4 ms·

I've been saying for years that software engineering needs to be elevated to the same standards held by other engineering fields; like civil, mechanical, biomed

by tbabb 9y ago

I've been saying for years that software engineering needs to be elevated to the same standards held by other engineering fields; like civil, mechanical, biomedical, and so on: If an engineer or a firm is negligent and people die and/or millions of dollars are lost, they are kicked out of the industry/lose their right to operate as a business. For example: To work on cryptography and security, you need a degree and to have passed certification, perhaps at regular multi-year intervals. Then if you build a login page and store the unsalted passwords in plain text and someone pwns your site, you lose your license, could be fined, sued, or possibly go to jail if your negligence is criminal. Then, if you are a company and you need a login system, you either (a) hire certified software engineers to write one, (b) subcontract a certified firm, or (c) license a certified off-the-shelf solution. If pwnage happens, the company is liable if they failed to do one those things. Therefore it becomes in the interest of companies to do security correctly, and of engineers to only attempt it if they are competent and qualified. It's really simple: In other fields of engineering, there are consequences if you fuck up. If you design a bridge that falls down and kills people, you lose your career, are sued, and/or go to jail. Not so in CS. That needs to change.

nitrogen 9y ago
Consequences and credentialism don't have to go hand in hand. Software's lack of credentialism is what allows so many to rise above their circumstances, break through class barriers, etc.
- tbabb 9y ago
  Somehow I doubt you would apply that argument to designing bridges, or medical practice, or airline piloting, or bus driving, or law, or any of a zillion other professions where credentials are normal and essential to safety and liability. We don't let random schmoes do those other things-- aspiring and starry-eyed or not-- without first proving that they know what they're doing. We certainly don't wait until the bridge has fallen down or the plane has crashed or the patient has died before we put a burden on the professional to certify their competence. I don't think it's unreasonable to mandate rigorous certification for life-critical, security-critical, and financial software engineering. You can write a cookie clicker with a high school degree and put it online if you want. But the moment your cookie clicker takes credit card numbers, you should be legally obligated to know what you are doing or hire someone who does.
  - dictum 9y ago
    When did Facebook, Equifax et al start hiring random schmoes, or more charitably, people who don't know what they're doing?
    - tbabb 9y ago
      One could argue from inspection that, when it comes to security, Equifax's talent is scarcely better than random schmoes, yes. But it's not just about preventing the hiring of "random schmoes". It's about legally formalizing responsibility and accountability, and the incentive structure that arises from that. As before, this is well-tested in other professions. Facebook might have made difference decisions if they had special legal obligations regarding "the handling of sensitive personal information." Perhaps their engineers would have thought twice about giving unfettered access to third party APIs if they knew that a breach down the line could ruin their careers.
  - nitrogen 9y ago
    I would apply the same logic to a lot of professions, actually. If you can do the job, you should be able to. Standards already exist that can be enforced without credentialing. PCI regulates credit card handling, HIPAA regulates health info, etc.
    - dragonwriter 9y ago
      Both PCI and HIPAA have credentialing (and HIPAA has a statutory mandate to require it, though the implementing regulations have not been adopted on the timeline mandated in the statute, and presumably won't be now since the Trump Administration seems to be applying the same neglect and sabotage approach to the required updates to HIPAA standards as to most of the ACA, perhaps because some of the requirements for the former were adopted with the latter or related bills.)

by tbabb 9y ago

nitrogen 9y ago

Consequences and credentialism don't have to go hand in hand. Software's lack of credentialism is what allows so many to rise above their circumstances, break through class barriers, etc.

tbabb 9y ago
Somehow I doubt you would apply that argument to designing bridges, or medical practice, or airline piloting, or bus driving, or law, or any of a zillion other professions where credentials are normal and essential to safety and liability. We don't let random schmoes do those other things-- aspiring and starry-eyed or not-- without first proving that they know what they're doing. We certainly don't wait until the bridge has fallen down or the plane has crashed or the patient has died before we put a burden on the professional to certify their competence. I don't think it's unreasonable to mandate rigorous certification for life-critical, security-critical, and financial software engineering. You can write a cookie clicker with a high school degree and put it online if you want. But the moment your cookie clicker takes credit card numbers, you should be legally obligated to know what you are doing or hire someone who does.
- dictum 9y ago
  When did Facebook, Equifax et al start hiring random schmoes, or more charitably, people who don't know what they're doing?
  - tbabb 9y ago
    One could argue from inspection that, when it comes to security, Equifax's talent is scarcely better than random schmoes, yes. But it's not just about preventing the hiring of "random schmoes". It's about legally formalizing responsibility and accountability, and the incentive structure that arises from that. As before, this is well-tested in other professions. Facebook might have made difference decisions if they had special legal obligations regarding "the handling of sensitive personal information." Perhaps their engineers would have thought twice about giving unfettered access to third party APIs if they knew that a breach down the line could ruin their careers.
- nitrogen 9y ago
  I would apply the same logic to a lot of professions, actually. If you can do the job, you should be able to. Standards already exist that can be enforced without credentialing. PCI regulates credit card handling, HIPAA regulates health info, etc.
  - dragonwriter 9y ago
    Both PCI and HIPAA have credentialing (and HIPAA has a statutory mandate to require it, though the implementing regulations have not been adopted on the timeline mandated in the statute, and presumably won't be now since the Trump Administration seems to be applying the same neglect and sabotage approach to the required updates to HIPAA standards as to most of the ACA, perhaps because some of the requirements for the former were adopted with the latter or related bills.)