3 ms·

The stack is too large, complicated, and abstracted to put the blame on a single engineer. Vulnerability in struts? Go after the open source engineers. CPU vu

by wil421 8y ago

The stack is too large, complicated, and abstracted to put the blame on a single engineer. Vulnerability in struts? Go after the open source engineers. CPU vulnerability? Go after the engineers at AMD and Intel. Bad firmware? Go after the network engineer who setup the box. In a time when even the highest people in companies are basically untouchable, for example Lehman Bros, and you want to start going after the engineers?

3pt14159 8y ago
I keep harping on it, but civil or nuclear engineers have a world of practice we could draw on in software. We just don't. > Buildings are too complicated! > Fabrication problem in struts? Go after the strut manufacturers. > Badly documented connection in column with resulting bracing failure and buckling? Go after the column connection manufacturers. > Bad soil conditions led to improper concrete pile hardening? Go after the geotechnical engineers or concrete placers. And so on. We have building codes with pre-set ways of doing things for a reason. You can go outside of them if you want to, but you take on way more cost. Not just bonding, but design, testing, etc. We also have, gasp, government inspectors. Say it ain't so! But every single domicile or place of work has had them give the thing a look over, but we can't even get them for a company as important as Equifax. The Economist is right about one thing: Data is the new oil. We're the new oilmen. And if you want to understand how they slept at night sweeping global warming under the rug look no further than our own corporations that are resisting regulation at every turn. Always on microphones in almost every home. Televisions that spy on us. Cameras everywhere with facial recognition. Companies that track our phones while we walk around. Hospitals that lose bulk patient records or keep Windows unpatched because "airgaps" then WannaCry hits. Children with anxiety and suicide rates that have sky rocketed. Babies parented by YouTube which for years lacked any oversight on content. Completely unregulated cyberarms market with American companies selling iPhone vulns to corrupt, illiberal states that torture journalists. Hackable cars. Hackable powerplants. Hackable electrical grids. Hackable telephone towers. Hackable satellites. Hackable tanks. Hackable aircraft carriers. This cannot stand.
- wil421 8y ago
  I agree we should hold companies accountable for everyone one of your hackabels. Broader and faster moving regulation is probably needed in the US around basic software and networking security. I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned.
  - donaltroddyn 8y ago
    > I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned. Both companies and individual software developers should be held responsible. Professional ethics dictate the behaviour of professionals is almost all fields. Software developers love to use the term engineer, but all other professional engineers have strict professional ethics codes. They usually require evidence of competence, which can be revoked, and require that professional engineers must refuse orders or instructions that they know or reasonably suspect are unlawful, could cause harm, or for which they’re not competent to carry out. If their superiors insist, they must refuse, to the point of termination or resignation. When a professional engineer makes an honest mistake, they are not prohibited from working (unless it stems from extreme incompetence). However, where they are negligent, they are, usually pending remedial training and assessment. They can be additionally criminally responsible where their negligence causes harm. I believe the same should be true of software developers. It would create a sustainable incentive structure, where good developers (who are already rare and in high demand) could refuse unlawful or unethical instructions on the grounds that they would be personally responsible. It would also allow technical leadership to make a stronger business case for developing secure, lawful, ethical software. I also think computing is a human right, and anybody should be allowed to write software. Professional standards and ethics should only apply to the development of software that could affect human life, safety, or privacy.

by wil421 8y ago

3pt14159 8y ago

I keep harping on it, but civil or nuclear engineers have a world of practice we could draw on in software. We just don't. > Buildings are too complicated! > Fabrication problem in struts? Go after the strut manufacturers. > Badly documented connection in column with resulting bracing failure and buckling? Go after the column connection manufacturers. > Bad soil conditions led to improper concrete pile hardening? Go after the geotechnical engineers or concrete placers. And so on. We have building codes with pre-set ways of doing things for a reason. You can go outside of them if you want to, but you take on way more cost. Not just bonding, but design, testing, etc. We also have, gasp, government inspectors. Say it ain't so! But every single domicile or place of work has had them give the thing a look over, but we can't even get them for a company as important as Equifax. The Economist is right about one thing: Data is the new oil. We're the new oilmen. And if you want to understand how they slept at night sweeping global warming under the rug look no further than our own corporations that are resisting regulation at every turn. Always on microphones in almost every home. Televisions that spy on us. Cameras everywhere with facial recognition. Companies that track our phones while we walk around. Hospitals that lose bulk patient records or keep Windows unpatched because "airgaps" then WannaCry hits. Children with anxiety and suicide rates that have sky rocketed. Babies parented by YouTube which for years lacked any oversight on content. Completely unregulated cyberarms market with American companies selling iPhone vulns to corrupt, illiberal states that torture journalists. Hackable cars. Hackable powerplants. Hackable electrical grids. Hackable telephone towers. Hackable satellites. Hackable tanks. Hackable aircraft carriers. This cannot stand.

wil421 8y ago
I agree we should hold companies accountable for everyone one of your hackabels. Broader and faster moving regulation is probably needed in the US around basic software and networking security. I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned.
- donaltroddyn 8y ago
  > I absolutely disagree with the OP about holding individual software engineers responsible and even banning them from ever working in software engineering again. Engineers take orders from management and executives. Even with the loudest protest possible they are often shutdown by higher ups. Sometimes the noisy engineers are replaced by more docile yes types or shunned. Both companies and individual software developers should be held responsible. Professional ethics dictate the behaviour of professionals is almost all fields. Software developers love to use the term engineer, but all other professional engineers have strict professional ethics codes. They usually require evidence of competence, which can be revoked, and require that professional engineers must refuse orders or instructions that they know or reasonably suspect are unlawful, could cause harm, or for which they’re not competent to carry out. If their superiors insist, they must refuse, to the point of termination or resignation. When a professional engineer makes an honest mistake, they are not prohibited from working (unless it stems from extreme incompetence). However, where they are negligent, they are, usually pending remedial training and assessment. They can be additionally criminally responsible where their negligence causes harm. I believe the same should be true of software developers. It would create a sustainable incentive structure, where good developers (who are already rare and in high demand) could refuse unlawful or unethical instructions on the grounds that they would be personally responsible. It would also allow technical leadership to make a stronger business case for developing secure, lawful, ethical software. I also think computing is a human right, and anybody should be allowed to write software. Professional standards and ethics should only apply to the development of software that could affect human life, safety, or privacy.