Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

>>> Software is now (rightfully) considered so dangerous that we tell everyone not to run it themselves. Instead, you are supposed to leave that to an “X as a service” provider, or perhaps just to “the cloud.” Compare this to a hypothetical situation where cars are so likely to catch fire that the advice is not to drive a car yourself, but to leave that to professionals who are always accompanied by professional firefighters.

I’m stealing that line :-)

View on HN

If cars were invented in 2024, there's no way that the general public would be permitted to drive them. We freak out over new products that result in a few deaths, let alone 40,000 per year.

This is hard to say because an alternate universe where the car didn’t exist would be quite different and may have not led to our contemporary understanding and management of risk in the first place.

I'm not so convinced. People talk similarly about the issues that smart phones have caused with the rise of social media but only fringe political groups want their use restricted by law (with exceptions, such as while driving). I'd expect the most popular opinion to be that the convenience outweighs the cost.

(Of course, as a sibling comment points out, it's impossible to really know.)

Like smoking in the 1960s.

Status quo bias is very strong. If you proposed accepting tens of thousands of fatalities per year, bulldozing entire city neighborhoods, kids not being able to cross the street safely, smog, and constant traffic noise people would be horrified. One common justification NIMBYs use is increased traffic aka the burden other drivers impose on a neighborhood by driving through. Ironically instead of identifying the root of the problem (too many cars and the subsidized infrastructure supporting them) they blame one of the solutions (more housing).

People often say this about bicycles too. It is appealing, but difficult to say. Self-driving cars are being invented and they are allowed (with restrictions).

My guess is if the invention had a big corporation behind and enough economic potential it would get passed.

> Software is now (rightfully) considered so dangerous that we tell everyone not to run it themselves. Instead, you are supposed to leave that to an “X as a service” provider, or perhaps just to “the cloud.”

Well, that's what cloud providers tell you. And their employees, whose salaries depend on them not understanding otherwise.

In my experience, it's not that simple as you make it sound.

In some cases, especially due to some compliance (ISO27001/SOC2-3, Fedramp, etc.) companies implement a proper management of CVEs. It has become a standard practice (typically, this is part of the Enterprise subscription of the SAAS/product of choice).

Having a service/lib/whatever that uses a crappy lib that doesn't get a CVE fixed in a specific timeframe can lead you to miss the SLA you define with your customers (e.g., "we fix high risk CVEs in 90 days and critical in 30 days", that kind of stuff).

For such companies having a service like that which is probably not even core business can become really a cost, especially because Enterprise companies will push very hard on you to make those CVEs fixed. I have seen colleagues working over weekends just to have 1 single CVE because of 1 single company pushing us really hard to fix that stuff. It was a big contract, you don't want to lose it.

So, yes: paying X$ to someone that promises you "we take care of CVEs", etc. can be a win. You're not just buying software: you are in a sense buying some accountability, although at the end of the day YOU are what the customer sees, not your SaaS behind the scenes.

All so that these vendors can mis-configure a S3 bucket or use the password "solarwinds123."

Can I just point out that the vast majority of users I know are basically teetering on the edge of the cliff of losing everything they have ever done. I'm not suggesting that selling your soul to the SaaS vendors (disclaimer: I work for one) is the right solution. In fact some of them you're probably better setting fire to your data than trusting them (disclaimer: I work for one of those!).

Example my now ex-girlfriend was distrusting of "the cloud", for rational reasons I will add thanks to a former Eastern Bloc childhood. However the alternative solution was hoping she wasn't going to lose the HP laptop she'd paid bottom dollar for. Some education later and she had peace of mind, at least on that front.

What we have is a general lack of education and consideration of what the consequences of that lack of education are. The end game is that you either have to accept the risk, and I've seen many a tear there, educate yourself, and I've not seen much of that, or suck up to the SaaS and cloud vendors.

It's a matter of personal responsibility and no one seems to have it so leaving that to the professionals (ha!) might be a less bad solution that trusting yourself.

Education is the right answer though but hopeless. I'm not sure if my post has a conclusion but it sure depresses me re-reading it.

I actually used that exact car argument when someone here was strongly against any use of psychedelics unless medical and aided by a professional.

Reply on news.ycombinator.com