5 ms·

What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence",

by junon 5y ago

What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management.

lhnz 5y ago
You'd presumably be fired or PIPed if you often held back releases for security reasons so the liability seems poorly placed.
aliasEli 5y ago
In most jurisdictions I know, the developer would be safe if he could show that he warned management about the security problem. In situation like this always write an e-mail to your manager and keep a copy in a safe place.
matheusmoreira 5y ago
The company and its developers should be liable. Developers know it is wrong and yet they do it anyway. The fact management told them to do it doesn't matter. Real engineers don't sign off on a project if they think the building is going to fall apart. If a company starts ignoring security for the sake of profit, developers should react by literally walking out and refusing to have anything to do with the project. Anything else means they share the blame.
- chousuke 5y ago
  The problem is, what power allows the developer to refuse? If they do, a manager can find someone who won't, and developers who stand by their principles will lose to competition. A building engineer could probably drop a hint somewhere and have all kinds of inspectors come knocking, but there's no "building code" for software except in very specific cases; it's perfectly legal to develop insecure software otherwise, and to keep that insecurity a secret from users.
  - josephg 5y ago
    > The problem is, what power allows the developer to refuse? One power we all have is how valuable we are in the jobs market. If you’re a decent engineer in today’s climate, you could get a new software job in days. And it’ll take your company weeks to replace you if they’re lucky, and months to bring your replacement up to speed on what you were working on. The idea that you’re stuck simply working at the whims of management is a self defeating illusion. It is only as true as you believe it to be.
    - username90 5y ago
      There are tons of engineers out there who aren't decent, what would you say they do in this scenario?
    - bsenftner 5y ago
      ...but that is an illusion power, because all we'd be doing is shifting from one poorly managed code dump to another, just shifting the faces on the pointy haired bosses. Finding a technology developing organization that is not a shit show of unmanaged personalities and a teetering tower of technical debt is extremely difficult.
    - wonderwonder 5y ago
      I find most employees over estimate their importance. Everyone is replaceable especially a software developer, there are hundreds of just as good developers waiting to take your place if the salary is right. In addition if they fire you on the spot, you are the one that has to deal with that. If the developer does not have a very good emergency fund that further compounds the stress to do as you are told. Not everyone in software makes a US FAANG, SF, NYC salary.
    - voakbasda 5y ago
      As a remote only 10xer, it take me months to find a new position. Last two search took over six months. I cannot afford to be principled and walk out every time my employer wants to ship buggy code. And we ship bugs pretty much on a weekly basis, because there is no profit in doing things correctly.
- willcipriano 5y ago
  That doesn't seem to be how anything else works. For example, when tech companies colluded to lower wages (anti-"poaching" agreements) I don't believe HR or the executive team was held personally liable. The same holds true for firms who have engaged in racial discrimination in hiring, or covered up risks with a new drug coming to market. Time and time again firms are asked to pay fines in response to executive malfeasance rather then the executives themselves, why is this different?
  - IncRnd 5y ago
    > Time and time again firms are asked to pay fines in response to executive malfeasance rather then the executives themselves, why is this different? It's an indication that engineers know in some cases they are releasing broken software, and management may not be aware. Just look at this page and it's article, developers know about this, because they congregate to discuss how they release broken software, know they should do better, yet don't always tell management about faults in the product. A business shield only protects people when they are conducting business.
    - willcipriano 5y ago
      If I'm taking the lion share of the risk on shipping a product, I'm also collecting the lions share of rewards or I'm not interested in participating. As new vulnerabilities are found every day, I'd expect those rewards to be ongoing, so they would look more like royalties, I'll need to be paid as long as you are using the software. Further I'll need to be able to invalidate that license when I no longer wish to carry the risk. I think under those conditions most firms would prefer to own the risk themselves.
      - IncRnd 5y ago
        Those conditions aren't realistic for an employee, since anyone working for someone else who feels that way is bound to be extremely frustrated. The point that you missed, however, is that an employee should not accept the risk but should transfer the risk by notifying the employer. Otherwise, articles such as this are fodder for putting the blame of exploited vulnerabilities squarely on employees who knew of the risk and, according to some of the comments here, plotted not to tell their employers.
- Aeolun 5y ago
  > The fact management told them to do it doesn't matter. It absolutely does. If you hold any legal power to reject a deployment (like a true engineer), then you can sue the company when they hold it against you, so they won’t. If you do it in any other situation you are just being difficult.
  - tremon 5y ago
    So, rephrasing your statement, it absolutely doesn't, because software developers don't hold any legal power to reject a deployment (since they aren't true engineers), so they can't sue the company when it's held against them. If software developers do that they are just being difficult.
pc86 5y ago
Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while management at the same company can't be?
wonderwonder 5y ago
I don't think this is accurate. You can sue the company, you cannot sue the developers. This applies to other companies as well. You can sue McDonalds if you get burned by their coffee, but you cant sue any of the employees that are responsible for selecting to keep the coffee at that temperature. https://www.caoc.org/?pg=facts https://www.caoc.org/?pg=facts
- nrmitchi 5y ago
  > you cant sue the worker that made the shake and gave it to you. I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. But between suing McDonalds, and suing the close-to-minimum-wage-employee working at McDonalds, which group do you think you would be most likely to collect from in the event you won? Not to mention the public perception of suing an individual McDonalds employee.
  - theevilsharpie 5y ago
    > I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. No, for this particular example, it would almost certainly not be possible. In the US, employees are shielded from personal liability under the doctrine of respondeat superior.
    - mr_coleman 5y ago
      You can sue them, you just won't win if it goes to trial. But most lawsuits don't end in a courtroom. It's sometimes cheaper to pay off a lawsuit you'd win in court than to go through the process.
theevilsharpie 5y ago
> What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management. [citation needed] Company employees in the US (including software developers) are shielded from personal liability by their companies, unless that liability was created by breaking the law or gross negligence (with the latter being extremely difficult to prove). The company can fire the developer for being incompetent or negligent, but the company would still be on the hook for any damages. The same is true when outsourcing development to a third-party development house. The client company may be able to sue the development company, but the individual developers would be shielded from personal liability by whoever they worked for. The only situation I can think of where a developer would be personally liable for buggy or insecure software is if they signed and sealed source code as a professional engineer (this is practically non-existent), or if they were freelancing and contracting with companies directly. In both cases, they would be eligible--and often required by their clients--to purchase insurance against errors and omissions.
mikestew 5y ago
That calls for a big ol' [citation needed]. I've been doing this for over 30 years, and I've never heard of a single instance of this happening. I'm not omniscient, but one would think I'd at least get a whiff of such if it is occurring.

by junon 5y ago

lhnz 5y ago

You'd presumably be fired or PIPed if you often held back releases for security reasons so the liability seems poorly placed.

aliasEli 5y ago

In most jurisdictions I know, the developer would be safe if he could show that he warned management about the security problem. In situation like this always write an e-mail to your manager and keep a copy in a safe place.

matheusmoreira 5y ago

The company and its developers should be liable. Developers know it is wrong and yet they do it anyway. The fact management told them to do it doesn't matter. Real engineers don't sign off on a project if they think the building is going to fall apart. If a company starts ignoring security for the sake of profit, developers should react by literally walking out and refusing to have anything to do with the project. Anything else means they share the blame.

chousuke 5y ago
The problem is, what power allows the developer to refuse? If they do, a manager can find someone who won't, and developers who stand by their principles will lose to competition. A building engineer could probably drop a hint somewhere and have all kinds of inspectors come knocking, but there's no "building code" for software except in very specific cases; it's perfectly legal to develop insecure software otherwise, and to keep that insecurity a secret from users.
- josephg 5y ago
  > The problem is, what power allows the developer to refuse? One power we all have is how valuable we are in the jobs market. If you’re a decent engineer in today’s climate, you could get a new software job in days. And it’ll take your company weeks to replace you if they’re lucky, and months to bring your replacement up to speed on what you were working on. The idea that you’re stuck simply working at the whims of management is a self defeating illusion. It is only as true as you believe it to be.
  - username90 5y ago
    There are tons of engineers out there who aren't decent, what would you say they do in this scenario?
  - bsenftner 5y ago
    ...but that is an illusion power, because all we'd be doing is shifting from one poorly managed code dump to another, just shifting the faces on the pointy haired bosses. Finding a technology developing organization that is not a shit show of unmanaged personalities and a teetering tower of technical debt is extremely difficult.
  - wonderwonder 5y ago
    I find most employees over estimate their importance. Everyone is replaceable especially a software developer, there are hundreds of just as good developers waiting to take your place if the salary is right. In addition if they fire you on the spot, you are the one that has to deal with that. If the developer does not have a very good emergency fund that further compounds the stress to do as you are told. Not everyone in software makes a US FAANG, SF, NYC salary.
  - voakbasda 5y ago
    As a remote only 10xer, it take me months to find a new position. Last two search took over six months. I cannot afford to be principled and walk out every time my employer wants to ship buggy code. And we ship bugs pretty much on a weekly basis, because there is no profit in doing things correctly.
willcipriano 5y ago
That doesn't seem to be how anything else works. For example, when tech companies colluded to lower wages (anti-"poaching" agreements) I don't believe HR or the executive team was held personally liable. The same holds true for firms who have engaged in racial discrimination in hiring, or covered up risks with a new drug coming to market. Time and time again firms are asked to pay fines in response to executive malfeasance rather then the executives themselves, why is this different?
- IncRnd 5y ago
  > Time and time again firms are asked to pay fines in response to executive malfeasance rather then the executives themselves, why is this different? It's an indication that engineers know in some cases they are releasing broken software, and management may not be aware. Just look at this page and it's article, developers know about this, because they congregate to discuss how they release broken software, know they should do better, yet don't always tell management about faults in the product. A business shield only protects people when they are conducting business.
  - willcipriano 5y ago
    If I'm taking the lion share of the risk on shipping a product, I'm also collecting the lions share of rewards or I'm not interested in participating. As new vulnerabilities are found every day, I'd expect those rewards to be ongoing, so they would look more like royalties, I'll need to be paid as long as you are using the software. Further I'll need to be able to invalidate that license when I no longer wish to carry the risk. I think under those conditions most firms would prefer to own the risk themselves.
    - IncRnd 5y ago
      Those conditions aren't realistic for an employee, since anyone working for someone else who feels that way is bound to be extremely frustrated. The point that you missed, however, is that an employee should not accept the risk but should transfer the risk by notifying the employer. Otherwise, articles such as this are fodder for putting the blame of exploited vulnerabilities squarely on employees who knew of the risk and, according to some of the comments here, plotted not to tell their employers.
Aeolun 5y ago
> The fact management told them to do it doesn't matter. It absolutely does. If you hold any legal power to reject a deployment (like a true engineer), then you can sue the company when they hold it against you, so they won’t. If you do it in any other situation you are just being difficult.
- tremon 5y ago
  So, rephrasing your statement, it absolutely doesn't, because software developers don't hold any legal power to reject a deployment (since they aren't true engineers), so they can't sue the company when it's held against them. If software developers do that they are just being difficult.

pc86 5y ago

Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while management at the same company can't be?

wonderwonder 5y ago

I don't think this is accurate. You can sue the company, you cannot sue the developers. This applies to other companies as well. You can sue McDonalds if you get burned by their coffee, but you cant sue any of the employees that are responsible for selecting to keep the coffee at that temperature. https://www.caoc.org/?pg=facts https://www.caoc.org/?pg=facts

nrmitchi 5y ago
> you cant sue the worker that made the shake and gave it to you. I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. But between suing McDonalds, and suing the close-to-minimum-wage-employee working at McDonalds, which group do you think you would be most likely to collect from in the event you won? Not to mention the public perception of suing an individual McDonalds employee.
- theevilsharpie 5y ago
  > I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. No, for this particular example, it would almost certainly not be possible. In the US, employees are shielded from personal liability under the doctrine of respondeat superior.
  - mr_coleman 5y ago
    You can sue them, you just won't win if it goes to trial. But most lawsuits don't end in a courtroom. It's sometimes cheaper to pay off a lawsuit you'd win in court than to go through the process.

theevilsharpie 5y ago

> What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management. [citation needed] Company employees in the US (including software developers) are shielded from personal liability by their companies, unless that liability was created by breaking the law or gross negligence (with the latter being extremely difficult to prove). The company can fire the developer for being incompetent or negligent, but the company would still be on the hook for any damages. The same is true when outsourcing development to a third-party development house. The client company may be able to sue the development company, but the individual developers would be shielded from personal liability by whoever they worked for. The only situation I can think of where a developer would be personally liable for buggy or insecure software is if they signed and sealed source code as a professional engineer (this is practically non-existent), or if they were freelancing and contracting with companies directly. In both cases, they would be eligible--and often required by their clients--to purchase insurance against errors and omissions.

mikestew 5y ago

That calls for a big ol' [citation needed]. I've been doing this for over 30 years, and I've never heard of a single instance of this happening. I'm not omniscient, but one would think I'd at least get a whiff of such if it is occurring.