Comment by andrewstuart2 | Hacker News Reader

Comment by andrewstuart2 | Hacker News Reader

Parent Full thread

I think maybe you have to think about the total economic impact for the article and frustration to make more sense. Fuel is a very fundamental part of our economy and almost always goes toward producing much more value than the value of the fuel itself. Add to that, shortages can and do contribute to irreversible losses like loss of life. If every gas distributor shut down because ransomware hit them all, you could completely grind the country to a halt.

It's not too far fetched either to hope that their customers would be willing to self-report. Sure you might get some people who'd take advantage of the situation, but it's not a the total loss scenario of giving away your product for free that you're talking about. Add in the opportunity cost and shutting down delivery if you have alternatives that may not be 100% accurate billing is probably a net loss for the company, though it's impossible to say.

> I'm still trying to find out what actually happened in Israel but god forbid a news source or commentator actually lay out the details of a complicated situation... (if you're not getting everybody pissed off about X, then you're not doing your job as a reporter?)

It's a bit ironic to take a morals-over-profit stance on reporting right after having taken the profit-over-morals stance of gas pipelines.

> It's not too far fetched either to hope that their customers would be willing to self-report. Sure you might get some people who'd take advantage of the situation

Would you bet millions of dollars on the goodness of the typical person?

> Would you bet millions of dollars on the goodness of the typical person?

Somewhere in that question is an answer to the Fermi paradox!

That's how credit card processing operated worldwide for many decades. That's also how hawala works. And Wikipedia, if you want a non-monetary example.

They are all literally trusting in the goodness of the typical person. And then doing some careful analysis and planning. And fraud detection for the rare misdeeds.

But a credit card still keeps track of how much you spend - it doesn't rely on you honestly reporting how much you spent over the month...

Oh, I think they are talking about the earlier period where you just did a carbon copy of the card, got it signed, and if the card was a fake there was certainly no way to tell at the time. It would be the equivalent of a bad check, talking the days before swipe machines.

I guess, but discounting active fraud, there is still a paper trail of how much you spent; The bank will still have said "We think you owe us $100, here is our reasoning based on things you signed" never "you spent some amount of money we're not sure of - please give it to us" or "all of our customers spent $1million, so let us have your share, whatever you think that may be" as would be the case here.

Yes, the system would fall apart if you disputed every single transaction and made them supply irrefutable evidence you did in fact authorise the transaction - but it doesn't revolve entirely on the trust that people will keep their own account of what they think they spent.

Sure, but the store that accepted the invalid credit card has traditionally been on the hook. The store is the one being targeted even if the person whose credit card was stolen can get off with disputing the charge.

And before everything was networked, there was no way for a store to check with the credit card company that the card wasn't reported stolen. That's the trusting people part, it's the store that is trusting people without the ability to even verify that the card hasn't been reported stolen.

Yes, there is a paper trail, but the situation I'm talking about is analogous to a bad check or a counterfeit bill -- there's no recourse if the bad actor can't be found and the store is on the hook.

Ah I understand now - from the shop’s point of view yes there is risk in this.

I am just about old enough to remember this time - it’s funny to think that security hinged on checking if the signature looked ‘right’. For cheques I remember here at least for yours to actually be accepted anywhere you needed a ‘cheque guarantee card’ which was basically just a debit card but with a fancy hologram - so a certificate of your ‘goodness’ - up to a certain limit per cheque. The shop would copy the details and this would supposedly guarantee they’ll be paid.

I was going to say that shops could have asked for ID - but at this time driving licences didn’t have a picture and weren’t cards - so no one carried them anyway. There was probably a lot of ‘subjective’ acceptance around the place (‘does this person look trustworthy, would they really be given a credit card or did they steal it?’) come to think of it…

Yes, I didn't want it to veer off topic, but I think it is extremely obvious that such standards involved implicit or explicit biases, as well as real recognition of individual customers' actual past behavior (like if a gas station has taken advantage of them in the past).

I assume the companies then just passed the risk onto the consumer (or ate it to grow their user base), I find it hard to believe they just continued operating on the honor system.

Would you bet millions of dollars on payment system with zero redundancy? Also with that kind of money involved I wouldn't be surprised if you could could get a court case running and force them to report how much they took.

I mean that’s how lots of business works? Is that not the whole basis of invoicing? I must be misunderstanding

An invoice would say “you owe $x for y gallons of gas” not “hey pay us some money for that gas you got”

True, but still: a lot of (big) businesses are still quite unhappy if they didn't pay what they should've paid. It also creates an uncertainty for them, there's often various years where the money can be requested back. Plus as far as I know, if you notice an error there's various financial rules you need to follow. You cannot just treat it as "cost saved". As a result, it is way easier to notify the other party and get a mistake fixed.

I think there's a way they could count the number of all the trucks without a computer.

> Would you bet millions of dollars on the goodness of the typical person?

This is about business to business, not business to consumer. I suggest to talk to a financial/accounting person in a big company. Often enough there are mistakes in payments that are only noticed by the other business. This despite all the various layers that should've prevented the entire problem.

I don't mean small mistakes either, I mean where someone wanted to enter something like 1234.56 (two decimals), but it ended up as 1234560.00. Basically a mixup between the decimal and thousand separator; such mistakes happen way more often than you'd think. I've heard various stories of a vendor notifying the company that they've been overpaid, e.g. the 1000 times what it should've been, but also various other kinds of mistakes.

Some companies have been working together for various decades. Employees might've switched between the companies, people know each other. It really isn't uncommon to have quite a bit of trust between companies. Obviously, this does depend on the country. In some parts of the world there's more trust than other parts.

When all parties are losing a bunch of money on acount of the shutdown, the rational choice would be to accept some lesser risk than these known losses in order to get things working to some degree, if that were technically feasible.

It shouldn't even be up to them to make a rational choice. It should be required via federal regulation on utilities.

No, I would create legislation that mandates that the pipeline must keep running in situations like this at the company's expense

>It's not too far fetched either to hope that their customers would be willing to self-report.

Spoken like someone who has never done business.

Spoken like someone who would let critical public infrastructure get privatized by a corporate monopoly.

Somewhat of a moot point when said infrastructure is already private. You can use the misaligned incentives to argue against private ownership of infrastructure, but criticizing a business for doing business is barking up the wrong tree.

It's not a moot point if we can create regulation or government takeover of said infrastructure. Conversations like this are the first step towards creating those kinds of regulations. It's only moot if you make it moot. When a private business completely controls a public utility and fails to act in the public's interest it is time to have this conversation because they have their hands all over something that should be in the hands of the public.

My point is that any business would have done the same. Expecting one to not look out for its own bottom line and rely on the kind heartedness of its customers is misguided. The problem is with the game, not the player.

I wonder if there is a capitalistic approach so solving this problem (making incentives align between the needs of the fuel distributor and that of the economy in the case of technical failure)?

The only approach I see is perhaps to have written into contracts with all buyers some kind of compensation for the pipeline being unavailable per hour.

Then colonial will prefer to have the pipeline turned on handing out free fuel because it's cheaper than the compensation for turning off.

If only the world economy ran on tears and sympathy instead of recorded transactions. I should pray that all my utility and food providers function without charging me money... until they go bankrupt and I am left with neither.

You'd probably be pretty pissed if your electricity provider suffered a ransomware attack on its billing system and then decided to stop your heating completely on its own accord because it can't know if you're paying your fair share.

They do that anyways here even without ransomware attacks. There were all kinds of articles about it on the front page of HN.

When?

Texas recently shut down their power grid when it got cold out because it was cheaper than weatherproofing or suffering the regulations to interconnect with other neighbouring states.

That's not in any way similar. The Colonial Pipeline was not shut down because they ran out of petroleum to distribute.

Grandparent commenter with "Austin" in his name was saying his power gets shut off even w/out ransomware. Parent commenter asked "when?" and I answered the question.

I'm not taking a position on the similarity or dissimilarity between shutting down a service because you can't bill accurately and shutting down a service because you refuse to interoperate with other providers.

All I'm saying is Texas customers did get their electricity cut off recently.

The Texas power grid didn’t run out of fuel either. It was known there needed to be controlled outages a couple weeks in advance. What wasn’t known was the scale or duration of the problem.

At any rate you are just looking for something to cry about. You asked for a hypothetical counter example not expecting to get one and now are splitting hairs to qualify big tears.

>The Texas power grid didn’t run out of fuel either.

"As of Wednesday morning, when the power outages were at their most severe, the cold had snuffed out about 46 gigawatts, or about 40 percent, of power-generation capacity in the state."

Sounds a lot like the grid did in fact run out of "fuel" (as in the product that they deliver).

>You asked for a hypothetical counter example

Of an electricity provider cutting power of its own accord because their billing service was not functioning, not because the electricity production in Texas dropped due to freezing while demand shot up.

There are some restrictions on when the utilities can shut off your power, water, electricity, etc. Whether gasoline should be regulated like a utility is an interesting question. Given how dependent on cars most Americans are, seems like a reasonable conversation to have.

Reply on news.ycombinator.com