Ivan Krstić provided a computer security primer with some interesting historical context when he introduced the Mac App Sandbox in 2011. I learned these important concepts when I started writing web software in 1995 with the Shockwave player, but I’ve never seen as clear an overview as in the first 20 minutes of this talk.

Here are some highlights:

We are conditioning our users to ignore our security messages…

What if we took this approach with car airbags?

The root problem is one of “ambient privilege.” Just because of the person who happened to run a program, we give that program all of the privileges we would give to the person. However, no human can understand and review all of the lines of code that we execute every day.

We are building complex systems, which always have vulnerabilities.

Complexity is growing, and there is no limit on the kind of damage an exploit can do. From cars to fighter planes, the amount of code we are putting into our vehicles has increased dramatically over time.

100M lines of code in a car today….

Mostly, the Mac App Sandbox introduces ideas that the Web Browser introduced in 1993, Shockwave in 1995 with a full program language, then with JavaScript running in its own sandbox a couple of years later. There are some new ideas, of course. One that I particularly like is the notion of leveraging the File Open dialog to capture a user’s intent and seamless allow selective file access only to those files that the user chooses to open.

We need more creative and thoughtful user experience design that allows humans to safely interact with a complex world.

I’ve noticed that people have the illusion that leaders are these “idea people” with throngs of followers who just do what they are told. Maybe some leaders work that way, but that isn’t true leadership. I’ve found that effective leaders identify people who are passionate about a shared goal. Organizations are effective when the people in them have personal goals that overlap with the group mission.

Sometimes people approach me with ideas that they think I can make happen as a leader. I’m excited when it is something that they are personally passionate about and want to help make happen. I’m dismayed when they think they can outline an idea and I’m going to independently make it happen — as if I don’t have three thousand ideas that are queued up just waiting for a few hours of spare time or the right collaborator to make happen.

I think the way media portrays leaders is unfortunate. I understand why it is convenient to focus on speeches and interviews with people at the tops of organizations. In many ways, it is the leader’s responsibility to communicate the impact of the work that all of their folks are doing, so folks can focus on making awesomeness happen. I love it when reporters dive into the details and find the people who make the the things, write the code, organize the events, and write the words. We need leaders to rally around and gather teams who will work better together and create a bigger impact than each individual would alone.