4 ms·

Once we get used to doing same thing multiple times a day, it doesn't matter if the log shows that we're about to take a destructive action, we'll still do it.

Once we get used to doing same thing multiple times a day, it doesn't matter if the log shows that we're about to take a destructive action, we'll still do it. Only thing that is foolproof is to not take the destructive action because people make mistake, it's human nature. I don't know how this can be implemented, may be encrypt the files, take a backup in some other location (which may not be allowed). Multiple reviewers here didn't catch the mistake https://www.bloombergquint.com/markets/citi-s-900-million-misfire-happened-in-midst-of-software-switch https://www.bloombergquint.com/markets/citi-s-900-million-mi...

dkersten 4y ago
> Multiple reviewers here didn't catch the mistake Sure, but we can only do so much. I find its good bang for buck and alternatives that might prevent that are not always available, so we do the best we can. You gotta make a call on whether its enough or not.
Danieru 4y ago
That form had a couple weird checkboxes with odd wording. It is a famous mistake, but also rather understandable just because the form was cryptic.
irrational 4y ago
Because everyone assumes that everyone else is looking at it more closely than they are. “I’ll just do a cursory look since I’m sure everyone else is doing a in-depth look.” Narrator: nobody did an in-depth search.
HowardStark 4y ago
While this is a huge issue, a solution (well, a partial mitigation) I've seen and used is the "Pointing and Calling" technique. The basic idea is that you incorporate more actions beyond reading and typing or pressing a button—generally by having people point at something and say aloud what it is they're doing and what they expect to happen. It's used rather extensively in safety-critical public transportation in Japan [1] and to a lesser extent in New York (along with many other countries) [2]. This can easily extend to software without overcomplicating by just setting the expectation that engineers, Q&A, etc. do this even when alone. [1] https://www.atlasobscura.com/articles/pointing-and-calling-japan-trains https://www.atlasobscura.com/articles/pointing-and-calling-j... [2] https://en.wikipedia.org/wiki/Pointing_and_calling https://en.wikipedia.org/wiki/Pointing_and_calling
- emerged 4y ago
  “I’m removing that semicolon!” (Pointing)
  - b112 4y ago
    Parent meant this sort of pointing. https://t.co/TjfX5K54H7 https://t.co/TjfX5K54H7
- samhw 4y ago
  Hell, GitHub does that to an extent, with the "type the name of this repository to delete it" prompts. Typing the name of the repository isn't exactly perfect, but it's an interesting direction.
  - Blackcatmaxy 4y ago
    There was a thread recently about a repo that accidentally went private and lost all of its stars because of confusion with GH teams vs GH profile readme repo naming. I think this type of prompt is very useful for explicitly preventing the rare worst case scenarios but the problem is making any type of prompt "routine" so that our brains fail to process it.
    - skrtskrt 4y ago
      I always copy-paste into that box as well, they should probably make at least an attempt at disabling pasting into it
    - lostlogin 4y ago
      This is it I think. https://news.ycombinator.com/item?id=31033758 https://news.ycombinator.com/item?id=31033758
    - swid 4y ago
      The suggestion in that post about how to fix it is good, and mirrors one I read in the Rachael by the Bay blog - type the number of machines to continue: https://rachelbythebay.com/w/2020/10/26/num/ https://rachelbythebay.com/w/2020/10/26/num/ The take away by both is there is actually something to do which can wake people up when the stakes are high, and they might not be doing what they expect.
slaymaker1907 4y ago
I'm a fan of doing things temporally so data is very rarely actually deleted from the database. Most of the time, you just update the "valid_to" field to the current time. Sometimes real deleted are required such as with privacy requests, but I think that sort of thing is pretty rare. If your application has space concerns, you can modify this approach to be like a recycle bin where you delete records which are no longer valid and have been invalid for over a month (or whatever time frame is appropriate for your application). However, I think this is unnecessary in most cases except for blob/file storage.

dkersten 4y ago

> Multiple reviewers here didn't catch the mistake Sure, but we can only do so much. I find its good bang for buck and alternatives that might prevent that are not always available, so we do the best we can. You gotta make a call on whether its enough or not.

Danieru 4y ago

That form had a couple weird checkboxes with odd wording. It is a famous mistake, but also rather understandable just because the form was cryptic.

irrational 4y ago

Because everyone assumes that everyone else is looking at it more closely than they are. “I’ll just do a cursory look since I’m sure everyone else is doing a in-depth look.” Narrator: nobody did an in-depth search.

HowardStark 4y ago

While this is a huge issue, a solution (well, a partial mitigation) I've seen and used is the "Pointing and Calling" technique. The basic idea is that you incorporate more actions beyond reading and typing or pressing a button—generally by having people point at something and say aloud what it is they're doing and what they expect to happen. It's used rather extensively in safety-critical public transportation in Japan [1] and to a lesser extent in New York (along with many other countries) [2]. This can easily extend to software without overcomplicating by just setting the expectation that engineers, Q&A, etc. do this even when alone. [1] https://www.atlasobscura.com/articles/pointing-and-calling-japan-trains https://www.atlasobscura.com/articles/pointing-and-calling-j... [2] https://en.wikipedia.org/wiki/Pointing_and_calling https://en.wikipedia.org/wiki/Pointing_and_calling

emerged 4y ago
“I’m removing that semicolon!” (Pointing)
- b112 4y ago
  Parent meant this sort of pointing. https://t.co/TjfX5K54H7 https://t.co/TjfX5K54H7
samhw 4y ago
Hell, GitHub does that to an extent, with the "type the name of this repository to delete it" prompts. Typing the name of the repository isn't exactly perfect, but it's an interesting direction.
- Blackcatmaxy 4y ago
  There was a thread recently about a repo that accidentally went private and lost all of its stars because of confusion with GH teams vs GH profile readme repo naming. I think this type of prompt is very useful for explicitly preventing the rare worst case scenarios but the problem is making any type of prompt "routine" so that our brains fail to process it.
  - skrtskrt 4y ago
    I always copy-paste into that box as well, they should probably make at least an attempt at disabling pasting into it
  - lostlogin 4y ago
    This is it I think. https://news.ycombinator.com/item?id=31033758 https://news.ycombinator.com/item?id=31033758
  - swid 4y ago
    The suggestion in that post about how to fix it is good, and mirrors one I read in the Rachael by the Bay blog - type the number of machines to continue: https://rachelbythebay.com/w/2020/10/26/num/ https://rachelbythebay.com/w/2020/10/26/num/ The take away by both is there is actually something to do which can wake people up when the stakes are high, and they might not be doing what they expect.

slaymaker1907 4y ago

I'm a fan of doing things temporally so data is very rarely actually deleted from the database. Most of the time, you just update the "valid_to" field to the current time. Sometimes real deleted are required such as with privacy requests, but I think that sort of thing is pretty rare. If your application has space concerns, you can modify this approach to be like a recycle bin where you delete records which are no longer valid and have been invalid for over a month (or whatever time frame is appropriate for your application). However, I think this is unnecessary in most cases except for blob/file storage.