3 ms·

I think a lot of software developers like to think of themselves as skilled code surgeons who precisely cut away solutions to life or death problems. Truth be t

I think a lot of software developers like to think of themselves as skilled code surgeons who precisely cut away solutions to life or death problems. Truth be told though, most software that gets built isn't very important. No one is going to die if another WordPress site falls over or if a mobile app crashes when you put an emoji in the Name field. People should be licensed when their failures have a serious impact on other people's lives. Devs don't need to be licensed; most of our failures are annoying rather than dangerous. The majority of us are the crystal aura cleansers of the medical profession.

deleted 5y ago
[deleted]
unicornmama 5y ago
Software engineers are more like orthopedic surgeons, who are living memes in the medicine community. Nsfw ortho meme: https://images.app.goo.gl/fTKFFYP9vTgoFiAs6 https://images.app.goo.gl/fTKFFYP9vTgoFiAs6
dataflow 5y ago
It's not websites or apps going down that's the issue here. Security breaches can very much have real impact on people. For security issues at least, it doesn't really matter how silly or nonconsequential the use case of your software is. What matters is the data you hold, and how you take care of it. Your software could literally be a background service gathering user data, and it could still be devastating for a user if that data gets leaked, even if they didn't know about (and were otherwise unimpacted by) your software's existence (or lack thereof).
- onion2k 5y ago
  There are lots of software security certifications though, for individuals and businesses. I've work with an ISO27001 company a few times - it's the CSO's job to assure things are done securely rather than the individual devs. The same is true for most aspects of the software lifecycle - PMs, security, QA, etc do have certifications available. Devs are just the people who do the hands on work, not the ones who made sure it's done well.
  - dataflow 5y ago
    In that model, who ensures the code is written without buffer overflows, undefined behavior, XSS/CSRF/etc. vulnerabilities, SQL injection vulnerabilities, etc.? You're suggesting code review by the security team is sufficient to ensure developers don't need to think about/understand potential vulnerabilities?
    - onion2k 5y ago
      The devs are responsible for the code, but the CSO is accountable for it. So it's the CSOs job to make sure the devs do their work well because it's the CSOs neck on the line if it isn't. That should take the form of the CSO making sure there's a budget for training the devs, security certification for senior devs who'll writing important aspects of the app, code review by the CSO and security certified devs, hiring in third party auditors, and so on. Hiring a dev who's "Secure Developer Certified" might be an option too, but there would still need to be all the above checks in place to make sure they're writing decent code, so looking for the certification at the point of hiring is a bit redundant.
atoav 5y ago
The weird thing is: Software devs kinda like to have it both ways. When you ask them how critical the things are they are doing, they like to (as you phrased it) think of themselves as skilled code surgeons who precisely cut away solutions to life or death problems. When you suggest to them stricter rules, guarantuees, checks and laws like you have them in civil engineering or electrical engineering they look at you in horror: "What, you mean I can't just carelessly try out a new framework on a project?" Programming to me is a multiplier profession. Unless you code for yourself privately, your code is going to impact other people, organisations and the environment we all live in. This can be a good thing because by making the right choice we can really shave off collective years of the useless stuff humanity does. But we can of course do the polar opposite as well: waste everybodies time, leak private medical data, create algorithms that feed violent racist content to kids, make mistakes that endanger whole industries etc. Simple preventable things like uninitialized variables still caused the dirty pipe vulnerability in the Linux kernel in 2020. The only thing that tends to give me a little hope is the traction Rust seems to be getting — at least we can stop doing the totally obvious and preventable mistakes and move on to unpredictable and unpreventable ones?
Bancakes 5y ago
Why would you leave bugs in the code? Why would you treat your software as unimportant? It's about self respect and recognition by others when you produce quality code, and undermining your efforts makes us stray from our Bell Labs predecessors.
- onion2k 5y ago
  Why would you leave bugs in the code? The reason is simple - there isn't enough time in the day to both push out the required features and fix all the bugs. We prioritize features because that's what we believe increases our value. Whether or not that's actually true is a matter of opinion. Our predecessors were expected to write code more slowly. They could take a year to make a small business app that a dev is expected to push out in 4 weeks now. And all credit to today's devs, we hit those deadlines. We achieve amazing things in very little time. But in our push to be as productive as possible we have largely forgotten that the most fundamental skill in software development - thinking about how to solve a problem well - hasn't changed at all. We believe that using a new framework, or buying a faster computer, or typing on a different keyboard, will make us faster, more productive developers, and in our effort to compress the amount of time it takes to build something we have also compressed the amount of time we spend thinking about it. That's why we leave bugs in code.
  - cheradenine_uk 5y ago
    Quite. A "small business app" would be far too expensive to build to "NASA" Standards, and furthermore, it would be wholly unnecessary to do so. Think opportunity cost. I have worked in places where, basically, there was so much money pouring in that the drive to actually ship anything had all but disappeared. Thus the 'axis of perfection' took over: Build the perfect shining crystalline entity, no matter the cost. Rebuild your own tools, even where good, liberally licensed FOSS alternatives already exist. Etc. I found the latter environments too frustrating to cope with, as I found "making code look nicer" did not lead to an existentially satisfying week.
jusssi 5y ago
Meanwhile, plenty of classical regulated fields have failures that kill people daily, regardless of regulation. Just open the newspaper for crashing airplanes, derailing trains, combusting cars, collapsing buildings and bridges, just to name the most spectacular ones.

deleted 5y ago

[deleted]

unicornmama 5y ago

Software engineers are more like orthopedic surgeons, who are living memes in the medicine community. Nsfw ortho meme: https://images.app.goo.gl/fTKFFYP9vTgoFiAs6 https://images.app.goo.gl/fTKFFYP9vTgoFiAs6

dataflow 5y ago

It's not websites or apps going down that's the issue here. Security breaches can very much have real impact on people. For security issues at least, it doesn't really matter how silly or nonconsequential the use case of your software is. What matters is the data you hold, and how you take care of it. Your software could literally be a background service gathering user data, and it could still be devastating for a user if that data gets leaked, even if they didn't know about (and were otherwise unimpacted by) your software's existence (or lack thereof).

onion2k 5y ago
There are lots of software security certifications though, for individuals and businesses. I've work with an ISO27001 company a few times - it's the CSO's job to assure things are done securely rather than the individual devs. The same is true for most aspects of the software lifecycle - PMs, security, QA, etc do have certifications available. Devs are just the people who do the hands on work, not the ones who made sure it's done well.
- dataflow 5y ago
  In that model, who ensures the code is written without buffer overflows, undefined behavior, XSS/CSRF/etc. vulnerabilities, SQL injection vulnerabilities, etc.? You're suggesting code review by the security team is sufficient to ensure developers don't need to think about/understand potential vulnerabilities?
  - onion2k 5y ago
    The devs are responsible for the code, but the CSO is accountable for it. So it's the CSOs job to make sure the devs do their work well because it's the CSOs neck on the line if it isn't. That should take the form of the CSO making sure there's a budget for training the devs, security certification for senior devs who'll writing important aspects of the app, code review by the CSO and security certified devs, hiring in third party auditors, and so on. Hiring a dev who's "Secure Developer Certified" might be an option too, but there would still need to be all the above checks in place to make sure they're writing decent code, so looking for the certification at the point of hiring is a bit redundant.

atoav 5y ago

The weird thing is: Software devs kinda like to have it both ways. When you ask them how critical the things are they are doing, they like to (as you phrased it) think of themselves as skilled code surgeons who precisely cut away solutions to life or death problems. When you suggest to them stricter rules, guarantuees, checks and laws like you have them in civil engineering or electrical engineering they look at you in horror: "What, you mean I can't just carelessly try out a new framework on a project?" Programming to me is a multiplier profession. Unless you code for yourself privately, your code is going to impact other people, organisations and the environment we all live in. This can be a good thing because by making the right choice we can really shave off collective years of the useless stuff humanity does. But we can of course do the polar opposite as well: waste everybodies time, leak private medical data, create algorithms that feed violent racist content to kids, make mistakes that endanger whole industries etc. Simple preventable things like uninitialized variables still caused the dirty pipe vulnerability in the Linux kernel in 2020. The only thing that tends to give me a little hope is the traction Rust seems to be getting — at least we can stop doing the totally obvious and preventable mistakes and move on to unpredictable and unpreventable ones?

Bancakes 5y ago

Why would you leave bugs in the code? Why would you treat your software as unimportant? It's about self respect and recognition by others when you produce quality code, and undermining your efforts makes us stray from our Bell Labs predecessors.

onion2k 5y ago
Why would you leave bugs in the code? The reason is simple - there isn't enough time in the day to both push out the required features and fix all the bugs. We prioritize features because that's what we believe increases our value. Whether or not that's actually true is a matter of opinion. Our predecessors were expected to write code more slowly. They could take a year to make a small business app that a dev is expected to push out in 4 weeks now. And all credit to today's devs, we hit those deadlines. We achieve amazing things in very little time. But in our push to be as productive as possible we have largely forgotten that the most fundamental skill in software development - thinking about how to solve a problem well - hasn't changed at all. We believe that using a new framework, or buying a faster computer, or typing on a different keyboard, will make us faster, more productive developers, and in our effort to compress the amount of time it takes to build something we have also compressed the amount of time we spend thinking about it. That's why we leave bugs in code.
- cheradenine_uk 5y ago
  Quite. A "small business app" would be far too expensive to build to "NASA" Standards, and furthermore, it would be wholly unnecessary to do so. Think opportunity cost. I have worked in places where, basically, there was so much money pouring in that the drive to actually ship anything had all but disappeared. Thus the 'axis of perfection' took over: Build the perfect shining crystalline entity, no matter the cost. Rebuild your own tools, even where good, liberally licensed FOSS alternatives already exist. Etc. I found the latter environments too frustrating to cope with, as I found "making code look nicer" did not lead to an existentially satisfying week.

jusssi 5y ago

Meanwhile, plenty of classical regulated fields have failures that kill people daily, regardless of regulation. Just open the newspaper for crashing airplanes, derailing trains, combusting cars, collapsing buildings and bridges, just to name the most spectacular ones.