3 ms·

Yes, people do actually die from compromises, you just don't hear about it. For you, somebody snatching your CC might mean a hassle due to having to call the b

Yes, people do actually die from compromises, you just don't hear about it. For you, somebody snatching your CC might mean a hassle due to having to call the bank and dispute the charges. For somebody with little money to spend, it can mean the difference between feeding their family for 3 days and not doing so. For you, somebody leaking your private messages on a social network might mean some inconvenient messages that have to be explained to a friend. For somebody else, it can mean that suddenly their homosexuality is well-known in a country where that carries the death penalty, and gets them executed. Software is infrastructure, plain and simple. You don't maintain it, people die. You don't make it safe, people die. It doesn't matter whether you personally see it causing problems for yourself. This "morally righteous fury", as you put it, is absolutely justified. Developers (and the companies managing them) need to take some goddamn responsibility for the infrastructure they build.

dsfyu404ed 8y ago
>Software is infrastructure, plain and simple. You don't maintain it, people die. You don't make it safe, people die. It doesn't matter whether you personally see it causing problems for yourself. This "morally righteous fury", as you put it, is absolutely justified. Not all software infrastructure is critical infrastructure. It's like the difference between a company that makes bottom dollar kitchen sink sprayers and washing machine hoses that always leaking and mine railings making a town's water supply undrinkable. Both are water problems. Only one is a big enough problem that people not affected by the problem should care about the problem. You have to take both likelihood of harm and severity of harm into account. Just because someone somewhere might get hurt using a bottom dollar washing machine hose to transfer dangerous chemicals doesn't mean we should regulate all things related to water the way we regulate waste disposal near rivers and wetlands.
- joepie91_ 8y ago
  > Not all software infrastructure is critical infrastructure. This might be a valid argument if we had a standardized way of classifying critical software vs. non-critical software, that took into account corner cases. We do not. Instead what happens is that people arbitrarily classify what they consider 'critical' based on gut feelings and rarely considering the situation of people-who-aren't-them, and that the resulting potpourri of judgments produces critical systems where the authors of individual parts thought that it wouldn't be as critical as it ends up being. Then it breaks, and now all hell breaks loose. In practice, people build critical software systems with off-the-shelf components that really weren't designed to be used for such critical cases. This isn't specific to open-source, either; it happens just as much with proprietary components. There are no certification processes worth a damn, no clear idea of where and why this matters. And until we get to a point where those processes and standards do exist, there is only one safe assumption to make: all software is critical infrastructure, because you have no idea what it's going to be used for in practice. Hence the 'fury' being justified. EDIT: Addendum... I've had the critical-systems discussion with many developers. The overwhelming interpretation of "critical" is "I can see a way in which the software can directly kill people". Think drones, airplanes, and so on. Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death. Realistically, barely anybody in the software industry has the first clue as to what constitutes a 'critical' system, or exactly how much damage their software can do. A similar issue exists in the design industry[1]. [1] https://www.youtube.com/watch?v=J0ucEt-La9w https://www.youtube.com/watch?v=J0ucEt-La9w
  - dsfyu404ed 8y ago
    >Addendum... I've had the critical-systems discussion with many developers. The overwhelming interpretation of "critical" is "I can see a way in which the software can directly kill people". Think drones, airplanes, and so on. >Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death. That's how things work in every other industry that doesn't specifically build things to operate in hazardous environments. Things are designed to not kill and/or harm in normal use, not to not kill and/or harm people in exceptional circumstances or if grossly misused.

dsfyu404ed 8y ago

>Software is infrastructure, plain and simple. You don't maintain it, people die. You don't make it safe, people die. It doesn't matter whether you personally see it causing problems for yourself. This "morally righteous fury", as you put it, is absolutely justified. Not all software infrastructure is critical infrastructure. It's like the difference between a company that makes bottom dollar kitchen sink sprayers and washing machine hoses that always leaking and mine railings making a town's water supply undrinkable. Both are water problems. Only one is a big enough problem that people not affected by the problem should care about the problem. You have to take both likelihood of harm and severity of harm into account. Just because someone somewhere might get hurt using a bottom dollar washing machine hose to transfer dangerous chemicals doesn't mean we should regulate all things related to water the way we regulate waste disposal near rivers and wetlands.

joepie91_ 8y ago
> Not all software infrastructure is critical infrastructure. This might be a valid argument if we had a standardized way of classifying critical software vs. non-critical software, that took into account corner cases. We do not. Instead what happens is that people arbitrarily classify what they consider 'critical' based on gut feelings and rarely considering the situation of people-who-aren't-them, and that the resulting potpourri of judgments produces critical systems where the authors of individual parts thought that it wouldn't be as critical as it ends up being. Then it breaks, and now all hell breaks loose. In practice, people build critical software systems with off-the-shelf components that really weren't designed to be used for such critical cases. This isn't specific to open-source, either; it happens just as much with proprietary components. There are no certification processes worth a damn, no clear idea of where and why this matters. And until we get to a point where those processes and standards do exist, there is only one safe assumption to make: all software is critical infrastructure, because you have no idea what it's going to be used for in practice. Hence the 'fury' being justified. EDIT: Addendum... I've had the critical-systems discussion with many developers. The overwhelming interpretation of "critical" is "I can see a way in which the software can directly kill people". Think drones, airplanes, and so on. Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death. Realistically, barely anybody in the software industry has the first clue as to what constitutes a 'critical' system, or exactly how much damage their software can do. A similar issue exists in the design industry[1]. [1] https://www.youtube.com/watch?v=J0ucEt-La9w https://www.youtube.com/watch?v=J0ucEt-La9w
- dsfyu404ed 8y ago
  >Addendum... I've had the critical-systems discussion with many developers. The overwhelming interpretation of "critical" is "I can see a way in which the software can directly kill people". Think drones, airplanes, and so on. >Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death. That's how things work in every other industry that doesn't specifically build things to operate in hazardous environments. Things are designed to not kill and/or harm in normal use, not to not kill and/or harm people in exceptional circumstances or if grossly misused.