7 ms·
If you want individual programmers to be "held accountable" for bugs they write, it seems that you do not consider their employers or managers even to be involv
by pekk 10y ago
If you want individual programmers to be "held accountable" for bugs they write, it seems that you do not consider their employers or managers even to be involved. This is an overly-simplistic understanding of where bugs come from.
Your argument depends on the premise that Rust is necessarily better than (say) C. If it turns out that Rust has a bug in it (it's software, it should have bugs, and it's relatively new software as well), then should the programmer who chose it over something else be liable? What if the alternative were an extremely rigid discipline for C programming using a very mature toolchain? I suspect your evidence for Rust being safer isn't worth taking to court.
Thought experiment: if an Evil Dictator simply killed programmers for writing software that contained bugs, would it give rise to a race of perfect programmers? Or would it crush the industry and impair the economy? Would you stake your life on Rust being bug-free? But you can financially ruin almost any engineer for life with the value of a suit for 100,000 credit card numbers. Under that regime, engineers who assumed all the risk would reasonably expect a much larger share of the profits. Are you starting to understand why programmers are not held individually liable for every bug they write?
- SpaceManiac 10y agoMaybe I read it differently, but it seems to me that GP us more concerned with the institutional bias and the attitude rather than anything relating to legal liability... the programmer is allowed to get away with believing that they are taking responsibility for the security of their code, but never feels any consequences for failure, and thus believes they are doing a good job when they are not.
- naasking 10y agoThat's phrasing it better than my original rushed comment, thanks. This insular environment doesn't tend to incentivise responsible choices in software development or in deployment. Perhaps liability is one way to address it, but hardly the only way. "Engineer" here in Canada is a protected term and you must belong to the society of professional engineers (P.eng), which carries various legal responsibilities when signing off on work. Requiring code reviews by a P.eng creates a whole different set of incentives, which would emphasise languages that are more expressive, clearer and easier to audit because the P.eng's time is way more costly than the whining of a software developer that wants to squeak 1% more performance out of his inner loops.
- naasking 10y ago> If you want individual programmers to be "held accountable" for bugs they write, it seems that you do not consider their employers or managers even to be involved. This is an overly-simplistic understanding of where bugs come from. It's not overly simplistic to point out that at least 80% of security vulnerabilities would never have happened if the program had been written in a memory safe language. That's not a management problem, that's an institutionalised programmer bias. And my argument does not depend on Rust at all. Plenty of safer alternatives to C exist, like Ada, or heck, Frama-C verification of C code. These tools aren't well known or sufficiently funded because of your exact type of bias that there's nothing wrong with choosing C.
- bitwize 10y agoIndividual engineers are held accountable -- sometimes criminally -- for bridges they design. Why shouldn't we do the same for programmers -- make it a licensed and bonded profession with serious consequences for screwing up? It could go a long way towards cleaning up the crappy practices which are accepted as normal for the field. Silicon Valley techie culture has long afforded programmers too much freedom. They serve the public and should be held accountable to the public.