Re: Design principles

[Neal H. Walfield]

At Mon, 15 Jan 2007 14:16:29 -0500,
Jonathan S. Shapiro wrote:
> On Mon, 2007-01-15 at 19:53 +0100, Marcus Brinkmann wrote:
> > At Mon, 15 Jan 2007 12:27:39 -0500,
> > "Jonathan S. Shapiro" <address@hidden> wrote:
> > > 
> > > An interesting assertion. What are Wikipedia's security mechanisms?
> > 
> > Mmh.  It's actually more interesting that you have to ask....
> 
> I didn't, but it was educationally useful to let step into the trap by
> yourself. Your list is almost exactly what I expected.
> 
> In short, Wikipedia doesn't *have* any security policies. What Wikipedia
> has is robust means of recovery. Wikipedia has absolutely no means for
> preclusion of hostile acts. It only has means for recovery and
> retaliation.
> 
> This is an interesting approach, and one that is effective for
> Wikipedia. It is not a security policy.

A security policy is simply a set of rules regarding

  - access (privacy)
  - modification
  - availability

So, yes, this is a security policy.  What you want to say is: "this is
a bad security policy."  But that is a judgment.  And judgments must
be bound in values.  It may be true that what you value is not covered
by this security policy but it is a security policy which is effective
at supporting a set of values.