Fragments

Short thoughts, lines and reflections of my own that don't need to become a full text. The books' ideas live on the shelf; everything here is mine.

• Hiding a button isn't authorization. The interface mirrors the rule; the server decides.

  From Authorization in four questions

• If a privilege's expiry depends on a cron job running, it's a suggestion.

  From Cached permissions go stale in three ways

• A system prompt saying “only use these tables” is a request, not a control.

  From The prompt is not a security boundary

• A state table says who has access today. Only an event trail says how they got there.

  From A log is not one thing

• Eternal backwards compatibility is just another way of keeping the old bug alive.

• A lot of success content out there is just the visible tip of a crowd of people who did exactly the same and went bust.

  From my review of Fooled by Randomness

• The Russian roulette image sums it up well: whoever made money pulling the trigger isn't a good investor, they're a survivor.

  From my review of Fooled by Randomness

• A good government plan looks a lot like good system design: it defines boundaries, priorities and what it won't do.

  From my review of Projeto Nacional: O Dever da Esperança

• It's not just the result you got that matters; it's how many bad results were equally possible from the same decision.

  From my review of Fooled by Randomness