4 ms·

I think level of safety is higher for other professions; if you mess up as a doctor somebody dies, if you mess up as a lawyer an innocent person goes to jail.

I think level of safety is higher for other professions; if you mess up as a doctor somebody dies, if you mess up as a lawyer an innocent person goes to jail. If you mess up a CRUD app as a junior full-stack developer, prod is broken until somebody fixes it. And you can learn enough to not break prod pretty quickly on the fly. It's a very reversible mistake in comparison.

badrequest 8y ago
You could just as easily conjure up a situation where a junior doctor or lawyer makes a mess of something trivial, while a junior developer put on a major healthcare project could absolutely do some damage to their fellow human beings.
- bbeekley 8y ago
  > a junior developer put on a major healthcare project could absolutely do some damage to their fellow human beings. Any compliant healthcare software project would keep a junior developer very far from the patient -- there are many layers of review, testing and validation that would prevent one developer's mistakes from significantly putting patient health or data at risk. Even senior developers (usually) shouldn't be able to touch stuff that close to patients. A doctor literally has their hands on a patient. There isn't a review pipeline that makes sure a doctor's mistakes are caught before they reach a patient. (That's not to say mistakes that harm patients don't happen in healthcare software, just that it's hard for one developer to cause harm without many others approving it first)
  - quakenul 8y ago
    Interesting perspective. In my mind, the fact that any one developer has the tools to think up, create and launch applications that deeply alter our society, has already done more harm than any single doctor has ever done and probably could ever do (at least by putting his hands on patients).
nbaksalyar 8y ago
It is possible to cause an irreversible disaster with critical software, though, like in the infamous Therac-25 case: https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25
- topkai22 8y ago
  Therac-25 is brought up I like to point out that the Therac-25, which killed 3 people), was released the same year as the Hyatt bridge disaster (https://en.m.wikipedia.org/wiki/Hyatt_Regency_walkway_collapse https://en.m.wikipedia.org/wiki/Hyatt_Regency_walkway_collap...) which killed 114. We really need a new reference case of the potential harm caused by software bugs. Perhaps the recent lion air crash will take that grim mantle.
ghobs91 8y ago
That may be generally the case for now, but as software becomes ingrained in more of our daily lives, especially things like healthcare or autonomous vehicles, bad code could absolutely harm/kill someone.
- yingw787 8y ago
  There is absolutely no situation where safety-critical code will be pushed to production builds without extensive testing, analysis, and verification, if the org standing behind it wants to live. This holds for medical device technology and autonomous vehicles. Furthermore, there is no situation where a junior full-stack developer with five months of experience will get anywhere near these systems, let alone write code without thorough code review by senior developers.
  - siscia 8y ago
    What I am worried is the other way around. Non critical software is push into production following reasonable practices for non-critical software. Then, with time, what was once non-critical became the stonewall of a much larger and complex systems and now it is a really "non-critical" system that powers other critical systems.
  - saagarjha 8y ago
    > There is absolutely no situation where safety-critical code will be pushed to production builds without extensive testing, analysis, and verification, if the org standing behind it wants to live. One would hope so, but I'm not quite as confident as you are…
  - digikata 8y ago
    Except for Uber automated cars... but in general I agree with you. The safety critical development areas are generally wrapped in safety critical processes with extensive process checks, and I would suspect Uber now has better practices.
  - paultopia 8y ago
    Didn't the Patriot Missile start missing because of floating point mishandling?
britch 8y ago
I couldn't pay a late bill once because my ISP's website was down for several days. Luckily for me I could afford the fine. Imagine if this is your power company and a bugged website means you can't pay your bill before your power goes out. Problems in prod can have affect people's lives.
mars4rp 8y ago
I think parent's examples are not so great. let me list some for you: CPA, even for being a barber you need to go to school for 2 years and get a degree, electricians, if you even want to work on nail, you need to be certified!!!!!
- yingw787 8y ago
  CPA: You do it wrong, IRS audits you for years. Barber: You hold a sharp object to somebody's head wrong, you could take out a chunk of scalp. If you're malicious, you could do more. Electricians: You do it wrong, you can literally fuse your corpse to the thing you were working on. All of these are greater consequences than having prod going down. In these fields, things can go very wrong very fast, and all these professions are right to same some form of certification.
  - CryptoPunk 8y ago
    Barber: you don't need a two year degree to learn how to use scissors on someone's hair without cutting into their scalp. This is something anyone with basic motor skills can do. And if you're malicious, you can just as easily run out into the street with scissors and start stabbing people. You don't need to get a job as a barber to give yourself that opportunity. >>In these fields, things can go very wrong very fast, and all these professions are right to same some form of certification. Licensing is not the same as certification. Licensing means you are forbidden from doing something until you meet certain conditions. In any occupation where the parties subjected to risk are consenting to that risk, there's no possible justification for such a restriction that doesn't involve a paternalistic argument that people should have their liberty curtailed by the state for their own good.
Mountain_Skies 8y ago
That is exactly why I required all of my software engineering students to write a research paper on software flaws that injured or killed people. I wish I could be more confident that all companies producing products that can harm people spent the time and money necessary to discover and remediate all defects but corners are cut all too often and the lure of cheap labor is just too tempting to resist. Maybe Boeing and Airbus will never have an Ada developer make an error that kills a plane full of people but there's already a push for javascript to be used in embedded systems and I'm sure it's coming from someone seeing the large numbers of javascript programmers coming out of coding boot camps and similar programs.
- afarrell 8y ago
  > spent the time and money to remediate all defects Surely you mean to design systems with modularity that helps RAM-limited brains made of meat to avoid defects and defense-in-depth which reduces the impact of defects.

badrequest 8y ago

You could just as easily conjure up a situation where a junior doctor or lawyer makes a mess of something trivial, while a junior developer put on a major healthcare project could absolutely do some damage to their fellow human beings.

bbeekley 8y ago
> a junior developer put on a major healthcare project could absolutely do some damage to their fellow human beings. Any compliant healthcare software project would keep a junior developer very far from the patient -- there are many layers of review, testing and validation that would prevent one developer's mistakes from significantly putting patient health or data at risk. Even senior developers (usually) shouldn't be able to touch stuff that close to patients. A doctor literally has their hands on a patient. There isn't a review pipeline that makes sure a doctor's mistakes are caught before they reach a patient. (That's not to say mistakes that harm patients don't happen in healthcare software, just that it's hard for one developer to cause harm without many others approving it first)
- quakenul 8y ago
  Interesting perspective. In my mind, the fact that any one developer has the tools to think up, create and launch applications that deeply alter our society, has already done more harm than any single doctor has ever done and probably could ever do (at least by putting his hands on patients).

nbaksalyar 8y ago

It is possible to cause an irreversible disaster with critical software, though, like in the infamous Therac-25 case: https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25

topkai22 8y ago
Therac-25 is brought up I like to point out that the Therac-25, which killed 3 people), was released the same year as the Hyatt bridge disaster (https://en.m.wikipedia.org/wiki/Hyatt_Regency_walkway_collapse https://en.m.wikipedia.org/wiki/Hyatt_Regency_walkway_collap...) which killed 114. We really need a new reference case of the potential harm caused by software bugs. Perhaps the recent lion air crash will take that grim mantle.

ghobs91 8y ago

That may be generally the case for now, but as software becomes ingrained in more of our daily lives, especially things like healthcare or autonomous vehicles, bad code could absolutely harm/kill someone.

yingw787 8y ago
There is absolutely no situation where safety-critical code will be pushed to production builds without extensive testing, analysis, and verification, if the org standing behind it wants to live. This holds for medical device technology and autonomous vehicles. Furthermore, there is no situation where a junior full-stack developer with five months of experience will get anywhere near these systems, let alone write code without thorough code review by senior developers.
- siscia 8y ago
  What I am worried is the other way around. Non critical software is push into production following reasonable practices for non-critical software. Then, with time, what was once non-critical became the stonewall of a much larger and complex systems and now it is a really "non-critical" system that powers other critical systems.
- saagarjha 8y ago
  > There is absolutely no situation where safety-critical code will be pushed to production builds without extensive testing, analysis, and verification, if the org standing behind it wants to live. One would hope so, but I'm not quite as confident as you are…
- digikata 8y ago
  Except for Uber automated cars... but in general I agree with you. The safety critical development areas are generally wrapped in safety critical processes with extensive process checks, and I would suspect Uber now has better practices.
- paultopia 8y ago
  Didn't the Patriot Missile start missing because of floating point mishandling?

britch 8y ago

I couldn't pay a late bill once because my ISP's website was down for several days. Luckily for me I could afford the fine. Imagine if this is your power company and a bugged website means you can't pay your bill before your power goes out. Problems in prod can have affect people's lives.

mars4rp 8y ago

I think parent's examples are not so great. let me list some for you: CPA, even for being a barber you need to go to school for 2 years and get a degree, electricians, if you even want to work on nail, you need to be certified!!!!!

yingw787 8y ago
CPA: You do it wrong, IRS audits you for years. Barber: You hold a sharp object to somebody's head wrong, you could take out a chunk of scalp. If you're malicious, you could do more. Electricians: You do it wrong, you can literally fuse your corpse to the thing you were working on. All of these are greater consequences than having prod going down. In these fields, things can go very wrong very fast, and all these professions are right to same some form of certification.
- CryptoPunk 8y ago
  Barber: you don't need a two year degree to learn how to use scissors on someone's hair without cutting into their scalp. This is something anyone with basic motor skills can do. And if you're malicious, you can just as easily run out into the street with scissors and start stabbing people. You don't need to get a job as a barber to give yourself that opportunity. >>In these fields, things can go very wrong very fast, and all these professions are right to same some form of certification. Licensing is not the same as certification. Licensing means you are forbidden from doing something until you meet certain conditions. In any occupation where the parties subjected to risk are consenting to that risk, there's no possible justification for such a restriction that doesn't involve a paternalistic argument that people should have their liberty curtailed by the state for their own good.

Mountain_Skies 8y ago

That is exactly why I required all of my software engineering students to write a research paper on software flaws that injured or killed people. I wish I could be more confident that all companies producing products that can harm people spent the time and money necessary to discover and remediate all defects but corners are cut all too often and the lure of cheap labor is just too tempting to resist. Maybe Boeing and Airbus will never have an Ada developer make an error that kills a plane full of people but there's already a push for javascript to be used in embedded systems and I'm sure it's coming from someone seeing the large numbers of javascript programmers coming out of coding boot camps and similar programs.

afarrell 8y ago
> spent the time and money to remediate all defects Surely you mean to design systems with modularity that helps RAM-limited brains made of meat to avoid defects and defense-in-depth which reduces the impact of defects.