3 ms·

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social ch

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.” The company fully blames the employee. I wish software companies had the same level of professionalism than airlines. "It's the pilot's fault" does not help to improve security. Nothing is learned.

Sebguer 4y ago
Airlines would behave the same way if there wasn't an aggressive government regulatory body forcing them to learn from failures.
- WorldMaker 4y ago
  Government regulatory body and a pilot's union.
  - ChadNauseam 4y ago
    Do countries without a pilot's union have more unsafe air travel?
    - WorldMaker 4y ago
      No idea, but in the context of "why can't airlines scapegoat more pilots rather than deal with root causes?", unions are on the list of labor protections to consider.
system2 4y ago
It is called dodging.
xmprt 4y ago
I don't think you can generalize Web3 companies to all software companies. Web3 companies have shown time and time again that they don't care much about security or good software development practices. I'm not sure if it's because the industry is so nascent or because the people joining are simply incompetent or because they don't care (or a combination of all three) but it's clear that Web3 companies have major incidents at higher rates than most other software companies.
- ChadNauseam 4y ago
  > clear that Web3 companies have major incidents at higher rates than most other software companies I won't argue this, but I think that it depends on where you look. Cryptography audit services are books out for months or years because of the demand from cryptocurrency projects. There's never been a vulnerability in the Bitcoin or Ethereum networks that allowed an attacker to steal funds or execute a double-spend. And cryptocurrency projects have pioneered whole fields of cryptography like zksnarks for security purposes. Cryptocurrency projects often have a fundamentally very difficult problem to solve, and attackers are also very sophisticated. There are currently very few people with the expertise needed to implement a complex cryptocurrency project securely. Disclaimer: I'm a protocol developer for a cryptocurrency project (not one of the ones mentioned here)
  - TimPC 4y ago
    Except you know that time Ethereum forked because the core contract on Ethereum was stolen.
giaour 4y ago
My takeaway was that Sky Mavis's ops culture is a dumpster fire, something that might be generalizable to a good chunk of the Web3 sector. The tech companies where I have worked (a couple BigTech cos, some smaller orgs, and civil service) have all taken the blameless postmortem approach very seriously.
rurp 4y ago
To be fair, an airline run like a typical crypto company would quickly be shut down due to all of their planes slamming into the ground.
hackernewds 4y ago
Whatever happened to blameless root cause analysis?

Sebguer 4y ago

Airlines would behave the same way if there wasn't an aggressive government regulatory body forcing them to learn from failures.

WorldMaker 4y ago
Government regulatory body and a pilot's union.
- ChadNauseam 4y ago
  Do countries without a pilot's union have more unsafe air travel?
  - WorldMaker 4y ago
    No idea, but in the context of "why can't airlines scapegoat more pilots rather than deal with root causes?", unions are on the list of labor protections to consider.

system2 4y ago

It is called dodging.

xmprt 4y ago

I don't think you can generalize Web3 companies to all software companies. Web3 companies have shown time and time again that they don't care much about security or good software development practices. I'm not sure if it's because the industry is so nascent or because the people joining are simply incompetent or because they don't care (or a combination of all three) but it's clear that Web3 companies have major incidents at higher rates than most other software companies.

ChadNauseam 4y ago
> clear that Web3 companies have major incidents at higher rates than most other software companies I won't argue this, but I think that it depends on where you look. Cryptography audit services are books out for months or years because of the demand from cryptocurrency projects. There's never been a vulnerability in the Bitcoin or Ethereum networks that allowed an attacker to steal funds or execute a double-spend. And cryptocurrency projects have pioneered whole fields of cryptography like zksnarks for security purposes. Cryptocurrency projects often have a fundamentally very difficult problem to solve, and attackers are also very sophisticated. There are currently very few people with the expertise needed to implement a complex cryptocurrency project securely. Disclaimer: I'm a protocol developer for a cryptocurrency project (not one of the ones mentioned here)
- TimPC 4y ago
  Except you know that time Ethereum forked because the core contract on Ethereum was stolen.

giaour 4y ago

My takeaway was that Sky Mavis's ops culture is a dumpster fire, something that might be generalizable to a good chunk of the Web3 sector. The tech companies where I have worked (a couple BigTech cos, some smaller orgs, and civil service) have all taken the blameless postmortem approach very seriously.

rurp 4y ago

To be fair, an airline run like a typical crypto company would quickly be shut down due to all of their planes slamming into the ground.

hackernewds 4y ago

Whatever happened to blameless root cause analysis?