4 ms·
For sure. The problem isn't the people, though they definitely can be part of it, the problem is the process. We never get a chance to reflect critically on ou
by tinco 5y ago
For sure. The problem isn't the people, though they definitely can be part of it, the problem is the process.
We never get a chance to reflect critically on our product. Imagine if an architect always would have their first draft constructed, without consulting a structural engineer, or the municipality or even the clients. They can't because if they did their company would either run out of money while they are at the drafting table, or a different company will build another shoddy but functional building faster and outpace them.
This is how software gets made, not necessarily by unqualified engineers, after my degree and 15 years of professional experience I feel my first draft on a software project has a reasonable chance of standing up in the high winds. But hasty and incomplete processes.
Agile like processes are an improvement, at least there is allotted time for improvements and corrections while the apartment building is still 1 story before and the customer can at least walk around a fully furnished apartment before we slam the other 99 on top.
We never get the chance to have our code audited when it is done, but before it is pushed to production. Best we can do is have a test suite with good statement coverage.
That being said, if we improved this situation software would be only marginally better. As awful as some of these problems are, they can slumber in software for decades before causing any harm, and frankly the amount of harm is quite limited.
- zozbot234 5y ago> We never get a chance to reflect critically on our product. Much of the Internet is built on publically available code, so anyone absolutely has the chance to critically review those projects and products. It's not clear how more gatekeeping would be an improvement; in fact, it would most likely make things worse.
- tinco 5y agoI meant we don't get a chance to spend time on reflecting critically. What I was thinking of specifically is how many people that depend on Log4j have actually read the Log4j source code and reflected on whether its complexity was a security risk to their product. How many people could go "Hey boss, we're gonna take 2 developers and spend the next two sprints moving our code base away from the industry standard logging framework because it has too many features".
- mamcx 5y ago> Much of the Internet is built on publically available code, so anyone absolutely has the chance to critically review those projects and products. Sure: - "Search for thing that do X" - "npm install thing" - "drinking cofee while it install 1000 deps" - "it works" - "end of critically thinking about this".