version2beta

Essay series · 4 essays

Simplicity Is Security

A program can do exactly what we asked and still have the power to do things we never intended. Correct behavior alone does not make software secure.

These four essays explore a principle that connects OpenBSD’s early security work to modern agentic coding: reduce what we must trust, eliminate capabilities we don’t need, and limit the consequences of mistakes we cannot prevent.

The argument develops from understanding intended behavior to controlling what software can do, and ultimately to the authority we give agents that write and modify our code. Each essay stands on its own, but together they make the case that simplicity is not merely a matter of code quality. It is a way to build security into our software.

  1. Part 1

    Intentions and Unintentions

    The negative space of security: unintended behavior, explicit permissions, and what testing can—and cannot—establish.

    11 min read

  2. Part 2

    Less Is More

    Writing less code can make that code more secure.

    10 min read

  3. Part 3

    The Limits of Understanding

    Human limits, OpenBSD audits, privilege separation, and the operating-system boundaries that contain unseen defects.

    13 min read

  4. Part 4

    Agentic Coding

    How agentic coding adds a boundary between the engineer and the program, and why working code must be simplified, described, and constrained.

    17 min read

All writing