4 ms·

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing struc

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.

eganist 5y ago
> Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand the relevance of this to my original question. > Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur. Or this, for that matter --- So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?
- bildung 5y ago
  Your actual original point was: > It's not all that great blaming the victim. Which is what I was replying to. Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.
  - eganist 5y ago
    > Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers. See my previous note: > There can be multiple victims, multiple causes/threat actors, and overlap between two categories. I think we've both concluded now that newsblur was largely a victim as a consumer of docker. Cheers, glad this helped.
detaro 5y ago
If there is a third-party exploiting that error to cause damage, sure (not the case in your examples, which is why they miss the point). If you don't get security for your business right and it gets burned down by an arsonist, nobody is going to not consider the business owner a victim too. Software culture is IMHO problematic there in multiple dimensions.

eganist 5y ago

> Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand the relevance of this to my original question. > Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur. Or this, for that matter --- So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?

bildung 5y ago
Your actual original point was: > It's not all that great blaming the victim. Which is what I was replying to. Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.
- eganist 5y ago
  > Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers. See my previous note: > There can be multiple victims, multiple causes/threat actors, and overlap between two categories. I think we've both concluded now that newsblur was largely a victim as a consumer of docker. Cheers, glad this helped.

detaro 5y ago

If there is a third-party exploiting that error to cause damage, sure (not the case in your examples, which is why they miss the point). If you don't get security for your business right and it gets burned down by an arsonist, nobody is going to not consider the business owner a victim too. Software culture is IMHO problematic there in multiple dimensions.