4 ms·

Theoretically yes, but the problem with obscurity is that it creates moral hazard by lowering visibility of all other measures that are or are not taken to prot

Theoretically yes, but the problem with obscurity is that it creates moral hazard by lowering visibility of all other measures that are or are not taken to protect the system. It's not unreasonable to decide that such extra layer of protection is not worth of making your decision makers subject to being able to cut corners as there is no feedback loop for them.

TickleSteve 10y ago
Its only a moral hazard if you don't trust the people who are certifying the system and therefore aren't subject to the obscurity. The trust question is the problem with obscurity. Do you trust the people making it obscure? In this particular case, where safety-critical standards are relatively well known (within the industry) and not themselves obscured, they deserve to be trusted.
- michaelt 10y ago
  As long as "independent certification" companies are selected in a competitive market and paid by the system makers, they can't remove moral hazard - only shift it around. After all, if you're a system maker, why would you hire hardasses who have rejected your products in the past? And if you're a certification house, why would you $$$ on many hours from experienced engineers when you could use fewer hours and junior employees giving you happier customers and higher profit margins at the same time? You can hire "independent" people to tell you what you want in a lot of industries. You want an "independent salary survey" to tell you that $50,000 is the market rate for an experienced programmer, but that your CEO needs a $5 million raise? Or an "independent credit rating agency" to tell you your subprime mortgage backed security is triple-A rated? The free market will happily provide such "independent" reports at the right price.
  - TickleSteve 10y ago
    Very true... that is a real effect... But the government(s) also employs similar agencies to perform the enforcement of the certifications. Its not a perfect system, but its a lot better than the developer-on-the-street realises.
- adrianN 10y ago
  Just like we trusted the people certifying VW's engine control software?
  - TickleSteve 10y ago
    Thats the point. Do we trust them or not? The problem with VW was not a 'bug'. it was a malicious design.

TickleSteve 10y ago

Its only a moral hazard if you don't trust the people who are certifying the system and therefore aren't subject to the obscurity. The trust question is the problem with obscurity. Do you trust the people making it obscure? In this particular case, where safety-critical standards are relatively well known (within the industry) and not themselves obscured, they deserve to be trusted.

michaelt 10y ago
As long as "independent certification" companies are selected in a competitive market and paid by the system makers, they can't remove moral hazard - only shift it around. After all, if you're a system maker, why would you hire hardasses who have rejected your products in the past? And if you're a certification house, why would you $$$ on many hours from experienced engineers when you could use fewer hours and junior employees giving you happier customers and higher profit margins at the same time? You can hire "independent" people to tell you what you want in a lot of industries. You want an "independent salary survey" to tell you that $50,000 is the market rate for an experienced programmer, but that your CEO needs a $5 million raise? Or an "independent credit rating agency" to tell you your subprime mortgage backed security is triple-A rated? The free market will happily provide such "independent" reports at the right price.
- TickleSteve 10y ago
  Very true... that is a real effect... But the government(s) also employs similar agencies to perform the enforcement of the certifications. Its not a perfect system, but its a lot better than the developer-on-the-street realises.
adrianN 10y ago
Just like we trusted the people certifying VW's engine control software?
- TickleSteve 10y ago
  Thats the point. Do we trust them or not? The problem with VW was not a 'bug'. it was a malicious design.