5 ms·

TBH having software engineer output in general be liable to some minimum safety, correctness and quality standard would be a god send for the world. But of cou

by izacus 3y ago

TBH having software engineer output in general be liable to some minimum safety, correctness and quality standard would be a god send for the world. But of course the developers will revolt against that.

mnau 3y ago
How do you define "minimum safety, correctness and quality standard"?
- deleted 3y ago
  [deleted]
- pintxo 3y ago
  By having professionals agree on a minimal set, and writing them down?
  - mnau 3y ago
    So you propose no idea of "minimal set". If a liability is proposed, it has to be reasonably binary state: compliant/non-compliant. Just like every time, there is no concrete proposal what constitute "minimal set". That's like "make education better", with no concrete plan. We can agree on goal, but on on the method.
    - josephg 3y ago
      There are several ways we could write a list of best practices. But the simplest would be to simply attach a financial cost to leaking any personal data to the open internet. This is essentially how every other industry already works: If my building falls down, the company which made it is financially liable. If I get sick from food poisoning, I can sue the companies responsible for giving me that food. And so on. We could also write a list of "best practices" - like they do in the construction and aviation industries. Things like: - Never store personal data on insecure devices (eg developer laptops which have FDE disabled or weak passwords) - Install (or at least evaluate) all security updates from your OS vendor and software dependencies - Salt all passwords in the database And so on. If you locked some competent security engineers in a room for a few days, it would be pretty easy to come up with a reasonable list of practices. There would have to be some judgement in how they're applied, just like in the construction industry. But if companies are held liable if customer data was leaked as a result of best practices not being followed, well, I imagine the situation would improve quite quickly. Its boring work. Compliance is always boring. But it might be better than the current situation, and our endless list of data breaches.
      - pintxo 3y ago
        > But if companies are held liable if customer data was leaked as a result of best practices not being followed, well, I imagine the situation would improve quite quickly. One might argue that GDPR does exactly this, it holds companies financially liable for data leaks. Would you say it has improved the situation?
      - mnau 3y ago
        Software is in a very unique position. It can be attacked all the time with completely impunity. Buildings are completely vulnerable even to simple hammer breaking windows, locks have been basically broken for decades Food processor is easily vulnerable to poisoned potato. Only the software has to take all attacks humans can come up with and withstand it. What other industry has to deal with that? Maybe military, army camp in middle of enemy territory? We have improved massively and will and should continue to do, but it's very different from other industries. That's the core reason for breaches. Some security checklist will help to filter most egregious idiots (especially upgrades from vulnerable versions).
        Anechoic 3y ago
        If a system is attacked or fails in novel way, and the system design was done in accordance with best-practices, the follow-up investigation will note this, the system implementers will in all likelihood not face any repercussions (because they weren't negligent) and the standards will be updated to account for the new vulnerability. Just like other engineering disciplines. Yes, things are constantly evolving in computer engineering, but how many of the failures that make the news are caused by novel new attack vectors, versus not following best-practices?
        twh270 3y ago
        We don't live in a hard, binary world of extremes. Yes -- buildings and locks are, for the most part, easily compromised. But... If I make a window of bulletproof glass, it's a lot harder to compromise. If I surround my building with a wall topped by razor wire, it's a lot harder to compromise. (Unless, of course, I'm making an action film.) Depending on what or who I'm protecting, I might find these solutions very valuable. Similarly in software, depending on what or who I am protecting, I might be very interested in various security measures. So far, we've managed to escape an incident where bad actors have compromised systems in a way that's led to severe loss or harm. People are terrible at evaluating risk, so people tend to assume the status quo is okay. It's not, and it's only a matter of time before a bad actor does some real damage. Think 9/11 style, something that causes an immediate reaction and shocks the population. Then, suddenly, our politicians will be all in favor of requiring software developers to be licensed; liability for companies that allow damages; etc.
    - pintxo 3y ago
      Well, I interpreted your question 'How do you define "minimum safety, correctness and quality standard"?' as to be about the process, not about the outcome. I actually have not invested much thought into what the outcome should/would be as I think it's unlikely to happen anyway. So why invest time? But maybe ask the author of the original comment?
- driscoll42 3y ago
  NCEES which administrates the regulation of Professional Engineers in the US made a Software Engineering Exam which had some standards: https://ncees.org/wp-content/uploads/2016/01/Software-Engineering-Practice-Standards-Licensure-Guide.pdf https://ncees.org/wp-content/uploads/2016/01/Software-Engine... However so few people took the test they discontinued it. But I at least liked the idea of it.
pintxo 3y ago
I don't think it would be the developers that would revolt. Well some would for sure, but the real opposition will come from the C-level, as this would give their employees way too much power to say no.
EthicalSimilar 3y ago
Would just cause more companies to outsource anyway.
- josephg 3y ago
  It might do the opposite. Imagine if the company was held responsible for the quality of the software regardless of how it was made. I suspect it would be much easier to meet any quality standards if software was written in-house.
  - lmz 3y ago
    It would get outsourced to the first provider who can indemnify the company against any failures in the software. Whether or not any provider would dare to provide such a service however...
    - josephg 3y ago
      However it happens, it still attaches a legal & financial cost to lazy security practices. And makes it actually in companies' best interest to do security auditing. I think that would be a net win for computer security - and consumers everywhere.
m_fayer 3y ago
The agile-peddling consultants and managers would certainly be the first to the barricades.
- izacus 3y ago
  As long as they're first to the stocks too, we're fine with it ;)
beAbU 3y ago
If you want to call yourself "engineer" then at a minimum all those standards and minimum requirements should apply, no questions asked. I've heard stories of hauling civil engineers out of retirement and in front of a tribunal after some structure that collapsed before it's time, or it was found that the original design was flawed in some way. An engineer "signing off" on something actually means something, with actual stakes. Of course the "developers" will revolt against this, because they are not engineers. A developer does not get to sign off on anything, and everything they do must be scrutinised by the engineer in charge before it can be deployed. Doing this for your common run-of-the-mill CRUD app or HTML website is obviously overkill. Just like you don't need an engineer to replace a broken window or hang a new door. But when it comes to things that actually matter, like data safety and privacy, you must ensure you bring in the right culture (let alone job title).
- avgcorrection 3y ago
  > If you want to call yourself "engineer" then at a minimum all those standards and minimum requirements should apply, no questions asked. I don’t call myself that so I’m all good. My general vocation is just “technologist”. Plus: not a protected title in my jurisdiction.
- renewiltord 3y ago
  All those engineers need to be hauled up because they’re killing people. Software engineers by contrast are high performance: barely any fatalities and so much value created. It’s why it’s not construction firms that are the most valuable companies but software companies. You can count on software engineers to build things that won’t kill, for the most part. Other kinds of engineers, on the other hand, are constantly killing people. We need higher standards for engineers. They could learn from software folks. If you can’t do it safely don’t do it.
  - josephg 3y ago
    I have a friend who works in a hospital. Apparently the hospital software they use constantly freezes for like, 30+ seconds while they're trying to get work done. Meanwhile my friend has had her passport, entire medical history and all sorts of personal information leaked by Medibank then Optus, within a few months of each other. Neither company as far as I can tell has been held in any way to account for the blunder. Meanwhile the Post Office Scandal is rocking the UK - where a software mistake landed a bunch of completely innocent people in jail and led to multiple suicides. And don't even get me started on the impact of social media. We might not kill as many people as engineers. Maybe. But we certainly cause more than our share of harm to society.
toast0 3y ago
I'm am engineer by many definitions, although I don't have or wear a stripey hat, so not the most important definition. I'm not licensed though and have no signoff rights or responsibilities. If I were to consider signing off on my work or the work of my colleagues after review, the industry would have to be completely different. I have been in the industry for more than 20 years and I can count the number of times I've had a complete specification for a project I worked on with zero hands. I can't sign off that the work is to spec it the spec is incomplete or nonexistant. Writing, consuming, and verifying specs costs time and money and adds another layer of people into the process. The cost of failure and the cost to remediate failures discovered after release for most software is too low to justify the cost of rigor. There's exceptions: software in systems involved with life safety, avionics, and the like obviously have a high cost for failure, and you can't take a crashed plane, turn it off and on and then transport the passengers. You don't get a civil engineer to sign off on a one-story house in most cases either.
- dave4420 3y ago
  Any software system that might produce legal evidence should also be an exception… it feels a bit too much of a common case to call it an exception though. (This is in reference to the Horizon scandal, yes.)
trey-jones 3y ago
I think you can prevent a lot of revolt by just finding a way of putting this other than "software engineer output" should be held to standards. The whole point of this article is that the individual is not the problem. Rather, the system should prevent the individual from being the problem. Nobody wants software quality to be regulated by people who don't know anything about software. So, probably we should be regulating ourselves. It's not an easy problem though. Can you really state a minimum safety standard for software that is quantifiable? - All tests passing? Not good enough - 100% test coverage? Not good enough - AI approved code? ha
deleted 3y ago
[deleted]
ticviking 3y ago
Our employers will revolt because we will either cost more or be slower. The price of an developer is already very high compared to other skilled labor
caskstrength 3y ago
> But of course the developers will revolt against that. Why would developers revolt? OTOH users would definitely be unhappy when every little app for their iPhone suddenly costs as much as an airplane ticket.
HeyLaughingBoy 3y ago
> and quality standard This is my life: https://en.wikipedia.org/wiki/IEC_62304 https://en.wikipedia.org/wiki/IEC_62304
- alfanick 3y ago
  Oh I also unfortunately know this standard by heart, hi!
rcxdude 3y ago
The EU is doing something like this with some proposed legislation. Basically it's a CE mark for software. The current version is very much a bare minimum, though. But it does impose liability on people selling software.

by izacus 3y ago

mnau 3y ago

How do you define "minimum safety, correctness and quality standard"?

deleted 3y ago
[deleted]
pintxo 3y ago
By having professionals agree on a minimal set, and writing them down?
- mnau 3y ago
  So you propose no idea of "minimal set". If a liability is proposed, it has to be reasonably binary state: compliant/non-compliant. Just like every time, there is no concrete proposal what constitute "minimal set". That's like "make education better", with no concrete plan. We can agree on goal, but on on the method.
  - josephg 3y ago
    There are several ways we could write a list of best practices. But the simplest would be to simply attach a financial cost to leaking any personal data to the open internet. This is essentially how every other industry already works: If my building falls down, the company which made it is financially liable. If I get sick from food poisoning, I can sue the companies responsible for giving me that food. And so on. We could also write a list of "best practices" - like they do in the construction and aviation industries. Things like: - Never store personal data on insecure devices (eg developer laptops which have FDE disabled or weak passwords) - Install (or at least evaluate) all security updates from your OS vendor and software dependencies - Salt all passwords in the database And so on. If you locked some competent security engineers in a room for a few days, it would be pretty easy to come up with a reasonable list of practices. There would have to be some judgement in how they're applied, just like in the construction industry. But if companies are held liable if customer data was leaked as a result of best practices not being followed, well, I imagine the situation would improve quite quickly. Its boring work. Compliance is always boring. But it might be better than the current situation, and our endless list of data breaches.
    - pintxo 3y ago
      > But if companies are held liable if customer data was leaked as a result of best practices not being followed, well, I imagine the situation would improve quite quickly. One might argue that GDPR does exactly this, it holds companies financially liable for data leaks. Would you say it has improved the situation?
    - mnau 3y ago
      Software is in a very unique position. It can be attacked all the time with completely impunity. Buildings are completely vulnerable even to simple hammer breaking windows, locks have been basically broken for decades Food processor is easily vulnerable to poisoned potato. Only the software has to take all attacks humans can come up with and withstand it. What other industry has to deal with that? Maybe military, army camp in middle of enemy territory? We have improved massively and will and should continue to do, but it's very different from other industries. That's the core reason for breaches. Some security checklist will help to filter most egregious idiots (especially upgrades from vulnerable versions).
      - Anechoic 3y ago
        If a system is attacked or fails in novel way, and the system design was done in accordance with best-practices, the follow-up investigation will note this, the system implementers will in all likelihood not face any repercussions (because they weren't negligent) and the standards will be updated to account for the new vulnerability. Just like other engineering disciplines. Yes, things are constantly evolving in computer engineering, but how many of the failures that make the news are caused by novel new attack vectors, versus not following best-practices?
      - twh270 3y ago
        We don't live in a hard, binary world of extremes. Yes -- buildings and locks are, for the most part, easily compromised. But... If I make a window of bulletproof glass, it's a lot harder to compromise. If I surround my building with a wall topped by razor wire, it's a lot harder to compromise. (Unless, of course, I'm making an action film.) Depending on what or who I'm protecting, I might find these solutions very valuable. Similarly in software, depending on what or who I am protecting, I might be very interested in various security measures. So far, we've managed to escape an incident where bad actors have compromised systems in a way that's led to severe loss or harm. People are terrible at evaluating risk, so people tend to assume the status quo is okay. It's not, and it's only a matter of time before a bad actor does some real damage. Think 9/11 style, something that causes an immediate reaction and shocks the population. Then, suddenly, our politicians will be all in favor of requiring software developers to be licensed; liability for companies that allow damages; etc.
  - pintxo 3y ago
    Well, I interpreted your question 'How do you define "minimum safety, correctness and quality standard"?' as to be about the process, not about the outcome. I actually have not invested much thought into what the outcome should/would be as I think it's unlikely to happen anyway. So why invest time? But maybe ask the author of the original comment?
driscoll42 3y ago
NCEES which administrates the regulation of Professional Engineers in the US made a Software Engineering Exam which had some standards: https://ncees.org/wp-content/uploads/2016/01/Software-Engineering-Practice-Standards-Licensure-Guide.pdf https://ncees.org/wp-content/uploads/2016/01/Software-Engine... However so few people took the test they discontinued it. But I at least liked the idea of it.

pintxo 3y ago

I don't think it would be the developers that would revolt. Well some would for sure, but the real opposition will come from the C-level, as this would give their employees way too much power to say no.

EthicalSimilar 3y ago

Would just cause more companies to outsource anyway.

josephg 3y ago
It might do the opposite. Imagine if the company was held responsible for the quality of the software regardless of how it was made. I suspect it would be much easier to meet any quality standards if software was written in-house.
- lmz 3y ago
  It would get outsourced to the first provider who can indemnify the company against any failures in the software. Whether or not any provider would dare to provide such a service however...
  - josephg 3y ago
    However it happens, it still attaches a legal & financial cost to lazy security practices. And makes it actually in companies' best interest to do security auditing. I think that would be a net win for computer security - and consumers everywhere.

m_fayer 3y ago

The agile-peddling consultants and managers would certainly be the first to the barricades.

izacus 3y ago
As long as they're first to the stocks too, we're fine with it ;)

beAbU 3y ago

If you want to call yourself "engineer" then at a minimum all those standards and minimum requirements should apply, no questions asked. I've heard stories of hauling civil engineers out of retirement and in front of a tribunal after some structure that collapsed before it's time, or it was found that the original design was flawed in some way. An engineer "signing off" on something actually means something, with actual stakes. Of course the "developers" will revolt against this, because they are not engineers. A developer does not get to sign off on anything, and everything they do must be scrutinised by the engineer in charge before it can be deployed. Doing this for your common run-of-the-mill CRUD app or HTML website is obviously overkill. Just like you don't need an engineer to replace a broken window or hang a new door. But when it comes to things that actually matter, like data safety and privacy, you must ensure you bring in the right culture (let alone job title).

avgcorrection 3y ago
> If you want to call yourself "engineer" then at a minimum all those standards and minimum requirements should apply, no questions asked. I don’t call myself that so I’m all good. My general vocation is just “technologist”. Plus: not a protected title in my jurisdiction.
renewiltord 3y ago
All those engineers need to be hauled up because they’re killing people. Software engineers by contrast are high performance: barely any fatalities and so much value created. It’s why it’s not construction firms that are the most valuable companies but software companies. You can count on software engineers to build things that won’t kill, for the most part. Other kinds of engineers, on the other hand, are constantly killing people. We need higher standards for engineers. They could learn from software folks. If you can’t do it safely don’t do it.
- josephg 3y ago
  I have a friend who works in a hospital. Apparently the hospital software they use constantly freezes for like, 30+ seconds while they're trying to get work done. Meanwhile my friend has had her passport, entire medical history and all sorts of personal information leaked by Medibank then Optus, within a few months of each other. Neither company as far as I can tell has been held in any way to account for the blunder. Meanwhile the Post Office Scandal is rocking the UK - where a software mistake landed a bunch of completely innocent people in jail and led to multiple suicides. And don't even get me started on the impact of social media. We might not kill as many people as engineers. Maybe. But we certainly cause more than our share of harm to society.

toast0 3y ago

I'm am engineer by many definitions, although I don't have or wear a stripey hat, so not the most important definition. I'm not licensed though and have no signoff rights or responsibilities. If I were to consider signing off on my work or the work of my colleagues after review, the industry would have to be completely different. I have been in the industry for more than 20 years and I can count the number of times I've had a complete specification for a project I worked on with zero hands. I can't sign off that the work is to spec it the spec is incomplete or nonexistant. Writing, consuming, and verifying specs costs time and money and adds another layer of people into the process. The cost of failure and the cost to remediate failures discovered after release for most software is too low to justify the cost of rigor. There's exceptions: software in systems involved with life safety, avionics, and the like obviously have a high cost for failure, and you can't take a crashed plane, turn it off and on and then transport the passengers. You don't get a civil engineer to sign off on a one-story house in most cases either.

dave4420 3y ago
Any software system that might produce legal evidence should also be an exception… it feels a bit too much of a common case to call it an exception though. (This is in reference to the Horizon scandal, yes.)

trey-jones 3y ago

I think you can prevent a lot of revolt by just finding a way of putting this other than "software engineer output" should be held to standards. The whole point of this article is that the individual is not the problem. Rather, the system should prevent the individual from being the problem. Nobody wants software quality to be regulated by people who don't know anything about software. So, probably we should be regulating ourselves. It's not an easy problem though. Can you really state a minimum safety standard for software that is quantifiable? - All tests passing? Not good enough - 100% test coverage? Not good enough - AI approved code? ha

deleted 3y ago

[deleted]

ticviking 3y ago

Our employers will revolt because we will either cost more or be slower. The price of an developer is already very high compared to other skilled labor

caskstrength 3y ago

> But of course the developers will revolt against that. Why would developers revolt? OTOH users would definitely be unhappy when every little app for their iPhone suddenly costs as much as an airplane ticket.

HeyLaughingBoy 3y ago

> and quality standard This is my life: https://en.wikipedia.org/wiki/IEC_62304 https://en.wikipedia.org/wiki/IEC_62304

alfanick 3y ago
Oh I also unfortunately know this standard by heart, hi!

rcxdude 3y ago

The EU is doing something like this with some proposed legislation. Basically it's a CE mark for software. The current version is very much a bare minimum, though. But it does impose liability on people selling software.