11 ms·

I agree with you, and this is a hard lesson to learn. But I don't think it's necessarily a bad thing. Software should really only be measured by the value it p

by eric_b 9y ago

I agree with you, and this is a hard lesson to learn. But I don't think it's necessarily a bad thing. Software should really only be measured by the value it provides. If a terribly buggy piece of poorly written code still saves hundreds of man hours a week, it's a win. (Unit tests be damned) If that big ball of mud that's using 20 year old technology still prints a billion dollars a year - that's a win. (Microservices be damned) If some slapdash jquery-and-duct-tape web app still solves a specific problem I have, that's a win. (React SPAs be damned) Does crappy software flourish while beautiful software dies? Sometimes. But usually code hygiene, security, bug counts and crashes are not what makes or breaks the success of a piece of software. Developers often think their work is the most important, when in actuality it is usually not. Sometimes you really just are a cog in the machine.

mtpn 9y ago
I’m a web developer in my spare time. I write little things that solve problems in my two day jobs, they haven’t tended to be pretty because often I’m learning as I go and when it works then it’s truly time to move on to the next problem, even though I now know enough to solve the old problem again more elegantly. I’m trying to use better practices and modern JS frameworks in new projects just for experience, even though they are actually overkill in many cases. Certainly the people I work for would rather have two useful utilities written in plain es5 and php than one useful utility plus a story about the code quality. I’m gradually finding the middle ground where somebody call look at my code and not instantly want to take a shower.
- andrei_says_ 9y ago
  Saying all this shows that 1. You care and 2. You know the difference. I’d hire you.
  - mtpn 9y ago
    Good to hear- I’m hoping to switch to full time web development some time in the new year. It's actually my favorite thing at these other jobs.
andrewflnr 9y ago
You're forgetting about ethics. Even if your boss doesn't care about security, if you want to be a decent person, you need to at least try to prevent your system from becoming a tool to harm others.
- koolba 9y ago
  Hanlon’s razor comes through in full force. The vast majority of people making agregrious security errors know no better. You could argue that whoever hired them shares or shoulders the blame, but to suggest they’re not decent people is a stretch. Most I’m sure are. They’re also likely infosec idiots. Now if you know something is terribly insecure, understand what’s involved in fixing it, and go out of your way not to, then yes ethics come into play. I see that the same as an engineer (in the true sense of the word) staying silent on an issue involving automobile brakes that could lead to casualties. The consequences are not 1:1 but the ethical question is in the category.
  - tluyben2 9y ago
    I already have issues when I see something but I know no-one is going to pay to fix it, so what can I do? I report it, no-one cares; I might be able to fix it but then I do this for free. If your bugs can hurt people (financially, physically) I think you need to work a bit harder to make sure it doesn't sneak into your work. Whatever you believe helps there (unit tests, formal verification, ...); if you didn't do all you could do because you are not paid for it (your boss tells you to add features, don't waste time on things that didn't break yet for instance), what should you do? Seems like a real issue for professional coders as there are not so many options; not many companies will pay to prevent these kinds of things unless they had a big issue before already (and someone(s) got fired / sued for it already).
  - andrewflnr 9y ago
    I'm normally on board with Hanlon, but "infosec idiots" who fail to educate themselves on basic security principles are guilty of negligence at best. There's no reasonable way they don't know that security is a real concern, so they should be looking into it. If they still fail, then we can go back to Hanlon's razor. But as one HNer to another, I was really talking about your second case. To claim here that security can ever be discounted, as the person I was replying to implied, is pretty much inexcusable. Everyone here knows that security affects more than just your business, so no one here should be solely applying business logic to it.
Terr_ 9y ago
> Software should really only be measured by the value it provides. The problem is when the "negative value" is externalized leading to false evaluations. "Oops, so sorry we leaked all your social security numbers. Our bad."
- joe_the_user 9y ago
  Yes, the "software should really only be measured by the value it provides" attitucde is kind of the key problem we're facing in a whole lot fields. Because it's not really the value overall the software provides that's being talked about but the instantaneous, immediately visible payoff to a single consumer that software, the people or that consumables are getting judged by. If the software is going to result in trouble over time, if it's going to have security holes that will cost a lot over time, if it's going to commit you to garbage that's updated less and less frequently, etc. None of this calculated. Just as the health costs of sugary drinks don't get calculated, the social costs of poor education don't get calculated, etc.
  - synotna 9y ago
    It's up to regulation - self or government imposed - to factor externalities in, change society and/or change the law
    - dorgo 9y ago
      Somehow I never consider to solve a problem by delegating it to government or society. My first thought is always: there must be a technical solution for this. Even government and society are going to be solved by technology: crypto/blockchain or something which will evolve out of it.
      - joe_the_user 9y ago
        There's no tech that specifically gets people to do the right thing. There's tech that might make people do things but that tech can be harnessed to get people to do either right or wrong things.
myrloc 9y ago
This, ironic enough, is my main motivation to improve my software development skills, from algorithms to system design to development patterns. Because, like first impressions, the first write is the most important. If it's done well the first time around, the true risk of missing an improvement upon the next iteration is significantly lowered. Edit: also the reason I'd like an ongoing education in basic security for app devs
CodeMage 9y ago
This is what I call the Mediocre Mercenary Mentality, this idea that "as long as we can make money off of it, it's good enough". This mentality is the reason why sometimes -- but not always! -- my phone won't play music in my car until I restart the _car_. This mentality is why game development companies get away with charging full price for unfinished, bug-ridden games with crippled features and missing content. This mentality is the reason why I couldn't see my credit card in the list of my accounts on my credit union's online banking site for several days. This mentality is why Experian and Equifax don't report the same credit score for me. This mentality is why I feel ashamed every time a receptionist apologizes for the wait, because they "have been having problems with the system." Most importantly, this mentality is why I have to worry about whether someone will steal my identity because people keep writing shitty code on top of shitty code and my personal information keeps getting leaked. When I'm so disgusted by my own profession, no wonder I ended up burned out.
- dpc59 9y ago
  We have an economic system where we reward maximizing short term financial gain. As long as that doesn't change companies will try to sell the crappiest shit they can sell you for the most money.
  - SpEd3Y 9y ago
    I think this is more than just the economic system. If you look at people in general, we live in the age of instant gratification. We want everything fast! Nobody is willing to put in the work and get the reward after a longer period of time... No! We want results now! We don't want to wait for the food to be properly cooked, we want it now, so we go for fast food. We don't want to put in 1 year of work to learn something new so we can feel that we achieved something, we want it now, so we play a game where we can 'win' in 30 minutes. We don't want to build a relationship and eventually end up being intimate, we want it now, so we go for 'one night stands'. Then you ask yourself... is it weird that the economic system works the same? That the software industry works the same? :/
    - 9y ago
godzilla82 9y ago
I have a feeling you dont have much experience on working on other peoples code. You have just bundled all kinds of issues into a bucket of "buggy piece of poorly written code". Some of these are outright security vulnerabilities and some make you wonder how was the bug not found so far. Sometimes fixing these issues require a heavy rewrite which cannot be justified as a bug-fix. And how do you justify playing with your customers data by "slapdash jquery-and-duct-tape" techniques.
s73ver_ 9y ago
"Software should really only be measured by the value it provides. If a terribly buggy piece of poorly written code still saves hundreds of man hours a week, it's a win. (Unit tests be damned)" But those bugs could easily lead to mistakes in the output.

by eric_b 9y ago

mtpn 9y ago

I’m a web developer in my spare time. I write little things that solve problems in my two day jobs, they haven’t tended to be pretty because often I’m learning as I go and when it works then it’s truly time to move on to the next problem, even though I now know enough to solve the old problem again more elegantly. I’m trying to use better practices and modern JS frameworks in new projects just for experience, even though they are actually overkill in many cases. Certainly the people I work for would rather have two useful utilities written in plain es5 and php than one useful utility plus a story about the code quality. I’m gradually finding the middle ground where somebody call look at my code and not instantly want to take a shower.

andrei_says_ 9y ago
Saying all this shows that 1. You care and 2. You know the difference. I’d hire you.
- mtpn 9y ago
  Good to hear- I’m hoping to switch to full time web development some time in the new year. It's actually my favorite thing at these other jobs.

andrewflnr 9y ago

You're forgetting about ethics. Even if your boss doesn't care about security, if you want to be a decent person, you need to at least try to prevent your system from becoming a tool to harm others.

koolba 9y ago
Hanlon’s razor comes through in full force. The vast majority of people making agregrious security errors know no better. You could argue that whoever hired them shares or shoulders the blame, but to suggest they’re not decent people is a stretch. Most I’m sure are. They’re also likely infosec idiots. Now if you know something is terribly insecure, understand what’s involved in fixing it, and go out of your way not to, then yes ethics come into play. I see that the same as an engineer (in the true sense of the word) staying silent on an issue involving automobile brakes that could lead to casualties. The consequences are not 1:1 but the ethical question is in the category.
- tluyben2 9y ago
  I already have issues when I see something but I know no-one is going to pay to fix it, so what can I do? I report it, no-one cares; I might be able to fix it but then I do this for free. If your bugs can hurt people (financially, physically) I think you need to work a bit harder to make sure it doesn't sneak into your work. Whatever you believe helps there (unit tests, formal verification, ...); if you didn't do all you could do because you are not paid for it (your boss tells you to add features, don't waste time on things that didn't break yet for instance), what should you do? Seems like a real issue for professional coders as there are not so many options; not many companies will pay to prevent these kinds of things unless they had a big issue before already (and someone(s) got fired / sued for it already).
- andrewflnr 9y ago
  I'm normally on board with Hanlon, but "infosec idiots" who fail to educate themselves on basic security principles are guilty of negligence at best. There's no reasonable way they don't know that security is a real concern, so they should be looking into it. If they still fail, then we can go back to Hanlon's razor. But as one HNer to another, I was really talking about your second case. To claim here that security can ever be discounted, as the person I was replying to implied, is pretty much inexcusable. Everyone here knows that security affects more than just your business, so no one here should be solely applying business logic to it.

Terr_ 9y ago

> Software should really only be measured by the value it provides. The problem is when the "negative value" is externalized leading to false evaluations. "Oops, so sorry we leaked all your social security numbers. Our bad."

joe_the_user 9y ago
Yes, the "software should really only be measured by the value it provides" attitucde is kind of the key problem we're facing in a whole lot fields. Because it's not really the value overall the software provides that's being talked about but the instantaneous, immediately visible payoff to a single consumer that software, the people or that consumables are getting judged by. If the software is going to result in trouble over time, if it's going to have security holes that will cost a lot over time, if it's going to commit you to garbage that's updated less and less frequently, etc. None of this calculated. Just as the health costs of sugary drinks don't get calculated, the social costs of poor education don't get calculated, etc.
- synotna 9y ago
  It's up to regulation - self or government imposed - to factor externalities in, change society and/or change the law
  - dorgo 9y ago
    Somehow I never consider to solve a problem by delegating it to government or society. My first thought is always: there must be a technical solution for this. Even government and society are going to be solved by technology: crypto/blockchain or something which will evolve out of it.
    - joe_the_user 9y ago
      There's no tech that specifically gets people to do the right thing. There's tech that might make people do things but that tech can be harnessed to get people to do either right or wrong things.

myrloc 9y ago

This, ironic enough, is my main motivation to improve my software development skills, from algorithms to system design to development patterns. Because, like first impressions, the first write is the most important. If it's done well the first time around, the true risk of missing an improvement upon the next iteration is significantly lowered. Edit: also the reason I'd like an ongoing education in basic security for app devs

CodeMage 9y ago

This is what I call the Mediocre Mercenary Mentality, this idea that "as long as we can make money off of it, it's good enough". This mentality is the reason why sometimes -- but not always! -- my phone won't play music in my car until I restart the _car_. This mentality is why game development companies get away with charging full price for unfinished, bug-ridden games with crippled features and missing content. This mentality is the reason why I couldn't see my credit card in the list of my accounts on my credit union's online banking site for several days. This mentality is why Experian and Equifax don't report the same credit score for me. This mentality is why I feel ashamed every time a receptionist apologizes for the wait, because they "have been having problems with the system." Most importantly, this mentality is why I have to worry about whether someone will steal my identity because people keep writing shitty code on top of shitty code and my personal information keeps getting leaked. When I'm so disgusted by my own profession, no wonder I ended up burned out.

dpc59 9y ago
We have an economic system where we reward maximizing short term financial gain. As long as that doesn't change companies will try to sell the crappiest shit they can sell you for the most money.
- SpEd3Y 9y ago
  I think this is more than just the economic system. If you look at people in general, we live in the age of instant gratification. We want everything fast! Nobody is willing to put in the work and get the reward after a longer period of time... No! We want results now! We don't want to wait for the food to be properly cooked, we want it now, so we go for fast food. We don't want to put in 1 year of work to learn something new so we can feel that we achieved something, we want it now, so we play a game where we can 'win' in 30 minutes. We don't want to build a relationship and eventually end up being intimate, we want it now, so we go for 'one night stands'. Then you ask yourself... is it weird that the economic system works the same? That the software industry works the same? :/
  - 9y ago

godzilla82 9y ago

I have a feeling you dont have much experience on working on other peoples code. You have just bundled all kinds of issues into a bucket of "buggy piece of poorly written code". Some of these are outright security vulnerabilities and some make you wonder how was the bug not found so far. Sometimes fixing these issues require a heavy rewrite which cannot be justified as a bug-fix. And how do you justify playing with your customers data by "slapdash jquery-and-duct-tape" techniques.

s73ver_ 9y ago

"Software should really only be measured by the value it provides. If a terribly buggy piece of poorly written code still saves hundreds of man hours a week, it's a win. (Unit tests be damned)" But those bugs could easily lead to mistakes in the output.