Hacker News Reader

Comment by MyFedora | Hacker News Reader

> Why is this different?

Because critical infrastructure doesn't get the convenience of shifting the blame. They must account for these risks in advance. Do you know what happens when IT breaks down in a bank? They've got two or more printers that print all new transactions. Database corruption? No problem, we've got the transactions right there. Printer breaks down? No problem, we've got another one printing the transactions right there. Hospitals don't get the luxury of shifting the cause of death from them failing to properly account for risks to a piece of software.

View on HN

Where is the line drawn on how much is the responsibility of the "end users" (hospitals, etc).

Hypothetically, if there was a widespread 'bug' in... Intel CPUs that caused a similar issue, would you say it was the hospitals that should be held accountable, or Intel, or someone else? What about if the issue was in Windows itself - what should each hospital do differently that would have avoided this?

Let the consumers sue the hospitals and banks, and let those entities that directly interface with consumers sue Intel in return. Consumers need an interface to recover damages. This will provide the motivation not to keep around shit vendors and entertain shit contracts that basically absolve the vendors of all blame.

When the damages are in the billions we need to make sure that there are billions in liability to balance the scales. Or else there will always be a perverse incentives to not give a shit.

I think they need to do both. But then again, I don't think most of the IT staff in these places are very capable. I have large hospitals as clients and everything is fairly terrible there (it is how I make most of my money; I solve these type of issues for companies when shit hits the fan and hospitals are kind of the worst, but banks or gov orgs are also not great). They don't understand any of this really so it's not weird that they buy stuff that's recommended in CIO magazine. But yes, they cannot shifting cause of death indeed.

I think BOTH must be held liable. I’d share the blame 50/50. And if Microsoft should have checked the CS sw because msft signed it (I’m not clear on if that happened), then I’d generously make msft also 10-15% responsible.

Reply on news.ycombinator.com