Hacker News Reader

Comment by el_duderino | Hacker News Reader

Microsoft released further details in its own blog post: https://msrc-blog.microsoft.com/2020/01/22/access-misconfigu...

View on HN

"Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were not enabled for this database."

They need a solution to watch their solution that watches their configs.

I bet the threat of prison would tune up their attitude. There's no reason that these "misconfigurations" shouldn't be felonies.

There's a massive reason these misconfigurations shouldn't be felonies. Since such errors are so hard to avoid (no company has perfect practice), few sane people would be willing to work in any role that involved taking such responsibility, so a bunch of services would suddenly cease to exist, and the economic cost from the loss of those services could well be way greater than the cost from the occasional breach (which I've as of yet never seen anyone here try to quantify).

How does it work in construction of buildings? If it got built with a misconfiguration in a safety critical part.

Or maybe it ought to be modelled after medical malpractice? If a doctor fumbles and messes you up.

People work in those roles all the time, do you say "well nobody has perfect practice" when a doctor leaves a thermometer in your child's skull after surgery?

There are malpractice regimes all over the place, it just results in having real training and an assessment of risks and, y'know, not cowboy'ing, before making changes. "What difference does it make that this girder is 1/2" out of alignment? Nobody's perfect."

For who though? I would hate to see the blame placed on some low-level database engineer. And there's no way you could blame the executives.

How about fining the company? Wouldn't that do the job of enforcing more careful policies?

How do you make sure the repercussions will fall on the right people?

What tells you they wont just layoff some random people to save some money to pay for the fine?

The problem with companies is you can always shift the blame on someone, on some department, etc...

In the end, the people that made the shitty decisions are rarely held accountable for the mistakes.

Sure but laying off random people isn't free to the corporation either. They have to hire new people which is costly, or end up with less people. And if the people actually responsible are still there, it will happen again. Unless they change their tune. In which case it's sad about the layoffs, but at least you've got a corporation to behave. Which is also nothing to sneeze at.

That would be determined in the process of drafting legislation.

Quis custodiet ipsos custodes?

For those who don't know the phrase: https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...

In Juvenal's context the question is rhetorical. An unfaithful partner will sleep with the people you set to watch over them, duh. But in the context where we use this phrase today the best answer is a full circle. Watching us, watching them, watching you.

Reply on news.ycombinator.com