Chapter 4 — Cryptography and trust services: competing explanations
Lesson map
Lesson 04 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Three rival explanations"]
N2["Lab — Explanation cross-tab"]
N3["4.2 Reading the cross-tab"]
N4["4.3 Confounding in plain terms"]
N5["4.4 Where change collision fits"]
N6["4.5 What the data can decide"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Three rival explanations"]
N2["Lab — Explanation cross-tab"]
N3["4.2 Reading the cross-tab"]
N4["4.3 Confounding in plain terms"]
N5["4.4 Where change collision fits"]
N6["4.5 What the data can decide"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[4.1 Three rival explanations]
|
v
[Lab — Explanation cross-tab]
|
v
[4.2 Reading the cross-tab]
|
v
[4.3 Confounding in plain terms]
|
v
[4.4 Where change collision fits]
|
v
[4.5 What the data can decide]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) set rival explanations for certificate expiry against each other; (2) read a cross-tabulation for confounding; (3) decide which explanation the data can and cannot distinguish.
4.1 Three rival explanations
Felipe states three explanations for expiry incidents. The renewal-mode explanation says manual renewal fails because people forget. The ownership explanation says certificates without a named owner fail because warnings reach nobody, whatever the renewal method. The change-collision explanation says renewals fail when network or firewall changes break validation or deployment, affecting automated renewals in particular. Each predicts a different pattern. If renewal mode dominates, manual incidents should outnumber automated ones even among owned certificates. If ownership dominates, owner-missing incidents should be common in both modes.
Lab — Explanation cross-tab
"""Cross-tab of 30 synthetic expiry incidents against two competing explanations."""
from collections import Counter
# (renewal mode, owner recorded?) for each incident
INC = ([("manual", False)] * 14 + [("manual", True)] * 9 + [("acme", False)] * 5 + [("acme", True)] * 2)
def main():
c = Counter(INC)
print(" owner-missing owner-known")
for mode in ("manual", "acme"):
print(f"{mode:<10} {c[(mode, False)]:>10} {c[(mode, True)]:>12}")
for mode in ("manual", "acme"):
tot = c[(mode, False)] + c[(mode, True)]
print(f"{mode}: {tot} incidents, owner missing in {100 * c[(mode, False)] / tot:.0f}%")
if __name__ == "__main__":
main()
Run with python3 lab_explain.py. Verified output:
owner-missing owner-known
manual 14 9
acme 5 2
manual: 23 incidents, owner missing in 61%
acme: 7 incidents, owner missing in 71%
4.2 Reading the cross-tab
Among thirty synthetic incidents, twenty-three involve manual certificates and seven ACME certificates. Owner-missing certificates account for 61 percent of manual incidents and 71 percent of ACME incidents. Felipe sees two things. Manual renewal is clearly over-represented, which supports the renewal-mode explanation. Yet the owner-missing share is high in both modes, which supports the ownership explanation too. Raw counts alone cannot separate them, because he has not yet divided by the number of certificates in each cell; a high count might just reflect many owner-missing certificates.
4.3 Confounding in plain terms
A confounder is a factor linked to both exposure and outcome. If Briarwood automated mostly well-owned, modern services and left orphaned legacy hosts on manual renewal, ownership would make automation look better than it is. Felipe checks the inventory and finds that 38 percent of manual certificates lack an owner compared with 21 percent of ACME certificates. Ownership is therefore a plausible confounder, and his analysis must compare like with like: manual and ACME certificates within the owner-known group, and separately within the owner-missing group.
4.4 Where change collision fits
The change-collision explanation needs different evidence: change tickets linked to renewal dates. Felipe finds that five of the seven ACME incidents followed a firewall or proxy change within the preceding week, where the ACME client could no longer complete its challenge and logged errors nobody watched. RFC 8555 defines challenge types such as HTTP-01 and DNS-01, and each depends on infrastructure outside the client. This explanation does not compete with automation so much as qualify it: automation removes forgetting but adds a monitored dependency.
4.5 What the data can decide
Felipe writes a decision table. The data can estimate incident rates by renewal mode within ownership strata, which addresses confounding by ownership. The data can describe how often automated failures follow changes, but with seven incidents only descriptively. The data cannot rule out unmeasured confounders such as service criticality, because Briarwood does not record it consistently. He states that his conclusion will be about association, adjusted for ownership, and that any causal language must be qualified. Naming the limits now prevents an overclaim later.
Worked example
Felipe's cross-tab shows manual renewal over-represented but owner-missing shares high in both modes; he adopts stratification by ownership and treats change collision as a qualifier of automation.
Synthetic note. The thirty incidents and ownership percentages are invented; RFC 8555 challenge types are real.
Errors and limits
Counts without denominators mislead; always convert to rates. Stratifying on one confounder leaves others uncontrolled.
Exercises
- EX021 — Three explanations. Name the three rival explanations. Rubric: 3 = renewal mode, ownership, change collision;; 2 = two;; 1 = one;; 0 = none.
- EX022 — Cross-tab shares. What owner-missing shares did the lab report for each mode? Rubric: 3 = 61 percent manual, 71 percent ACME;; 2 = one;; 1 = counts only;; 0 = none.
- EX023 — Why counts fail. Why can raw incident counts not separate the explanations? Rubric: 3 = no denominators; counts may reflect how many certificates each cell holds;; 2 = need rates;; 1 = small sample;; 0 = none.
- EX024 — Confounder evidence. What inventory figures make ownership a confounder? Rubric: 3 = 38 percent manual vs 21 percent ACME lack owners;; 2 = direction;; 1 = vague;; 0 = none.
- EX025 — Change collisions. How many ACME incidents followed infrastructure changes, and why? Rubric: 3 = five of seven; client could not complete challenge, errors unwatched;; 2 = number;; 1 = reason;; 0 = none.
- EX026 — Unmeasured confounder. Which confounder can the data not address? Rubric: 3 = service criticality, not consistently recorded;; 2 = "unmeasured";; 1 = ownership;; 0 = none.
Synthesis
Rival explanations predict different patterns; testing them requires rates, stratification on measured confounders and candour about what remains unmeasured.
Continue studying — chapter 04 of 08
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →