4 ms·

It makes me cynical when most certifications and compliance involves a lot of paperwork and not much in the way of changes to software.

helmholtz 4y ago
Great, so you won't make the piles of money that RHEL does, but maybe you'll enjoy your work more.
- vetinari 4y ago
  You can have work that 1) you enjoy, 2) is well paid and 3) is legal. Pick two.
  - roschdal 4y ago
    Tell me more about this well paying and enjoyable work please.
    - sclarisse 4y ago
      Short version: You’re high off your own stash.
pas 4y ago
because compliance is mostly about documentation. glorified checklists. but checklists work (you might have heard about surgeons leaving medical tools in patients, and checklists eliminating this problem, seemingly the dumbest simplest technology, yet it's very powerful compared to the default of nothing) of course the quality of answers matter, but that's on the environment (auditors, regulators, industry best practices, trade groups, client expectations), see the absolute total shambles of the state of IT sec in South Korea, the 1000 year old COBOL systems in finance/insurance, the reservation system in air travel, the sorry state of TLS before LetsEncrypt, SMTP servers (how SPF, DMARC, DKIM and ARC and MTA-STS are all needed to signal that you really prefer TLS, really don't want to be impersonated, you really vouch for forwarded stuff, etc). also there's the BeyondCorp step-up. nobody bothered to really segment the internal network. nowadays the default is zero-trust.
- carlmr 4y ago
  >but checklists work (you might have heard about surgeons leaving medical tools in patients, and checklists eliminating this problem, seemingly the dumbest simplest technology, yet it's very powerful compared to the default of nothing) These glorified checklists also backfire all the time. With the surgeon it's indeed simple. With software what I see is that certification and process often lessens quality. Why you ask? Well if you need certification, changes become expensive. Because there's a huge tail of documentation and processes to be done. This leads to the perverse incentive to change as little as possible, even though you know it's broken. Boeing knew that they needed to retrain pilots if they changed the 737 MAX airplane too much. So they hacked the hardware, which lead to hacking the software, which lead to omission in the training. All because of the incentive not to change too much lest they need to retrain all pilots. The problem of course is that the retraining is an either or. Either your plane is sufficiently 737 like or not. If not the costs are huge. Especially since the competition's airplane would not need retraining. So the risks of these hacks to make it 737-like enough were weighed against huge costs. The costs were basically not being able to do business at all. Since these planes would be cost prohibitive for the cheap domestic airlines that want them. If the costs were more linear I'm sure this wouldn't have happened. E.g. if you can retrain pilots on only the MCAS system and still not require full recertification.
  - acapybara 4y ago
    I'm failing to see how this relates, whatsoever, to the discussion at hand. I don't mean any offense toward you. Just having an incredibly hard time making any sense of what you wrote.
    - bregma 4y ago
      I work for a company that ships safety-certified software. We, or often our customers, have discovered bugs in that software. We do not fix the bugs because one single small bugfix means re-certifying the entire software, a process that takes months of producing proof of matching the safety case plus many more months of updating and approving accompanying documentation and going through an audit. Everything has to be re-touched. We just issue an updated defect list to go with the software and our customers needs to work around the bug. Known unfixed bugs are a fact of life in certified software. Update releases are not. Customers pay a premium for this because they, too, would have to go through the same pain and expense on their side.
ho_schi 4y ago
I think there are checklists (good, safe operation) and certifications (paperwork). Seen verifications for ISO-Something, were incredible efforts invested to get the certificate. Looking at the actual technical side…I’m worried. Certifications which were influenced by people which follow their personal targets are a way to block competition and innovation. Certifications influenced by people with right mindest could help (e.g. require source access, data access, compatibility) a lot. What I wonder as user: What does Red Hat and Canonical actually test when ThinkPads are certified?
HPsquared 4y ago
The right paperwork brings the money in. Value is irrelevant, we're talking about government and megacorp procurement here!
op00to 4y ago
Checklists literally drive the world.

helmholtz 4y ago

Great, so you won't make the piles of money that RHEL does, but maybe you'll enjoy your work more.

vetinari 4y ago
You can have work that 1) you enjoy, 2) is well paid and 3) is legal. Pick two.
- roschdal 4y ago
  Tell me more about this well paying and enjoyable work please.
  - sclarisse 4y ago
    Short version: You’re high off your own stash.

pas 4y ago

because compliance is mostly about documentation. glorified checklists. but checklists work (you might have heard about surgeons leaving medical tools in patients, and checklists eliminating this problem, seemingly the dumbest simplest technology, yet it's very powerful compared to the default of nothing) of course the quality of answers matter, but that's on the environment (auditors, regulators, industry best practices, trade groups, client expectations), see the absolute total shambles of the state of IT sec in South Korea, the 1000 year old COBOL systems in finance/insurance, the reservation system in air travel, the sorry state of TLS before LetsEncrypt, SMTP servers (how SPF, DMARC, DKIM and ARC and MTA-STS are all needed to signal that you really prefer TLS, really don't want to be impersonated, you really vouch for forwarded stuff, etc). also there's the BeyondCorp step-up. nobody bothered to really segment the internal network. nowadays the default is zero-trust.

carlmr 4y ago
>but checklists work (you might have heard about surgeons leaving medical tools in patients, and checklists eliminating this problem, seemingly the dumbest simplest technology, yet it's very powerful compared to the default of nothing) These glorified checklists also backfire all the time. With the surgeon it's indeed simple. With software what I see is that certification and process often lessens quality. Why you ask? Well if you need certification, changes become expensive. Because there's a huge tail of documentation and processes to be done. This leads to the perverse incentive to change as little as possible, even though you know it's broken. Boeing knew that they needed to retrain pilots if they changed the 737 MAX airplane too much. So they hacked the hardware, which lead to hacking the software, which lead to omission in the training. All because of the incentive not to change too much lest they need to retrain all pilots. The problem of course is that the retraining is an either or. Either your plane is sufficiently 737 like or not. If not the costs are huge. Especially since the competition's airplane would not need retraining. So the risks of these hacks to make it 737-like enough were weighed against huge costs. The costs were basically not being able to do business at all. Since these planes would be cost prohibitive for the cheap domestic airlines that want them. If the costs were more linear I'm sure this wouldn't have happened. E.g. if you can retrain pilots on only the MCAS system and still not require full recertification.
- acapybara 4y ago
  I'm failing to see how this relates, whatsoever, to the discussion at hand. I don't mean any offense toward you. Just having an incredibly hard time making any sense of what you wrote.
  - bregma 4y ago
    I work for a company that ships safety-certified software. We, or often our customers, have discovered bugs in that software. We do not fix the bugs because one single small bugfix means re-certifying the entire software, a process that takes months of producing proof of matching the safety case plus many more months of updating and approving accompanying documentation and going through an audit. Everything has to be re-touched. We just issue an updated defect list to go with the software and our customers needs to work around the bug. Known unfixed bugs are a fact of life in certified software. Update releases are not. Customers pay a premium for this because they, too, would have to go through the same pain and expense on their side.

ho_schi 4y ago

I think there are checklists (good, safe operation) and certifications (paperwork). Seen verifications for ISO-Something, were incredible efforts invested to get the certificate. Looking at the actual technical side…I’m worried. Certifications which were influenced by people which follow their personal targets are a way to block competition and innovation. Certifications influenced by people with right mindest could help (e.g. require source access, data access, compatibility) a lot. What I wonder as user: What does Red Hat and Canonical actually test when ThinkPads are certified?

HPsquared 4y ago

The right paperwork brings the money in. Value is irrelevant, we're talking about government and megacorp procurement here!

op00to 4y ago

Checklists literally drive the world.