5 ms·

You really need the software version of a building or fire code so that no individual company can gain a competitive advantage by skipping out on security.

dcow 5y ago
Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.
- R0b0t1 5y ago
  Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).
  - dcow 5y ago
    What? The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume of people from participating. Rather, incorporate a credentialing system so that maybe your fresh grad or boot-camper isn’t working 18hr days on standing up core infrastructure without the experience to push back against manipulative management or ridiculous client timelines. Prioritizing security will only happen if all engineers require it (otherwise you’d be undercut by someone who doesn't care). That’s why you need governance. We all have to be on the same page about security and reliability and it just happens that not everyone is equally qualified to do security or has the edge to build really reliable systems. And sometimes engineers just need to be protected from themselves even if they are experienced and qualified. It’s easy to say you’ll do that later when there aren’t immediate consequences for not. And we all know how often “later” becomes “never”. Nothing I’ve described prevents innovation. You can still build your sloppy app really fast and throw it at the wall because it’s probably not doing anything important. But if you’re getting hired commissioned whatever to build real software that keeps industrial systems running or puts things in space or handles personal information or blasts messages at millions of people all at once, etc., there should be a framework to help you communicate costs to people. Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. As much as I hate the fact that we depend so much on oil, the industry is fundamentally important and the software that operates it should be secure because people run the gas stations when it’s not. You cant really make the argument that the oil industry only happened because some disruptive college kids got together in their garage and had ambition in the face of an unregulated dreamscape. And it’s not like the oil industry cant afford to pay for security.
    - EricE 5y ago
      >I’d like to treat software engineering like a real engineering profession. I tend to lean libertarian/free market more than anything else, but yes - it's well past time for computer "science" to be more than a cheap label. No one likes to have insurance so we mandate minimums are purchased so affected people have a chance of being made whole. Same thing with software. Why is a critical gas pipeline down for weeks after a ransomware attack? Why wasn't the company able to enact their disaster recovery plan, plow over their network and restore from backup? Probably because they have backups that have never been tested, systems that aren't even being backed up and if they have a disaster recovery play it probably exists as pure fiction and not as something that is routinely tested and updated to keep up with the state of their operating environment. I would say the above is business management 101 but to most organizations it's burdensome overhead they don't need to worry about because nothing could ever happen to them, right?
      - R0b0t1 5y ago
        I have little issue with insurance. Smart businesses ask for it anyway, and you can buy insurance for basically anything, including failure to deliver. The problem arises when you mandate credentialism through legislation.
    - R0b0t1 5y ago
      Buddy, most things don't get hacked. It's true they don't get hacked mostly by virtue of nobody caring but assuming the market is efficient then the opportunity cost of these bad things happening must be very low. In this case a disaster recovery plan existed and was used. They did their job by preparing unknown unknowns, get off your high horse. > Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. I never took exception to this, the issue is that e.g. building codes in many areas have become highly specific and overdone to the point of preventing investment in housing. What slapped me in the face with this was a YTer who was going into the family business of building code inspection. You need an engineering degree yet exercise no critical thinking over what is actually happening, and the father seemed to relish in how much he was costing people when telling them to fix basically cosmetic issues. There's issues in healthcare, like doctors being overtrained and artificially scarce.

dcow 5y ago

Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.

R0b0t1 5y ago
Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).
- dcow 5y ago
  What? The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume of people from participating. Rather, incorporate a credentialing system so that maybe your fresh grad or boot-camper isn’t working 18hr days on standing up core infrastructure without the experience to push back against manipulative management or ridiculous client timelines. Prioritizing security will only happen if all engineers require it (otherwise you’d be undercut by someone who doesn't care). That’s why you need governance. We all have to be on the same page about security and reliability and it just happens that not everyone is equally qualified to do security or has the edge to build really reliable systems. And sometimes engineers just need to be protected from themselves even if they are experienced and qualified. It’s easy to say you’ll do that later when there aren’t immediate consequences for not. And we all know how often “later” becomes “never”. Nothing I’ve described prevents innovation. You can still build your sloppy app really fast and throw it at the wall because it’s probably not doing anything important. But if you’re getting hired commissioned whatever to build real software that keeps industrial systems running or puts things in space or handles personal information or blasts messages at millions of people all at once, etc., there should be a framework to help you communicate costs to people. Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. As much as I hate the fact that we depend so much on oil, the industry is fundamentally important and the software that operates it should be secure because people run the gas stations when it’s not. You cant really make the argument that the oil industry only happened because some disruptive college kids got together in their garage and had ambition in the face of an unregulated dreamscape. And it’s not like the oil industry cant afford to pay for security.
  - EricE 5y ago
    >I’d like to treat software engineering like a real engineering profession. I tend to lean libertarian/free market more than anything else, but yes - it's well past time for computer "science" to be more than a cheap label. No one likes to have insurance so we mandate minimums are purchased so affected people have a chance of being made whole. Same thing with software. Why is a critical gas pipeline down for weeks after a ransomware attack? Why wasn't the company able to enact their disaster recovery plan, plow over their network and restore from backup? Probably because they have backups that have never been tested, systems that aren't even being backed up and if they have a disaster recovery play it probably exists as pure fiction and not as something that is routinely tested and updated to keep up with the state of their operating environment. I would say the above is business management 101 but to most organizations it's burdensome overhead they don't need to worry about because nothing could ever happen to them, right?
    - R0b0t1 5y ago
      I have little issue with insurance. Smart businesses ask for it anyway, and you can buy insurance for basically anything, including failure to deliver. The problem arises when you mandate credentialism through legislation.
  - R0b0t1 5y ago
    Buddy, most things don't get hacked. It's true they don't get hacked mostly by virtue of nobody caring but assuming the market is efficient then the opportunity cost of these bad things happening must be very low. In this case a disaster recovery plan existed and was used. They did their job by preparing unknown unknowns, get off your high horse. > Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. I never took exception to this, the issue is that e.g. building codes in many areas have become highly specific and overdone to the point of preventing investment in housing. What slapped me in the face with this was a YTer who was going into the family business of building code inspection. You need an engineering degree yet exercise no critical thinking over what is actually happening, and the father seemed to relish in how much he was costing people when telling them to fix basically cosmetic issues. There's issues in healthcare, like doctors being overtrained and artificially scarce.