4 ms·
"Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were no
by IanDrake 7y ago
"Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were not enabled for this database."
They need a solution to watch their solution that watches their configs.
- driverdan 7y agoQuis custodiet ipsos custodes? For those who don't know the phrase: https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...
- tialaramex 7y agoIn Juvenal's context the question is rhetorical. An unfaithful partner will sleep with the people you set to watch over them, duh. But in the context where we use this phrase today the best answer is a full circle. Watching us, watching them, watching you.
- rhizome 7y agoI bet the threat of prison would tune up their attitude. There's no reason that these "misconfigurations" shouldn't be felonies.
- kart23 7y agoFor who though? I would hate to see the blame placed on some low-level database engineer. And there's no way you could blame the executives.
- yoavm 7y agoHow about fining the company? Wouldn't that do the job of enforcing more careful policies?
- tsukurimashou 7y agoHow do you make sure the repercussions will fall on the right people? What tells you they wont just layoff some random people to save some money to pay for the fine? The problem with companies is you can always shift the blame on someone, on some department, etc... In the end, the people that made the shitty decisions are rarely held accountable for the mistakes.
- tripzilch 7y agoSure but laying off random people isn't free to the corporation either. They have to hire new people which is costly, or end up with less people. And if the people actually responsible are still there, it will happen again. Unless they change their tune. In which case it's sad about the layoffs, but at least you've got a corporation to behave. Which is also nothing to sneeze at.
- rhizome 7y agoThat would be determined in the process of drafting legislation.
- logicchains 7y agoThere's a massive reason these misconfigurations shouldn't be felonies. Since such errors are so hard to avoid (no company has perfect practice), few sane people would be willing to work in any role that involved taking such responsibility, so a bunch of services would suddenly cease to exist, and the economic cost from the loss of those services could well be way greater than the cost from the occasional breach (which I've as of yet never seen anyone here try to quantify).
- tripzilch 7y agoHow does it work in construction of buildings? If it got built with a misconfiguration in a safety critical part. Or maybe it ought to be modelled after medical malpractice? If a doctor fumbles and messes you up.
- rhizome 7y agoPeople work in those roles all the time, do you say "well nobody has perfect practice" when a doctor leaves a thermometer in your child's skull after surgery? There are malpractice regimes all over the place, it just results in having real training and an assessment of risks and, y'know, not cowboy'ing, before making changes. "What difference does it make that this girder is 1/2" out of alignment? Nobody's perfect."