Security, Verification & Market Testing

← Back to Domain-Specific Families

Abstractions about authentication, cryptography, formal verification, secrets, model theft, rate limits, and lightweight tests of product or message validity.

13 abstractions in this family — domain-specific abstractions that sit near one another in structural-signature space (k-means over structural-signature embeddings). Each is shown with its short description.

• Authentication Failure — The breakdown of a system's identity-verification, in which a claim is accepted when it should not be — because the procedure checked too little, the wrong evidence, or evidence an impostor could produce — yielding a session that inherits the real actor's privileges and corrupts every control conditioned on 'who is this?'
• Digital signature — Bind a specific message to a specific private-key holder with a short string anyone can check against the public key, confining all remaining trust to one question — does this public key authentically belong to its claimed principal?
• Formal Verification — Establish with the rigor of a theorem that an engineered artifact satisfies a precisely stated specification by producing a machine-checkable proof that holds over every input in scope at once, rather than sampling behavior on tested inputs the way testing does.
• Friction Budgeting — The design discipline of treating interaction cost as an explicit allocation variable rather than a uniform negative — concentrating load-bearing friction where it buys reflection, safety, or consent, and removing dead weight elsewhere, under a bounded user-tolerance budget.
• Kerckhoffs's principle — Design a cryptosystem to stay secure even when the entire algorithm is public, confining secrecy to the key alone — because a leaked key is cheaply rotated while a leaked algorithm cannot be replaced without rebuilding the whole system.
• Landing-Page Test — A lean-startup demand test that publishes a page describing an unbuilt offering as if it existed, then counts costly commitment signals (sign-ups, pre-orders, deposits) from representative traffic against a pre-committed threshold — a necessary-not-sufficient gate that can kill a weak idea but never confirm a strong one.
• Model Theft — Clone a deployed model's valuable function from its outputs alone by treating it as a high-bandwidth oracle — querying it, harvesting (input, prediction) pairs, and fitting a substitute — so the IP boundary becomes a price set by extraction cost, not a wall.
• Problem-Solution Fit — The lean-startup gate that demands cheap, need-side evidence — a real, important problem for an identified user, and a solution preferred over their current workaround — before committing to build at scale, guarding against 'build it and they will come.'
• Public-Key Cryptography — Give each party a mathematically linked public/private key pair where an operation done with one key is invertible only with the other and the private key cannot feasibly be computed from the public one, so confidentiality and verifiable authorship need no pre-shared secret.
• Rate-Limit Absence — Diagnose a whole family of endpoint abuses as one defect — a callable action left uncapped whose per-invocation cost to the service far exceeds the attacker's, so no enforced per-source budget separates legitimate demand from adversarial demand driven at machine speed.
• Secret Sprawl — Diagnose a credential's danger not by whether its primary store is locked but by whether its copies have spread into more places than the issuer tracks, so revocability collapses and rotation cost scales with the unknown copy count.
• Smoke Test — Probe demand for a product that doesn't exist yet with a cheap false-front — a landing page, pre-order, or fake door — that extracts a commitment-bearing signal, and build only if that signal clears a kill threshold set in advance.
• Synthetic Media Laundering — The information-ecosystem failure in which algorithmically generated content enters an evidence channel past an unscrutinized intake node and is progressively washed through authenticating intermediaries until downstream consumers treat it as verified-provenance reality.