4 ms·
What? The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume
by dcow 6y ago
What?
The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume of people from participating. Rather, incorporate a credentialing system so that maybe your fresh grad or boot-camper isn’t working 18hr days on standing up core infrastructure without the experience to push back against manipulative management or ridiculous client timelines. Prioritizing security will only happen if all engineers require it (otherwise you’d be undercut by someone who doesn't care). That’s why you need governance. We all have to be on the same page about security and reliability and it just happens that not everyone is equally qualified to do security or has the edge to build really reliable systems. And sometimes engineers just need to be protected from themselves even if they are experienced and qualified. It’s easy to say you’ll do that later when there aren’t immediate consequences for not. And we all know how often “later” becomes “never”.
Nothing I’ve described prevents innovation. You can still build your sloppy app really fast and throw it at the wall because it’s probably not doing anything important. But if you’re getting hired commissioned whatever to build real software that keeps industrial systems running or puts things in space or handles personal information or blasts messages at millions of people all at once, etc., there should be a framework to help you communicate costs to people.
Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. As much as I hate the fact that we depend so much on oil, the industry is fundamentally important and the software that operates it should be secure because people run the gas stations when it’s not. You cant really make the argument that the oil industry only happened because some disruptive college kids got together in their garage and had ambition in the face of an unregulated dreamscape. And it’s not like the oil industry cant afford to pay for security.
- EricE 6y ago>I’d like to treat software engineering like a real engineering profession. I tend to lean libertarian/free market more than anything else, but yes - it's well past time for computer "science" to be more than a cheap label. No one likes to have insurance so we mandate minimums are purchased so affected people have a chance of being made whole. Same thing with software. Why is a critical gas pipeline down for weeks after a ransomware attack? Why wasn't the company able to enact their disaster recovery plan, plow over their network and restore from backup? Probably because they have backups that have never been tested, systems that aren't even being backed up and if they have a disaster recovery play it probably exists as pure fiction and not as something that is routinely tested and updated to keep up with the state of their operating environment. I would say the above is business management 101 but to most organizations it's burdensome overhead they don't need to worry about because nothing could ever happen to them, right?
- R0b0t1 6y agoI have little issue with insurance. Smart businesses ask for it anyway, and you can buy insurance for basically anything, including failure to deliver. The problem arises when you mandate credentialism through legislation.
- R0b0t1 6y agoBuddy, most things don't get hacked. It's true they don't get hacked mostly by virtue of nobody caring but assuming the market is efficient then the opportunity cost of these bad things happening must be very low. In this case a disaster recovery plan existed and was used. They did their job by preparing unknown unknowns, get off your high horse. > Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. I never took exception to this, the issue is that e.g. building codes in many areas have become highly specific and overdone to the point of preventing investment in housing. What slapped me in the face with this was a YTer who was going into the family business of building code inspection. You need an engineering degree yet exercise no critical thinking over what is actually happening, and the father seemed to relish in how much he was costing people when telling them to fix basically cosmetic issues. There's issues in healthcare, like doctors being overtrained and artificially scarce.
- R0b0t1 6y agoApparently they did pay the random, which surprises me.
- dcow 5y agoBuddy? (Not sure what your comment about a high horse is about, I made no claims that I am somehow specially qualified and would end up on top or something? I have simply seen what happens many times over when push comes to shove with respect to securing systems. Inevitably they ship because you can always find an engineer and PM who are intensely interested in product and don’t care about edge cases and security. Even on supposed security products!) And most doctors don't fuck up and most houses don't fall over. It’s about the consequences when things do go south. That’s my whole point. I didn't say every little product itch you want to scratch needs to be compliant. Just that at a certain threshold, it does, and as an industry we should be capable of promoting or surfacing the people who can do those jobs and insulating ourselves as professionals from the effects of cheaper or quicker uncertified labor that claims it can. It also wouldn't be “free”. With increased levels of certification or whatever would come increased liability requirements. Our industry has a problem capturing liability so nobody has to take responsibility when something like leftpad happens. It’s just another day in the life of “software”. Just because one organization (the ama) is fucked up and keeps physicians artificially scares doesn't mean all other instances/attempts are doomed to the same fate. Anyway.. I really don't think we’re that far apart and don't quite understand your antagonistic edge. I hope I didn't offend you.