Hacker News Reader

Comment by mjw_byrne | Hacker News Reader

Clickbaity, trying-too-hard title. The point being made is mundane: perfection is too expensive, so we settle for "good enough". This is near-universally applicable and near-universally understood.

The author is trying to make it sound deep and meaningful with statements like "you should welcome some fraud", as though fraud is actually required for the system to function (clever counterintuitive point made, cue huge dopamine spike). But no, we simply tolerate a certain amount of fraud because eliminating it isn't worth it. Yawn.

View on HN

The comment directly above you on the page right now gives an example of people getting the trade-off wrong, so your dismissiveness is pointless.

The framing is also relevant for another reason: choosing a conscious trade-off point means that you can choose to move it as circumstances dictate, which can be very non-obvious. There's currently a lot of noise in the UK media about dodgy PPE contracts issued during COVID, and for my money most of the coverage misses the point.

The coverage focuses on who the contracts went to, and how much they cost. There is only scant consideration given to whether the contracts were fulfilled (and they weren't - the PPE was no good and couldn't be used).

This is precisely backwards: in an emergency situation where you don't have enough of a thing, and the existing systems to provide the thing are very much tuned to preventing fraud, you absolutely want to be able to throw money at the problem and accept that more of it than usual will be going places you wouldn't ordinarily tolerate. That's a lever we should definitely be able to pull, by making a conscious choice to relax . But that's only true if you do actually get what you paid for.

Yes, you want to be able to follow up any dodgy procurement after the fact, but in the moment what you need is the critical resource.

The scandal should be that none of it worked, not how it was bought.

> The comment directly above you on the page right now gives an example of people getting the trade-off wrong, so your dismissiveness is pointless.

I was only dismissing the way the article presented fraud tolerance as something deeper than a trade-off. I did acknowledge that the trade-off exists and in my other comment stated explicitly that I think discussion of how one finds the right trade-off is interesting.

On your COVID example, I agree that in an emergency it's worth pulling the lever as you put it, i.e. grease the wheels and get the stuff we need. But I wouldn't expect the extra spending to be directed disproportionately at cronies of the government, fraudulent or not.

Exactly. "We can't divert all of society's resources on policing" is different than "The optimal amount of murder is non-zero" or "you should welcome greater than zero murders".

Your mundane explanation misses the main point that perfect security can't exist while maintainint function. It is not just a matter of cost cutting, it is a (sort of) fundamental law that security and usability are opposite ends of a spectrum, at the limit any gains in security can only be achieved by a loss of usability. So any system that is perfectly secure will be perfectly unusable, or in the business angle, any system with 0% fraud will have 0% sales.

I'm not sure this is true in principle though. For example, there's plenty of encryption in use today that has "perfect" security (in the sense that a cipher hasn't been broken) and which is transparent to the end user. This wouldn't have been true a long time ago, when there was no such thing as computer science and the security of information was more to do with how many soldiers you had and how beefy your strongbox was.

Similarly, there's no reason in principle why certain classes of fraud couldn't be rendered practically impossible by an advance in technology, which would undermine the whole "you should welcome some fraud" argument.

Agree. Particularly the tax writeoff argument is complete bullshit.

You could make an argument that you need some level of fraud to keep the anti-fraud dept on its toes. It’s like war. If you have an army that has never fought a war in a century, you should have no confidence you have an army at all. That’s a problem the day a real war or in this case a real fraud, happens.

Yes, and that would be a genuinely interesting point. For example, it could be compared it to the need for regular backup testing, where we generally try to maintain DR readiness with artificial testing and certainly not by accepting a certain frequency of disasters.

Reply on news.ycombinator.com