Laywers and the law don't care about provable security models and neither do the gold owners who want the system. Zed is absolutely right, build what they want even if it isn't provably secure. Test it sufficiently, cover all the cases you can, and move on.
Something doesn't have to be provable to work, the same applies to type systems. Lot's of things that aren't provable and would be forbidden by a static type system will happily chug along just fine in a dynamic system that does what you tell it.
When it's law vs theory, law wins. Unlike theory, the law doesn't have to make sense but you sure as hell better be able to show that you attempted to comply with it.
Comments
Laywers and the law don't care about provable security models and neither do the gold owners who want the system. Zed is absolutely right, build what they want even if it isn't provably secure. Test it sufficiently, cover all the cases you can, and move on.
Something doesn't have to be provable to work, the same applies to type systems. Lot's of things that aren't provable and would be forbidden by a static type system will happily chug along just fine in a dynamic system that does what you tell it.
When it's law vs theory, law wins. Unlike theory, the law doesn't have to make sense but you sure as hell better be able to show that you attempted to comply with it.