6 ms·

Financial losses? The comment you're replying to is mentioning heart attack treatment here. We're talking about deaths. Most of us won't like to hear this but f

by maeil 2y ago

Financial losses? The comment you're replying to is mentioning heart attack treatment here. We're talking about deaths. Most of us won't like to hear this but for all of us who work at SaaS that is deployed on servers around the worlds, our bugs cause people to die. It's a given that at least a dozen people will die directly (medical flights, hospitals both being hit) due to this broken update, let alone indirectly.

frereubu 2y ago
I don't think the parent comment was ignoring that. The penalty for a company who does this can't be to bring someone back from the dead, it's likely to be financial, which is the aspect they're talking about.
- maeil 2y ago
  [flagged]
  - kadoban 2y ago
    Good. That's the HN way.
  - stavros 2y ago
    That's how I read it, ie "will there be severe fines for the loss of life and other losses for this?".
    - deleted 2y ago
      [deleted]
  - SirGiggles 2y ago
    As others have already stated, yes, that is how we should be interpreting comments, in good faith and in the most charitable way as the site guidelines suggests us to.
  - cqqxo4zV46cp 2y ago
    You’re basically asking for a virtue signalling disclaimer. I think you’d prefer a different social network.
    - Clubber 2y ago
      I've finally learned to spot and ignore all emotional arguments. https://www.scribbr.com/fallacies/appeal-to-emotion https://www.scribbr.com/fallacies/appeal-to-emotion
- covercash 2y ago
  If this was a Japanese company, the entire c-suite would have committed seppuku by now.
bugbuddy 2y ago
We must demand both financial and criminal liabilities against the perpetrators! Get the torches and pitchforks out! We need to teach them a lesson!
- maeil 2y ago
  I did not mean to imply this, as there's a very long culpability chain. For this reason, I'm not sure if it makes any sense to imprison individuals for this. A lot of people playing a part in this causing such chaos. But it is something to be very aware of for those of us who develop software run in e.g. hospitals and airlines, and should receive more attention, instead of only bringing up financial losses which is what usually happens. I noticed the same with the big ransomware attacks.
- pjmlp 2y ago
  Indeed, pity that we need major failures like these, for goverments to finally start paying attention to give the same kind of laws as anything else, instead of careless EULAs and updates without field testing.
  - consteval 2y ago
    It's very bizarre to me how normalized we have made kernel-level software in critical systems. This software is inherently risky but companies throw it around like it's nothing. And cherry on top, we let it auto-update too. I'm surprised critical failures like this don't happen more often.
- InsideOutSanta 2y ago
  I can't tell if you're serious or sarcastic, but there is such a thing as criminal negligence. CrowdStrike knows that their software runs on computers that are in fricken hospitals and airports, they know that a mistake can potentially cause a human death. They also know how to properly test software, and they know how to do staggered releases. Given what we know now, it seems pretty likely that to any reasonable person, the amount of risk they took when deploying changes to clients was in no way reasonable. People absolutely should go to jail for this.
immibis 2y ago
Since we live in a capitalism, financial losses are the only one anyone cares about at scale. What's a human life worth nowadays? About 10 million for a healthy prime age adult? Negative for elderly?
- alexisread 2y ago
  I think it depends what passport etc. you hold... One dystopian take is the trolley problem, where the self-driving car in question uses smartphones to determine the identity of the people involved, to work out who is cheaper to kill.
  - ben_w 2y ago
    That reminds me of why McDonalds got such a high penalty in the court case everyone remembers as "person sues for spilling hot coffee on themselves". The reason this reminds me of that, assuming that I remember right, is that I think they had even taken the decision that the cost of paying lawsuits for those injuries was lower than the increase in revenue for being able to say "we have the hottest coffee"… and that was why they were deemed so severely liable. They were definitely shown to have known it was resulting in injuries from other settlements: https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restaurants https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restau...
- gpvos 2y ago
  Not true. Making C-level executives of software companies criminally liable with the chance to go to jail did change their behaviour in some recent lawmaking situation (forgot which, sorry).
HenryBemis 2y ago
I made a separate (longer) comment about this.. Why don't orgs test their updates? Every decent IT management/governance under the sun demands that you test your updates. How the hell did so many orgs that are ISO 2700x, COBIT, PCI-DSS, NIST CSF, etc. certified failed so hard?? (ToS/contracts will probably get you out of any damages.)
- inkyoto 2y ago
  > Why don't orgs test their updates? Because historically orgs have been really bad with applying updates: either no updates or delayed updates resulting in botnets taking over unpatched PC's. Microsoft's solution was to force the updates unconditionally upon everybody with very few opportunities to opt out (for large enterprise customers only). Another complication comes from the fact that operating system updates are not essential for running a business and especially for small businesses – as long as the main business app runs, the business runs. And most businesses are too far removed from IT to even know what a update is and why it is important. Hence the dilemma of fully automated vs manually applied and tested updates.
  - vetinari 2y ago
    > Microsoft's solution was to force the updates unconditionally upon everybody with very few opportunities to opt out (for large enterprise customers only). Not a Microsoft's fan, but this is not true. Everyone who has Windows Server somewhere, with some spare disk space for the updates, has this ability. Just install and run WSUS (included in Windows Server) and you can accept/reject/hold indefinitely any update you want.
    - inkyoto 2y ago
      Not disagreeing, however: 1) the prevailing majority of laptop and desktop PC installations (home, business and enterprise) are not Windows Server; 2) kiosk style installs (POS terminals, airport check-in stands etc) are fully managed, unsupervised installations (the ones that ground to a complete halt today) and do not offer any sort of user interaction by design; 3) most Windows Server installations are also unsupervised.
LinXitoW 2y ago
If companies want the nice parts of being "a person", they should also deal with the bad parts of being a person. Financial fines are not enough. Though I'm not sure how we'd build a jail cell for an entire company.
- RobotToaster 2y ago
  The death penalty could be an option? Dissolve the company, seize their assets, bar anyone involved from ever running or owning a company again.
  - bryant 2y ago
    Should be, but I don't know that that's appropriate for involuntary manslaughter. Do it to Boeing, sure.
- deleted 2y ago
  [deleted]
- luizcdc 2y ago
  Fines are not enough because a large enough fine will kill a company, destroying lots of jobs and supply chains. Why not dilute the shareholder pool by a serious amount? There's no need for a statization to formally happen, the government can sell the shares back over time without actually exercising control. Also fire execs and ban them from holding office on publicly traded companies for the foreseeable future. Seizing shares doesn't impact the cash flow of the company directly, thus shouldn't cause job losses, but shareholders (who should put pressure on executives and the board to act with prudence to avoid these kinds of disasters) are adequately punished.
  - Izkata 2y ago
    > Fines are not enough because a large enough fine will kill a company, destroying lots of jobs and supply chains. That could be amazing: "Ooopsie, in punishing Crowdstrike they've ended up folding and now there's a second global outage."
  - 2y ago
SapuroAshjey 2y ago
[dead]

by maeil 2y ago

frereubu 2y ago

I don't think the parent comment was ignoring that. The penalty for a company who does this can't be to bring someone back from the dead, it's likely to be financial, which is the aspect they're talking about.

maeil 2y ago
[flagged]
- kadoban 2y ago
  Good. That's the HN way.
- stavros 2y ago
  That's how I read it, ie "will there be severe fines for the loss of life and other losses for this?".
  - deleted 2y ago
    [deleted]
- SirGiggles 2y ago
  As others have already stated, yes, that is how we should be interpreting comments, in good faith and in the most charitable way as the site guidelines suggests us to.
- cqqxo4zV46cp 2y ago
  You’re basically asking for a virtue signalling disclaimer. I think you’d prefer a different social network.
  - Clubber 2y ago
    I've finally learned to spot and ignore all emotional arguments. https://www.scribbr.com/fallacies/appeal-to-emotion https://www.scribbr.com/fallacies/appeal-to-emotion
covercash 2y ago
If this was a Japanese company, the entire c-suite would have committed seppuku by now.

bugbuddy 2y ago

We must demand both financial and criminal liabilities against the perpetrators! Get the torches and pitchforks out! We need to teach them a lesson!

maeil 2y ago
I did not mean to imply this, as there's a very long culpability chain. For this reason, I'm not sure if it makes any sense to imprison individuals for this. A lot of people playing a part in this causing such chaos. But it is something to be very aware of for those of us who develop software run in e.g. hospitals and airlines, and should receive more attention, instead of only bringing up financial losses which is what usually happens. I noticed the same with the big ransomware attacks.
pjmlp 2y ago
Indeed, pity that we need major failures like these, for goverments to finally start paying attention to give the same kind of laws as anything else, instead of careless EULAs and updates without field testing.
- consteval 2y ago
  It's very bizarre to me how normalized we have made kernel-level software in critical systems. This software is inherently risky but companies throw it around like it's nothing. And cherry on top, we let it auto-update too. I'm surprised critical failures like this don't happen more often.
InsideOutSanta 2y ago
I can't tell if you're serious or sarcastic, but there is such a thing as criminal negligence. CrowdStrike knows that their software runs on computers that are in fricken hospitals and airports, they know that a mistake can potentially cause a human death. They also know how to properly test software, and they know how to do staggered releases. Given what we know now, it seems pretty likely that to any reasonable person, the amount of risk they took when deploying changes to clients was in no way reasonable. People absolutely should go to jail for this.

immibis 2y ago

Since we live in a capitalism, financial losses are the only one anyone cares about at scale. What's a human life worth nowadays? About 10 million for a healthy prime age adult? Negative for elderly?

alexisread 2y ago
I think it depends what passport etc. you hold... One dystopian take is the trolley problem, where the self-driving car in question uses smartphones to determine the identity of the people involved, to work out who is cheaper to kill.
- ben_w 2y ago
  That reminds me of why McDonalds got such a high penalty in the court case everyone remembers as "person sues for spilling hot coffee on themselves". The reason this reminds me of that, assuming that I remember right, is that I think they had even taken the decision that the cost of paying lawsuits for those injuries was lower than the increase in revenue for being able to say "we have the hottest coffee"… and that was why they were deemed so severely liable. They were definitely shown to have known it was resulting in injuries from other settlements: https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restaurants https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restau...
gpvos 2y ago
Not true. Making C-level executives of software companies criminally liable with the chance to go to jail did change their behaviour in some recent lawmaking situation (forgot which, sorry).

HenryBemis 2y ago

I made a separate (longer) comment about this.. Why don't orgs test their updates? Every decent IT management/governance under the sun demands that you test your updates. How the hell did so many orgs that are ISO 2700x, COBIT, PCI-DSS, NIST CSF, etc. certified failed so hard?? (ToS/contracts will probably get you out of any damages.)

inkyoto 2y ago
> Why don't orgs test their updates? Because historically orgs have been really bad with applying updates: either no updates or delayed updates resulting in botnets taking over unpatched PC's. Microsoft's solution was to force the updates unconditionally upon everybody with very few opportunities to opt out (for large enterprise customers only). Another complication comes from the fact that operating system updates are not essential for running a business and especially for small businesses – as long as the main business app runs, the business runs. And most businesses are too far removed from IT to even know what a update is and why it is important. Hence the dilemma of fully automated vs manually applied and tested updates.
- vetinari 2y ago
  > Microsoft's solution was to force the updates unconditionally upon everybody with very few opportunities to opt out (for large enterprise customers only). Not a Microsoft's fan, but this is not true. Everyone who has Windows Server somewhere, with some spare disk space for the updates, has this ability. Just install and run WSUS (included in Windows Server) and you can accept/reject/hold indefinitely any update you want.
  - inkyoto 2y ago
    Not disagreeing, however: 1) the prevailing majority of laptop and desktop PC installations (home, business and enterprise) are not Windows Server; 2) kiosk style installs (POS terminals, airport check-in stands etc) are fully managed, unsupervised installations (the ones that ground to a complete halt today) and do not offer any sort of user interaction by design; 3) most Windows Server installations are also unsupervised.

LinXitoW 2y ago

If companies want the nice parts of being "a person", they should also deal with the bad parts of being a person. Financial fines are not enough. Though I'm not sure how we'd build a jail cell for an entire company.

RobotToaster 2y ago
The death penalty could be an option? Dissolve the company, seize their assets, bar anyone involved from ever running or owning a company again.
- bryant 2y ago
  Should be, but I don't know that that's appropriate for involuntary manslaughter. Do it to Boeing, sure.
deleted 2y ago
[deleted]
luizcdc 2y ago
Fines are not enough because a large enough fine will kill a company, destroying lots of jobs and supply chains. Why not dilute the shareholder pool by a serious amount? There's no need for a statization to formally happen, the government can sell the shares back over time without actually exercising control. Also fire execs and ban them from holding office on publicly traded companies for the foreseeable future. Seizing shares doesn't impact the cash flow of the company directly, thus shouldn't cause job losses, but shareholders (who should put pressure on executives and the board to act with prudence to avoid these kinds of disasters) are adequately punished.
- Izkata 2y ago
  > Fines are not enough because a large enough fine will kill a company, destroying lots of jobs and supply chains. That could be amazing: "Ooopsie, in punishing Crowdstrike they've ended up folding and now there's a second global outage."
- 2y ago

SapuroAshjey 2y ago

[dead]