6 ms·

What’s different between a baker liable for flour content and an SDE liable for packaged library vulnerabilities?

giantg2 3y ago
Standardized food safety practices, pre-approved and comparatively trivial recipes, state/county inspections, etc. None of which apply to software. One is fairly trivial and standardized. The other is massively complex, rapidly changing, and unable to be boiled down to a standard set of trivial procedures. And to answer your question more directly, the flour itself causes the damage. The vulnerability is only damaging if a malicious actor takes advantage of it.
- beedeebeedee 3y ago
  > Standardized food safety practices Food safety practices only became standardized after regulation was enacted. > pre-approved and comparatively trivial recipes That sounds like most software development. I think you are unwittingly making the case that software development is a lot like food production. Software development is only beginning to get regulated because it is only now reaching the level where it is hazardous to public safety, unlike food production which reached that a long time ago.
  - giantg2 3y ago
    "Food safety practices only became standardized after regulation was enacted." Because you actually can standardize them. Software isn't so simple. "> pre-approved and comparatively trivial recipes That sounds like most software development." Lol no that does not. Why wouldn't high school graduates or drop outs work in software instead of at fast food? The number of languages, frameworks, patterns, etc are much more complex than basic sanitation and time/temp/acidity.
    - kube-system 3y ago
      > Because you actually can standardize them. Software isn't so simple. It isn't simple due to choice, not due to the nature of software. Software is relatively simple compared to other meat-space engineering disciplines. Software engineering is an relatively immature engineering discipline, but it is implicated in enough safety critical systems these days that it is about time to start maturing. It will be painful but I welcome more software regulatory standards, because it is necessary for our trade to mature.
      - SOLAR_FIELDS 3y ago
        It’s probable to make the case that some forms of software are simple enough to regulate. How many Supabase style crud apps have been made in our lifetimes (not shading Supabase, they’re just automating the commonalities here)
        kube-system 3y ago
        All software is simple enough to regulate. You don't have to micromanage every single line someone writes to regulate something. The way most professional regulations work is that someone writes down the safety practices that should be done, and then the law requires people to do those things. For example, one might require some software to undergo various degrees of planning, testing, analysis, support, documentation, etc. Right now, the amount of planning, testing, analysis, support, and documentation required by law is generally zero. This might be fine for someone's hobby project, but it is not okay for software that human lives depend on.
        jocoda 3y ago
        > ...for software that human lives depend on. who decides, and how?
        kube-system 3y ago
        For every other technology regulated this way, this is determined at the end application. How does someone know that a particular application is something lives depend on? Either your lawyer, insurance company, or regulator explicitly tells you.
  - erik_seaberg 3y ago
    Knuth’s code has bugs. NASA’s code has bugs. I would like to think that someday our profession might be able to achieve high enough quality to survive with liability, but today nobody is close to that at all.
    - gavinhoward 3y ago
      I think that liability shouldn't require perfection, just close enough as long as the criteria is objective. I personally think that any criteria that SQLite and Curl can't pass is too strict.
      - erik_seaberg 3y ago
        The AMA doesn’t require perfection, yet a doctor has to pay six-figure liability insurance premiums for the risk of harming a small fraction of his patients. I don’t have faith that this would be run more practically.
        gavinhoward 3y ago
        We have that problem in the medical world, but for some reason, we don't have it in the engineering world. Why? I don't know. Is the medical world just messed up? Or is there something wrong with licensure?
        erik_seaberg 3y ago
        I think it’s because civil and mechanical engineering weren’t invented from scratch in living memory. We already have some safe, conservative materials and designs for them to reuse. Our profession is still in a very early stage, sort of like the era of barbers performing surgery.
marcinzm 3y ago
The same difference as there is between a baker liable for flour content and you being liable for flour content when sharing some home made cookies with your co-workers.
deleted 3y ago
[deleted]

Standardized food safety practices, pre-approved and comparatively trivial recipes, state/county inspections, etc. None of which apply to software. One is fairly trivial and standardized. The other is massively complex, rapidly changing, and unable to be boiled down to a standard set of trivial procedures. And to answer your question more directly, the flour itself causes the damage. The vulnerability is only damaging if a malicious actor takes advantage of it.

beedeebeedee 3y ago
> Standardized food safety practices Food safety practices only became standardized after regulation was enacted. > pre-approved and comparatively trivial recipes That sounds like most software development. I think you are unwittingly making the case that software development is a lot like food production. Software development is only beginning to get regulated because it is only now reaching the level where it is hazardous to public safety, unlike food production which reached that a long time ago.
- giantg2 3y ago
  "Food safety practices only became standardized after regulation was enacted." Because you actually can standardize them. Software isn't so simple. "> pre-approved and comparatively trivial recipes That sounds like most software development." Lol no that does not. Why wouldn't high school graduates or drop outs work in software instead of at fast food? The number of languages, frameworks, patterns, etc are much more complex than basic sanitation and time/temp/acidity.
  - kube-system 3y ago
    > Because you actually can standardize them. Software isn't so simple. It isn't simple due to choice, not due to the nature of software. Software is relatively simple compared to other meat-space engineering disciplines. Software engineering is an relatively immature engineering discipline, but it is implicated in enough safety critical systems these days that it is about time to start maturing. It will be painful but I welcome more software regulatory standards, because it is necessary for our trade to mature.
    - SOLAR_FIELDS 3y ago
      It’s probable to make the case that some forms of software are simple enough to regulate. How many Supabase style crud apps have been made in our lifetimes (not shading Supabase, they’re just automating the commonalities here)
      - kube-system 3y ago
        All software is simple enough to regulate. You don't have to micromanage every single line someone writes to regulate something. The way most professional regulations work is that someone writes down the safety practices that should be done, and then the law requires people to do those things. For example, one might require some software to undergo various degrees of planning, testing, analysis, support, documentation, etc. Right now, the amount of planning, testing, analysis, support, and documentation required by law is generally zero. This might be fine for someone's hobby project, but it is not okay for software that human lives depend on.
        jocoda 3y ago
        > ...for software that human lives depend on. who decides, and how?
        kube-system 3y ago
        For every other technology regulated this way, this is determined at the end application. How does someone know that a particular application is something lives depend on? Either your lawyer, insurance company, or regulator explicitly tells you.
- erik_seaberg 3y ago
  Knuth’s code has bugs. NASA’s code has bugs. I would like to think that someday our profession might be able to achieve high enough quality to survive with liability, but today nobody is close to that at all.
  - gavinhoward 3y ago
    I think that liability shouldn't require perfection, just close enough as long as the criteria is objective. I personally think that any criteria that SQLite and Curl can't pass is too strict.
    - erik_seaberg 3y ago
      The AMA doesn’t require perfection, yet a doctor has to pay six-figure liability insurance premiums for the risk of harming a small fraction of his patients. I don’t have faith that this would be run more practically.
      - gavinhoward 3y ago
        We have that problem in the medical world, but for some reason, we don't have it in the engineering world. Why? I don't know. Is the medical world just messed up? Or is there something wrong with licensure?
        erik_seaberg 3y ago
        I think it’s because civil and mechanical engineering weren’t invented from scratch in living memory. We already have some safe, conservative materials and designs for them to reuse. Our profession is still in a very early stage, sort of like the era of barbers performing surgery.

marcinzm 3y ago

The same difference as there is between a baker liable for flour content and you being liable for flour content when sharing some home made cookies with your co-workers.

deleted 3y ago

[deleted]