17 ms·

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassi

by mfoy_ 9y ago

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

aeorgnoieang 9y ago
I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.
- mfoy_ 9y ago
  No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. What many SVers call "innovation", other industries would call "reckless". How embarrassing for us! EDIT: In terms of regulation, we're practically chiropractors.
  - aeorgnoieang 9y ago
    A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people so it's not clear that the current tradeoffs are optimal. And it's not at all obvious that, overall, regulation does much more than protect incumbents in a given field or industry at the expense of everyone else. Based on my own experience, I've 'known' about regulations that governed the industries with which I've worked. I'm not sure what evidence specifically you or the author have that leads you to believe software developers should be embarrassed.
    - dkersten 9y ago
      > A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people And? Making sure that the bridge will hold under the weight that its required to is demonstrably bad for my profits (if I were the construction company). That doesn't mean that we should loosen the regulations or whatever. We don't owe anyone the right to profits, regulations are meant to protect us and keep the playing field fair. Of course that will always negatively affect someone.
      - jacobr1 9y ago
        It isn't obvious that is a case. Some companies make bad short-term decisions. But many take a longer-term view. Who would hire the construction company again that made the bad bridge? Or consider food and drug regulation. Countries with more lax requirements for proof of drug efficacy and large-scale trails don't have worse health outcomes. In fact, the countries with stricter policy regimes are often slower to have receive life-saving drugs. Does the suppression of a drug with adverse effects that only shows up in a wider population or after more prolonged exposure have a stronger benefit than that the suppression of drugs without such downsides? Often countries optimize in the wrong direction here. Many licensing laws fall in this category too. Do barbers and hair stylists need a license? Probably not to ensure safety and we have plenty of comparable jurisdictions with and without such rules to prove it. People don't just start doing bad things in the absence of rules.
        chopin 9y ago
        Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. Big projects will often be done by a pool of companies. Which would you hold accountable then. As well, some things are so bad that you don't want to punish after the fact.
        aeorgnoieang 9y ago
        > Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. This would be a much more difficult thing for them to do if it was easy to track the history of bad behavior of the relevant people. This seems like something that should be relatively easy to do nowadays, module some probably not-too-significant obstacles like the 'right to be forgotten'. > Big projects will often be done by a pool of companies. Which would you hold accountable then. In the absence of detailed information, one would reasonably hold them all partially accountable. > As well, some things are so bad that you don't want to punish after the fact. There's no perfect way to do this. Murder seems like it's "so bad that you don't want to punish after the fact" but I don't think either of us would want to live in a society that was perfectly capable of preventing any murders.
    - mfoy_ 9y ago
      If we want to accept that privacy is important and valuable then we need to accept that it is not okay for our industry to continue to do what it has been doing. I challenge you to give me an example of some "demonstrably bad" effect caused by "avoiding recklessness" that isn't the direct result of shirking responsibility. To go along with your devil's advocate argument: I could argue that "taking extra measures to ensure the security of sensitive data" would have been "demonstrably bad" for Equifax. But don't you agree that it was extremely irresponsible of them to not do that?
  - chimeracoder 9y ago
    > No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. Eh, not substantially or consistently more than in software. It's possible to cherry-pick examples where engineers in other fields are more aware of relevant regulations, but overall, it's roughly comparable. I'm generally very critical of the move-fast-and-break-things mentality, but engineers in other fields are generally not more knowledgeable about industry regulations than software engineers are.
    - wglb 9y ago
      American engineer building a bridge or tunnel in EU is certainly going to know EU regulations. An EE designing circuits for EU needs to know about lead-free solder requirements. On the other side, Mies van der Rohe needed to work with a US-certified architect to build the Seagrams. Having been in the software industry for a while, it is often discouraging to see how both explicitly and often inadvertently move-fast-and-break-things has resulted in some pretty bad software industry wide. Just look at the sense of most of the comments here--there seems to be a consensus of how to get around this, or how it doesn't apply to me.
      - slededit 9y ago
        EEs everywhere know about ROHS simply because it makes no sense to have seperate designs for Europe and everywhere else. Also lead free solder really isn't that bad...
      - cortesoft 9y ago
        Right, but the point is that you KNOW the country your bridge or tunnel is going to be used in, because you build it there. If I build a web app and deploy it on a server in California, it can immediately be used by people in almost any country in the world. Is it my responsibility to follow the censorship rules from China on my webapp in California? Is it my responsibility to know all the regulations on web apps from Sri Lanka? Building software with care and professionalism is unrelated to understanding all the rules in place all around the world.
  - deleted 9y ago
    [deleted]
  - sbov 9y ago
    The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be implying exist do not exist.
    - DavidHm 9y ago
      The comparison doesn't hold up when developers create solutions that in breach with the regulation of the city and country they live in.
    - mamon 9y ago
      So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.
      - wyager 9y ago
        Ah yes, digital isolationism and segregated networks are great. Have we given up on the idea of the internet being a force for global human interaction? Are vague and impotent privacy protections more important?
        antpls 9y ago
        I live in EU. -> Are vague and impotent privacy protections more important ? More important than "global human interaction" ? Yes, in my opinion. "Global human interaction" doesn't mean it should be the Far-West gold rush. It aims at fair and equal human interactions with the respect for the freedom of each single human on Earth. Freedom means equality for all, and to ensure more equality, we created laws. Laws are not perfect, but sometime they are the only tool we have. Laws are not fixed in stone, they can be improved over-time. Essentially we want global human interaction with respect of individuals.
      - 9y ago
  - wyager 9y ago
    And most of those industries have been stagnant for decades.
- the_mitsuhiko 9y ago
  > I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do. I have plenty of friends and relatives who work in construction or architecture and knowing the building codes and everything related to it is something you learn at university, update every year and is something every person involved in planning and constructing a building is aware of. Lawyers only get involved if a building fails.
  - jlg23 9y ago
    Construction workers and architects don't tend to work internationally. If they do, they hire lawyers to sort out legal requirements for them before they even sign a contract.
    - the_mitsuhiko 9y ago
      The same should be true for most software companies going forward. The approach to just assume it's the obligation of the user to ensure compliance won't work for much longer.
      - woolvalley 9y ago
        Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings, even if the building was made before the law was created. And if you don't comply, they will fine you millions of dollars. McDonalds goes and retrofits all of their buildings in the world because they have shops in the EU at great cost. Some pizza shop that does delivery in the USA, and the owners go on vacation once in a while in Europe? ‍️They probably are not even aware of it. That is what the GDPR is in a nutshell.
        the_mitsuhiko 9y ago
        > Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings You are reaching. I give you a better example: it does not matter where a building part is being produced, if it ends up in a building in Europe it needs to be up to the local building codes and to the regulations of the single market.
nsxwolf 9y ago
And another compliance industry is born.
sanderjd 9y ago
Sure, and it is one of the main reasons those professions require licensure. It seems to me that most people in the industry would like to avoid that for software development. Speaking purely for myself, I would welcome it. But it would be a large and disruptive change that we may not be ready for.
driverdan 9y ago
Developers should already know the "legal and policy landscape." Sending email? You should know the CAN-SPAM act. Do business with CA citizens? You'd better know about CA's privacy policy requirements. Doing ecommerce? You need to learn about sales tax and PCI requirements.
ec109685 9y ago
Not true. Developers should consult with lawers and privacy experts and not try to “know legal and policy landscape” themselves.

by mfoy_ 9y ago

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

aeorgnoieang 9y ago

I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

mfoy_ 9y ago
No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. What many SVers call "innovation", other industries would call "reckless". How embarrassing for us! EDIT: In terms of regulation, we're practically chiropractors.
- aeorgnoieang 9y ago
  A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people so it's not clear that the current tradeoffs are optimal. And it's not at all obvious that, overall, regulation does much more than protect incumbents in a given field or industry at the expense of everyone else. Based on my own experience, I've 'known' about regulations that governed the industries with which I've worked. I'm not sure what evidence specifically you or the author have that leads you to believe software developers should be embarrassed.
  - dkersten 9y ago
    > A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people And? Making sure that the bridge will hold under the weight that its required to is demonstrably bad for my profits (if I were the construction company). That doesn't mean that we should loosen the regulations or whatever. We don't owe anyone the right to profits, regulations are meant to protect us and keep the playing field fair. Of course that will always negatively affect someone.
    - jacobr1 9y ago
      It isn't obvious that is a case. Some companies make bad short-term decisions. But many take a longer-term view. Who would hire the construction company again that made the bad bridge? Or consider food and drug regulation. Countries with more lax requirements for proof of drug efficacy and large-scale trails don't have worse health outcomes. In fact, the countries with stricter policy regimes are often slower to have receive life-saving drugs. Does the suppression of a drug with adverse effects that only shows up in a wider population or after more prolonged exposure have a stronger benefit than that the suppression of drugs without such downsides? Often countries optimize in the wrong direction here. Many licensing laws fall in this category too. Do barbers and hair stylists need a license? Probably not to ensure safety and we have plenty of comparable jurisdictions with and without such rules to prove it. People don't just start doing bad things in the absence of rules.
      - chopin 9y ago
        Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. Big projects will often be done by a pool of companies. Which would you hold accountable then. As well, some things are so bad that you don't want to punish after the fact.
        aeorgnoieang 9y ago
        > Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. This would be a much more difficult thing for them to do if it was easy to track the history of bad behavior of the relevant people. This seems like something that should be relatively easy to do nowadays, module some probably not-too-significant obstacles like the 'right to be forgotten'. > Big projects will often be done by a pool of companies. Which would you hold accountable then. In the absence of detailed information, one would reasonably hold them all partially accountable. > As well, some things are so bad that you don't want to punish after the fact. There's no perfect way to do this. Murder seems like it's "so bad that you don't want to punish after the fact" but I don't think either of us would want to live in a society that was perfectly capable of preventing any murders.
  - mfoy_ 9y ago
    If we want to accept that privacy is important and valuable then we need to accept that it is not okay for our industry to continue to do what it has been doing. I challenge you to give me an example of some "demonstrably bad" effect caused by "avoiding recklessness" that isn't the direct result of shirking responsibility. To go along with your devil's advocate argument: I could argue that "taking extra measures to ensure the security of sensitive data" would have been "demonstrably bad" for Equifax. But don't you agree that it was extremely irresponsible of them to not do that?
- chimeracoder 9y ago
  > No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. Eh, not substantially or consistently more than in software. It's possible to cherry-pick examples where engineers in other fields are more aware of relevant regulations, but overall, it's roughly comparable. I'm generally very critical of the move-fast-and-break-things mentality, but engineers in other fields are generally not more knowledgeable about industry regulations than software engineers are.
  - wglb 9y ago
    American engineer building a bridge or tunnel in EU is certainly going to know EU regulations. An EE designing circuits for EU needs to know about lead-free solder requirements. On the other side, Mies van der Rohe needed to work with a US-certified architect to build the Seagrams. Having been in the software industry for a while, it is often discouraging to see how both explicitly and often inadvertently move-fast-and-break-things has resulted in some pretty bad software industry wide. Just look at the sense of most of the comments here--there seems to be a consensus of how to get around this, or how it doesn't apply to me.
    - slededit 9y ago
      EEs everywhere know about ROHS simply because it makes no sense to have seperate designs for Europe and everywhere else. Also lead free solder really isn't that bad...
    - cortesoft 9y ago
      Right, but the point is that you KNOW the country your bridge or tunnel is going to be used in, because you build it there. If I build a web app and deploy it on a server in California, it can immediately be used by people in almost any country in the world. Is it my responsibility to follow the censorship rules from China on my webapp in California? Is it my responsibility to know all the regulations on web apps from Sri Lanka? Building software with care and professionalism is unrelated to understanding all the rules in place all around the world.
- deleted 9y ago
  [deleted]
- sbov 9y ago
  The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be implying exist do not exist.
  - DavidHm 9y ago
    The comparison doesn't hold up when developers create solutions that in breach with the regulation of the city and country they live in.
  - mamon 9y ago
    So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.
    - wyager 9y ago
      Ah yes, digital isolationism and segregated networks are great. Have we given up on the idea of the internet being a force for global human interaction? Are vague and impotent privacy protections more important?
      - antpls 9y ago
        I live in EU. -> Are vague and impotent privacy protections more important ? More important than "global human interaction" ? Yes, in my opinion. "Global human interaction" doesn't mean it should be the Far-West gold rush. It aims at fair and equal human interactions with the respect for the freedom of each single human on Earth. Freedom means equality for all, and to ensure more equality, we created laws. Laws are not perfect, but sometime they are the only tool we have. Laws are not fixed in stone, they can be improved over-time. Essentially we want global human interaction with respect of individuals.
    - 9y ago
- wyager 9y ago
  And most of those industries have been stagnant for decades.
the_mitsuhiko 9y ago
> I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do. I have plenty of friends and relatives who work in construction or architecture and knowing the building codes and everything related to it is something you learn at university, update every year and is something every person involved in planning and constructing a building is aware of. Lawyers only get involved if a building fails.
- jlg23 9y ago
  Construction workers and architects don't tend to work internationally. If they do, they hire lawyers to sort out legal requirements for them before they even sign a contract.
  - the_mitsuhiko 9y ago
    The same should be true for most software companies going forward. The approach to just assume it's the obligation of the user to ensure compliance won't work for much longer.
    - woolvalley 9y ago
      Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings, even if the building was made before the law was created. And if you don't comply, they will fine you millions of dollars. McDonalds goes and retrofits all of their buildings in the world because they have shops in the EU at great cost. Some pizza shop that does delivery in the USA, and the owners go on vacation once in a while in Europe? ‍️They probably are not even aware of it. That is what the GDPR is in a nutshell.
      - the_mitsuhiko 9y ago
        > Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings You are reaching. I give you a better example: it does not matter where a building part is being produced, if it ends up in a building in Europe it needs to be up to the local building codes and to the regulations of the single market.

nsxwolf 9y ago

And another compliance industry is born.

sanderjd 9y ago

Sure, and it is one of the main reasons those professions require licensure. It seems to me that most people in the industry would like to avoid that for software development. Speaking purely for myself, I would welcome it. But it would be a large and disruptive change that we may not be ready for.

driverdan 9y ago

Developers should already know the "legal and policy landscape." Sending email? You should know the CAN-SPAM act. Do business with CA citizens? You'd better know about CA's privacy policy requirements. Doing ecommerce? You need to learn about sales tax and PCI requirements.

ec109685 9y ago

Not true. Developers should consult with lawers and privacy experts and not try to “know legal and policy landscape” themselves.