> The failsafe is backups. Backups are not a failsafe. Firstly, backups are not an emergency plan. Restoring backups is the emergency plan, and that needs to

> The failsafe is backups. Backups are not a failsafe. Firstly, backups are not an emergency plan. Restoring backups is the emergency plan, and that needs to be tested and verified on a regular basis. Making backups without validated restoration is just theatre, Second, a backup is not a failsafe. A failsafe is something that lets you keep working in the event of a failure. It's not something that lets you keep working after you recover. If a self-driving car had the failsafe of stopping dead in the middle of the railway tracks until you restore it from backup you're going to have a lot of damaged trains. No amount of computer database backup will help you when the power goes out. Fires, floods, tornadoes, hurricanes, earthquakes, they happen and power can go out for weeks (in the first world) or longer (in most of the world). With today's connected world, all it takes is for a network switch to go out and hundreds of thousands of commuters get stuck in the downtown during rush hour because the commuter trains have no failsafe while freight trains keep trundling on the same tracks because they do [0]. Making backups is not a failsafe and it's not good enough. [0] ttps://www.cbc.ca/news/canada/toronto/go-transit-system-problem-1.6985282