Hacker News Reader

Comment by dylan604 | Hacker News Reader

A lot of companies have insurance on events causing them to lose sources of income. Whether that's farmers having crop insurance, big box retailers having insurance for catastrophic damage to their big box, I would assume there's something for infrastructure collapse to bring sales to $0 for the duration.

Even if everyone that was affected sued ClownStrike for 100% of their losses, it's not like ClownStrike has the revenue to cover those losses. So even if you're a fan of shutting them down, nobody recovers anything close to actual losses.

So what would you actually propose? Bug free code is pretty much impossible. Some risk is accepted by the user. Do you seriously think that software should be absolutely 100% bug free before being able to be used? How do you prove that? Of course, the follow up would be how clean is your code that you feel that's even achievable?

View on HN

>Bug free code is pretty much impossible. Some risk is accepted by the user.

This wasn't your average SW bug, it was gross negligence on behalf of Crowdstreike, who seems to not have heard of SW testing on actual systems and canary deployment. Big difference.

Yeah SW bugs happen all the time but you have to show you took some steps to prevent them, while some dev at Crowdstrike just said "whatever, it works on my machine" and directly pushed to all customer production systems on a Friday. That's the definition of gross negligence that they didn't have any processes in place to prevent something like this.

That's like a surgeon not bothering to sterilize his hands and then saying "oh well, hospital infections happen all the time".

The bug was egregious.

Using regexp (edit: in the kernel). (Wtf. It's a bloody language.) And not sanitizing the usage. Then using it differently than testing. And boom.

There's people, and there's companies.

This company ought to be nuked.

Genuinely, what good does that do?

It’s all well and good to write dramatic meaningless comments on social networks like Hacker News, but if your desired had actual consequence, can you honestly say that “nuking the company” is a net positive?

Is keeping CrowdStrike around a net positive?

You should look up Arthur Anderson

Well, in the America we've got something called corporate personhood and it's this odd concept. It seems like an unfair concept to I don't know to me as a citizen of America.

And you know laws are supposed to keep feeling like you're living in a fair world right?

So, nuke the company That cause billions Of dollars in losses, millions of hours of wasted human time, potentially loss of life though we haven't you know had a study yet that identifies those people who lost their lives because of disruption to healthcare services, heart attacks that were due to stress, etc etc. Nuke them. Nuke that corporate person. Force the humans who comprise that corporation to rebuild it as a better corporation.

> can you honestly say that “nuking the company” is a net positive?

Yes of course it would be positive. On the short term, remove one incompetent high-risk company from the industry.

But more importantly long term, it would do a lot to encourage quality in the industry if it was known that such an outcome is possible.

> That's like a surgeon not bothering to sterilize his hands and then saying "oh well, hospital infections happen all the time".

And hospitals and doctors have malpractice insurance. They also go through an investigation where they have their own brotherhood where it is difficult to get other doctors to testify against. There's also stories of people writing on their good leg "The other leg" in Sharpie because such moronic mistakes of removing left appendage instead of right. So even doctors are not above negligence. We just have things in place for when they do. Why you think ClownStrike is above that is bewildering.

At the end of the day, mistakes happen. It's not like they have denied they were at fault. So I'm really not sure what you're actually wanting.

>It's not like they have denied they were at fault. So I'm really not sure what you're actually wanting.

Paying for their mistake. In money. Admitting for their mistake is one thing, paying for it is another.

If your doctor made a mistake due to his negligence that costs you, wouldn't you want compensation instead of just a hollow apology?

Want vs receive are two entirely different things. If someone did something against me in malice, damn straight I want ________. If someone makes a mistake, owns up to it, changes in ways to not make same mistake again, then that's exactly the opportunity I'd hope someone would allow for me to have if the roles were reversed. This particular company's mistake just happened to be so widespread due to their popularity makes it seemingly egregious, but there are other outages that have occurred that lasted longer and did not draw this much attention. Was it an inconvenience, yes. Was it a silly mistake in hindsight, yes. Was it fixable, yes. Was it malevolent, nope. Should you lose your job for making this mistake?

Bug-free code is impossible. Stupid, negligent bug-free code, however, is very much doable. You just can't hire anyone who happens to be able to fog a mirror to write it.

If you think this was written by a moron vs a break down in procedures, then I'd think you'd be one that barely fogs a mirror. This is no different the multiple times that AWS us-east-1 has gone down and taken down a large portion of the internet when they've pushed changes. Do you think AWS is hiring moronic mirror foggers causing havoc or just examples of how even within a bureaucratic structure within AWS it is still possible to side step best laid plans?

Reply on news.ycombinator.com