4 ms·
The programmers and administrators of that system also have CYA incentives. I recently built a fairly complicated reservation/scheduling/accounting system. Bec
by noblethrasher 15y ago
The programmers and administrators of that system also have CYA incentives.
I recently built a fairly complicated reservation/scheduling/accounting system. Because of office politics, I elected to design and implement an auditing feature even though it wasn't a requested (or even desired) feature.
- ordinary 15y agoFor anyone else who didn't know what "CYA" means: Cover Your Ass.
- danso 15y agoI guess that makes sense...when an incident like this comes up, it's impossible for anyone at any part in the chain (from the chief to whoever hired the contractor) to justify: "We just didn't think we needed to track every time someone wanted to look up private info" Given that such a computer system probably has a lot of redundancy (or machines spinning) to make sure that cops, at any time, can call up info and do everything else through that network...logging 10-100K logins would be pretty trivial. Given that you weren't asked to do the auditing feature in the first place, did you also build any kind of suspicious-behavior detection?
- noblethrasher 15y agoI did consider building some kind of fraud detection system since there was some suspicion of... treachery. But I didn't know enough about the domain to believe that I could implement something that would work reliably. In fact, my doubts about my domain knowledge is one of the main things that motivated me to build the auditing feature. If something went wrong I wanted to make sure that I could only be blamed for legitimate mistakes on my part. I'm sure the same thing happens with larger systems.