After CrowdStrike, Programmers Deserve Consequences
mccue.dev
mccue.dev
But there is an entire chain of responsibility here. The hospital IT department that chose to use a computer instead of dumber technologies. The IT department that chose to run Windows. The security team that chose to purchase CrowdStrike's software, possibly without vetting them.
If a software's license has clear terms stating that there is no warranty, and the buyer buys it anyway, why shouldn't this be a caveat emptor situation? If they didn't like it, they could negotiate indemnity clauses, go to a competitor, or not use the software at all.
Don't get me wrong, I absolutely think that CrowdStrike did a shitty thing. But maybe they already disclosed that in their license agreement, and the purchasers decided to overlook that to their own peril. After all, running kernel-mode software is equivalent to handing over the keys to your computers. Maybe negotiating/selling software with liability clauses should be more normalized?
Not only protections, but financial incentives. As a society and civilization, but can't depend on accidental heroes to be the ones that safeguard and correct the course of the entire group. Especially when we idolize money and power, and have a workforce that is manipulated across so many dimensions (healthcare, non-competes, historical admissions, union/anti-union, gig-economy, salary/hourly).
Fully true. But working against that is a human trend so entrenched it isn't discussed.
No one anywhere want to clean their own house.
At some point, some rep came and sold software to customers engaged in business that their license stated their software was not fit for.
Anesthesiologist, Structural Engineer
Yesterday a friend of mine was stuck in the Hospital all day. Their computer system went down and that led to a delay of care. Delays in care kill people.
Coders of a CrowdStrike-sized company have layers of people-exercising-company-authority above them. Coders are employees who operate within the confines they are given.
Those confines get shaped by what filters down from shareholders/investors and executives.
Conversely, anesthesiologists and structural engineers are commonly directed by people they interact with. Their expertise carries real weight. In many cases they have a degree of ownership in the biz getting paid.
source: 30y supporting the latter
* Management and Marketing insisting on having a product done by a specific date, no matter what.
* Testing is always a second thought
* not enough hardware available to test all possible configurations.
Until companies spend real money on Development and Testing instead of cutting corners, this will happen again and again.
Also, it's the customers fault for clustering blindly into Crowdstrike. There needs to be diversity and choice.
Moreover, if uBlock Origin can be an open source success, then an open alternative to Crowdstrike can in theory too.
In my experience the software engineers that often get promoted crank out as many features as possible with almost no regard to the defect rate. If you do things at a more deliberate pace, you can be regarded by product or management as slow and unproductive. Real incentives exist in software development that push for quantity over quality.
This is not analogous to the failure of an anesthesiologist to properly sedate a patient. This is a process failure. Clearly the proper amount of QA was not in place for whatever reason and they need to re-examine their approach. Of course their process needs extra diligence given the cost of failure.
It would be a real shame if an individual is punished for this instead of examining the process and system of incentives that led to this failure.
Those lawsuits will be directed at the corporation - which well insulates those who dictate corporate action.
The author seemingly wants to extract the coders from the company structure and have them bear the full weight of the consequences, instead. This would insulate not only the decision makers but the corporation as well.
If there was a gauge like this Evil <---> Ethical, the author's suggestion would land well to the left.
Even the CrowdStrike blog said it was doing a root cause analysis into how that poor logic was introduced.
That isn't the point; all software can have bugs. This is a failure of their QA process. It was clearly quite easy to trigger the problem.
The engineer who caused all this has surely already been fired, but that's just scratching the surface--I hope this is brought to court as criminal negligence.
Who required the operating system to be undermined in the name of security? It wasn't that programmer.
Who created the regulatory environment where such decisions actually look like a good idea? It sure wasn't any programmer.
What does real engineering look like?
When the decision was made to use a li-on battery instead of a RAT in the 787, the battery was designed to be fail safe. There was no way it could fail.
The engineer who created the enclosure for it in the airplane started with the assumption that it would fail catastrophically, and that the enclosure would need to contain it.
It's a good thing he did, because that battery did fail, and the enclosure kept the plane from failing.
That's what the OS is for.
Structural engineers are held at criminal fault if a bridge they signed off on collapses. Ok, now why do we have the bridge in the first place? Because city planning segregated residential and commercial zones across a body of water. And who was responsible for that decision? The city planning council?
So if a bridge collapses and hundreds of people die you put the blame on the politician who signed off on zoning laws, instead of the engineer who designed a broken bridge?
wtf kind of BS to allow any remote semblance of programmers deserving consequences? if programmers received EXECUTIVE level pay then yes, they deserve the rammifications, but they do not, executive pay is ridiculous with their already inflated salary, ridiculous bonuses, and stock buybacks. whoever gets paid more is the one that deserves the consequences.
Thats the WHOLE GODDAM REASON THEY ARE IN THAT POSITION.
For those affected, consider it a relatively painless test of your DR systems, and a chance to fix 'em up.