No general-purpose computer, or everything under surveillance?

[gunnar at arctecgroup.net (Gunnar Peterson)]

> But the difference is who is in final control.  In the end, the users of
> computers should be in final control, not their makers, or we have given
> up essential liberty.  We can develop systems which provide suites of
> more specialized privileges to particular functions, without giving up
> essential liberty.  We have a long way to go in actually DOING this, but
> the opportunity is there.


I believe the point of Dan Geer's paper is not that these are desired 
outcomes so much as realistic outcomes. If you cannot provide effective 
security (and we're not) and people are relying more and more on 
computers for real world things (and they are), then someone else (who 
is not a geek) is going to come in and more or less arbitrarily assign 
risk and responsibility to parties. For example (quoting Dan Geer's paper):

"We've done this before?Regulation Z of the Truth in Lending Act of 1968 
says that the most a consumer can lose from misuse of a credit card is 
$50. The consumer can be an idiot, but can't lose more than $50. 
Consumers are, in fact, not encouraged to self-protect by such a 
limit?quite the opposite (and $50 in 1968 would be $275 today). No, if 
there is to be a preemption, the intelligence it requires will be based 
on a duty of surveillance that is assigned to various ?deep pockets.? 
The countermeasures, in other words, are not risk-sensitive to where the 
risk naturally lies but risk-sensitive to where it is assigned. Look out 
side effects, here we come."

Something like Regulation Z may not come to pass in information 
security, but if I were a betting man, I think its a more likely outcome 
in the real world than a combination of principle of least privilege + 
perfect code + 4 billion highly trained users; none of which  I have seen.

-gp