Hacker News Reader

Comment by fy20 | Hacker News Reader

Actually it's the opposite. I worked for an NGO half a decade ago, and they wanted to add 2FA authentication to their login system used by ~400 staff. I created a quick demo using Google Authenticator in less than a week.

However the director of IT didn't like this solution. He insisted we use RSA keys and hire IBM to build a solution using that - I think the original estimate was a few million $ and it would take six months or so for their team (of basically new graduates) to build.

I asked my boss why the director was pushing so much for IBM to build it:

He told me that if we build it, and it doesn't work, then the director has to take the blame. If IBM build it, and it doesn't work, then IBM take the blame.

View on HN

Same reason why it took companies very long until they were ready to accept OSS. "But who can we sue if something doesn't work?" - at the end of the day it's always about someone being responsible. And if people can make sure that that someone is not them they will often take that option.

While I understand your point, the point the GP and I were making is that by bringing in (eg) IBM to the project, you're increasing the chance of failure.

I suppose the irony is that you bring in this huge bureaucracy to reduce the risk of blowback, but not the risk of failure.

That’s definitely a consideration: it increases the risk of failure but also increases the odds that you won’t be held accountable personally. One of the interesting dynamics here is that if they fail you, they have an extensive PR machine which will shop around excuses for the problems and help minimize them. If you do your own thing, the same people will tell their other marks that it was because you didn’t use them.

In the public sector, there’s often a political aspect as well - the senior management of the big consulting companies are far more likely to meet with the politicians than you, and even if you are certain that your decision is correct you have to ask what the odds are that their narrative will set the tone at a level you’re rarely asked to appear at.

Yes. There’s also the revolving door problem. The bureaucrat making the decision is often angling for a cushy role at the contractor. And the contractor is making the offer under the table to get the gig. From the decision makers perspective, it doesn’t matter if the project succeeds, they’ll be long gone. I’ve seen this with my own eyes.

> if we build it, and it doesn't work, then the director has to take the blame. If IBM build it, and it doesn't work, then

...the guy who decided to outsource it to IBM has to take the blame. No? Oh, right, "there is no way he reasonably could have known that it could fail". Then again, the same argument could have been used with the in-house development as well?..

I guess it basically boils down to what is and is not a "socially" acceptable way to deflect blame from yourself and those things, as all things social/customary, don't have to really be consistent.

Literally "nobody ever gets fired for buying IBM".

No one person gets fired but there might be a round of layoffs to pay the bill.

Reply on news.ycombinator.com