4 ms·

> It's not all that great blaming the victim. Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation woul

> It's not all that great blaming the victim. Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. Risk management is a core part of the engineer's job. https://www.sebokwiki.org/wiki/Risk_Management https://www.sebokwiki.org/wiki/Risk_Management

eganist 5y ago
> Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. There can be multiple victims, multiple causes/threat actors, and overlap between two categories. But what's the end user a victim of in this case? Other than a brief lack of availability?
- bildung 5y ago
  Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.
  - eganist 5y ago
    > Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand the relevance of this to my original question. > Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur. Or this, for that matter --- So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?
    - bildung 5y ago
      Your actual original point was: > It's not all that great blaming the victim. Which is what I was replying to. Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.
      - eganist 5y ago
        > Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers. See my previous note: > There can be multiple victims, multiple causes/threat actors, and overlap between two categories. I think we've both concluded now that newsblur was largely a victim as a consumer of docker. Cheers, glad this helped.
  - detaro 5y ago
    If there is a third-party exploiting that error to cause damage, sure (not the case in your examples, which is why they miss the point). If you don't get security for your business right and it gets burned down by an arsonist, nobody is going to not consider the business owner a victim too. Software culture is IMHO problematic there in multiple dimensions.
imtringued 5y ago
This is completely wrong. By this logic me killing a parent turns the parent into a perpetrator because the parent didn't learn proper self defense. No, the parent is a victim and the children are dependents of the victim. Thus hurting the parent also hurts the children. It's the same thing with Newsblur. Hurting Newsblur hurts their customers.

eganist 5y ago

> Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. There can be multiple victims, multiple causes/threat actors, and overlap between two categories. But what's the end user a victim of in this case? Other than a brief lack of availability?

bildung 5y ago
Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.
- eganist 5y ago
  > Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand the relevance of this to my original question. > Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur. Or this, for that matter --- So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?
  - bildung 5y ago
    Your actual original point was: > It's not all that great blaming the victim. Which is what I was replying to. Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.
    - eganist 5y ago
      > Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers. See my previous note: > There can be multiple victims, multiple causes/threat actors, and overlap between two categories. I think we've both concluded now that newsblur was largely a victim as a consumer of docker. Cheers, glad this helped.
- detaro 5y ago
  If there is a third-party exploiting that error to cause damage, sure (not the case in your examples, which is why they miss the point). If you don't get security for your business right and it gets burned down by an arsonist, nobody is going to not consider the business owner a victim too. Software culture is IMHO problematic there in multiple dimensions.

imtringued 5y ago

This is completely wrong. By this logic me killing a parent turns the parent into a perpetrator because the parent didn't learn proper self defense. No, the parent is a victim and the children are dependents of the victim. Thus hurting the parent also hurts the children. It's the same thing with Newsblur. Hurting Newsblur hurts their customers.