3 ms·

People seem to be under the impression that regulation inevitably means "someone has to review/audit every single change that was made to any aspect of a produc

by cnvogel 10y ago

People seem to be under the impression that regulation inevitably means "someone has to review/audit every single change that was made to any aspect of a product". But in practice there can be all kinds of provisions, from the weak to the strong. A weak provision may be that at least a minimum of development and testing has to take place, with requirements on record-keeping and naming of responsible persons: For a simple device, or a simple software, this might take the form of a checklist or a questionnaire which you have to take before uploading code to the App-Store. Yes, this seems very straightforward to fake, but at least then you have deliberately cheated a system designed to catch errors, and not "just written shitty code" (or built a flimsy mechanical device... when applying this scheme to non-software world). Which, I think, would already help a lot to make people accountable for their products/inventions/... {for, example: with CE certifications, you, as a producer only state that you have built your products according to some harmonized standards, but the conformance itself is not tested by a third party} With increasing security/privacy requirements, the mandated measures can could then be ramped up. Maybe scaled by permissions of an application (accesses otherwise protected data?), the ability to process sensitive date or maybe number of users? The extremes measure would be a full line-by-line review on every change, when software is life-sustaining or a fault may have catastrophic (death of people, like running a pacemaker or steering a huge plane).

pjc50 10y ago
As a producer, CE certification is very disconcerting. I started out with the mindset of "how can I be certain that I'm compliant?", and the best answer is that it simply doesn't work like that. It's more of a question of whether you have enough paperwork to cover yourself in the (pretty unlikely) event of litigation. There's some testing you can do, and you can sort of guess which product categories fit you exactly and apply those, but if your product is really innovative this is vague. You end up just putting a declaration of conformity in the box and a sticker on the product and hoping for the best.
- Gracana 10y ago
  I liked the CE process and thought it was pretty clear. You need to identify hazards and classify them according to probability of occurance and severity, then take appropriate measures to reduce the risk of harm. It's all spelled out pretty well without being a precise code (like NEC or UL 508A or something), so it's flexible enough to apply to whatever domain you're in.
digler999 10y ago
This is how medical devices are regulated. The FDA doesn't micro manage or guide your development. They just say "you must have a quality management system spelled out and stick to it. However it's written you must obey it. "
- coredog64 10y ago
  There's a little more to it. There's some CFR standards that you must adhere to (it's been 12 years, so I don't recall the CFR part number off the top of my head).
tluyben2 10y ago
We have all our code inspected and pen tested under different regulations and certification rules; if you would take that even a bit broader, no software would be written anymore; all programmers would be busy checking code. And this software is not 'that' critical (financial). I would actually agree that life or dead software should be checked line by line by experts, software and well described processes. I would even insist that critical software that can be formally verified should be formally verified. But for a broader range of software this is not possible and well, I don't think it should be needed for innocent software like, say, games. What could work for non critical software is having to pay for bugs if software is faulty based on the severity of the bug. I would be very much against the kind of liability that involves again kind of indirect damages, so the maximum of damage is limited to what you paid. Most people do not want that but you would want to have some or all money back in case of neglect (bugs that do not properly get fixed) without forgoing your license. That will kill companies (if turned back the clock with this rule, MS + Oracle notably) but then again, they won't cut corners like what happens now.

by cnvogel 10y ago

pjc50 10y ago

As a producer, CE certification is very disconcerting. I started out with the mindset of "how can I be certain that I'm compliant?", and the best answer is that it simply doesn't work like that. It's more of a question of whether you have enough paperwork to cover yourself in the (pretty unlikely) event of litigation. There's some testing you can do, and you can sort of guess which product categories fit you exactly and apply those, but if your product is really innovative this is vague. You end up just putting a declaration of conformity in the box and a sticker on the product and hoping for the best.

Gracana 10y ago
I liked the CE process and thought it was pretty clear. You need to identify hazards and classify them according to probability of occurance and severity, then take appropriate measures to reduce the risk of harm. It's all spelled out pretty well without being a precise code (like NEC or UL 508A or something), so it's flexible enough to apply to whatever domain you're in.

digler999 10y ago

This is how medical devices are regulated. The FDA doesn't micro manage or guide your development. They just say "you must have a quality management system spelled out and stick to it. However it's written you must obey it. "

coredog64 10y ago
There's a little more to it. There's some CFR standards that you must adhere to (it's been 12 years, so I don't recall the CFR part number off the top of my head).

tluyben2 10y ago

We have all our code inspected and pen tested under different regulations and certification rules; if you would take that even a bit broader, no software would be written anymore; all programmers would be busy checking code. And this software is not 'that' critical (financial). I would actually agree that life or dead software should be checked line by line by experts, software and well described processes. I would even insist that critical software that can be formally verified should be formally verified. But for a broader range of software this is not possible and well, I don't think it should be needed for innocent software like, say, games. What could work for non critical software is having to pay for bugs if software is faulty based on the severity of the bug. I would be very much against the kind of liability that involves again kind of indirect damages, so the maximum of damage is limited to what you paid. Most people do not want that but you would want to have some or all money back in case of neglect (bugs that do not properly get fixed) without forgoing your license. That will kill companies (if turned back the clock with this rule, MS + Oracle notably) but then again, they won't cut corners like what happens now.