3 ms·

Meh. That's all I have to say about that. We already have the distinction between software that can actually affect people's lives in a negative/positive way an

Meh. That's all I have to say about that. We already have the distinction between software that can actually affect people's lives in a negative/positive way and software that is merely a nuance or inconvenient. The former is heavily regulated. Mistakes in financial accounting software, healthcare software, or mission critical software such as industrial automation or say launching satellites cause companies to vanish Your task management crud app that crashes every now and then isn't going to cause you to die. Marketing and advertisement software may be a large nuisance, but it isn't killing anyone. I've worked in both environments. The cultures are appropriate for each of the given situations.

jonathankoren 10y ago
No we don't have that distinction. We have places where outsiders, typically from heavily regulated industries like finance, like medicine, like areospace, have imposed testing and validation procedures and best practices onto the software industry. Left to our own devices, we get IoT bullshit like Nest thermostats that randomly turn the temperature down because they turn off[0], security exploit via unneeded running service part 2028, the 9382nd installment of security exploit via default credentials, the 11 millionth edition of buffer overflow security exploit, and the list goes on. These problems screw up not just it, but other systems (see mirari dns ddos, see ransomware, see ransomware on MUNI, see all the other effects from people that coded up things that relied on a ubiquitous persistent internet connection) [0] http://mobile.nytimes.com/2016/01/14/fashion/nest-thermostat-glitch-battery-dies-software-freeze.html?referer= http://mobile.nytimes.com/2016/01/14/fashion/nest-thermostat...
- noir_lord 10y ago
  Completely agree with all of this and it has to be addressed soon.
jdietrich 10y ago
There's no such thing as harmless software any more. Our devices are too interconnected and we are too reliant upon them. Failure modes can cascade in unpredictable ways. "Harmless" systems often contain potentially harmful data; highly sensitive systems often share network resources with IoT junk. Some semi-hypothetical scenarios: A data leak in an appointment management app allows an abusive ex-partner to track down and kill their victim. Mobile malware spread by an in-game advertising network causes a massive DDoS of the cellular network. Some areas are left without cell coverage for several hours while operators scramble to reconfigure their base station equipment; thousands of 911 calls go unanswered until service is resumed. Poor encryption in a chat app allows an oppressive regime to identify, surveil and "disappear" human rights activists. A bug in an integrated logistics management system causes some parcels to be tagged with the wrong attributes. A consignment of temperature-sensitive medicine is inadvertently shipped in an unrefrigerated container; the mistake goes unnoticed until patients start dying, because the "smart" temperature sensor inside the package thought that the shipment was safe to transport at ambient temperatures. A disreputable dating app is hacked and the names of the users published, leading to several suicides. A wifi-enabled printer is connected to the secure side of a hospital network by an unwitting member of staff. The printer is pwned, bringing down the entire network for 36 hours. Two ICU patients die as a result of preventable errors, because their medical records were unavailable. Several models of aftermarket in-car entertainment units are pwned due to an unpatched vulnerability in Android. The units are connected to the CAN-bus in order to use the media controls on the steering wheel. The poorly-written malware intermittently floods the CAN-bus with malformed packets, causing sudden failures of the braking system in several cars. I could go on ad nauseum.
- tener 10y ago
  You are missing the big picture here. The key phrase is: "risk management". Anything that your are doing (or NOT doing) have inherent risks. You should manage those risks. If risk realises you will be losing money (in various ways, including litigation) or other assets (such as reputation, talented people, market share etc.). You can lower your exposure to the risk generally by spending money on it. You can hire more devs, testers, enact better policies, increase auditing etc. You can even buy insurance. What you are advocating for is myopic. You should decrease your risk exposure in a way that is most efficient. It may be with better software, but often this isn't the case. What the public can and should do is to work on the other part of the equation: make the failure more costly. You should "make them pay" - literally. If you could go to out of business or to prison because the software you have delivered is faulty, you will really make sure it isn't. Simple as that. EDIT: a few recent banking regulations are good examples. In general various regulators have demanded that the international banks setup demonstrably independent local companies with appointed heads that are criminally responsible for misdeeds done those local companies. Putting in prisons few developers isn't goint to fix anything - the company will simply hire another few. Threatening the people in power is the way to go.
  - alistairSH 10y ago
    If you could go to out of business or to prison because the software you have delivered is faulty And that's the problem. If a civil engineer designed a bridge that maimed hundreds, he would lose his license. There is no license to be lost for software developers. What will be the cost to the company that built this shoddy justice system software? Will anybody go to jail or be personally held accountable? I doubt it (I can't think of cases where a developer has been personally responsible).
    - tener 10y ago
      If you are going to put to jail a single developer, you may as well put to jail the entire company. That in turn wouldn't be practical or fair. It isn't the developer who has signed the contract to deliver the faulty piece of software that started this whole discussion.

jonathankoren 10y ago

No we don't have that distinction. We have places where outsiders, typically from heavily regulated industries like finance, like medicine, like areospace, have imposed testing and validation procedures and best practices onto the software industry. Left to our own devices, we get IoT bullshit like Nest thermostats that randomly turn the temperature down because they turn off[0], security exploit via unneeded running service part 2028, the 9382nd installment of security exploit via default credentials, the 11 millionth edition of buffer overflow security exploit, and the list goes on. These problems screw up not just it, but other systems (see mirari dns ddos, see ransomware, see ransomware on MUNI, see all the other effects from people that coded up things that relied on a ubiquitous persistent internet connection) [0] http://mobile.nytimes.com/2016/01/14/fashion/nest-thermostat-glitch-battery-dies-software-freeze.html?referer= http://mobile.nytimes.com/2016/01/14/fashion/nest-thermostat...

noir_lord 10y ago
Completely agree with all of this and it has to be addressed soon.

jdietrich 10y ago

There's no such thing as harmless software any more. Our devices are too interconnected and we are too reliant upon them. Failure modes can cascade in unpredictable ways. "Harmless" systems often contain potentially harmful data; highly sensitive systems often share network resources with IoT junk. Some semi-hypothetical scenarios: A data leak in an appointment management app allows an abusive ex-partner to track down and kill their victim. Mobile malware spread by an in-game advertising network causes a massive DDoS of the cellular network. Some areas are left without cell coverage for several hours while operators scramble to reconfigure their base station equipment; thousands of 911 calls go unanswered until service is resumed. Poor encryption in a chat app allows an oppressive regime to identify, surveil and "disappear" human rights activists. A bug in an integrated logistics management system causes some parcels to be tagged with the wrong attributes. A consignment of temperature-sensitive medicine is inadvertently shipped in an unrefrigerated container; the mistake goes unnoticed until patients start dying, because the "smart" temperature sensor inside the package thought that the shipment was safe to transport at ambient temperatures. A disreputable dating app is hacked and the names of the users published, leading to several suicides. A wifi-enabled printer is connected to the secure side of a hospital network by an unwitting member of staff. The printer is pwned, bringing down the entire network for 36 hours. Two ICU patients die as a result of preventable errors, because their medical records were unavailable. Several models of aftermarket in-car entertainment units are pwned due to an unpatched vulnerability in Android. The units are connected to the CAN-bus in order to use the media controls on the steering wheel. The poorly-written malware intermittently floods the CAN-bus with malformed packets, causing sudden failures of the braking system in several cars. I could go on ad nauseum.

tener 10y ago
You are missing the big picture here. The key phrase is: "risk management". Anything that your are doing (or NOT doing) have inherent risks. You should manage those risks. If risk realises you will be losing money (in various ways, including litigation) or other assets (such as reputation, talented people, market share etc.). You can lower your exposure to the risk generally by spending money on it. You can hire more devs, testers, enact better policies, increase auditing etc. You can even buy insurance. What you are advocating for is myopic. You should decrease your risk exposure in a way that is most efficient. It may be with better software, but often this isn't the case. What the public can and should do is to work on the other part of the equation: make the failure more costly. You should "make them pay" - literally. If you could go to out of business or to prison because the software you have delivered is faulty, you will really make sure it isn't. Simple as that. EDIT: a few recent banking regulations are good examples. In general various regulators have demanded that the international banks setup demonstrably independent local companies with appointed heads that are criminally responsible for misdeeds done those local companies. Putting in prisons few developers isn't goint to fix anything - the company will simply hire another few. Threatening the people in power is the way to go.
- alistairSH 10y ago
  If you could go to out of business or to prison because the software you have delivered is faulty And that's the problem. If a civil engineer designed a bridge that maimed hundreds, he would lose his license. There is no license to be lost for software developers. What will be the cost to the company that built this shoddy justice system software? Will anybody go to jail or be personally held accountable? I doubt it (I can't think of cases where a developer has been personally responsible).
  - tener 10y ago
    If you are going to put to jail a single developer, you may as well put to jail the entire company. That in turn wouldn't be practical or fair. It isn't the developer who has signed the contract to deliver the faulty piece of software that started this whole discussion.