7 ms·

> If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Strange comment. Are the engineers who made th

> If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Strange comment. Are the engineers who made the code change responsible?? Do engineers need to be lawyers and financial gurus too, and evaluate every ticket they are given for possible illegality in every country the software is used??

lawn 4y ago
If the engineer(s) should be responsible or not doesn't really matter, you could still get blamed either way.
CSMastermind 4y ago
I don't know, we hold other engineers responsible for the consequences of their work, personally I think the industry would be better off if we had more accountability for programmers.
- renewiltord 4y ago
  Software engineers are some of the highest quality engineers there are. Objectively by a simple metric: lives ended through incompetence. Software engineers lead. No other engineering discipline comes close.
- galaxyLogic 4y ago
  But we don't hold the gun-industry accountable for mass-shootings. Maybe we should. But situation is a little bit similar here. The engineer created the gun. He didn't use the software to shoot people. Or maybe he did. The question is did he personally benefit from the change made more than his usual salary? Or think about people who build bridges. They just follow the orders they get from higher ups. Bridge collapses. The higher-ups should be held accountable not the workers. The question I think is did the engineer here just follow orders? Perhaps he understood very little about finance, only about programming.
  - pavlov 4y ago
    > "The question is did he personally benefit from the change made more than his usual salary?" I would guess the compensation structure at FTX included a lot of their own crypto tokens, since the company can mint those at no cost. And Alameda was a big holder of those FTT/Serum tokens. So you're a software engineer who owns theoretically millions of dollars worth of FTT tokens, and then the boss comes to you and asks to make an exception for Alameda... Since you work at FTX, you're probably aware that Alameda holds and trades a lot of FTT. If you do the code change to make Alameda look better and maintain the value of your own crypto portfolio, there's no question that you're a part of the fraud.
  - jnsaff2 4y ago
    A `DELETE FROM` function can be used for good or bad. A gun can be used for good or bad (see the war in Ukraine, it can be used to murder or protect your family from murderers). A code change excluding a known, named entity from safety checks is more like rigging a bridge to explode when your enemy crosses the bridge. Zero ambiguity.
  - zopa 4y ago
    > The question is did he personally benefit from the change made more than his usual salary? That’s not the question — as in, it won’t be an element of any of the crimes he’s eventually charged with. The question is whether he was knowingly or recklessly involved in a scheme to defraud people. And just generally, legal reasoning does frequently use analogies but they need to be tighter than the ones you’re using. This case isn’t much like building a faulty bridge.
    - galaxyLogic 4y ago
      I would think that in most crimes the motivation of the accused is a factor. Think about hate-crimes. They are not hate-crimes unless the person did them out of hate for the PURPOSE of hurting members of some minority. Murder-in-first-degree means you didn't just recklessly cause the death of somebody, it means you did it intentionally, on purpose. See Mens Rea, "Criminal Intent" https://www.law.cornell.edu/wex/mens_rea https://www.law.cornell.edu/wex/mens_rea Was this engineer knowingly and intentionally helping to commit the crime? We don't know because we haven't seen many details or testimonies in this case. He must be assumed innocent until proven guilty. And proving him guilty must include proving he had criminal intent, Mens Rea. The court of public opinion as in Hacker News is of course a different matter.
- tomnipotent 4y ago
  > we had more accountability for programmers You could make this argument for literally every profession.
johnnyApplePRNG 4y ago
Agreed. The person who commissioned this change, knowing the potential financial ramifications that it opened them and their depositors money up to, is the one who should be charged.
faizmokhtar 4y ago
Yes? You don't need to be lawyers or financial gurus, you just need to have common sense and strong ethics.
xg15 4y ago
"I was only following orders" is generally seen as a bad defense since the end of WW2.
- joshlemer 4y ago
  This is why I don't get why the phrase/excuse/justification "I'm just doing my job" is so commonly used.
  - checkyoursudo 4y ago
    It can be hard to do the right thing, especially if there are real-world consequences like "do this bad act or lose your job" threats. However, "do this bad act and we'll all get rich" seems a bit ... harder to sympathize with.
  - chillfox 4y ago
    Because there’s not been a large obvious reminder for some time. In fact the last such reminder was before most currently living software developers were born.
  - grog454 4y ago
    When an executive level manager is paid multiple times (or orders of magnitude) what an engineer is paid, I feel there should be a different assignment of responsibility and exposure to risk.
  - wolverine876 4y ago
    Yet owners and management get to say, 'it's business' or 'it's just business'.
    - joshlemer 4y ago
      Not according to me, they're both wrong in the exact same way to me.
baq 4y ago
But if you only told someone to do it and haven’t actually done it yourself, are you guilty of breaking the law? Yes, you are. Splitting responsibility between those who give orders and those who follow them to avoid penalties is exactly why both are persecuted and put in jail.
- denton-scratch 4y ago
  > persecuted and put in jail. That sounds like Julian Assange. Did you mean "prosecuted"?
  - baq 4y ago
    Yes a bad case of autocorrection…
ilikehurdles 4y ago
In some cases, yes, they are held responsible. When I was trained on HIPAA compliance lawyers made it clear that individual employees could be held responsible for some violations. And yes, we restricted service availability based on region until we achieved compliance with GDPR and various regional PII/PHI data export laws. I work in another regulated industry today, and throughout the year sign off on understanding various regulations and trainings of 3 letter agencies, that are essentially in place to indemnify the company in case of a violation. I’d expect financial services follows similar steps.
martingoodson 4y ago
Yes of course they need to know the law. Anyone who might potentially break the law during the course of their work needs to know what that law is. ‘Just following orders’ is not a defence. This is very odd special pleading by programmers. Every industry needs to do this: journalists learn media law in their university degrees, architects have to learn the building regulations. Why is programming any different?
- tomnipotent 4y ago
  > Yes of course they need to know the law That's absolutely ridiculous, and no court would expect it.
  - wyldberry 4y ago
    They won't until they do. When it's something seemingly egregious like this, it has the potential to be something that makes an example and changes curriculum for CS students across the country for decades. I expect other engineers to know laws when creating things (not like having a JD). Accredited business schools in the US teach business law to their undegrads. It's absolutely not ridiculous or a stretch to have a similar expectation.
    - tomnipotent 4y ago
      There's a big difference between the HN crowd shouting "they should know the laws!" vs. licensed and controlled professionals like architects and structural engineers that "follow the law" via established codes, which have clear boundaries that can be evaluated and prosecuted when violated. > When it's something seemingly egregious like this You don't even know what "this" is. So the BI engineer that stitches together data for a report should have known that combining these two values was illegal? What silliness.
      - martingoodson 4y ago
        ‘clear boundaries that can be evaluated and prosecuted when violated.’ Have you ever looked at media law or libel law? It does not have clear boundaries, but journalists are still expected to follow the law. Journalists are not absolved of the responsibility because it’s complicated. You just need to not break the law. It’s how it works. If you don’t want exposure to liability, you need to acquaint yourself with relevant law.
siva7 4y ago
Yes, engineers are also held responsible. If you're being serious, here us some education about the origin of this principle: https://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat https://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat
deleted 4y ago
[deleted]

lawn 4y ago

If the engineer(s) should be responsible or not doesn't really matter, you could still get blamed either way.

CSMastermind 4y ago

I don't know, we hold other engineers responsible for the consequences of their work, personally I think the industry would be better off if we had more accountability for programmers.

renewiltord 4y ago
Software engineers are some of the highest quality engineers there are. Objectively by a simple metric: lives ended through incompetence. Software engineers lead. No other engineering discipline comes close.
galaxyLogic 4y ago
But we don't hold the gun-industry accountable for mass-shootings. Maybe we should. But situation is a little bit similar here. The engineer created the gun. He didn't use the software to shoot people. Or maybe he did. The question is did he personally benefit from the change made more than his usual salary? Or think about people who build bridges. They just follow the orders they get from higher ups. Bridge collapses. The higher-ups should be held accountable not the workers. The question I think is did the engineer here just follow orders? Perhaps he understood very little about finance, only about programming.
- pavlov 4y ago
  > "The question is did he personally benefit from the change made more than his usual salary?" I would guess the compensation structure at FTX included a lot of their own crypto tokens, since the company can mint those at no cost. And Alameda was a big holder of those FTT/Serum tokens. So you're a software engineer who owns theoretically millions of dollars worth of FTT tokens, and then the boss comes to you and asks to make an exception for Alameda... Since you work at FTX, you're probably aware that Alameda holds and trades a lot of FTT. If you do the code change to make Alameda look better and maintain the value of your own crypto portfolio, there's no question that you're a part of the fraud.
- jnsaff2 4y ago
  A `DELETE FROM` function can be used for good or bad. A gun can be used for good or bad (see the war in Ukraine, it can be used to murder or protect your family from murderers). A code change excluding a known, named entity from safety checks is more like rigging a bridge to explode when your enemy crosses the bridge. Zero ambiguity.
- zopa 4y ago
  > The question is did he personally benefit from the change made more than his usual salary? That’s not the question — as in, it won’t be an element of any of the crimes he’s eventually charged with. The question is whether he was knowingly or recklessly involved in a scheme to defraud people. And just generally, legal reasoning does frequently use analogies but they need to be tighter than the ones you’re using. This case isn’t much like building a faulty bridge.
  - galaxyLogic 4y ago
    I would think that in most crimes the motivation of the accused is a factor. Think about hate-crimes. They are not hate-crimes unless the person did them out of hate for the PURPOSE of hurting members of some minority. Murder-in-first-degree means you didn't just recklessly cause the death of somebody, it means you did it intentionally, on purpose. See Mens Rea, "Criminal Intent" https://www.law.cornell.edu/wex/mens_rea https://www.law.cornell.edu/wex/mens_rea Was this engineer knowingly and intentionally helping to commit the crime? We don't know because we haven't seen many details or testimonies in this case. He must be assumed innocent until proven guilty. And proving him guilty must include proving he had criminal intent, Mens Rea. The court of public opinion as in Hacker News is of course a different matter.
tomnipotent 4y ago
> we had more accountability for programmers You could make this argument for literally every profession.

johnnyApplePRNG 4y ago

Agreed. The person who commissioned this change, knowing the potential financial ramifications that it opened them and their depositors money up to, is the one who should be charged.

faizmokhtar 4y ago

Yes? You don't need to be lawyers or financial gurus, you just need to have common sense and strong ethics.

xg15 4y ago

"I was only following orders" is generally seen as a bad defense since the end of WW2.

joshlemer 4y ago
This is why I don't get why the phrase/excuse/justification "I'm just doing my job" is so commonly used.
- checkyoursudo 4y ago
  It can be hard to do the right thing, especially if there are real-world consequences like "do this bad act or lose your job" threats. However, "do this bad act and we'll all get rich" seems a bit ... harder to sympathize with.
- chillfox 4y ago
  Because there’s not been a large obvious reminder for some time. In fact the last such reminder was before most currently living software developers were born.
- grog454 4y ago
  When an executive level manager is paid multiple times (or orders of magnitude) what an engineer is paid, I feel there should be a different assignment of responsibility and exposure to risk.
- wolverine876 4y ago
  Yet owners and management get to say, 'it's business' or 'it's just business'.
  - joshlemer 4y ago
    Not according to me, they're both wrong in the exact same way to me.

baq 4y ago

But if you only told someone to do it and haven’t actually done it yourself, are you guilty of breaking the law? Yes, you are. Splitting responsibility between those who give orders and those who follow them to avoid penalties is exactly why both are persecuted and put in jail.

denton-scratch 4y ago
> persecuted and put in jail. That sounds like Julian Assange. Did you mean "prosecuted"?
- baq 4y ago
  Yes a bad case of autocorrection…

ilikehurdles 4y ago

In some cases, yes, they are held responsible. When I was trained on HIPAA compliance lawyers made it clear that individual employees could be held responsible for some violations. And yes, we restricted service availability based on region until we achieved compliance with GDPR and various regional PII/PHI data export laws. I work in another regulated industry today, and throughout the year sign off on understanding various regulations and trainings of 3 letter agencies, that are essentially in place to indemnify the company in case of a violation. I’d expect financial services follows similar steps.

martingoodson 4y ago

Yes of course they need to know the law. Anyone who might potentially break the law during the course of their work needs to know what that law is. ‘Just following orders’ is not a defence. This is very odd special pleading by programmers. Every industry needs to do this: journalists learn media law in their university degrees, architects have to learn the building regulations. Why is programming any different?

tomnipotent 4y ago
> Yes of course they need to know the law That's absolutely ridiculous, and no court would expect it.
- wyldberry 4y ago
  They won't until they do. When it's something seemingly egregious like this, it has the potential to be something that makes an example and changes curriculum for CS students across the country for decades. I expect other engineers to know laws when creating things (not like having a JD). Accredited business schools in the US teach business law to their undegrads. It's absolutely not ridiculous or a stretch to have a similar expectation.
  - tomnipotent 4y ago
    There's a big difference between the HN crowd shouting "they should know the laws!" vs. licensed and controlled professionals like architects and structural engineers that "follow the law" via established codes, which have clear boundaries that can be evaluated and prosecuted when violated. > When it's something seemingly egregious like this You don't even know what "this" is. So the BI engineer that stitches together data for a report should have known that combining these two values was illegal? What silliness.
    - martingoodson 4y ago
      ‘clear boundaries that can be evaluated and prosecuted when violated.’ Have you ever looked at media law or libel law? It does not have clear boundaries, but journalists are still expected to follow the law. Journalists are not absolved of the responsibility because it’s complicated. You just need to not break the law. It’s how it works. If you don’t want exposure to liability, you need to acquaint yourself with relevant law.

siva7 4y ago

Yes, engineers are also held responsible. If you're being serious, here us some education about the origin of this principle: https://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat https://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat

deleted 4y ago

[deleted]