Hacker News Reader

Comment by moughxyz | Hacker News Reader

Hmm, I wonder if swapping "private" for "secure" would change the framing. Would an application touting "secure" in their tagline, but offering an insecure plugin architecture, be disjointed? I ask because the interchangeability of "private" and "secure" has always been a fascinating dilemma to me. Their definitions are precisely what I try to poke into in this post.

View on HN

I don't know that the layperson sees them as interchangeable. Private, to me, merely says that the goal is for this to be for my eyes only. Secure tells me that they've gone to extra steps to ensure that that privacy is upheld.

It's like if someone has a private office versus a secure office. One is a room with a door on it, the other is a room with a security guard.

Privacy and security seem orthogonal to me.

Privacy is only one thing of many that could be assured via security. Imagine an office with glass walls, very little sound insulation, and a security guard at the door. The security guard and walls prevent physical attacks on the office occupant, thus ensuring their physical security, but it'd be difficult to say that office is private.

Is iPhone private? Apple says it is. Yet Apple also has the keys to user iCloud data. I agree that with proper metaphor the distinction becomes very clear, but in the open I’m not so sure if this distinction is well-defined, well-used, or well-understood.

I do not see much difference between 'application' and 'plugin'. Both are just some code one installs one on one's computer that somehow work together. There is risk that plugin does 'rm -rf ~/', but the same risk is for the application, both are mitigated through distribution infrastructure. So i do not see why application should have any kind of responsibility for plugins.

"Secure" is a much better word to discuss, because it's obviously a relative term that only has meaning against a threat model. So, yes, if the author kept using "secure" on his article, we would see a much better conversation, about how he is changing the goalposts instead of simply arguing that the goal is on a place where the posts are not.

I think you are responding to the author actually. But I agree, I think the author is mixing up privacy and security here.

Reply on news.ycombinator.com