5 ms·

Zero accountability, complete lack of responsibility, and a total absence of sufficient security in far too many instances. Something like this has been long lo

Zero accountability, complete lack of responsibility, and a total absence of sufficient security in far too many instances. Something like this has been long long overdue.

SV_BubbleTime 5y ago
Yes. But - I’m skeptical that a probe will have any more teeth than the censorship testimony fist shaking we’ve seen at Zuckerberg and Dorsey. Even if there is, the solution needs to be punitive. That if you ship shitty software and didn’t follow good practices that you’ll be investigated and fined. New frameworks for what constitutes software negligence. The last thing I would want to see is software regulation, oversight of development, Government access. For about a dozen reasons each.
- datameta 5y ago
  The implementation of anything in the last paragraph would be a shit snowball of the finest degree.
  - ClumsyPilot 5y ago
    Yeah, god forbid if the public has access to source code of critical systems that the country relies upon to run critical infrastructure like oil pipelines. We might loose any respect for people in charge whatsoever.
    - SV_BubbleTime 5y ago
      Just like all the transparency from all the other gov agencies right? And I think the discussion is about private businesses not some forced open source ideal you seem to have conjured up.
      - ClumsyPilot 5y ago
        It is your private business freemarket ideal when half the country comes to a standstill because the oil pipeline runs on windows XP or some shit?
        SV_BubbleTime 5y ago
        Are you implying that Windows XP needs security reviews now? Or that regulated energy markets make Windows XP? You lost me with any sort of relevancy there. As I understand it, the topic is about software mfgs. Did you just want to throw some freemarket attack (while not using a freemarket example)?
- AniseAbyss 5y ago
  Interesting I've always wondered if we could hold software developers to the same standards as we do medical practitioners. But of course with the extreme shortages companies will basically hire anyone fresh from college and the level of responsibility from people in the industry is low.
  - amanaplanacanal 5y ago
    This is why real engineers complain about developers calling themselves engineers.
    - jcrites 5y ago
      Software engineers are engineers in the sense that we employ the same scientific methodology to design systems to a target level of reliability. However, because the majority of software does not affect the safety of human lives (the exceptions being software that operates critical medical equipment, avionics on aircraft and rockets, etc.), the target level of reliability is not nearly as high as in the engineering of objects that do affect the safety of human lives (like buildings and bridges). Humanity also has centuries (indeed, millennia) more experience with the construction of physical objects, although rigorous scientific design of them only began in the last few; and even modern era engineering fails to account for all factors (e.g. the Tacoma Narrows bridge that collapsed due to oscillation induced by wind: https://en.wikipedia.org/wiki/Tacoma_Narrows_Bridge_(1940) https://en.wikipedia.org/wiki/Tacoma_Narrows_Bridge_(1940) ). Modern engineers operating today still make mistakes that cause death, such as the collapse of the construction crane in Seattle in 2019: https://en.wikipedia.org/wiki/Seattle_crane_collapse https://en.wikipedia.org/wiki/Seattle_crane_collapse (due to wind and unsafe operation IIRC). If you're building a website or app where people can order food from restaurants and creating a market for couriers and consumers to connect, then no aspect of your software has any affect on human life. (The software might tell the courier where to drive, but they are responsible for driving safely to those locations.) When we consider software that is responsible for the operation of autonomous vehicles, or the avionics on aircraft or rockets, then the level of engineering reliability is targeted to match or exceed the reliability of the physical systems. A great article on the software engineers who worked for NASA on the Space Shuttle's software: https://www.fastcompany.com/28121/they-write-right-stuff https://www.fastcompany.com/28121/they-write-right-stuff A software engineer is a person who can build software to a target level of reliability. That the targets are not always as high as "responsible for safety of human life" does not mean it's not engineering. I would give AWS's automated theorem-proving about the correctness of their TLS implementation as an example of a feat of software engineering that targets a high level of reliability: https://aws.amazon.com/blogs/security/automated-reasoning-and-amazon-s2n/ https://aws.amazon.com/blogs/security/automated-reasoning-an...

Zero accountability, complete lack of responsibility, and a total absence of sufficient security in far too many instances. Something like this has been long long overdue.

SV_BubbleTime 5y ago

Yes. But - I’m skeptical that a probe will have any more teeth than the censorship testimony fist shaking we’ve seen at Zuckerberg and Dorsey. Even if there is, the solution needs to be punitive. That if you ship shitty software and didn’t follow good practices that you’ll be investigated and fined. New frameworks for what constitutes software negligence. The last thing I would want to see is software regulation, oversight of development, Government access. For about a dozen reasons each.

datameta 5y ago
The implementation of anything in the last paragraph would be a shit snowball of the finest degree.
- ClumsyPilot 5y ago
  Yeah, god forbid if the public has access to source code of critical systems that the country relies upon to run critical infrastructure like oil pipelines. We might loose any respect for people in charge whatsoever.
  - SV_BubbleTime 5y ago
    Just like all the transparency from all the other gov agencies right? And I think the discussion is about private businesses not some forced open source ideal you seem to have conjured up.
    - ClumsyPilot 5y ago
      It is your private business freemarket ideal when half the country comes to a standstill because the oil pipeline runs on windows XP or some shit?
      - SV_BubbleTime 5y ago
        Are you implying that Windows XP needs security reviews now? Or that regulated energy markets make Windows XP? You lost me with any sort of relevancy there. As I understand it, the topic is about software mfgs. Did you just want to throw some freemarket attack (while not using a freemarket example)?
AniseAbyss 5y ago
Interesting I've always wondered if we could hold software developers to the same standards as we do medical practitioners. But of course with the extreme shortages companies will basically hire anyone fresh from college and the level of responsibility from people in the industry is low.
- amanaplanacanal 5y ago
  This is why real engineers complain about developers calling themselves engineers.
  - jcrites 5y ago
    Software engineers are engineers in the sense that we employ the same scientific methodology to design systems to a target level of reliability. However, because the majority of software does not affect the safety of human lives (the exceptions being software that operates critical medical equipment, avionics on aircraft and rockets, etc.), the target level of reliability is not nearly as high as in the engineering of objects that do affect the safety of human lives (like buildings and bridges). Humanity also has centuries (indeed, millennia) more experience with the construction of physical objects, although rigorous scientific design of them only began in the last few; and even modern era engineering fails to account for all factors (e.g. the Tacoma Narrows bridge that collapsed due to oscillation induced by wind: https://en.wikipedia.org/wiki/Tacoma_Narrows_Bridge_(1940) https://en.wikipedia.org/wiki/Tacoma_Narrows_Bridge_(1940) ). Modern engineers operating today still make mistakes that cause death, such as the collapse of the construction crane in Seattle in 2019: https://en.wikipedia.org/wiki/Seattle_crane_collapse https://en.wikipedia.org/wiki/Seattle_crane_collapse (due to wind and unsafe operation IIRC). If you're building a website or app where people can order food from restaurants and creating a market for couriers and consumers to connect, then no aspect of your software has any affect on human life. (The software might tell the courier where to drive, but they are responsible for driving safely to those locations.) When we consider software that is responsible for the operation of autonomous vehicles, or the avionics on aircraft or rockets, then the level of engineering reliability is targeted to match or exceed the reliability of the physical systems. A great article on the software engineers who worked for NASA on the Space Shuttle's software: https://www.fastcompany.com/28121/they-write-right-stuff https://www.fastcompany.com/28121/they-write-right-stuff A software engineer is a person who can build software to a target level of reliability. That the targets are not always as high as "responsible for safety of human life" does not mean it's not engineering. I would give AWS's automated theorem-proving about the correctness of their TLS implementation as an example of a feat of software engineering that targets a high level of reliability: https://aws.amazon.com/blogs/security/automated-reasoning-and-amazon-s2n/ https://aws.amazon.com/blogs/security/automated-reasoning-an...