3 ms·
>First, I want to say that the team here did amazing work: they built and shipped a fix in less than 12 hours from the initial report. As someone who sat in the
by ziddoap 8y ago
>First, I want to say that the team here did amazing work: they built and shipped a fix in less than 12 hours from the initial report. As someone who sat in the meeting where it happened, I can say that people were working incredibly hard in a tough situation and that very little time was wasted.
It's a bit disheartening to see the "Lessons" section opened with this. I understand that everyone worked very hard to get things up and running - but that is not a lesson learned. That is self-back-patting.
- dblohm7 8y agoThe post-mortem hasn't even started yet; now that 66.0.5 is out and the initial incident response is finally winding down, now they can move on to that.
- ziddoap 8y agoI don't quite follow how this reply relates to the first paragraph under the "Lessons" section of the linked article.
- fwip 8y agoIt's context for the next paragraph. > With that said, obviously this isn’t an ideal situation and it shouldn’t have happened in the first place. We clearly need to adjust our processes both to make this and similar incidents it less likely to happen and to make them easier to fix.
- ziddoap 8y agoI did gather that much. In my _personal opinion_, it would have been much more palatable to start the lessons learned section with >We’ll be running a formal post-mortem next week and will publish the list of changes we intend to make, but in the meantime here are my initial thoughts about what we need to do. First, we should have a much better way of tracking And shoe-horn the back-patting in earlier or later. Perhaps I'm being pedantic. Fair enough. But for me, I would rather see this issue addressed in a way that the severity of the situation requires. Back-patting is not on the plate for me.
- shawnz 8y agoIt's clearly just a disclaimer to show his respectful intent, since the paragraphs following that are addressing failures of his colleagues.
- ziddoap 8y agoUnderstood, and I explained a bit more of my thoughts in another comment. I understand I'm being a bit pedantic. But, as a user who is pretty concerned with a CA having a certificate issue of this scale, which affected this many people, I don't care about the authors respectful intent to their colleagues. Tell them in person, in an internal memo, whatever. It's simply not a lesson learned.
- shawnz 8y agoLikewise, I'm sure he cares more about keeping good working relationships with his colleagues than about what the reader thinks of his choice of paragraph order. A manager who makes his team feel insulted is not conducive to producing better software (which is presumably what you care most about here).
- ziddoap 8y agoHow is laying out, in a technical fashion, what went wrong and the lessons learned insulting his colleagues? I'm very curious. Just because someone made a mistake, and that mistake is acknowledged, doesn't mean they are insulting them. Also, how come it can't be done in an internal memo, email, party, pay bonus, raises, etc.?
- tialaramex 8y agoMozilla, unlike all of the other major Trust Stores does not actually operate a publicly trusted CA. Microsoft, Apple, and Google all do, the biggest Trust Store I can think of that does NOT operate a CA other than Mozilla is Oracle (who manage the default Java trust store) This puts Mozilla in a good situation of independence IMNSHO. At Google we know it takes actual effort to make sure that corporate firewalls protect the Trust Store function from being sabotaged by the convenience of, say, Google's Cloud function or people in their SRE wanting to keep the lights on for Chrome users. One day Google's CA people accidentally minted certs that Chrome wouldn't trust for Google web sites, and there had to be mechanisms in place to ensure that "Just tell the Chrome engineers to ignore it" wasn't a viable fix, because that would be _easier_ but it destroys any value in that trust store.