Applying the rules of power saw safety to internet security

[theweaselking]

here are some of the key safety features that are built into the DeWalt Mitre Saw. Notice in all three of these examples you do not have to do anything special, just use the device. This is how we need to think from a security perspective.

Safety Cover: There is a plastic safety cover that protects the entire rotating blade. The only time the blade is actually exposed is when you lower the saw to actually cut into the wood. The moment you start to raise the blade after cutting, the plastic cover protects everything again. This means to hurt yourself you have to manually lower the blade with one hand then insert your hand into the cutting blade zone.

Power Switch: Actually, there is no power switch. Instead, after the saw is plugged in, to activate the saw you have to depress a lever. Let the lever go and saw stops. This means if you fall, slip, blackout, have a heart attack or any other type of accident and let go of the lever, the saw automatically stops. In other words, the saw always fails to the off (safe) position.

Shadow: The saw has a light that projects a shadow of the cutting blade precisely on the wood where the blade will cut. No guessing where the blade is going to cut.

Safety is like security, you cannot eliminate risk. But I feel this is a great example of how security can learn from others on how to take people into account.

- From Securing The Human

Comments

[ironphoenix.livejournal.com]

This has indeed been known to be a good idea for a while in other fields.

[resonant.livejournal.com]

We use that a LOT at work. Every time something goes wrong, we implement physical blockages in our process to prevent it. We have a room full of 3D printers that do nothing but make error-proof assembly fixtures.

[pappy-legba.livejournal.com]

Some of this is cultural and regulatory: if a saw ends up cutting extremities off a small but non-trivial portion of its users, the saw designers and manufacturers do not blame the user. Even if they do, it does not protect them from liability lawsuits.

I really need to start keeping a list of the most obscure and counterintuitive things that developers blame on the 'stupid user.'