Also applies to software supply chains:

https://www.platformsecuritysummit.com/2019/speaker/sherman/

> Today’s software is largely assembled rather than written, and most of the assembly comes from open source components. The creation of components and their inclusion into applications creates a “supply chain” just like in conventional manufacturing. While physical supply chains have well established chains-of-custody to establish properties like refrigeration maintenance, authenticity or spoilage avoidance, the software supply chain is very much a wild, wild west, filled with vulnerabilities that can be (and are) inadvertently inserted into applications. As supply chain risk and mitigations are being explored by government and academia, a larger attack surface is being uncovered that needs to be addressed.

We laugh about golf and Vegas visits, but it's really hard to stab someone in the back when you're used to looking them in the eye. If they're just some suit you meet once every three years? Fuck 'em.

- Counterfeit components, like memory out of spec that creates scaled failures.

- Fake products from the channel.

- Fundamental mistruths with regard to how services are delivered.

- Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester.

- Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work.

- Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token.

- Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets.

Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.

But generally value derives from multiple independent credible verifiable audit mechanisms.

Yes you do. You get exactly what you pay for. If you pay for a dozen of German inspectors who think Chinese factory produces junk that is outside the spec, a dozen of German inspectors with that attitude are going to do inspections. If you do no want to pay those German inspectors, you are not going to get those inspections.

In most of the cases companies do not want to pay for it. Apple manufactures amazing iPhones in China. Apple iPhones easily last 5-6 years. Blu manufactures crappy Android phones. They barely last a year. Apple's iphones cost more to manufacture than Blu phones sell for.

But when you build ongoing relationships, you get benefits from not pushing for the bottom dollar at all costs.

A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.

JS Mill has some interesting observations going back a ways.

Auditing is still recommended.

Ignoring auditing for a moment:

The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly.

But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable.

And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam

This is a classic bait and switch in many online work platforms. The person who interviews for your open contract/role is not the person who does the work.

Curious to hear examples if you can share.

He could jump into the flow of parts and information for a specific printer model from 10 years ago. He knew the reasons for each steps like import tax avoidance, cost/benefit analysis of using one vendor/shipper/etc, or even that they used to have a specific engineer at that one factory who was amazing at QA and tolerance checking or something like that. When teams were behind due to supply chain issues, he would jump in to analyze their process. Sometimes that meant combining it with ongoing flows like "This factory here makes a part like that for product X, I'll get you a sample so you can adapt it into your product to rework."

He had immense company value and history committed to memory that he tried to pass before leaving as teams moved to India or China. But I doubt anyone at a decision making level was aware.

> He knew the reasons for each steps like import tax avoidance, cost/benefit analysis of using one vendor/shipper/etc, or even that they used to have a specific engineer at that one factory who was amazing at QA and tolerance checking or something like that.

Excellent example. Some of those you wouldn't be allowed to document in writing, even if you wanted to.

Ideas like regionalization and flexible manufacturing are great ideas, in most cases, the capital machinery of factories are relatively easy to replicate and setup (harder than software, but much easier now than any time in the past). However, the economic and accounting system needs to balance out the global employee wage differentials for it to gain any traction.

Tariffs have been hated on economically, in part because the analysis values the generic profit creation over the risk; but it seems like one way to balance wage differentials to encourage de-risking our supply chain. I'm sure there are other maybe better methods?

Add 10% of the value of all inventory sourced outside North America as a "risk liability". Same for 10% of yearly labor that's outsourced.

Basically find ways to make short term thinking visible in their financial reports, since that's what's measured and rewarded.

Companies are required to disclose significant risks, but the quality of that disclosure...varies.

Mostly these kinds of risk factors are mentioned verbally in their reports at the moment.

Insurance obligations -- auto, health, life, C&L, bonding, mortgage and title -- are generally required by or offered via third. parties. Sometimes governments, but often creditors, counterparties, employers, or other entities.

If you have to shut down your business, that's mostly impacting your business in a very direct way.

What do you mean by 'balancing wage differentials'?

Global trade is on of the best ways to balance wage differentials. That's how China had crazy catch-up growth in the last few decades.

(Another great way to help poor people get more productive and thus richer is open borders.)

If downstream customers want to de-risk, they should pay for it. Either by setting up their supply chains differently, or by outright purchasing insurance, etc.

If they choose not to engage in this expense, perhaps they are right, and just bearing the risk is overall a better trade-off? Who are we to tell other people what level of risk aversion they should have?

Of course, once the calamity hits everyone wishes they would have bought prepared or bought insurance. But that doesn't mean we should all go out and make our roofs asteroid impact proof, or never ever go out because we might break a leg.

good tariff policy is hard to achieve in divisive political environments however. for instance, in many cases, you'd want them to go away dynamically as conditions improve, but lawmakers hate giving away their levers of power.

Food is often used as the counter example, but IMO domestic production is less valuable than a multi year stockpile.

nobody is going to stockpile food or consumer goods when you're demonized for charging more for them when the demand goes up. there's no way to do anything but lose money on it.

PS: At the extreme end Honey can be stored for thousands of years at room temperature.

Easier to image with a 1,000,000% tariff: nobody would actually pay the tariff, so there's no dividend to distribute. Yet, you get an economic impact.

You still get deadweight losses from lower tariff levels.

Further, unlike a direct subsidy it’s adding tax revenue.

I don't see a connection between tarrifs and risk in a supply chain. Infamously US autos which refused to adopt Tailorism or other cousin methodologies for reliability wound up being expensive crap compared to Japanese car makers. It is a peripheral variable at best or an irrelevant one at worst.

Tarriffs as a solutio resemble opportunistic timing to not let a crisis go to waste rather than addressing a root cause.

The only reason there's any question who's the richest person in the world is that Sam Walton is dead.

(Trivia) EDES was one of the few users of RPL (RapidGen Programming Language) - Decision Table based, and running on PDP11s and later MicroVaxs.

https://www.cbronline.com/news/sterling_commerce_buys_into_u...

I haven't been at many companies where a customer paid us money specifically to build up capacity for them first. Most of the time I've had to ramp up, we had to pay for it out of investment dollars or scraped out of contracts specifically for deliverables. Even when we special-built a feature for a customer, we still had to find a way to generalize it for others to turn a profit on it, and that was out of pocket.

Apple has apparently paid a number of manufactures to get good at something in exchange for a short lockup period and a permanent discount on orders. Which I think is why when Intel tried to make their first direct Macbook competitor, it turned out their margins were razor thin compared to Apple's.

And enormous expense. You shouldn't have to have Apple money to establish visibility into, and security of, your supply chain. I mean, do you really want to be down in the weeds trying to make sure the coltan isn't essentially coming from Rwandan warlords? Apple can afford that, most people can't.

You could, by default, have lots of visibility in your supply chain. Or you could get a substantial discount in return for giving up on that visibility.

You are arguing that the discount should be smaller?

if you know more companies / projects in this area, I would love to know. It's of course wiser and easier to do b2b in this space, but there's also the dual problem from the consumer side of getting to know the supply chain.

It would be so great to have a portal where I can scan a barcode and get to know the whole chain of production.

I am going to bookmark this thread in anticipation of this phenomenon.

"Nobody could have foreseen what would happen when the world’s second-largest economy went offline and completely shut down external logistics connections."

Exactly what they said about the housing bubble. Honestly, how many people on HN and elsewhere couldn't anticipate this? I think the main thing that has caught everyone by surprise is just how comically unprepared we are for this. And the overwhelming sentiment I've been getting from the memeplex is that this situation is entirely the fault of Trump, when he fired Obama's pandemic team. Not only is this not actually technically true, the idea or insinuation (dog-whistling) that the extension of that team would have mitigated this whole thing seems to be quite unlikely, to put it mildly. Oh yes, of course having this team in place would have improved things - but by how much, and under what counter-factual scenarios?

These are the discussions we need to have, but I don't think Western culture as it is is capable of having them. We need to wake up and realize the human ego is the root of all of these problems.

It is of course both. Global supply chains and JIT delivery have made us more fragile. But China reacted well - locked down a region of 60 M people - then sent in the resources we of 1.5 BN to stop the spread to the rest of the country. Now they are basically hanging on till a vacccine.

USA pandemic teams probably had similar plans - shutdown California for example - in other words steering away from the worst of the icebergs.

Is China's strategy "best"? Hard call to make - especially now. But it beats many many alternatives.

Also Trump 'dependence on China is a huge problem'.

Dependence on <x> (where <x> could be China or many other things) has been an obvious risk across numerous dimensions for a very long time now. Many of these ideas have been discussed here, although not in a manner befitting for the gravity of the matter.

That even on HN we are often unable to engage in unbiased, purely rational discussion has been another big systemic risk that I have been banging the drum about for months. It makes a person start to wonder: what will it take for people to wake up? Maybe it isn't even possible?

Companies already bear the costs and benefits of their resilience. So it's already internalised.

You could, however, pass a law that specifically allowed people to charge whatever prices they can get a customer to agree to pay; and ban all laws outlawing such pricing.

That way you would give companies an incentive to be especially resilient in the face of disruptions.

Right now, you are mostly not allowed to sell hand sanitiser for thousand dollars a bottle. So the incentives to become so resilient that you are still producing when everyone else has shut down and you can charge these kinds of prices, is kind of dulled.

Just want to add that this same story is playing out at the individual level right now, as well. Milk comes from supermarket shelves, not cows.

Supply chain management is like 50%+ of all manufacturing industry. I think you must be responding to the idea of like a hospital not knowing where their masks come from- and I don't think thats the focus of the article.

Carefully sourcing parts is one thing, tracking the whole supply chain of where your suppliers get their materials is another.

Except Walmart