# A Rant on Usable Security

DevFeed: [A Rant on Usable Security](<https://devfeed.tech/articles/a-rant-on-usable-security-35145.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/a-rant-on-usable-security/>)

Published: 2017-07-27T15:09:26Z

Content type: opinion

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [DevOps](<https://devfeed.tech/topics/devops.md>), [API](<https://devfeed.tech/topics/api.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [collaboration](<https://devfeed.tech/tags/collaboration.md>), [containers](<https://devfeed.tech/tags/containers.md>), [devops](<https://devfeed.tech/tags/devops.md>), [docker](<https://devfeed.tech/tags/docker.md>), [http](<https://devfeed.tech/tags/http.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

An opinion article about usable security argues that security tools should balance protection with convenience. It emphasizes collaboration between security and software engineers and discusses Docker's default AppArmor and Seccomp profiles as examples of container security tooling.

## Source excerpt

I recently gave a talk at DevOps Days (slides) and it had a pretty great response. I'm still pretty care-mad about the topics it covered so I figured I would turn some key points from it into a blog post. The overall outline of the talk covered the past, present, and future of usable security. Let's start with the past. The Past A lot of the security tooling of the past (that we still use today) require users to jump through a lot of hoops or learn a hard to grok interface. One of the examples I used was GPG. Contrary to popular opinion, I actually don't find GPG entirely unusable. I obviously agree that it could be easier to use, rotate keys, revoke keys blah blah blah. While I find it not exactly terrible, I can see and completely understand why the majority of criticism I hear about GPG is that it is hard to use. There is a point at which better security comes at the expense of convenience. This needs to stop happening. Stop compromising convenience for security. Instead find the right balance between the two. Doing this takes collaboration from both security engineers and software engineers. Dave Cheney recently had a great tweet. Why is all software shit? Today I discovered the @duosec API returns 200 even if someone denies the 2fa request. -- Dαve Cheney (@davecheney) July 25, 2017 I love this tweet because it reeks of the stench that only security engineers built this API. Most software engineers I know would decide to use an HTTP status code... I mean that's what they are for. ;) When you combine expertise in different areas you build better products. This is not rocket science. However egos tend to get in the way as well as biases towards people who know and like the same things you do. I assure you, though, when security and software engineers work together truly usable security will be the outcome. The Present A lot of the content for this portion of the talk focused on how containers make securing your infrastructure easier. I will touch on some of that but