Hacker News Reader

Comment by eitally | Hacker News Reader

I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script.

Fwiw -- and I know there are plenty of googlers here -- the OMG isn't locked down and it was legitimately a unique bug. I appreciate the forensic analysis of public statements that the author of this post strung together, but it doesn't really advance the conversation.

View on HN

I want to know!

Used to work on GCE, but as the article mentioned, there are a lot of safeguards built in over there to prevent you from accidentally deleting things and account wipeout has a grace period to prevent a lapse in billing from deleting anything.

It matters because if it was a customer error I would want to know what the error was in order to better avoid it myself.

Per Google, it wasn't a customer error -- it was a bug, that has subsequently been patched.

How many other classes of such bugs exist. Without a public COE one can't know that it was systemically fixed. One can't know whether security boundaries were by-passed by the bug. One can't know what sorts of extra protections are introduced for this type of systemic error. So what confidence would you have in the product with no public explanation -- are you saying, oh they're google, I'm sure they're doing the right thing.

Yes (in this kind of case). I wouldn't be so trustworthy across the board.

There is value even if it is a "legitimately a unique bug" in demonstrating to customers that it truly was a unique bug. It's not unreasonable to be skeptical of such a claim.

> I don't see any value in Google being more transparent here if it was either 1) legitimately a unique bug, or 2) customer error with a Terraform script.

It could be valuable in the sense that scenario 2 has me shrugging my shoulders, but scenario 1 goes on the ever growing list of "reasons to avoid Google _anything_".

Reply on news.ycombinator.com