Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

jalopnik.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#71

Post by StavrosK »

neltnerb wrote: post #36
alibarber wrote: post #30

Earlier quoted context omitted.

But a credit card still keeps track of how much you spend - it doesn't rely on you honestly reporting how much you spent over the month...

Oh, I think they are talking about the earlier period where you just did a carbon copy of the card, got it signed, and if the card was a fake there was certainly no way to tell at the time. It would be the equivalent of a bad check, talking the days before swipe machines.

I assume the companies then just passed the risk onto the consumer (or ate it to grow their user base), I find it hard to believe they just continued operating on the honor system.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#72

Post by vsareto »

colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

>Of course they shut down if they couldn't bill?

I know it's a commercial operation but there's strategic reasons to keep it up. The attention it got from the US is evidence of that. Plus, they could have just made an educated guess on billing and resolved it later. Even the US could have made cash flow happen if that was an issue. And anyone who tried to take advantage of that would likely get the US's attention. Not worth it long-term.

But all this was overshadowed by the risk of ransomware possibly attacking the industrial systems which is really why it was shut down.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#73

Post by bkor »

FeepingCreature wrote: post #20
romwell wrote: post #15

Earlier quoted context omitted.

>Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? They better do that if they get the permission from the gov't to operate the only grocery store in the area, and people weren't able to get food otherwise.

Okay, so establish some sort of "crisis service fund" that pays out when payment processing breaks through no fault of your own. This is something the state can do at any time. Honestly, allowing a monopoly without planning something like this just seems careless. Providing service without hope of ever being paid is stupid. The market is pretty good at selecting against stupidity.

> Okay, so establish some sort of "crisis service fund" that pays out when payment processing breaks through no fault of your own.

One company which suffered a cyber attack solved this partly by transferring a rough estimate of what a vendor should've been paid as a bank transfer. This up front. They did similar things for smaller vendors (smaller vendors might have bigger issues not getting paid on time). Not for everyone due to the amount of work involved. They got agreements in place to sort out the exact amounts afterwards. This required a huge trust and at the same time it created a great amount of goodwill from those vendors. Meaning, these vendors took over work on behalf of the company.

Afterwards the exact costs can be figured out. What is important that business continues as much as possible, if you completely stop your business you'll also not have any revenue you could maybe charge later.

I think the pipeline action on first hand is a rather stupid action. Loads of business is pretty predictable, plus often you already had the insight on the orders for the coming period. The cost of some mishaps and the economic damage to the country should be considered as well. It seems a case of "penny wise, pound foolish".

Regarding "payment processing" breakdowns: there are various things in place in NL for that, though most don't know. Simply stated: you fill out a paper form, sign it, done.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#74

Post by croutonwagon »

cowsandmilk wrote: post #64
colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

Frankly, you seem to lack knowledge here. Your example of a grocery store is B2C with no knowledge of the customers. The pipeline is B2B with legal contracts in place and use invoices. You can order dozens of types of oil through the pipeline. With travel distances of thousands of miles, many destinations, and the need for product segregation, the pipeline knows where all the oil is going. If they couldn’t track segr…

>If they couldn’t track segregation and destinations in the pipeline, that is a good reason to shut down.

Wouldnt that then conceded the pipeline was not fine?

>If they were just going to be delayed in sending out invoices or had to input some items into the system manually after recovery, they most definitely should not have shut down.

I am willing to bet a signifigant number of "customers" (businesses in this case with teams of lawyers) would challenge the vailidity of invoices based on estimates and not actual usage. Theres no free lunch, the pipeline owners understand this and decided its in the best interest for their company to stop deliveries until the system that manages their order tracking is back online. Thats totally reasonable.

The US government (and states for that matter) made 0 guarantees of coverage of any thing. And even if they did, its not like the government does much to make anything a straightforward process.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#75

Post by macspoofing »

colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

I agree with you that the company can't make a decision to simply ship fuel for free. This is where the government should step in. You can't have this kind of wide-scale economic disruption occurring. Government could mandate that they resume shipments, have them bill manually as best they can, and maybe use tax dollars can plug any holes after the fact (and if necessary).

They should also be fined for letting their billing system get compromised.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#76

Post by koheripbal »

The author here is misrepresenting his sources to spin a specific agenda point, in order to construct a false narrative. It's as fake as fake news gets.

From the author's own sources...

> Colonial’s corporate IT network and the process control network are connected and exchange information about how much fuel each supplier or distributor receives in order to bill them for it.

> ...they could change [data about the] flow rates, they could modify the data

> Although infecting Colonial Pipeline’s process control network would be disruptive, it isn’t the only concern. Colonial’s control system also connects to the control systems at tank farms that feed fuel into Colonial’s pipeline.... An attacker can potentially pass through Colonial’s control systems into the control systems of these farms.

I really hate advocacy journalism. It's such a fundamentally dishonest medium.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#77

Post by Rastonbury »

cowsandmilk wrote: post #64
colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

Frankly, you seem to lack knowledge here. Your example of a grocery store is B2C with no knowledge of the customers. The pipeline is B2B with legal contracts in place and use invoices. You can order dozens of types of oil through the pipeline. With travel distances of thousands of miles, many destinations, and the need for product segregation, the pipeline knows where all the oil is going. If they couldn’t track segr…

> The pipeline is B2B with legal contracts in place and use invoices.

What if billing is tied to metered usage and it was impossible to meter? Or what if the billing system is needed to shut off access when customer has reached a quota? The article is scant on details but "legal contracts and invoices" are not going to save a company legal fees with when multiple customers dispute their bills.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#78

Post by flaubere »

cm2187 wrote: post #19
colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

The other thing is when you have hackers in your network, shutting down the things that could be physically dangerous if they access it, until you know what you are facing and you identified the compromised machines, doesn't seem unreasonable to me.

That depends on what the alternative is. If it involves clueless people filling up garbage bags with gasoline and storing them in their kitchens perhaps letting the pipeline continue to run would have been safer.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#79

Post by Stranger43 »

cube00 wrote: post #44
Stranger43 wrote: post #38

Earlier quoted context omitted.

At what point in history was that? Unix(tm) and mainframes predate windows server by a far margin and was never seen as inferior to windows by the wider sysadmin community, there might have been a time when windows server had merit as the discount solutions for people who could not afford highly available Unix boxen, but it was never seen as superior or particularly well suited for critical infrastructure. I think th…

Thick desktops were ruled by Windows so if you wanted a custom application it was Microsoft Visual Basic or Visual C++, Java as desktop apps didn't seem to catch on for the enterprise. Even if you tried to bring an application to the web back in the 90s you could still end up caught in the Microsoft ecosystem via ActiveX.

And desktops were never critical infrastructure were almost exclusively talking about servers here not disposable client devices as there is no such thing as an highly available desktop/laptop.

I have personally been involved in more java fat client then activeX based fake webapps, but im also not an wintel admin with an background in non-critical mid sized business applications.

Re: The Colonial Pipeline Was Fine, Shutdown to Make Sure Its Owner Would Get Paid

#80

Post by salawat »

phreeza wrote: post #53
colechristensen wrote: post #4

The author of this article comes off as really very clueless. Yes, in fact, if a store's computers go down they don't just let customers walk out the door with products and hope they get paid eventually? As far as I understand colonial is basically a big gas station connected with a series of tubes. Look ma, the gas pump still works but it doesn't keep track of how much we pumped or charge us any more! Of course they…

Isn't the argument that it should be a utility and not a purely for-profit business? Would you expect your local water company to shut off supply if they have a similar bookkeeping problem?

People, and particularly software people I've noticed, seem to chronically underestimate the magnitude of B2B where you have a potential number of different vendors to settle with in the 6 digits, that changes over time according to vendor internal reorg, closings, openings, relocations, changes of payment and financial service outsourcing arrangement, etc.

That doesn't at all come for free. Entire departments and businesses revolve around making that complexity disappear. Gettting locked out of your infrastructure to do that is essentially paralysis of your business period. It isn't a case of "Just put some meters on the tap of the pipe" .

You have to be able to read them, you have to know to read them and when, you've got to know where the invoice goes, what terms were negotiated, etc. If you don't have access to that dataset, the only physical way for the human network to recreate that web is by people picking up phones and blowing up and slamming your point of contact which runs into the issue of having enough people on your end to handle things in the meantime, and your customers actually knowing who to call, and javing planned a procedure for a massive degradation in your info system, even if it means going back to pen and paper.

Post reply on HN