6 ms·

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with

by skewart 10y ago

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professional have done in this case?" Would any reasonable contractor have interpreted those drawings to mean the joists should be spaced 24" apart? Or would a reasonable professional have interpreted it to be 20"? The same standard could be applied to software engineering and data breaches. Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016? I suspect as soon as any amount of precedent is set for lawsuits around "hacking" law firms will push open the floodgates and it will suddenly become very common. In the construction industry the frequency of lawsuits has created a culture where people go to great lengths to reduce their risk of liability. Architects draw deliberately vague details around waterproofing and contractors push to have every detail for how to do things spelled out on paper, so they won't be on the hook if one of the steps in the process is wrong.

sooheon 10y ago
How do architects get away with vague details when lives can be on the line? If they design the building correctly, they should be pushing to make things as explicit as possible so that when contractors make a mistake it is clear where the fault is. It seems unprofessional that they'd be pushing in the other direction.
- skewart 10y ago
  For context, the majority of lawsuits in construction involve defects that are far from life threatening. Waterproofing, insulation, or, say, windows not working quite right are more common. There could be millions of dollars at stake because a defective building is worth less as an asset, but there are rarely lives on the line. I don't think many architects would be comfortable taking risks with critical structural details. Also, even if a firm isn't found technically liable for a deadly building failure it can still be very bad for business. That said I'm sure some architects still put people's lives at risk to avoid liability. I suspect it's similar any other industry where, sometimes, collectively people in a company put the public at risk for the sake of financial gain - pharmaceutical companies, manufacturers, mining companies, etc. No individual feels personally responsible.
- porlw 10y ago
  Typically an architect's design would need to be signed off by a structural engineer before construction begins. The structural engineer would take on the liability for safety critical aspects of the design. The architect and engineer would presumably collaborate to ensure that the design is at least clear enough to be safely built.
ams6110 10y ago
Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016 You are suggesting that a software engineer should be personally liable for the code he writes, just as a civil engineer is liable when he stamps a blueprint. That would be quite a change for our profession.
- josephg 10y ago
  The reality is that today nobody is responsible for data security. Developers foist the risk onto consumers, who don't have any real choice in the matter, and don't even know what the real risk profile is that they (we) are agreeing to. If you accept that somebody, somewhere needs to be held responsible for data breaches, the most sensible party is us. We have all the domain knowledge and we're the only ones who can actually protect our user's data. And I say this as someone who's spent time in consulting. The prices would necessarily go up in the face of litigation. But I think it would be well worth it - I'd love to be able to financially justify taking extra time to make the systems I build secure. (I make systems secure anyway of course, but I'm competing with companies packed full of General Assembly grads who don't know what a hashing function is yet.)
  - ams6110 10y ago
    So -- national building codes for software? Government instpectors who audit code? Building permits required to even write code, or modify existing code? Doesn't seem to line up very well with "Move fast and break things"
    - josephg 10y ago
      > Doesn't seem to line up very well with "Move fast and break things" When it comes to security around my personal data, I don't want anyone to move fast or break things. Businesses should either not bulk collect identifiable data or treat it with the care and diligence it deserves. And while we're at it if 20 year old self taught rockstar programmers don't have the skills to do that, maybe they should learn. If you're making web software which stores personal information and you can't name 5 of the OWASP top 10 without looking them up, you're a privacy time bomb. I want my personal data far far away from your product. When it comes to security, move slowly and fix your shit.

by skewart 10y ago

sooheon 10y ago

How do architects get away with vague details when lives can be on the line? If they design the building correctly, they should be pushing to make things as explicit as possible so that when contractors make a mistake it is clear where the fault is. It seems unprofessional that they'd be pushing in the other direction.

skewart 10y ago
For context, the majority of lawsuits in construction involve defects that are far from life threatening. Waterproofing, insulation, or, say, windows not working quite right are more common. There could be millions of dollars at stake because a defective building is worth less as an asset, but there are rarely lives on the line. I don't think many architects would be comfortable taking risks with critical structural details. Also, even if a firm isn't found technically liable for a deadly building failure it can still be very bad for business. That said I'm sure some architects still put people's lives at risk to avoid liability. I suspect it's similar any other industry where, sometimes, collectively people in a company put the public at risk for the sake of financial gain - pharmaceutical companies, manufacturers, mining companies, etc. No individual feels personally responsible.
porlw 10y ago
Typically an architect's design would need to be signed off by a structural engineer before construction begins. The structural engineer would take on the liability for safety critical aspects of the design. The architect and engineer would presumably collaborate to ensure that the design is at least clear enough to be safely built.

ams6110 10y ago

Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016 You are suggesting that a software engineer should be personally liable for the code he writes, just as a civil engineer is liable when he stamps a blueprint. That would be quite a change for our profession.

josephg 10y ago
The reality is that today nobody is responsible for data security. Developers foist the risk onto consumers, who don't have any real choice in the matter, and don't even know what the real risk profile is that they (we) are agreeing to. If you accept that somebody, somewhere needs to be held responsible for data breaches, the most sensible party is us. We have all the domain knowledge and we're the only ones who can actually protect our user's data. And I say this as someone who's spent time in consulting. The prices would necessarily go up in the face of litigation. But I think it would be well worth it - I'd love to be able to financially justify taking extra time to make the systems I build secure. (I make systems secure anyway of course, but I'm competing with companies packed full of General Assembly grads who don't know what a hashing function is yet.)
- ams6110 10y ago
  So -- national building codes for software? Government instpectors who audit code? Building permits required to even write code, or modify existing code? Doesn't seem to line up very well with "Move fast and break things"
  - josephg 10y ago
    > Doesn't seem to line up very well with "Move fast and break things" When it comes to security around my personal data, I don't want anyone to move fast or break things. Businesses should either not bulk collect identifiable data or treat it with the care and diligence it deserves. And while we're at it if 20 year old self taught rockstar programmers don't have the skills to do that, maybe they should learn. If you're making web software which stores personal information and you can't name 5 of the OWASP top 10 without looking them up, you're a privacy time bomb. I want my personal data far far away from your product. When it comes to security, move slowly and fix your shit.