5 ms·
How banal can a software mistake be before we aren't allowed to besmirch the name of the devs involved? Is forgetting a test case a shameable offense? What abou
by mrguyorama 3y ago
How banal can a software mistake be before we aren't allowed to besmirch the name of the devs involved? Is forgetting a test case a shameable offense? What about ignoring authentication? Rolling your own?
Turns out when you write APIs that access security related things, you have to treat everything coming in as a threat, right? Shouldn't that be table stakes by now?
We need a professional gatekeeping organization because the vast majority of us suck at our jobs and refuse to do anything about it.
- deleted 3y ago[deleted]
- phillipcarter 3y agoThe issue was caused by a race condition in extremely complicated software. Good luck setting up a gatekeeping organization that can track that level of detail (and understand every dimension of a possible fault like this).
- lcnPylGDnU4H9OF 3y agoI wouldn't expect the gatekeeper to track these issues but rather to sign the credentials that developers have. Then the individual developers (ostensibly) have a base level of training that set them up to more likely avoid these issues.
- phillipcarter 3y agoI don't know if you appreciate the level of complexity here. We're talking about a core diagnostics system (extremely complex software), that already has guards in place to protect against this stuff (complex again), but there was a race condition (complex again), and this one instance in likely billions and billions of transactions is what led to an issue. What training do you think could have prevented this? Microsoft deals with complex software at enormous scale. Bugs happen. And in this case, it was a severe one that's already been dealt with.
- ano-ther 3y agoI don’t understand the reflex for shaming. Everyone makes mistakes, and we are usually better off to understand & learn from it. If the first instinct is to punish, people will not be helpful in identifying their own mistake. Also, this is why companies like Microsoft have processes and systems to avoid such mistakes. They obviously failed here, but can be improved independently of the people involved. IIRC, airline safety investigations run in that way quite successfully.
- shadowgovt 3y agoMistakes and errors are inevitable. They are the side-effect of a functioning system. Where concern should occur is if one sees repeated mistakes of the same preventable kind.
- mrguyorama 3y agoAirlines are actually a great point. Pilots get better and learn from past mistakes because they are REQUIRED by licensing agencies to LEARN about these past failures. Our industry can't even manage the OWASP top ten with new grads. Surely we can try something slight different?
- GMoromisato 3y agoMedicine is the same: https://en.wikipedia.org/wiki/Morbidity_and_mortality_conference https://en.wikipedia.org/wiki/Morbidity_and_mortality_confer... M&M conferences are "non-punitive" to encourage people to accurately report what happened, even if what happened was a fatal medical mistake.
- belltaco 3y agoPeople will always make mistakes. Thats why it's better to focus on processes that should've been built to catch or stop mistakes, especially mistakes by a single person.