3 ms·

I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script. Fwiw -

I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script. Fwiw -- and I know there are plenty of googlers here -- the OMG isn't locked down and it was legitimately a unique bug. I appreciate the forensic analysis of public statements that the author of this post strung together, but it doesn't really advance the conversation.

anytime5704 2y ago
I want to know! Used to work on GCE, but as the article mentioned, there are a lot of safeguards built in over there to prevent you from accidentally deleting things and account wipeout has a grace period to prevent a lapse in billing from deleting anything.
simonw 2y ago
It matters because if it was a customer error I would want to know what the error was in order to better avoid it myself.
- eitally 2y ago
  Per Google, it wasn't a customer error -- it was a bug, that has subsequently been patched.
  - fizlebit 2y ago
    How many other classes of such bugs exist. Without a public COE one can't know that it was systemically fixed. One can't know whether security boundaries were by-passed by the bug. One can't know what sorts of extra protections are introduced for this type of systemic error. So what confidence would you have in the product with no public explanation -- are you saying, oh they're google, I'm sure they're doing the right thing.
    - eitally 2y ago
      Yes (in this kind of case). I wouldn't be so trustworthy across the board.
advisedwang 2y ago
There is value even if it is a "legitimately a unique bug" in demonstrating to customers that it truly was a unique bug. It's not unreasonable to be skeptical of such a claim.
aaron695 2y ago
[dead]
ghusto 2y ago
> I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script. It could be valuable in the sense that scenario 2 has me shrugging my shoulders, but scenario 1 goes on the ever growing list of "reasons to avoid Google _anything_".

anytime5704 2y ago

I want to know! Used to work on GCE, but as the article mentioned, there are a lot of safeguards built in over there to prevent you from accidentally deleting things and account wipeout has a grace period to prevent a lapse in billing from deleting anything.

simonw 2y ago

It matters because if it was a customer error I would want to know what the error was in order to better avoid it myself.

eitally 2y ago
Per Google, it wasn't a customer error -- it was a bug, that has subsequently been patched.
- fizlebit 2y ago
  How many other classes of such bugs exist. Without a public COE one can't know that it was systemically fixed. One can't know whether security boundaries were by-passed by the bug. One can't know what sorts of extra protections are introduced for this type of systemic error. So what confidence would you have in the product with no public explanation -- are you saying, oh they're google, I'm sure they're doing the right thing.
  - eitally 2y ago
    Yes (in this kind of case). I wouldn't be so trustworthy across the board.

advisedwang 2y ago

There is value even if it is a "legitimately a unique bug" in demonstrating to customers that it truly was a unique bug. It's not unreasonable to be skeptical of such a claim.

aaron695 2y ago

[dead]

ghusto 2y ago

> I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script. It could be valuable in the sense that scenario 2 has me shrugging my shoulders, but scenario 1 goes on the ever growing list of "reasons to avoid Google _anything_".