Optimistic Security
summary
Specific claims and fixes: humans use fast‑and‑frugal trees and heuristics that become 186 cognitive biases leading to confirmation bias and Dunning–Kruger errors; a study watches 10 developers for an hour and finds habitual shortcuts, ignored compiler warnings and overconfidence. Failure cases include a misread fetal scan later resolved (heartbeat 160 bpm) and the VSS Enterprise‑style crash where disengaging feather lock at Mach 0.84 (safe window Mach 1.4–1.8, ~4 seconds) causes catastrophic breakup; remedies: feedback, pull requests, threat analysis and risk matrices, and preferring realistic optimism over naive optimism.
AI-written summary · about
chapters (17)
- 0:00Optimistic security introduction
- 2:08Mental shortcuts in brains
- 5:39Social interactions difficulty
- 9:48Shortcuts to harmful biases
- 12:54Confirmation bias in code
- 15:24Dunning-Kruger effect
- 18:12Optimism vs reality story
- 22:46Programmer biases in coding
- 25:14Human natural optimism
- 27:42Virgin Galactic disaster errors
- 31:11Naive vs realistic security
- 32:17Ikea effect flaws
- 34:04Builders resisting solutions
- 35:46Duck or PR feedback
- 37:07Threat analysis risks
- 38:31Brutal honesty critical thinking
- 39:15Takeaways Linda problem
related talks
53mOptimistic Security
01h 00mCognitive biases in software development
31mThe psychology of security: Why we make mistakes
01h 02mCognitive biases in software development
40mThrough Your Mind’s Eye: What Biases Are Impacting Your Security Posture?
31mUnderstanding Cognitive Bias Found In Judgement & Choice
58mThreat Modeling Developer Behaviour: The Psychology of Bad Code
39mHow Cognitive Biases Affect our Software Architectures