3 ms·

Yeah, obviously you have to try to predict the effects of your disaster prevention measures, and if you can use quantitative methods so much the better, but tha

Yeah, obviously you have to try to predict the effects of your disaster prevention measures, and if you can use quantitative methods so much the better, but that's not "measurement". Not even close, and especially not in the sense that the people who want to count lines of code yearn for. And yes, those people are still out there. Some of them have learned their lesson about LoC in particular, but they haven't lost their craving for simple (often simplistic) metrics. The difference with "regular" engineering is that working features are in fact quite tangible, even if their exact costs aren't. You put a ticket on the board for a button, or a bridge, and eventually you can push the button or drive on the bridge. Not so for prevented disasters. By the time a disaster becomes tangible, it's usually too late.

saghm 2y ago
Yep, I don't pretend to believe that "software engineering" is actually "engineering" in the traditional sense. I still that security concerns in software engineering lies somewhere in the spectrum between "real engineering" and "impossible to meaningfully reason about". As for the people who want to find a metric as simple as lines of code, I can't imagine we ever find something that will satisfy them, so I'm not particularly dissuaded by the idea of people looking for that not being happy with the measures that I think would be effective. To me, this is a classic case of not letting the perfect be the enemy of the good, and I think that it would be unfortunate for us as an industry if we only considered ways of measuring risk prevention that are 100% quantitative.
- andrewflnr 2y ago
  > As for the people who want to find a metric as simple as lines of code, I can't imagine we ever find something that will satisfy them The problem with these people is that they're "satisfied" with the illusion of certainty, until things blow up. We agree on the fundamentals re measurement, but you have to watch out for that effect. Every metric is a chance for someone to implicitly decide that it's the ultimate truth of reality.

saghm 2y ago

Yep, I don't pretend to believe that "software engineering" is actually "engineering" in the traditional sense. I still that security concerns in software engineering lies somewhere in the spectrum between "real engineering" and "impossible to meaningfully reason about". As for the people who want to find a metric as simple as lines of code, I can't imagine we ever find something that will satisfy them, so I'm not particularly dissuaded by the idea of people looking for that not being happy with the measures that I think would be effective. To me, this is a classic case of not letting the perfect be the enemy of the good, and I think that it would be unfortunate for us as an industry if we only considered ways of measuring risk prevention that are 100% quantitative.

andrewflnr 2y ago
> As for the people who want to find a metric as simple as lines of code, I can't imagine we ever find something that will satisfy them The problem with these people is that they're "satisfied" with the illusion of certainty, until things blow up. We agree on the fundamentals re measurement, but you have to watch out for that effect. Every metric is a chance for someone to implicitly decide that it's the ultimate truth of reality.