Computing minimalism

There's no such thing as perfectly secure software. Running any software is a security liability because if an attacker has access to software in any way then there's a risk of compromise.

This means there is a security benefit to not running software. You can look at this as an example of what I'll call computing minimalism. If you're running software, especially networked software, it's a good idea to periodically look critically at it. Perhaps you can do without it or you might be able to make it the responsibility of others. At minimum you might be able to restrict what it can access or what can access it.

An example of making it the responsibility of others is switching to a hosted app. We're lucky today that so much software is available this way. Even offloading the browser might soon be a reality.

This is contrary to my philosophy of many years that self hosting is a good security practice. Yes, self hosting means my data is inaccessible to third parties, but there is a trade off as I'm responsible for running the software.

Am I going to run it more securely than third parties? Even if I am, is the risk it entails worth it? Because there's a massive risk. If the third party is compromised at least my systems are safe. If I'm running something and it's compromised, that system and everything on it is exposed. Worse, compromising that system might allow access to much more.

I want to isolate my systems from attack. Yes, third party systems are not secure, but I'm able to draw a firm line between them and me. It limits the blast radius.

If I decide I have to run a piece of software, there are ways to make it more secure. For example, I can run it on its own physical system and otherwise isolate it from other systems.

I don't intend to run no software at all, but I look hard at everything I run. Every time I do I find things I can pare back and restrict further.