[downwithdisease]

>> "Solarwinds hasnt offered any remediation or major changes in their development, leadership or code."

Not accurate re: leadership. A new CEO just started in January, and their CTO was either terminated or he left just after the hack news.

[spoonjim]

LOL the whole “fall guy” thing is how companies keep doing what they’re doing while making some symbolic penance. For a software company a fuckup of this magnitude should be: all customers leave, company dies, execs never work again. Anything less is an insufficient incentive to work extremely hard to prevent this from happening.

[notimetorelax]

Sorry, I can’t agree with you here. What you’re saying is basically company’s dissolution of it is hacked. If this indeed becomes the case the companies will indeed kill to keep their secrets.

[sofixa]

First, with GDPR and co, they can't keep their secrets if they get hacked.

Second, with such negligence? They deserve to be shut down. This isn't a highly sophisticated zero day exploit, there were multiple huge failure at Solarwinds that allowed the attack to happen.

[WalterBright]

Your method sounds good, but it makes things less safe in practice because it provides every possible incentive to hide, cover up, deny, etc., any problems.

A far better system is "no fault" where the company has incentive to be open about problems and finding solutions.

[bzzzt]

Years ago, the company I worked at had a very big production issue which resulted in a customer's database being deleted. Of course, the customer was furious and called the CEO asking for the person responsible to be fired.

Calmly, our CEO said: 'No. If there's anyone in this company who will never make that mistake again it's him.'

[treis]

I've seen this sort of Zen of CEO type story a lot but it doesn't match up with reality. Someone that deletes a production DB by being careless or reckless is likely to do something similar again. Perhaps not in the exact same way, but there's infinite ways to break things. Those that stumble upon one are likely to stumble upon another.

[bzzzt]

In that case everyone making 1 mistake is 'out'. Seems "cancel culture" is leaking into ops...

I was in the room when the CEO told that (one of the nice things about small companies) and have had contact with the person responsible for a few years until he got another job. True story ;)

There were changes though: the 'two pair of eyes' principle was enforced a lot stricter from then on.

[mrmonkeyman]

And if you ever ignore a red light, pay your taxes late or do anything other than your absolute best to be an upstanding citizen you should be put into prison for the rest of your life.

[spoonjim]

If you ignore a red light and kill 10,000 people? Maybe. That’s what this kind of software hack is.