5 ms·

This is the wrong response, because that means that the learning would be lost. The security community didn't want that to happen when one of the CA's got a vul

This is the wrong response, because that means that the learning would be lost. The security community didn't want that to happen when one of the CA's got a vulnerability, we do not want it to happen to other companies. We want companies to succeed and get better, being shameful doesn't help towards that. Learning the right lessons does, and resigning means that you are learning the wrong ones.

TZubiri 2y ago
I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.
- otterley 2y ago
  Under what theory of psychology are you operating? This is along the same lines as the theory that punishment is an effective deterrent of crime, which we know isn’t true from experience.
  - slibhb 2y ago
    While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does!
    - AdieuToLogic 2y ago
      > While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does! Punishment does not deter crime. The threat of punishment does to a degree. IOW, most people will be unaware of a person being sent to prison for years until and unless they have committed a similar offense. But everyone is aware of repercussions possible should they violate known criminal laws.
      - TZubiri 2y ago
        My grandmother used to say that arguing about an idea is the ultimate concession. If the topic becomes questioning century old traditions like jails, taxes, or war, like we're about to revolutionaze humankind, I'm out.
    - mirashii 2y ago
      The overwhelming majority of evidence suggests otherwise. https://www.psychologytoday.com/us/blog/crime-and-punishment/201804/why-punishment-doesnt-reduce-crime https://www.psychologytoday.com/us/blog/crime-and-punishment... https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-punishments-deter-crime https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-pun... https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.helsinki.fi/en/news/economics/do-harsh-punishments-deter-crime-research-sheds-light-question https://www.helsinki.fi/en/news/economics/do-harsh-punishmen...
      - TZubiri 2y ago
        When I was younger I used to be much more influentiable, now you just can't change my mind, I made it up for good thank you. And it pays off in cases like this, I'll be talking with someone about a topic like the seriousness of a vulnerability, they disagree, that's fine no need to convince me, you won't. And then it turns out they're left-leaning abolitionists who are against the idea of jails. Many such cases, on the other hand I'll be disagreeing with someone on business strategy, and two lines later they reveal that they think taxation is theft. I can rest easy and ignore them.
        otterley 2y ago
        > now you just can't change my mind, I made it up for good thank you Respectfully, that’s not a very “hacker” way of seeing the world. Hackers learn from their mistakes and adapt. (Just like this software company is doing.)
  - TZubiri 2y ago
    "jails don't work and we shouldn't have jails" Got it
    - otterley 2y ago
      I think you’re misunderstanding my point. The reality is more complicated than that. There are some people who will be discouraged from committing a crime over threat of punishment. But many will not. Many people behave well because they’re just moral people, and others won’t because they’re just selfish and antisocial. Still others commit crimes out of desperation despite the risks. If the threat of imprisonment were effective, there would be no crime, because we already have prisons and penalties of punishment. But since we do have crime, it logically follows that it’s not effective. The other point here is that threat of punishment is not particularly effective as a management strategy in the private sector. It doesn’t incentivize behavior in the manner you might believe. Mostly it makes your reports dislike you and it makes them less productive. It’s a thing you learn pretty quickly as a manager. There’s a model of a person being a rational thinker, but in reality, people aren’t always rational. (Hell, adolescents are biologically programmed not to be rational and to stress test the limits of nature and society.) You find success in making less-than-rational people work together in harmony and achieve positive outcomes.
- matkoniecz 2y ago
  > However if a dev who gets caught doing a bad is forced to resign. then nearly everyone involved has incentive to coverup problem or to shift blame
- mirashii 2y ago
  I suggest reading one or two of Sydney Dekker’s books, which are a pretty comprehensive takedown of this idea. If an organization punishes mistakes, mistakes get hidden, covered up, and no less frequent.
  - jerry1979 2y ago
    Is it Dekker? https://www.goodreads.com/book/show/578243.Field_Guide_to_Human_Error_Investigations https://www.goodreads.com/book/show/578243.Field_Guide_to_Hu...
    - mirashii 2y ago
      Sure is, autocorrect got me.
- phantomathkg 2y ago
  Can you back up your theory with the example of all the mistakes you have committed and force resigned taken?
  - TZubiri 2y ago
    I won't publicly list them. But yes, I can recount them mentally and I can confirm I learned from them.
- sky2224 2y ago
  > If you get a slap on the wrist, do you learn? No, you play it down. Except Dave didn't play it down. He's literally taking responsibility for a situation that could have resulted in significantly worse consequences. Instead of saying, "nothing bad happened, let's move on," he, and by extension his company, have worked to remedy the issue, do a write up on it, disclose of the issue and its impact to users, and publicly apologize and hold themselves accountable. That right there is textbook engineering ethics 101 being followed.
  - TZubiri 2y ago
    > "we've fundamentally restructured our security practices to ensure this scenario can't recur." "Yeah it was a problem but it's fixed now, won't happen again" Sure buddy. It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned. It's like a skyscraper built with hay that had a close call with some strong northern winds, and they come out and say, we have fortified the northern wall, all is good now. You gotta take it down and build it with brick my man. I'm done warning people about security, we'll fight it out in the industry, I hope we bankrupt you.
    - sky2224 2y ago
      > It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned. That's the last thing you should ever do within a large scale software system. The idea that restarting from scratch because "oh we'll do it better again" is the kind of thing that bankrupts companies. Plenty of seasoned engineers will tell you this. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
      - TZubiri 2y ago
        I'm aware of that article. I'm saying file bankruptcy for the company, so yeah tear it down, it doesn't need to exist if it can get pwned.
- moq4 2y ago
  this is probably one of the worst takes i've ever read on here

TZubiri 2y ago

I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

otterley 2y ago
Under what theory of psychology are you operating? This is along the same lines as the theory that punishment is an effective deterrent of crime, which we know isn’t true from experience.
- slibhb 2y ago
  While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does!
  - AdieuToLogic 2y ago
    > While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does! Punishment does not deter crime. The threat of punishment does to a degree. IOW, most people will be unaware of a person being sent to prison for years until and unless they have committed a similar offense. But everyone is aware of repercussions possible should they violate known criminal laws.
    - TZubiri 2y ago
      My grandmother used to say that arguing about an idea is the ultimate concession. If the topic becomes questioning century old traditions like jails, taxes, or war, like we're about to revolutionaze humankind, I'm out.
  - mirashii 2y ago
    The overwhelming majority of evidence suggests otherwise. https://www.psychologytoday.com/us/blog/crime-and-punishment/201804/why-punishment-doesnt-reduce-crime https://www.psychologytoday.com/us/blog/crime-and-punishment... https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-punishments-deter-crime https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-pun... https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.helsinki.fi/en/news/economics/do-harsh-punishments-deter-crime-research-sheds-light-question https://www.helsinki.fi/en/news/economics/do-harsh-punishmen...
    - TZubiri 2y ago
      When I was younger I used to be much more influentiable, now you just can't change my mind, I made it up for good thank you. And it pays off in cases like this, I'll be talking with someone about a topic like the seriousness of a vulnerability, they disagree, that's fine no need to convince me, you won't. And then it turns out they're left-leaning abolitionists who are against the idea of jails. Many such cases, on the other hand I'll be disagreeing with someone on business strategy, and two lines later they reveal that they think taxation is theft. I can rest easy and ignore them.
      - otterley 2y ago
        > now you just can't change my mind, I made it up for good thank you Respectfully, that’s not a very “hacker” way of seeing the world. Hackers learn from their mistakes and adapt. (Just like this software company is doing.)
- TZubiri 2y ago
  "jails don't work and we shouldn't have jails" Got it
  - otterley 2y ago
    I think you’re misunderstanding my point. The reality is more complicated than that. There are some people who will be discouraged from committing a crime over threat of punishment. But many will not. Many people behave well because they’re just moral people, and others won’t because they’re just selfish and antisocial. Still others commit crimes out of desperation despite the risks. If the threat of imprisonment were effective, there would be no crime, because we already have prisons and penalties of punishment. But since we do have crime, it logically follows that it’s not effective. The other point here is that threat of punishment is not particularly effective as a management strategy in the private sector. It doesn’t incentivize behavior in the manner you might believe. Mostly it makes your reports dislike you and it makes them less productive. It’s a thing you learn pretty quickly as a manager. There’s a model of a person being a rational thinker, but in reality, people aren’t always rational. (Hell, adolescents are biologically programmed not to be rational and to stress test the limits of nature and society.) You find success in making less-than-rational people work together in harmony and achieve positive outcomes.
matkoniecz 2y ago
> However if a dev who gets caught doing a bad is forced to resign. then nearly everyone involved has incentive to coverup problem or to shift blame
mirashii 2y ago
I suggest reading one or two of Sydney Dekker’s books, which are a pretty comprehensive takedown of this idea. If an organization punishes mistakes, mistakes get hidden, covered up, and no less frequent.
- jerry1979 2y ago
  Is it Dekker? https://www.goodreads.com/book/show/578243.Field_Guide_to_Human_Error_Investigations https://www.goodreads.com/book/show/578243.Field_Guide_to_Hu...
  - mirashii 2y ago
    Sure is, autocorrect got me.
phantomathkg 2y ago
Can you back up your theory with the example of all the mistakes you have committed and force resigned taken?
- TZubiri 2y ago
  I won't publicly list them. But yes, I can recount them mentally and I can confirm I learned from them.
sky2224 2y ago
> If you get a slap on the wrist, do you learn? No, you play it down. Except Dave didn't play it down. He's literally taking responsibility for a situation that could have resulted in significantly worse consequences. Instead of saying, "nothing bad happened, let's move on," he, and by extension his company, have worked to remedy the issue, do a write up on it, disclose of the issue and its impact to users, and publicly apologize and hold themselves accountable. That right there is textbook engineering ethics 101 being followed.
- TZubiri 2y ago
  > "we've fundamentally restructured our security practices to ensure this scenario can't recur." "Yeah it was a problem but it's fixed now, won't happen again" Sure buddy. It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned. It's like a skyscraper built with hay that had a close call with some strong northern winds, and they come out and say, we have fortified the northern wall, all is good now. You gotta take it down and build it with brick my man. I'm done warning people about security, we'll fight it out in the industry, I hope we bankrupt you.
  - sky2224 2y ago
    > It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned. That's the last thing you should ever do within a large scale software system. The idea that restarting from scratch because "oh we'll do it better again" is the kind of thing that bankrupts companies. Plenty of seasoned engineers will tell you this. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
    - TZubiri 2y ago
      I'm aware of that article. I'm saying file bankruptcy for the company, so yeah tear it down, it doesn't need to exist if it can get pwned.
moq4 2y ago
this is probably one of the worst takes i've ever read on here