Security quotes of the week

Security quotes of the week

You absolutely do not want humans to be the primary judgement agents for the majority of cases; final arbiters, yes, but the error rate of a human is relatively high compared to a system designed to have high precision. Indeed, a good spam filter tuned for high precision has an error rate lower than a 5 human chain can manage.

In the ideal world, you have a system with 100% precision handle the obvious cases (no human involvement). You then have a system with 100% recall decide which of the remaining cases get put before a human; these are the hard ones. A system with 100% precision cannot have a false positive (by definition); it has a mix of false negatives, true negatives, and true positives. Similarly, a system with 100% recall cannot have a false negative - it throws out a mix of true positives, false positives and true negatives. The pairing isn't perfect, because something that a 100% precision system correctly classifies as a negative can be misclassifed by a 100% recall system as a false positive - there's then no way to tell which of the two systems is correct, bar bringing in human judgement.