Hacker News Reader

Comment by yAnonymous | Hacker News Reader

I doubt it. Nobody wants to pay for that.

You might be right, unfortunately. If it's cheaper to buy insurance that will cover the (expected) losses caused by outages, most organizations will choose to do that instead of making the software more failure-resistant. The problem is that insurance only works well for isolated incidents, but a software failure can cause a cascading failure with a huge impact. Insurance companies generally aren't prepared for that and don't have the resources to pay out to everyone.

But aren't the insurance companies smart enough to figure this out and start correcting their rates to be much higher?And if they actually have their acts together, wouldn't those same insurance companies start insisting on basic audits of their client's systems?

I actually don't know about this stuff, so any correction of my thoughts is appreciated.

A cynic in me feels that someone will figure out the problems with cascade case and insure from failure of insurance companies to pay out insure money. Just like during 2008 financial crisis.

That's what existing reinsurance companies do, if I understand correctly. They insure the insurance companies.

> But aren't the insurance companies smart enough to figure this out and start correcting their rates to be much higher?

That seems like a naive "MARKET WILL FIX IT" approach.

More likely, if the market does fix it, it'll be by having insurance companies deploy actual inspectors who know what they are doing and what sorts of problems to work for.

They might even be a fun combination of physical pentester/irl chaos monkey. Doesn't that sound like a fun job?

Quite often operational losses aren't insured against this kind of error, for example the Knight-Ridder automated trading losses. Sufficiently big operational failures can just destroy companies, especially small companies.

System audits would have to be standardised. There's bits of this in ISO9001, PCI compliance, FIPS, and so on. But the technology changes rapidly and the insurance companies don't have the expertise.

Cascading failure will be covered in the expected loss, so insurance fees go up and up ?

I think we just need to build smarter. I've become disillusioned with the "runaway state" problem (as well as spaghetti-dependency problems) in OO languages which contributes to bugs and general nondeterministic behavior as well as making long term maintenance difficult, and at the same time I've become enamored of unit test suites and functional immutable languages like Elixir as well as static code analysis tools (I'm still coming around to Haskell-esque typing, but I generally think it's a good idea to write "potentially provably correct" code that has parts which provably have no side effects).

Reply on news.ycombinator.com