3 ms·

I'm a bit on two feet about this article: - On one hand, professional liability would indeed be a good thing for overall reliability of our software systems. A

by WJW 4y ago

I'm a bit on two feet about this article: - On one hand, professional liability would indeed be a good thing for overall reliability of our software systems. A "code" for offering software products to citizens would be a good thing. The GDPR is a good step in the right direction for privacy concerns, but there are many other types of concerns that could be covered. - On the other hand, most of the "real" problems in infrastructure software come from adversarial action. Most software systems run more or less fine by themselves, from a professional liability standpoint. Adversarial action is not usually covered by "professional liability". For example, nobody blames the architects of the Azovstal plant that the steel furnaces couldn't stand up to sustained artillery bombardment. - Despite all the talk about how critical software systems are these days, 99% of systems out there is the equivalent of a garden shed and nobody would care if it falls over. Certainly the shed in my own garden would not survive a proper hurricane, but that is OK because a. we don't really get hurricanes here and b. the cost to completely rebuild it would be much lower than bringing it up to hurricane standards. Even Maersk, which is surely not a small target, managed to survive a full blown ransomware hit just fine. (By which I mean, they took a fairly large hit financially but nobody died and no ships sank. By and large all vessels even reached their destination on time) Their IT had to work a lot of overtime for sure, but "the system" is not as vulnerable as people like to claim. So what to do? I would not mind some form of legally mandated checklist to follow that would be mandatory for any company offering services on the internet, but at the same time I don't think it would be very effective in countering the worst threats and I also don't think it would be proportionate for most companies.

drewcoo 4y ago
The shed's a strawman. How do we handle hurricane damage and other "acts of god?" Not in court, but with insurers. Do insurers currently insure properties with sheds? Yes. Do they insure shabby sheds against hurricanes? Maybe - it's up to them and I'm sure they can figure out if the odds would pay off for them. If your shed exploded into millions of shards of glass when struck by high wind that would be a different story. Or if it spread toxic chemicals all over your neighborhood. Or if it caught fire easily and the fire could spread to other buildings. Who would have thought sheds would make such wonderful metaphors?
- WJW 4y ago
  I think you are missing the point I was trying to make with my shed. It's a flimsy building that was definitely not "Engineered" with a capital E. It was slapped together by some carpenters apprentice in much the same way that most software is slapped together without much calculation or planning, and that is fine because it's just a shed. The hurricane is not very relevant to the argument, just that there is no building code regulating the shed. My point in the GP was that most software (even in the biggest of enterprises) is more like a shed than a skyscraper: not very well Engineered and also not very critical. Even Maersk can apparently survive just fine without their logistics planning software for over two weeks. What would be the appropriate level of regulation for software that is apparently not all that critical? I think the appropriate level of regulation for most software would be extremely low, because not much is at stake.

by WJW 4y ago

drewcoo 4y ago

The shed's a strawman. How do we handle hurricane damage and other "acts of god?" Not in court, but with insurers. Do insurers currently insure properties with sheds? Yes. Do they insure shabby sheds against hurricanes? Maybe - it's up to them and I'm sure they can figure out if the odds would pay off for them. If your shed exploded into millions of shards of glass when struck by high wind that would be a different story. Or if it spread toxic chemicals all over your neighborhood. Or if it caught fire easily and the fire could spread to other buildings. Who would have thought sheds would make such wonderful metaphors?

WJW 4y ago
I think you are missing the point I was trying to make with my shed. It's a flimsy building that was definitely not "Engineered" with a capital E. It was slapped together by some carpenters apprentice in much the same way that most software is slapped together without much calculation or planning, and that is fine because it's just a shed. The hurricane is not very relevant to the argument, just that there is no building code regulating the shed. My point in the GP was that most software (even in the biggest of enterprises) is more like a shed than a skyscraper: not very well Engineered and also not very critical. Even Maersk can apparently survive just fine without their logistics planning software for over two weeks. What would be the appropriate level of regulation for software that is apparently not all that critical? I think the appropriate level of regulation for most software would be extremely low, because not much is at stake.