Also applies to software supply chains:
https://www.platformsecuritysummit.com/2019/speaker/sherman/
> Today’s software is largely assembled rather than written, and most of the assembly comes from open source components. The creation of components and their inclusion into applications creates a “supply chain” just like in conventional manufacturing. While physical supply chains have well established chains-of-custody to establish properties like refrigeration maintenance, authenticity or spoilage avoidance, the software supply chain is very much a wild, wild west, filled with vulnerabilities that can be (and are) inadvertently inserted into applications. As supply chain risk and mitigations are being explored by government and academia, a larger attack surface is being uncovered that needs to be addressed.
We laugh about golf and Vegas visits, but it's really hard to stab someone in the back when you're used to looking them in the eye. If they're just some suit you meet once every three years? Fuck 'em.
- Counterfeit components, like memory out of spec that creates scaled failures.
- Fake products from the channel.
- Fundamental mistruths with regard to how services are delivered.
- Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester.
- Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work.
- Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token.
- Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets.
Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.
But generally value derives from multiple independent credible verifiable audit mechanisms.
Yes you do. You get exactly what you pay for. If you pay for a dozen of German inspectors who think Chinese factory produces junk that is outside the spec, a dozen of German inspectors with that attitude are going to do inspections. If you do no want to pay those German inspectors, you are not going to get those inspections.
In most of the cases companies do not want to pay for it. Apple manufactures amazing iPhones in China. Apple iPhones easily last 5-6 years. Blu manufactures crappy Android phones. They barely last a year. Apple's iphones cost more to manufacture than Blu phones sell for.
But when you build ongoing relationships, you get benefits from not pushing for the bottom dollar at all costs.
A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.
JS Mill has some interesting observations going back a ways.
Auditing is still recommended.
Ignoring auditing for a moment:
The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly.
But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable.
And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam
This is a classic bait and switch in many online work platforms. The person who interviews for your open contract/role is not the person who does the work.