4 ms·

Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem. That's the thing about expectations: e

Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem. That's the thing about expectations: even if you can't come up with a rationale for doing something, other peoples' reactions to not doing the thing can be a sufficient justification for doing it. > well that's what you do I assume what this phrase is supposed to get at the sense that doing port mortems is the (morally) right thing to do and part of our duties as engineers to each other and to the public that has an interest in security. If that's the case then I have to disagree with you, that's an excellent reason to do it. (The fact that something would be the right thing to do means that you have a good reason to do the thing: namely, that it would be the right thing to do.) You can be cynical and say that "doing the right thing" is not going to be a good enough motivation to convince business X to do it, and that's fine, but it doesn't sound like that's what you're saying here.

slt2021 6y ago
doing post mortem will be responsible thing to do as it will allow other companies to strenghten their defenses against this vector. if it was rogue employee who used his credentials - well that's one vector. if it was cheap CIO who kept security team understaffed and underpaid => underskilled -> well that's another lesson to learn for all other CIOs/CISOs around the world. Try to cut costs on your IT people, try to outsource talent - this is what you get. It will earn a goodwill for Solarwinds and will help everybody else to be aware of the attack vector
gist 6y ago
> Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem. 'good company' to what audience? Hackers and security people and 'nerds'. How big is that audience? You don't make business decisions based like that. It's business after all. Look at all the (for lack of a better way to put it) 'dicked off' things Apple has done. They pissed off (and continue to piss off) very diverse groups of people and companies that interact with them. In the end the vast majority of the Apple customers (the people who pay them money) don't care about this at all. Note I didn't say that things couldn't be shared with direct and important groups of people. Just that it didn't have to be open and public and broadcast in any way as entertainment or help for the community at large.

slt2021 6y ago

doing post mortem will be responsible thing to do as it will allow other companies to strenghten their defenses against this vector. if it was rogue employee who used his credentials - well that's one vector. if it was cheap CIO who kept security team understaffed and underpaid => underskilled -> well that's another lesson to learn for all other CIOs/CISOs around the world. Try to cut costs on your IT people, try to outsource talent - this is what you get. It will earn a goodwill for Solarwinds and will help everybody else to be aware of the attack vector

gist 6y ago

> Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem. 'good company' to what audience? Hackers and security people and 'nerds'. How big is that audience? You don't make business decisions based like that. It's business after all. Look at all the (for lack of a better way to put it) 'dicked off' things Apple has done. They pissed off (and continue to piss off) very diverse groups of people and companies that interact with them. In the end the vast majority of the Apple customers (the people who pay them money) don't care about this at all. Note I didn't say that things couldn't be shared with direct and important groups of people. Just that it didn't have to be open and public and broadcast in any way as entertainment or help for the community at large.