5 ms·

Real engineers have a system in place for this. It's called "Professional Engineer" and it's managed by NCEES. There is no possible reason that practice canno

Real engineers have a system in place for this. It's called "Professional Engineer" and it's managed by NCEES. There is no possible reason that practice cannot directly apply to software engineering, except for the cultural refusal of software engineers to take responsibility for anything.

avenoir 9y ago
While I agree, how do you apply software engineering practices in a field where a good chunk of the workforce doesn't have formal computer science education?
- ksenzee 9y ago
  Even if the whole workforce had formal computer science degrees, most of us still wouldn't have formal engineering education. The CS programs turn out computer scientists, not professional engineers.
  - nol13 9y ago
    And even if they did have formal engineering education and formal CS degrees and formal whatever most(all?) would still be incapable of writing/designing/implementing bulletproof code.
- stonogo 9y ago
  The same way real engineers work: classroom training in formal engineering, followed by years of experience under an accredited engineer in the field. There is testing at each transition to weed out the skaters. Software engineers don't need to be computer scientists, in the same way civil engineers don't need to be materials scientists. There is a bootstrap process, and even in other industries not all engineers are PEs... but all projects are reviewed and stamped by PEs.
- sidlls 9y ago
  We have literally centuries of history in engineering in the physical sciences to use as an example. This industry resists because it's filled with CS folks who either can't or won't believe that there is anything more to engineering than data structures and algorithms trivia.
flatline 9y ago
I agree in part, but I think there are a few things about this scenario that highlight the problems with software. First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Unfortunately this tends to lower the bar for a first release. Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low.
- solomatov 9y ago
  > First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Sometimes, instead of patching, the software should be decommissioned. Search in the news for planes which were grounded when serious flaws are found. > Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. There're different components for different kinds of requirements. You won't use components for two story buildings, to build a skyscraper. > Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low. If the risks are high, systems shouldn't be deployed. There's a reason we don't allow people to have machine guns for self defense.
wpietri 9y ago
I think one of the problems is that it's just not societally necessary for 95% of software. If a game is shitty or an order entry system crashes occasionally, nobody dies. Nobody really even cares. Normal social and market mechanisms mean most software at least approaches adequacy. In at least some of the areas where we really care about software quality (e.g., banking, medical devices) there are existing regulators who will fuck your shit up if you don't take certain aspects of quality seriously. Which is good, but I think it's part of why we don't have an industry-wide program. Maybe we should take a lesson from Hammurabi: "If a builder build a house for some one, and does not construct it properly, and the house which he built fall in and kill its owner, then that builder shall be put to death. If it kill the son of the owner the son of that builder shall be put to death." [1] The occasional execution would probably make people much more serious about unit testing. [1] http://mcadams.posc.mu.edu/txt/ah/Assyria/Hammurabi.html#Hammurabi.Law.229 http://mcadams.posc.mu.edu/txt/ah/Assyria/Hammurabi.html#Ham...
- otakucode 9y ago
  That would be acceptable if we were talking about buildings, a blue collar job. But if you try to apply it to a white collar executive you're going to run into social resistance of a great magnitude. White collar crime is a social norm and only very rarely even lightly punished. It is, to a degree, expected. White collar crime kills more people and does much more economic damage every year compared to street crime, but our society has established as a norm treating street crime harshly while turning a blind eye to white collar crime. If the builders company gave the builder substandard materials to build with and refused to supply him with the tools needed or the time needed, few will get behind the idea of executing the executive who got his shareholders a 0.1% bump in profitability that quarter through those cuts, no matter who it killed. Just look at Toyotas "unintended acceleration" case. If their firmware engineers had access to static analysis tools (a few grand for a license), the bug would have been pointed out to them immediately. Instead, Toyota hired inexperienced engineers, deprived them of appropriate tooling, and pushed the cars out to the marketplace where they killed people. The result? Toyota was cleared of any wrongdoing. They're computers. They're too complicated. No one can know how they work.
lfowles 9y ago
In fact, there has been a Software Engineering PE exam since 2013. It's not surprising that you don't hear a lot about it because most of the topics on the test would make the average CS student groan (requirements, maintenance, software development lifecycle, etc) https://ncees.org/ncees-introduces-pe-exam-for-software-engineering/ https://ncees.org/ncees-introduces-pe-exam-for-software-engi... Exam specs: https://ncees.org/wp-content/uploads/2015/07/SWE-Apr-2013.pdf https://ncees.org/wp-content/uploads/2015/07/SWE-Apr-2013.pd...
lawnchair_larry 9y ago
This concept is really not at all portable to software, especially security. It's a tempting analogy, but an invalid one.
- stonogo 9y ago
  No, it's not even an analogy. The precise methods and regulations are almost directly transferable. People are doing it. It works. It just needs to be industry-wide.
  - lawnchair_larry 9y ago
    No, it doesn't work at all.

avenoir 9y ago

While I agree, how do you apply software engineering practices in a field where a good chunk of the workforce doesn't have formal computer science education?

ksenzee 9y ago
Even if the whole workforce had formal computer science degrees, most of us still wouldn't have formal engineering education. The CS programs turn out computer scientists, not professional engineers.
- nol13 9y ago
  And even if they did have formal engineering education and formal CS degrees and formal whatever most(all?) would still be incapable of writing/designing/implementing bulletproof code.
stonogo 9y ago
The same way real engineers work: classroom training in formal engineering, followed by years of experience under an accredited engineer in the field. There is testing at each transition to weed out the skaters. Software engineers don't need to be computer scientists, in the same way civil engineers don't need to be materials scientists. There is a bootstrap process, and even in other industries not all engineers are PEs... but all projects are reviewed and stamped by PEs.
sidlls 9y ago
We have literally centuries of history in engineering in the physical sciences to use as an example. This industry resists because it's filled with CS folks who either can't or won't believe that there is anything more to engineering than data structures and algorithms trivia.

flatline 9y ago

I agree in part, but I think there are a few things about this scenario that highlight the problems with software. First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Unfortunately this tends to lower the bar for a first release. Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low.

solomatov 9y ago
> First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Sometimes, instead of patching, the software should be decommissioned. Search in the news for planes which were grounded when serious flaws are found. > Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. There're different components for different kinds of requirements. You won't use components for two story buildings, to build a skyscraper. > Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low. If the risks are high, systems shouldn't be deployed. There's a reason we don't allow people to have machine guns for self defense.

wpietri 9y ago

I think one of the problems is that it's just not societally necessary for 95% of software. If a game is shitty or an order entry system crashes occasionally, nobody dies. Nobody really even cares. Normal social and market mechanisms mean most software at least approaches adequacy. In at least some of the areas where we really care about software quality (e.g., banking, medical devices) there are existing regulators who will fuck your shit up if you don't take certain aspects of quality seriously. Which is good, but I think it's part of why we don't have an industry-wide program. Maybe we should take a lesson from Hammurabi: "If a builder build a house for some one, and does not construct it properly, and the house which he built fall in and kill its owner, then that builder shall be put to death. If it kill the son of the owner the son of that builder shall be put to death." [1] The occasional execution would probably make people much more serious about unit testing. [1] http://mcadams.posc.mu.edu/txt/ah/Assyria/Hammurabi.html#Hammurabi.Law.229 http://mcadams.posc.mu.edu/txt/ah/Assyria/Hammurabi.html#Ham...

otakucode 9y ago
That would be acceptable if we were talking about buildings, a blue collar job. But if you try to apply it to a white collar executive you're going to run into social resistance of a great magnitude. White collar crime is a social norm and only very rarely even lightly punished. It is, to a degree, expected. White collar crime kills more people and does much more economic damage every year compared to street crime, but our society has established as a norm treating street crime harshly while turning a blind eye to white collar crime. If the builders company gave the builder substandard materials to build with and refused to supply him with the tools needed or the time needed, few will get behind the idea of executing the executive who got his shareholders a 0.1% bump in profitability that quarter through those cuts, no matter who it killed. Just look at Toyotas "unintended acceleration" case. If their firmware engineers had access to static analysis tools (a few grand for a license), the bug would have been pointed out to them immediately. Instead, Toyota hired inexperienced engineers, deprived them of appropriate tooling, and pushed the cars out to the marketplace where they killed people. The result? Toyota was cleared of any wrongdoing. They're computers. They're too complicated. No one can know how they work.

lfowles 9y ago

In fact, there has been a Software Engineering PE exam since 2013. It's not surprising that you don't hear a lot about it because most of the topics on the test would make the average CS student groan (requirements, maintenance, software development lifecycle, etc) https://ncees.org/ncees-introduces-pe-exam-for-software-engineering/ https://ncees.org/ncees-introduces-pe-exam-for-software-engi... Exam specs: https://ncees.org/wp-content/uploads/2015/07/SWE-Apr-2013.pdf https://ncees.org/wp-content/uploads/2015/07/SWE-Apr-2013.pd...

lawnchair_larry 9y ago

This concept is really not at all portable to software, especially security. It's a tempting analogy, but an invalid one.

stonogo 9y ago
No, it's not even an analogy. The precise methods and regulations are almost directly transferable. People are doing it. It works. It just needs to be industry-wide.
- lawnchair_larry 9y ago
  No, it doesn't work at all.