5 ms·

If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence. I’ve foun

If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence. I’ve found and reported serious security vulnerabilities to many companies that I’ve worked with, and become very disillusioned with some of the responses. Companies that operate in fields which materially affect people's lives (such as healthcare, finance and telecoms) will deploy software that is so badly designed that there is often no need to break any technical aspect to get access to private and sensitive data. Yet, when I report a breach, the same people who deployed software with broken (or sometimes no) authorisation models, access control, etc, are suddenly competent enough to investigate their own failure. Invariably, they always have perfect logging and reporting that could not possibly have been evaded and which proves that no breach occurred or data was exfiltrated before the vulnerability was reported. If another professional, say an engineer, lawyer, or doctor, had demonstrated the incompetence or negligence in their field that I’ve seen some software developers display (sometimes wilfully - “It’s a feature”), they would never be allowed to work again. Software is now so important that I believe that some of the developers and technical leaders that I have dealt with in resolving security vulnerabilities should never again be allowed to work with software that interacts with personal or sensitive data (or, more generally, with software that could affect human life, safety, or privacy).

benzoate 8y ago
I agree emphatically, and it’s why I’m a member of the BCS (British Computing Society). It’s absurd that we have people building essential public infrastructure with close to no repercussions when their failure screws people over.
- iamben 8y ago
  Controversial opinion, but I'd have little problem with Google (for instance) having anonymised access (and obviously there is _a LOT_ of caveats here) to medical data (again, for instance) in exchange for digitising the NHS (again, for instance). At least you'd have some assurances it worked and was secure. The amount of low ball quotes for government work that I've seen or heard of that go over budget or barely work is a little worrying. I've also seen teams of developers that are by no means first rate; it's little surprise we end up with these failures.
wil421 8y ago
The stack is too large, complicated, and abstracted to put the blame on a single engineer. Vulnerability in struts? Go after the open source engineers. CPU vulnerability? Go after the engineers at AMD and Intel. Bad firmware? Go after the network engineer who setup the box. In a time when even the highest people in companies are basically untouchable, for example Lehman Bros, and you want to start going after the engineers?
- 3pt14159 8y ago
  I keep harping on it, but civil or nuclear engineers have a world of practice we could draw on in software. We just don't. > Buildings are too complicated! > Fabrication problem in struts? Go after the strut manufacturers. > Badly documented connection in column with resulting bracing failure and buckling? Go after the column connection manufacturers. > Bad soil conditions led to improper concrete pile hardening? Go after the geotechnical engineers or concrete placers. And so on. We have building codes with pre-set ways of doing things for a reason. You can go outside of them if you want to, but you take on way more cost. Not just bonding, but design, testing, etc. We also have, gasp, government inspectors. Say it ain't so! But every single domicile or place of work has had them give the thing a look over, but we can't even get them for a company as important as Equifax. The Economist is right about one thing: Data is the new oil. We're the new oilmen. And if you want to understand how they slept at night sweeping global warming under the rug look no further than our own corporations that are resisting regulation at every turn. Always on microphones in almost every home. Televisions that spy on us. Cameras everywhere with facial recognition. Companies that track our phones while we walk around. Hospitals that lose bulk patient records or keep Windows unpatched because "airgaps" then WannaCry hits. Children with anxiety and suicide rates that have sky rocketed. Babies parented by YouTube which for years lacked any oversight on content. Completely unregulated cyberarms market with American companies selling iPhone vulns to corrupt, illiberal states that torture journalists. Hackable cars. Hackable powerplants. Hackable electrical grids. Hackable telephone towers. Hackable satellites. Hackable tanks. Hackable aircraft carriers. This cannot stand.
  - wil421 8y ago
    I agree we should hold companies accountable for everyone one of your hackabels. Broader and faster moving regulation is probably needed in the US around basic software and networking security. I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned.
was_boring 8y ago
This isn't an engineering failure, but a failure of management. Non-technical management has no clue how expensive it is to properly maintain a system and design it for security when all they can see is an output of a widget. In almost every case, it is non-technical management who decide when work stops not the engineer tasked with building it. With that being said, the only way change will come is either through government intervention (but they barely understand the internet, so good luck) or through organized labor movements that then codify it into law. However, there is a large anti-union block within technology so that has it's own challenges. Realistically, nothing will happen within our life time unless there is a crisis that changes the norms or a particularly likable person makes it their life mission.
LiterallyDoge 8y ago
I think this rests on the architect / technical lead to force their minions to use TDD or something similar. You can't expect a noob out of college to be responsible, that's just asking for trouble.
TheCapn 8y ago
I agree. I simply think that if people want to use the "Engineer" moniker then they should be required to abide by the profession's code of ethics. I really want our profession to have a set of standards that people can trust. I have my P.Eng in software engineering (Canadian); people tell me that it is "useless" but I want to be ahead of the professional curve. I think we will see demand for traditional engineering rigor in software. I already know my clients take safety extremely seriously (Industrial automation) and being able to say I belong to our provincial body of engineers does mean something (i think)
cageface 8y ago
We know how to build secure software. It's just very time consuming and expensive. For the most part nobody wants to pay for this so we have a constant stream of hacks instead.

benzoate 8y ago

I agree emphatically, and it’s why I’m a member of the BCS (British Computing Society). It’s absurd that we have people building essential public infrastructure with close to no repercussions when their failure screws people over.

iamben 8y ago
Controversial opinion, but I'd have little problem with Google (for instance) having anonymised access (and obviously there is _a LOT_ of caveats here) to medical data (again, for instance) in exchange for digitising the NHS (again, for instance). At least you'd have some assurances it worked and was secure. The amount of low ball quotes for government work that I've seen or heard of that go over budget or barely work is a little worrying. I've also seen teams of developers that are by no means first rate; it's little surprise we end up with these failures.

wil421 8y ago

The stack is too large, complicated, and abstracted to put the blame on a single engineer. Vulnerability in struts? Go after the open source engineers. CPU vulnerability? Go after the engineers at AMD and Intel. Bad firmware? Go after the network engineer who setup the box. In a time when even the highest people in companies are basically untouchable, for example Lehman Bros, and you want to start going after the engineers?

3pt14159 8y ago
I keep harping on it, but civil or nuclear engineers have a world of practice we could draw on in software. We just don't. > Buildings are too complicated! > Fabrication problem in struts? Go after the strut manufacturers. > Badly documented connection in column with resulting bracing failure and buckling? Go after the column connection manufacturers. > Bad soil conditions led to improper concrete pile hardening? Go after the geotechnical engineers or concrete placers. And so on. We have building codes with pre-set ways of doing things for a reason. You can go outside of them if you want to, but you take on way more cost. Not just bonding, but design, testing, etc. We also have, gasp, government inspectors. Say it ain't so! But every single domicile or place of work has had them give the thing a look over, but we can't even get them for a company as important as Equifax. The Economist is right about one thing: Data is the new oil. We're the new oilmen. And if you want to understand how they slept at night sweeping global warming under the rug look no further than our own corporations that are resisting regulation at every turn. Always on microphones in almost every home. Televisions that spy on us. Cameras everywhere with facial recognition. Companies that track our phones while we walk around. Hospitals that lose bulk patient records or keep Windows unpatched because "airgaps" then WannaCry hits. Children with anxiety and suicide rates that have sky rocketed. Babies parented by YouTube which for years lacked any oversight on content. Completely unregulated cyberarms market with American companies selling iPhone vulns to corrupt, illiberal states that torture journalists. Hackable cars. Hackable powerplants. Hackable electrical grids. Hackable telephone towers. Hackable satellites. Hackable tanks. Hackable aircraft carriers. This cannot stand.
- wil421 8y ago
  I agree we should hold companies accountable for everyone one of your hackabels. Broader and faster moving regulation is probably needed in the US around basic software and networking security. I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned.

was_boring 8y ago

This isn't an engineering failure, but a failure of management. Non-technical management has no clue how expensive it is to properly maintain a system and design it for security when all they can see is an output of a widget. In almost every case, it is non-technical management who decide when work stops not the engineer tasked with building it. With that being said, the only way change will come is either through government intervention (but they barely understand the internet, so good luck) or through organized labor movements that then codify it into law. However, there is a large anti-union block within technology so that has it's own challenges. Realistically, nothing will happen within our life time unless there is a crisis that changes the norms or a particularly likable person makes it their life mission.

LiterallyDoge 8y ago

I think this rests on the architect / technical lead to force their minions to use TDD or something similar. You can't expect a noob out of college to be responsible, that's just asking for trouble.

TheCapn 8y ago

I agree. I simply think that if people want to use the "Engineer" moniker then they should be required to abide by the profession's code of ethics. I really want our profession to have a set of standards that people can trust. I have my P.Eng in software engineering (Canadian); people tell me that it is "useless" but I want to be ahead of the professional curve. I think we will see demand for traditional engineering rigor in software. I already know my clients take safety extremely seriously (Industrial automation) and being able to say I belong to our provincial body of engineers does mean something (i think)

cageface 8y ago

We know how to build secure software. It's just very time consuming and expensive. For the most part nobody wants to pay for this so we have a constant stream of hacks instead.