penalties aren’t serious.

Given this accurate risk analysis, any rational employee will regularly circumvent security to get his or her job done. That’s what the company rewards, and that’s what the company actually wants.

Bruce Schneier

Don’t make something unless it is both necessary and useful; but if it is both necessary and useful, don’t hesitate to make it beautiful.

The Shaker Design Philosophy – Bokardo

They’s a time of change, an’ when that comes, dyin’ is a piece of all dyin’, and bearin’ is a piece of all bearin’, an’ bearin’ an’ dyin’ is two pieces of the same thing. An’ then things ain’t so lonely anymore. An’ then a hurt don’t hurt so bad.

John Steinbeck, The Grapes of Wrath

I regularly break seven of those rules. How about you?

Schneier on Security: Password Advice