3 ms·

I believe our industry needs regulations and liability, but the CRA could be dangerous. (See my comment at [1].) There is a better way [2], but I don't know ho

I believe our industry needs regulations and liability, but the CRA could be dangerous. (See my comment at [1].) There is a better way [2], but I don't know how we would convince politicians that there is a better way. [1]: https://news.ycombinator.com/item?id=38788919 https://news.ycombinator.com/item?id=38788919 [2]: https://gavinhoward.com/2023/11/how-to-fund-foss-save-it-from-the-cra-and-improve-cybersecurity/ https://gavinhoward.com/2023/11/how-to-fund-foss-save-it-fro...

api 3y ago
If this isn’t done extremely carefully and with deep understanding of the industry, software will get 10X as expensive and innovation will halt due to liability concerns. It’ll turn into the aerospace industry where “if it hasn’t flown, it can’t fly.” This is among other things why we still burn leaded gas in small planes. Replacing it is easy, but the cost of certifying any kind of new design is insane. I’ve always just been against any such regulation because I have zero confidence our technically ignorant politicians can do it well. I also think it’s likely to be sabotaged by consultants and big tech monopolists who see an opportunity to lock out competitors or create gravy trains.
- gavinhoward 3y ago
  All of what you said is true. That is why I want the industry to self-regulate with professional licensure first. If we let politicians do it, they'll do it wrong. If we do it first, and push hard to have politicians adopt our system when they've decided that regulation will happen, then we have a chance that it won't be awful. As for consultants, yes, that could be a problem. However, I think professional licensure would minimize that because requiring a Professional Software Engineer (PSWE) on a project means having someone there for the long term, dedicated to the project, which is antithetical to consultants game plan to run either short projects or many projects at once. As for Big Tech monopolists, yes that could be a problem. However, I think professional licensure, with a Code of Ethics, would actually give the PSWE at such companies the ability to say no to such monopolization. And they would, if we could actually threaten loss of license. So you are correct that my proposal isn't perfect, but I do think it minimizes the risk of bad things happening among the others.
  - Ekaros 3y ago
    My problem with self-regulation is that time for that was 10 years ago. Maybe 20 is too much, but certainly over a decade ago... The industry had their change, they fully squandered it. Now it is time for the whip.
    - gavinhoward 3y ago
      And I'm afraid I agree with you. I just hope it doesn't destroy the nice things. If it does, well, this is why we can't have nice things.
  - kaashif 3y ago
    As with anything, professional licensure can make things better or worse. What tends to happen with professional licensing is that barriers to entry are erected, reducing the supply of labour and artificially increasing the price of labour for existing software engineers. See cosmetology licenses for example: it is ludicrous that it is illegal to shampoo someone's hair in New York without completing a 1,000 hour course of study or having 5 years (!!!) of experience [1]. Yeah, sure, you shouldn't be spreading diseases or anything, but this is far, far beyond that. A less ridiculous example: doctors. In the US, there is a hilariously restrictive number of residency places available, and this number is set by the government and backed by the American Medical Association. This inflates doctors' wages and makes it much harder to become a doctor than is necessary. There's a strong case for licensing doctors, but the particular way it's done in the US is obviously suboptimal. My point is that yes, politicians writing regulations wrong will hurt the industry, but strangling the industry by limiting the number of software engineers can also cause harm. I believe you know this already ("my proposal isn't perfect") so don't take this as an argument, I'm just making the possible downsides explicit and adding some detail. [1]: https://dos.ny.gov/cosmetology https://dos.ny.gov/cosmetology
    - gavinhoward 3y ago
      > I believe you know this already ("my proposal isn't perfect") so don't take this as an argument... Yes, I do, and I agree. This could go horribly wrong.
- Barrin92 3y ago
  I think that is an odd comparison. Yes, there's parts of an industry like aerospace where innovation is slow, but then again if airplanes were build like web apps they'd get twice as heavy every year and fall out of the sky once per day. Compared to the relatively high engineering standards and slow but at least continuous improvements in actual engineering disciplines, software is built so badly most of it should never see the light of day. If most machines we build were as insecure and crappy as software we'd have brought the Code of Hammurabi back already.
zvr 3y ago
FYI, there will be a FOSDEM devroom specifically on the European Legislative Landscape, where a number of people involved in drafting this and similar regulations are expected to be present. The deadline for submitting presentation proposals has passed, but the schedule should be available shortly at https://fosdem.org/2024/schedule/track/eu-policy/ https://fosdem.org/2024/schedule/track/eu-policy/
- gavinhoward 3y ago
  Oh, no...My post came out before the deadline, but I didn't know... Well, I sent an email with the link; that is all I can do.

api 3y ago

If this isn’t done extremely carefully and with deep understanding of the industry, software will get 10X as expensive and innovation will halt due to liability concerns. It’ll turn into the aerospace industry where “if it hasn’t flown, it can’t fly.” This is among other things why we still burn leaded gas in small planes. Replacing it is easy, but the cost of certifying any kind of new design is insane. I’ve always just been against any such regulation because I have zero confidence our technically ignorant politicians can do it well. I also think it’s likely to be sabotaged by consultants and big tech monopolists who see an opportunity to lock out competitors or create gravy trains.

gavinhoward 3y ago
All of what you said is true. That is why I want the industry to self-regulate with professional licensure first. If we let politicians do it, they'll do it wrong. If we do it first, and push hard to have politicians adopt our system when they've decided that regulation will happen, then we have a chance that it won't be awful. As for consultants, yes, that could be a problem. However, I think professional licensure would minimize that because requiring a Professional Software Engineer (PSWE) on a project means having someone there for the long term, dedicated to the project, which is antithetical to consultants game plan to run either short projects or many projects at once. As for Big Tech monopolists, yes that could be a problem. However, I think professional licensure, with a Code of Ethics, would actually give the PSWE at such companies the ability to say no to such monopolization. And they would, if we could actually threaten loss of license. So you are correct that my proposal isn't perfect, but I do think it minimizes the risk of bad things happening among the others.
- Ekaros 3y ago
  My problem with self-regulation is that time for that was 10 years ago. Maybe 20 is too much, but certainly over a decade ago... The industry had their change, they fully squandered it. Now it is time for the whip.
  - gavinhoward 3y ago
    And I'm afraid I agree with you. I just hope it doesn't destroy the nice things. If it does, well, this is why we can't have nice things.
- kaashif 3y ago
  As with anything, professional licensure can make things better or worse. What tends to happen with professional licensing is that barriers to entry are erected, reducing the supply of labour and artificially increasing the price of labour for existing software engineers. See cosmetology licenses for example: it is ludicrous that it is illegal to shampoo someone's hair in New York without completing a 1,000 hour course of study or having 5 years (!!!) of experience [1]. Yeah, sure, you shouldn't be spreading diseases or anything, but this is far, far beyond that. A less ridiculous example: doctors. In the US, there is a hilariously restrictive number of residency places available, and this number is set by the government and backed by the American Medical Association. This inflates doctors' wages and makes it much harder to become a doctor than is necessary. There's a strong case for licensing doctors, but the particular way it's done in the US is obviously suboptimal. My point is that yes, politicians writing regulations wrong will hurt the industry, but strangling the industry by limiting the number of software engineers can also cause harm. I believe you know this already ("my proposal isn't perfect") so don't take this as an argument, I'm just making the possible downsides explicit and adding some detail. [1]: https://dos.ny.gov/cosmetology https://dos.ny.gov/cosmetology
  - gavinhoward 3y ago
    > I believe you know this already ("my proposal isn't perfect") so don't take this as an argument... Yes, I do, and I agree. This could go horribly wrong.
Barrin92 3y ago
I think that is an odd comparison. Yes, there's parts of an industry like aerospace where innovation is slow, but then again if airplanes were build like web apps they'd get twice as heavy every year and fall out of the sky once per day. Compared to the relatively high engineering standards and slow but at least continuous improvements in actual engineering disciplines, software is built so badly most of it should never see the light of day. If most machines we build were as insecure and crappy as software we'd have brought the Code of Hammurabi back already.

zvr 3y ago

FYI, there will be a FOSDEM devroom specifically on the European Legislative Landscape, where a number of people involved in drafting this and similar regulations are expected to be present. The deadline for submitting presentation proposals has passed, but the schedule should be available shortly at https://fosdem.org/2024/schedule/track/eu-policy/ https://fosdem.org/2024/schedule/track/eu-policy/

gavinhoward 3y ago
Oh, no...My post came out before the deadline, but I didn't know... Well, I sent an email with the link; that is all I can do.