Accountability Sinks

> The reader can feel a glimpse of the author's ego the moment he explains his skills as a Google Site Reliabiliy Engineer and his glorious work on improving gmail post-mortems

That's a horrible take. He did nothing of that sort. He didn't say anything about his skills, nor did he say anything about improving Gmail postmortems. You made everything up. He was just mentioning the fact that in this case, limited accountability when handling emergencies has strong benefits.

A fair comparison would not be the return, but Berlin-Györ being more expensive than Vilnius-Berlin-Györ. Is that common in logistics, in your experience?

My go-to example of a whole mesh of "accountability sinks" is... cybersecurity. In the real world, this field is really not about the tech and math and crypto - almost all of it is about distributing and dispersing liability through contractual means.

That's why you install endpoint security tools. That's why you're forced to fulfill all kinds of requirements, some of them nonsensical or counterproductive, but necessary to check boxes on a compliance checklist. That's why you have external auditors come to check whether you really check those boxes. It's all that so, when something happens - because something will eventually happen - you can point back to all these measures, and say: "we've implemented all best practices, contracted out the hard parts to world-renowned experts, and had third party audits to verify that - there was nothing more we could do, therefore it's not our fault".

With that in mind, look at the world from the perspective of some corporations, B2B companies selling to those corporations, other suppliers, etc.; notice how e.g. smaller companies are forced to adhere to certain standards of practice to even be considered by the larger ones, etc. It all creates a mesh, through which liability for anything is dispersed, so that ultimately no one is to blame, everyone provably did their best, and the only thing that happens is that some corporate insurance policies get liquidated, and affected customers get a complimentary free credit check or some other nonsense.

I'm not even saying this is bad, per se - there are plenty of situations where discharging all liability through insurance is the best thing to do; see e.g. how maritime shipping handles accidents at sea. It's just that understanding this explains a lot of paradoxes of cybersecurity as a field. It all makes much more sense when you realize it's primarily about liability management, not about hat-wearing hackers fighting other hackers with differently colored hats.

This, and I think it gets deeper. I started reading more about history of "just culture" and it seems like historically it was the dominant culture of justice in the tribes and smaller communities.

It's the _just culture_ focused on repairing the damage – for the victim and for the community – and trying to fix the reasons and integrate the offender back into life (otherwise community would end up being a bloodbath of revenge and dies out).

What wasn't obvious to me is that switch from restorative justice culture to retribution justice culture happened for economic reasons. At some point of nation states formation, crime became an act of offence against the king, not the community. You didn't do wrong to the community, you "disobeyed the rule of king" and thus has to be punished. The whole "justice transaction" became a deal between an offender and the state/king, instead of community and victim and offender. Paying retribution fee became a source of income for the kingdom, incentivising this type of justice culture. Victim and community was largely left untouched by this new type of "fixing justice". Pretty dramatic change.

Ah yes, ass cover as a service.

There's a classic article (2010) about it: https://thetech.com/2010/04/09/dubai-v130-n18 (HN: https://news.ycombinator.com/item?id=1257644)

The difference is that while the decision has been made, it isn't necessarily very good.