4 ms·

This might be a good time for folks to go back and watch the first episode of James Burke's Connections: The Trigger Effect https://www.youtube.com/watch?v=NcO

This might be a good time for folks to go back and watch the first episode of James Burke's Connections: The Trigger Effect https://www.youtube.com/watch?v=NcOb3Dilzjc https://www.youtube.com/watch?v=NcOb3Dilzjc Interconnected systems can fail spectacularly in unforeseen ways. Strange that something so obvious is so often dismissed or overlooked.

rincebrain 2y ago
If you realize something horrific, your options are to decide it's not your problem (and feel guilty when it blows up), carefully forget you learned it, or try to do something to get it changed. Since the last of these involves overcoming everyone else's shared distress in admitting the emperor has no clothes, and the first of these involves a lot of distress for you personally, a lot of people opt for option B.
- HPsquared 2y ago
  Option C is to quietly distance yourself from it.
- __MatrixMan__ 2y ago
  > overcoming everyone else's shared distress in admitting the emperor has no clothes I don't disagree, but why do we do we react this way? Doesn't knowing the emperor has no clothes instill a bit of hope that things can change? I feel for the people who were impacted by this, but I'm also a little bit excited. Like... NOW can we fix it? Please?
  - AmpsterMan 2y ago
    Going off of that framework: Because doing three requires convincing a bunch of people that are currently doing number two, to do number one instead.
  - johnklos 2y ago
    It's a nice idea, but has that worked historically? Some people will make changes, but I think we'd be naive to think that things will change in any large and meaningful way. Having another I-told-you-so isn't so bad, though - it does give us IT people a little more latitude when we tell people that buying the insecurity fix du jour increases work and adds more problems than it addresses.
    - __MatrixMan__ 2y ago
      Sure, on long enough timescales. I mean, there's less lead in the environment than there used to be. We don't practice blood letting anymore. Things change. Eventually enough will be enough and we'll start using systems that are transparent about what their inputs are and have a way of operating in cases where the user disables one of those inputs because it's causing problems (e.g. crowdstrike updates). I'd just like it to be soon because I'm interested in building such systems and I'd rather be paid to do so instead of doing it on my off time.
      - Bluestein 2y ago
        > We don't practice blood letting anymore. Things change Gonna make me a Tshirt outta this :)
  - rincebrain 2y ago
    The problem is, making noise incurs risk. The higher up in large organizations you go, in politics or employment or w/e, the more what matters is not facts, but avoiding being visibly seen to have made a mistake, so you become risk-averse, and just ride the status quo unless it's an existential threat to you or something you can capitalize on for someone else's misjudgment. So if you can't directly gain from pointing out the emperor's missing clothes, there's no incentive to call it out, there's active risk to calling it out if other people won't agree, and moreover, this provides an active incentive for those with political capital in the organization to suppress the embarrassment of anyone pointing out they did not admit the problem everyone knew was there. (This is basically how you get the "actively suppress any exceptions to people collectively treating something as a missing stair" behaviors.)
    - galangalalgol 2y ago
      I've not seen that at my fortune 100. I found other's willing to agree and we walked it up to the most senior evp in the corporation. Got face time andbwe weren't punished. Just, nothing changed. Some of the directors that helped walk it up the chain eventually became more powerful and the suggested actions took place about 15 years later.
      - rincebrain 2y ago
        Sure, I've certainly seen exceptions, and valued them a lot. But often, at least in my experience, exceptions are limited in scope to whatever part of the org chart the person who is the exception is in charge of, and then that still governs everything outside of that box...
    - Bluestein 2y ago
      And, another problem, if I may: This, too will be soon forgotten. Our "attention cycle" is too short.- (Look all the recent, severe supply chain attacks by state actors, and how soon they have been displaced off-focus ...)
    - __MatrixMan__ 2y ago
      So if we want our technology to be more reliable, we need to make its current unreliability into an existential threat to certain people? I mean, it already is to some people, as shown elsewhere in this thread. Seems like it's the wrong people though.
- yawnxyz 2y ago
  there are way too many horrific things in the world to learn about... and then realizing you can't do something about every of those things. But at least you can tackle one of them! (In my case, antibiotic resistance)
fsloth 2y ago
Crowdstrike though is not part of a system of engineered design. It’s a half-baked rootkit sold as a figleaf for incompetent it managers so they can implement ”best practices” in their companys PC:s. The people purchasing it don’t actually know what it does, they just know it’s something they can invest their cybersecurity budget into and have an easy way to fullfill their ”implement cybersecurity” kpi:s without needing to do anything themselves.
- lawlessone 2y ago
  >they just know it’s something they can invest their cybersecurity budget into and have an easy way to fullfill their ”implement cybersecurity” kpi:s To be fair. This is what companies like Crowdstrike are selling to these managers. Emphasis on the world "SELLING"
  - fsloth 2y ago
    Exactly.
  - 015a 2y ago
    Exactly, and this is why I've heard the take that the companies who integrate this software need to be held responsible by not having proper redundancy, and while its a fine take, we need to keep absolutely assailing blame at Crowdstrike and even Microsoft. They're the companies that drum the beat of war every chance they get, scaring otherwise reasonable people into thinking that the Cyberworld is ending and only their software can save them, who push stupid compliance and security frameworks, and straight-up lie to their prospects about the capabilities and stability of their product. Microsoft sets the absolutely dog water standard of "you get updates, you cant turn them off, you can't stagger them, you can't delay them, you get no control, fuck you".
- bryant 2y ago
  This is an interesting response. I'm curious why you specifically believe "it’s a half-baked rootkit sold as a figleaf for incompetent it managers."
Bluestein 2y ago
Again, as I feel I must every time Connections is mentioned: That series is an unmitigated masterpiece. It really is ...
cchance 2y ago
My issue is WTF do sooooooo many companies trust this 1 fucking company lol, like its always some obscure company that every major corporation is trusting lol. All because crowdstrike apparently throws good parties for C-Level execs lol
keeganpoppen 2y ago
Nassim Taleb is having a good day
eviks 2y ago
Except this is not that, good and known practices exist against these kind of fails, and are used by others.

rincebrain 2y ago

If you realize something horrific, your options are to decide it's not your problem (and feel guilty when it blows up), carefully forget you learned it, or try to do something to get it changed. Since the last of these involves overcoming everyone else's shared distress in admitting the emperor has no clothes, and the first of these involves a lot of distress for you personally, a lot of people opt for option B.

HPsquared 2y ago
Option C is to quietly distance yourself from it.
__MatrixMan__ 2y ago
> overcoming everyone else's shared distress in admitting the emperor has no clothes I don't disagree, but why do we do we react this way? Doesn't knowing the emperor has no clothes instill a bit of hope that things can change? I feel for the people who were impacted by this, but I'm also a little bit excited. Like... NOW can we fix it? Please?
- AmpsterMan 2y ago
  Going off of that framework: Because doing three requires convincing a bunch of people that are currently doing number two, to do number one instead.
- johnklos 2y ago
  It's a nice idea, but has that worked historically? Some people will make changes, but I think we'd be naive to think that things will change in any large and meaningful way. Having another I-told-you-so isn't so bad, though - it does give us IT people a little more latitude when we tell people that buying the insecurity fix du jour increases work and adds more problems than it addresses.
  - __MatrixMan__ 2y ago
    Sure, on long enough timescales. I mean, there's less lead in the environment than there used to be. We don't practice blood letting anymore. Things change. Eventually enough will be enough and we'll start using systems that are transparent about what their inputs are and have a way of operating in cases where the user disables one of those inputs because it's causing problems (e.g. crowdstrike updates). I'd just like it to be soon because I'm interested in building such systems and I'd rather be paid to do so instead of doing it on my off time.
    - Bluestein 2y ago
      > We don't practice blood letting anymore. Things change Gonna make me a Tshirt outta this :)
- rincebrain 2y ago
  The problem is, making noise incurs risk. The higher up in large organizations you go, in politics or employment or w/e, the more what matters is not facts, but avoiding being visibly seen to have made a mistake, so you become risk-averse, and just ride the status quo unless it's an existential threat to you or something you can capitalize on for someone else's misjudgment. So if you can't directly gain from pointing out the emperor's missing clothes, there's no incentive to call it out, there's active risk to calling it out if other people won't agree, and moreover, this provides an active incentive for those with political capital in the organization to suppress the embarrassment of anyone pointing out they did not admit the problem everyone knew was there. (This is basically how you get the "actively suppress any exceptions to people collectively treating something as a missing stair" behaviors.)
  - galangalalgol 2y ago
    I've not seen that at my fortune 100. I found other's willing to agree and we walked it up to the most senior evp in the corporation. Got face time andbwe weren't punished. Just, nothing changed. Some of the directors that helped walk it up the chain eventually became more powerful and the suggested actions took place about 15 years later.
    - rincebrain 2y ago
      Sure, I've certainly seen exceptions, and valued them a lot. But often, at least in my experience, exceptions are limited in scope to whatever part of the org chart the person who is the exception is in charge of, and then that still governs everything outside of that box...
  - Bluestein 2y ago
    And, another problem, if I may: This, too will be soon forgotten. Our "attention cycle" is too short.- (Look all the recent, severe supply chain attacks by state actors, and how soon they have been displaced off-focus ...)
  - __MatrixMan__ 2y ago
    So if we want our technology to be more reliable, we need to make its current unreliability into an existential threat to certain people? I mean, it already is to some people, as shown elsewhere in this thread. Seems like it's the wrong people though.
yawnxyz 2y ago
there are way too many horrific things in the world to learn about... and then realizing you can't do something about every of those things. But at least you can tackle one of them! (In my case, antibiotic resistance)

fsloth 2y ago

Crowdstrike though is not part of a system of engineered design. It’s a half-baked rootkit sold as a figleaf for incompetent it managers so they can implement ”best practices” in their companys PC:s. The people purchasing it don’t actually know what it does, they just know it’s something they can invest their cybersecurity budget into and have an easy way to fullfill their ”implement cybersecurity” kpi:s without needing to do anything themselves.

lawlessone 2y ago
>they just know it’s something they can invest their cybersecurity budget into and have an easy way to fullfill their ”implement cybersecurity” kpi:s To be fair. This is what companies like Crowdstrike are selling to these managers. Emphasis on the world "SELLING"
- fsloth 2y ago
  Exactly.
- 015a 2y ago
  Exactly, and this is why I've heard the take that the companies who integrate this software need to be held responsible by not having proper redundancy, and while its a fine take, we need to keep absolutely assailing blame at Crowdstrike and even Microsoft. They're the companies that drum the beat of war every chance they get, scaring otherwise reasonable people into thinking that the Cyberworld is ending and only their software can save them, who push stupid compliance and security frameworks, and straight-up lie to their prospects about the capabilities and stability of their product. Microsoft sets the absolutely dog water standard of "you get updates, you cant turn them off, you can't stagger them, you can't delay them, you get no control, fuck you".
bryant 2y ago
This is an interesting response. I'm curious why you specifically believe "it’s a half-baked rootkit sold as a figleaf for incompetent it managers."

Bluestein 2y ago

Again, as I feel I must every time Connections is mentioned: That series is an unmitigated masterpiece. It really is ...

cchance 2y ago

My issue is WTF do sooooooo many companies trust this 1 fucking company lol, like its always some obscure company that every major corporation is trusting lol. All because crowdstrike apparently throws good parties for C-Level execs lol

keeganpoppen 2y ago

Nassim Taleb is having a good day

eviks 2y ago

Except this is not that, good and known practices exist against these kind of fails, and are used by others.