jperezduerto.info
Security in depth · Unit 28 · Lesson 6 of 11
Make the initial choice a safe one
Check the initial audience across ordinary creation and template-based creation.
Helpful before thisThreat modeling: ask before building
After this lesson you can
- Find a creation path that does not follow the owner-approved private starting state.
One idea. One situation. One reasoned decision.
Defaults apply at a particular transition
A secure default establishes an appropriate initial state without requiring users to discover a hidden setting. It must match the approved purpose. For private collaboration, broader sharing should follow a clear decision by someone entitled to make it.
Read the supplied record
D1 concerns a fictional research notebook app.
| Creation path or rule | Supplied behavior |
|---|---|
| Owner-approved rule | Every new project starts private to its creator |
| Blank project | Starts private |
| From a shared template | Copies content and the template’s collaborator list |
| Template audience | Includes former external collaborators |
| New sharing decision | None requested during template creation |
Assume the copied collaborator list actually grants read access and that no separate policy narrows it. The blank path follows the rule; the template path does not. Selecting useful starting content is not the separate sharing decision required here.
Propose keeping template content while initializing the new project’s audience from the approved private default. An entitled owner can then choose collaborators after seeing what they will receive. Validate that an uninvited synthetic reader cannot access either kind of newly created project and that deliberate approved sharing still works.
Do not silently rewrite existing projects’ audiences. Existing intentional collaboration, copied projects already created, and restored configurations require their own review and owner decisions.
The supplied record establishes initial permission behavior, not proof that a former collaborator read anything. Record creation path and configuration version to verify the relevant correction.
The key distinction: A private default on one creation path does not cover every way to create a resource.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which proposal addresses D1’s actual default mismatch?
Show the answer
Correct answer: Make both new-project paths start private, then require the authorized owner to choose any collaborators. The requirement applies to every new project in this case. Copying a template must not silently substitute the template’s audience for that decision.
Try it
- WriteWrite acceptance rows for blank creation, creation from a shared template, and deliberate sharing with one collaborator. Separate the treatment of existing projects from the new-project default.