5 ms·

"Linux does not have a safety culture... Linux does not have a quality culture." While this is critical for an airplane (as well as an automobile) I would thin

by mikece 3y ago

"Linux does not have a safety culture... Linux does not have a quality culture." While this is critical for an airplane (as well as an automobile) I would think the seeds of this would be desirable in corporate application servers as well. While someone might not lose their life if an app server goes down the "move fast and break things" culture only gets you so far before a culture with adult supervision and an eye toward stability is required.

mschuster91 3y ago
> the "move fast and break things" culture only gets you so far before a culture with adult supervision and an eye toward stability is required. You can run multi billion dollar companies that way (Reddit, Twitter, Meta, Tesla), hell you can get richest-man-in-the-world by shitting on everything.
- crabbone 3y ago
  But you cannot build airplanes this way, which is the point of the article.
  - svleest 3y ago
    Our point was a but more nuanced. We pointed out the problem (and also value) of the collaborative innovation. Then, we also noted that with some care, we think a carefully customized distribution could be shown to be sufficiently safe.
ccakes 3y ago
It’s wild to me that software engineers don’t need to be certified in a similar vein to civil engineers. As more and more of our comms move into closed-gardens over the internet, the opportunity for a bug to indirectly result in injury or death grows. All it takes is a bug in a billing system that prevents a delinquent customer from contacting emergency services..
- PrimeMcFly 3y ago
  > It’s wild to me that software engineers don’t need to be certified in a similar vein to civil engineers. At the moment any coder can claim to be a software engineer. Certification is needed so we can draw a distinction between those who can code, and those can can engineer software solutions, as well as holding them to a higher standard.
  - lloeki 3y ago
    In France it is: "engineer"-the-title specifically means having a degree from a state-certified engineering school, and when you get the degree the state inscribes you as an engineer in a national registry. Whether it's software engineer or another domain is immaterial, the title "engineer" is heavily protected and making use of it without the degree is liable for pursuit the same way claiming to be a doctor and delivering medical advice when one is not: in the same way as with the Hippocrates oath, engineers are held to a high moral standard of ethics and integrity. The words "élite de la nation" often comes up - and often in derogatory ways from outsiders - but it is borne out from these requirements, that engineers are to be placed in position of great power and corresponding responsibility, meaning they have a duty to call the shots in high stakes situations in ways that go beyond technical knowledge and mastery but also factor in intellectual and moral values. One can get a masters degree in computer science and/or software development though, which is the same "knowledge level" of studies (an engineering degree doubles as a masters degree), but that does not make one an engineer, which is a corps (in the same sense that e.g US Marines are a corps). This dates back to Napoleon and the creation of "classes préparatoires" and public (state-owned) engineer schools, heavily inspired by the military. Case in point Polytechnique is a military school (although the goal is not to produce armymen), and entering any of the three french military corps (the navy, the air force, and the "ground" army) as an officer goes through the same classe préparatoire process. This design has been relaxed over time and for quite a time there are private engineering schools that don't require going through these first two prépa years, but they still require the state certification to legally produce engineers.
    - PrimeMcFly 3y ago
WJW 3y ago
Well nobody is ever against "more safety", it's just when you ask how much it is allowed to cost that the sputtering starts. Most companies don't even want to pay for basic maintenance or to pay license costs for a programming language, let alone that they would want to pay for libraries that could also be had for free in a FOSS version. Every FOSS library rightly comes with a license that states in all caps that "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND". That is pretty directly opposed to the kind of "We guarantee this software will perform within spec 100% of the time" assurances that airplane manufacturers want.
- secondcoming 3y ago
  Do any CPUs ship with correctness guarantees?
  - WJW 3y ago
    You can definitely get CPUs which run in pairs and verify amongst themselves that they both come to the same answer when running the same code on the same inputs: https://en.wikipedia.org/wiki/Lockstep_(computing) https://en.wikipedia.org/wiki/Lockstep_(computing). Being physical devices, even if the design adheres to the spec any individual CPU might still be defective of course. You can only test "is it still good" by periodically running one through a test suite and re-certifying that it still returns the correct answers, but there is never any guarantee that it won't break a second later due to freak circumstances. You can get down to acceptable margins though.
    - svleest 3y ago
      Using redundant systems helps detect (dual redunant) and even correct (triple modular redundant) physical faults in the system, where one system will provide a different answer than the other(s). System redundancy does not detect/correct for design flaws, which are a common mode failure. Catching design flaws is currently done by testing (compared to known correct answers) and peer review (by domain experts). Someday, mathematical proofs might be used (known as "formal methods"), but currently these are only possible to use on very small software projects, such as the seL4 project that formally proved correctness for around 10K lines of code.
cesarb 3y ago
> the "move fast and break things" culture only gets you so far before a culture with adult supervision and an eye toward stability is required. In my opinion, we are still in a "pioneer" phase of software engineering, where expansion (aka "software is eating the world") is prioritized over consolidation. But I think this is already starting to change; one example I've observed (in corporate application servers) being an increased focus on software supply chain management.
- svleest 3y ago
  Yes, that's it. We want to take advantage of the innovative technology in the "expansion" but need to carefully manage what we actually put on the airplane to demonstrate (with evidence) that it is well suited for the intended purpose. Which I think is what you mean by "consolidation".
dijit 3y ago
Linux itself does not have a culture of move fast and break things. Solaris had a more conservative approach than Linux though and people obviously didn't go in for that, thus IllumOS is essentially dead.
- SoftTalker 3y ago
  Solaris was more conservative in a business sense perhaps, but it was in no way built to avionics standards.
nottorp 3y ago
> "Linux does not have a safety culture... Linux does not have a quality culture." Of course, Linux is mostly competing with Windows and Mac OS, not airplane RTOSes. Thing is, are they expecting someone to do a linux based RTOS for free? Like just pull it off kernel.org and set it up in the airplane?
- svleest 3y ago
  Linux competes not only on the desktop with Windows and Mac OS, but also on the server and cloud environments, and also in embedded environments. It is highly scalable to many use cases. No, we don't expect to use Linux right off the shelf. As the full presentation noted we would create a carefully curated profile to go on the airplane. And that work to curate and manage it, and producing certification evidence of correctness -- is definitely not free.

by mikece 3y ago

mschuster91 3y ago

> the "move fast and break things" culture only gets you so far before a culture with adult supervision and an eye toward stability is required. You can run multi billion dollar companies that way (Reddit, Twitter, Meta, Tesla), hell you can get richest-man-in-the-world by shitting on everything.

crabbone 3y ago
But you cannot build airplanes this way, which is the point of the article.
- svleest 3y ago
  Our point was a but more nuanced. We pointed out the problem (and also value) of the collaborative innovation. Then, we also noted that with some care, we think a carefully customized distribution could be shown to be sufficiently safe.

ccakes 3y ago

It’s wild to me that software engineers don’t need to be certified in a similar vein to civil engineers. As more and more of our comms move into closed-gardens over the internet, the opportunity for a bug to indirectly result in injury or death grows. All it takes is a bug in a billing system that prevents a delinquent customer from contacting emergency services..

PrimeMcFly 3y ago
> It’s wild to me that software engineers don’t need to be certified in a similar vein to civil engineers. At the moment any coder can claim to be a software engineer. Certification is needed so we can draw a distinction between those who can code, and those can can engineer software solutions, as well as holding them to a higher standard.
- lloeki 3y ago
  In France it is: "engineer"-the-title specifically means having a degree from a state-certified engineering school, and when you get the degree the state inscribes you as an engineer in a national registry. Whether it's software engineer or another domain is immaterial, the title "engineer" is heavily protected and making use of it without the degree is liable for pursuit the same way claiming to be a doctor and delivering medical advice when one is not: in the same way as with the Hippocrates oath, engineers are held to a high moral standard of ethics and integrity. The words "élite de la nation" often comes up - and often in derogatory ways from outsiders - but it is borne out from these requirements, that engineers are to be placed in position of great power and corresponding responsibility, meaning they have a duty to call the shots in high stakes situations in ways that go beyond technical knowledge and mastery but also factor in intellectual and moral values. One can get a masters degree in computer science and/or software development though, which is the same "knowledge level" of studies (an engineering degree doubles as a masters degree), but that does not make one an engineer, which is a corps (in the same sense that e.g US Marines are a corps). This dates back to Napoleon and the creation of "classes préparatoires" and public (state-owned) engineer schools, heavily inspired by the military. Case in point Polytechnique is a military school (although the goal is not to produce armymen), and entering any of the three french military corps (the navy, the air force, and the "ground" army) as an officer goes through the same classe préparatoire process. This design has been relaxed over time and for quite a time there are private engineering schools that don't require going through these first two prépa years, but they still require the state certification to legally produce engineers.
  - PrimeMcFly 3y ago

WJW 3y ago

Well nobody is ever against "more safety", it's just when you ask how much it is allowed to cost that the sputtering starts. Most companies don't even want to pay for basic maintenance or to pay license costs for a programming language, let alone that they would want to pay for libraries that could also be had for free in a FOSS version. Every FOSS library rightly comes with a license that states in all caps that "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND". That is pretty directly opposed to the kind of "We guarantee this software will perform within spec 100% of the time" assurances that airplane manufacturers want.

secondcoming 3y ago
Do any CPUs ship with correctness guarantees?
- WJW 3y ago
  You can definitely get CPUs which run in pairs and verify amongst themselves that they both come to the same answer when running the same code on the same inputs: https://en.wikipedia.org/wiki/Lockstep_(computing) https://en.wikipedia.org/wiki/Lockstep_(computing). Being physical devices, even if the design adheres to the spec any individual CPU might still be defective of course. You can only test "is it still good" by periodically running one through a test suite and re-certifying that it still returns the correct answers, but there is never any guarantee that it won't break a second later due to freak circumstances. You can get down to acceptable margins though.
  - svleest 3y ago
    Using redundant systems helps detect (dual redunant) and even correct (triple modular redundant) physical faults in the system, where one system will provide a different answer than the other(s). System redundancy does not detect/correct for design flaws, which are a common mode failure. Catching design flaws is currently done by testing (compared to known correct answers) and peer review (by domain experts). Someday, mathematical proofs might be used (known as "formal methods"), but currently these are only possible to use on very small software projects, such as the seL4 project that formally proved correctness for around 10K lines of code.

cesarb 3y ago

> the "move fast and break things" culture only gets you so far before a culture with adult supervision and an eye toward stability is required. In my opinion, we are still in a "pioneer" phase of software engineering, where expansion (aka "software is eating the world") is prioritized over consolidation. But I think this is already starting to change; one example I've observed (in corporate application servers) being an increased focus on software supply chain management.

svleest 3y ago
Yes, that's it. We want to take advantage of the innovative technology in the "expansion" but need to carefully manage what we actually put on the airplane to demonstrate (with evidence) that it is well suited for the intended purpose. Which I think is what you mean by "consolidation".

dijit 3y ago

Linux itself does not have a culture of move fast and break things. Solaris had a more conservative approach than Linux though and people obviously didn't go in for that, thus IllumOS is essentially dead.

SoftTalker 3y ago
Solaris was more conservative in a business sense perhaps, but it was in no way built to avionics standards.

nottorp 3y ago

> "Linux does not have a safety culture... Linux does not have a quality culture." Of course, Linux is mostly competing with Windows and Mac OS, not airplane RTOSes. Thing is, are they expecting someone to do a linux based RTOS for free? Like just pull it off kernel.org and set it up in the airplane?

svleest 3y ago
Linux competes not only on the desktop with Windows and Mac OS, but also on the server and cloud environments, and also in embedded environments. It is highly scalable to many use cases. No, we don't expect to use Linux right off the shelf. As the full presentation noted we would create a carefully curated profile to go on the airplane. And that work to curate and manage it, and producing certification evidence of correctness -- is definitely not free.