"only prohibit what you can prevent"

[dthompson@toot.cat]

"only prohibit what you can prevent"

erights.org is one of the websites of all time

http://erights.org/elib/capability/delegations.html

[dthompson@toot.cat]

Communicating Conspirators

Alice delegates Power to Bob. Alice does not want Mallet to have Power. Can Alice prevent that? Nope!

An ACL system will gladly let you express that Mallet may not access Power but it's completely unenforceable. ACLs provide a false sense of security in this regard.

http://erights.org/elib/capability/conspire.html

[dthompson@toot.cat]

Alice invites Bob to the chat room. Alice doesn't want Mallet to read the chat log. Can Alice prevent it? Nope!

[arnebab@rollenspiel.social]

@dthompson Not completely. But a communication system can make it hard enough for Bob to invite someone else that it doesn’t often happen in practice.

Bob can always copy, but if a link to the chat by default requires a login by Bob, most Bobs won’t want to do the work required.

That’s the effect of defaults and convention.

[dthompson@toot.cat]

@ArneBab the point is that we don't want to give users a false sense of security by saying that we can prevent something we cannot. we can surely add friction, but that's it.

[arnebab@rollenspiel.social]

@dthompson yes.

My point is that this friction is actually valuable.

I can’t actually prevent someone on mastodon from reading my public toots by blocking them, but blocking them still prevents most people from doing so.

⇒ needs to get UX right. In Hyphanet we usually got that part wrong (e.g. told people "you’re totally insecure" when they actually were safe against the 99% of people who don’t patch their node to spy on their friends).