7 ms·

Whilst I agree in principle, would any Senior Engineer want to work on such a system that had their personal liability attached? I'd want 10's of millions in an

Whilst I agree in principle, would any Senior Engineer want to work on such a system that had their personal liability attached? I'd want 10's of millions in annual comp just for the risk

nottorp 2y ago
The real problem is who could afford a system that a competent senior engineer would take personal liability for...
- sfn42 2y ago
  The real problem is our entire industry is a giant clusterfuck. Do a 2-week bootcamp, congratulations now you're a software engineer. Every other discipline has education requirements, codified standards for how to do things etc.
  - nottorp 2y ago
    > codified standards for how to do things I don't know you but i bet that if you and me were locked up in a room together for a month we wouldn't be able to 100% agree on "codified standards for how to do things" :) Industry isn't mature enough for that and it's perhaps doubtful that it will ever be. See the halting problem.
    - bobnamob 2y ago
      ye gods, can we come up with a "law" to describe appealing to the halting problem? Just because there are unanswered questions that doesn't mean we can't have bare minimum codified standards. Furthermore, standards aren't invalidated just because practitioners disagree with them. Plenty of <insert engineer type>s disagree with the standards body of their respective field, they still follow the standards out of fear of prosecution or simply as a path of least resistance and when those standards are found to be defective, they (generally) evolve.
      - nottorp 2y ago
        > we can't have bare minimum codified standards So, functional, imperative or OOP? :) > Just because there are unanswered questions The halting problem is undecidable. Not undecided. I.e. it has been solved and the answer is "you can't".
        int_19h 2y ago
        We don't need to solve the halting problem. We just need to come up with a sensible set of practices that, if followed, make the risks small enough to be considered acceptable. Then we can point at that list and say, "this is what the reasonable expectation of due diligence in software engineering is" - and legally enforce that.
        gorft 2y ago
        This is the most pedantic sort of semantic navel-gazing that can only originate in the bowels of an HN thread. Bravissimo, truly.
        nottorp 2y ago
        Yep, now answer me the part about functional, imperative or oop, and come up with a plan to convince everyone.
    - ratorx 2y ago
      > 100% agree I don’t think it’s necessary to agree completely. You could start by codifying a minimal set of things that the majority of people agree on (user data sanitisation, authentication handling etc) and then build on it over time. The standards could also help codify more meta things, like vulnerability policies, reporting and outages. This would be helpful to form a dataset which you can use to properly codify best practices later. The main problem is that this increases the bar for doing software development, but you can get around this by distinguishing serious software industries from others (software revenue over a certain size, industries like fintech, user data handling etc)
    - int_19h 2y ago
      The industry will be 80 years old soon. If it's not "mature enough", it's only because of the pervading culture. For comparison, electrical engineers started introducing things like national standards for plugs by 1915.
      - nottorp 2y ago
        Plugs? You mean various forms of rpc and more or less well specified data interchange formats like xml or json? We have them.
        int_19h 2y ago
        XML and JSON is more like standardizing the voltage (and even there the fact that we still have both shows that it's very much a moving target).
  - pjmlp 2y ago
    Thankfully not every country out there has such liberties with "enginnering" titles, but yeah that is a problem.
    - int_19h 2y ago
      It's not the title that's the problem. It's the part where people and go write software that gets deployed at scale in an environment where bugs can cause very real and significant damage (monetary or otherwise).
      - pjmlp 2y ago
        The title is part of the problem, because it reveals the culture, slapping cool titles without upping oneself to what those titles actually mean. As for the rest, anything that brings computing to level of the rest of other professionals, has my signature. A Software Engineering professor of mine used to say, many applications are akin to buying shoes that randomly explode when tying shoelaces, whereas a minor defect on real shoes gets a full refund.
        nyarlathotep_ 2y ago
        > The title is part of the problem, because it reveals the culture, slapping cool titles without upping oneself to what those titles actually mean. The irony is there are actual disciplines in software that are worthy of being called "engineering"--how the hell does an engine ECU work with the level of precision that it does? ABS systems? Hell, how about most electronic control systems on an airplane? These are some of the most impressive feats in software development, and I've heard near 0 about any of them. Yet the "industry" is hyper-focused on mashing together "containerized" monstrosities to put strings in databases, or to find a new way to add a chatbot to something that doesn't need it.
        Terr_ 2y ago
        I'd argue that really says more about capitalism, wealth distribution, and the financialization of everything, as opposed to software stuff per se-- In another area it might be the complete insufficiency of formal botany credentials among Dutch companies growing and trading tulips.
arethuza 2y ago
Professionally qualified engineers in other fields seem to manage OK?
- nottorp 2y ago
  They work with certified components on predictable systems though. You realize that you'd need someone at MS to take liability for Windows before you can sign off anything running on Windows? Or someone at Google if you do a web app that only runs on Chrome, not to mention other browsers.
  - Devasta 2y ago
    Well yeah, but the fact that no one takes responsibility for anything and just smears layers of crap on top of each other is the problem. We have build enormous houses of cards on foundations of quicksand and its causing very real harm, but no one cares because the only thing they'll face consequences for is drops in story points on their sprint or whatever else and nothing for failing to do things that actually matter.
  - Symbiote 2y ago
    Some systems must have these certifications. What OS renders the monitoring screens for air traffic control systems, or railways signalling? Those both have rigorous software engineering behind them — railway signalling is the original of engineered, safety-critical logic systems, starting with mechanical interlocks in 1843. (The signalman physically couldn't move certain levers into bad configurations.)
- lores 2y ago
  And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.
  - oarsinsync 2y ago
delfinom 2y ago
Yes? Plenty of non-software engineers do it daily. You start off by having a Professional Liability insurance policy, your company will generally pay for it unless you are a consultant/contractor in which case you bring your own policy. Depending on size of operation, your employer may even indemnify you in the employment contract specifically for even negligence lol. You then do your job correctly. The laws only go after you for liability if you were negligent, i.e. you skipped protocol and policies, you skipped best practices and couldn't justify it, etc. If you weren't negligent and just made an error, great, your insurance covers you. Insurance can also cover negligence too depending on policy, lol https://www.nspe.org/resources/professional-liability/liability-employed-engineers https://www.nspe.org/resources/professional-liability/liabil...
- jack_riminton 2y ago
  Yes and they do non-software engineering Are we going to have international protocols and policies on the best language to use, how to do SQL queries and CSS? no
gpderetta 2y ago
Professional liability insurance and legal insurance as a minimum.
- teamonkey 2y ago
  I'm fairly sure Fujitsu do have liability insurance in some form. In a situation like this an insurer is strongly motivated to prove that the company is not at fault, because it doesn't want to pay the bond. The company is also strongly motivated, even though insured, to prove that the company is not at fault, because it doesn't want to have its future insurance rates affected or be sued by the insurer for breaches of terms. Either way, it doesn't help the people affected. Not unless they have personal insurance against workplace computer system errors, in which case their insurance provider is also not motivated to pay out, or to battle a corporation as large as Fujitsu unless there's chance of a class-action suit.
pjmlp 2y ago
Yes, that is exactly part of being a Professional Software Engineer entails, and why there are universities assessed by Enginnering Order, and professional exams. Lets stop glueing "engineering" to any job title where someone knows how to write a bunch of code lines.
- arethuza 2y ago
  The important bit is that if you screw up badly enough then your professional qualification is removed and you can't do that type of work any more. [NB I am frequently reminded of this point by my wife who is a solicitor].
  - pjmlp 2y ago
    I am aware of that, because I happen to be from a country with an Engineering Order. Another important part is that one might be liable when signing contracts as the responsible Engineer in a project delivery.
- nyarlathotep_ 2y ago
  Don't understand how this isn't the dominant perspective on this. This title inflation of calling web programmers "engineers" is absurd.

Whilst I agree in principle, would any Senior Engineer want to work on such a system that had their personal liability attached? I'd want 10's of millions in annual comp just for the risk

nottorp 2y ago

The real problem is who could afford a system that a competent senior engineer would take personal liability for...

sfn42 2y ago
The real problem is our entire industry is a giant clusterfuck. Do a 2-week bootcamp, congratulations now you're a software engineer. Every other discipline has education requirements, codified standards for how to do things etc.
- nottorp 2y ago
  > codified standards for how to do things I don't know you but i bet that if you and me were locked up in a room together for a month we wouldn't be able to 100% agree on "codified standards for how to do things" :) Industry isn't mature enough for that and it's perhaps doubtful that it will ever be. See the halting problem.
  - bobnamob 2y ago
    ye gods, can we come up with a "law" to describe appealing to the halting problem? Just because there are unanswered questions that doesn't mean we can't have bare minimum codified standards. Furthermore, standards aren't invalidated just because practitioners disagree with them. Plenty of <insert engineer type>s disagree with the standards body of their respective field, they still follow the standards out of fear of prosecution or simply as a path of least resistance and when those standards are found to be defective, they (generally) evolve.
    - nottorp 2y ago
      > we can't have bare minimum codified standards So, functional, imperative or OOP? :) > Just because there are unanswered questions The halting problem is undecidable. Not undecided. I.e. it has been solved and the answer is "you can't".
      - int_19h 2y ago
        We don't need to solve the halting problem. We just need to come up with a sensible set of practices that, if followed, make the risks small enough to be considered acceptable. Then we can point at that list and say, "this is what the reasonable expectation of due diligence in software engineering is" - and legally enforce that.
      - gorft 2y ago
        This is the most pedantic sort of semantic navel-gazing that can only originate in the bowels of an HN thread. Bravissimo, truly.
        nottorp 2y ago
        Yep, now answer me the part about functional, imperative or oop, and come up with a plan to convince everyone.
  - ratorx 2y ago
    > 100% agree I don’t think it’s necessary to agree completely. You could start by codifying a minimal set of things that the majority of people agree on (user data sanitisation, authentication handling etc) and then build on it over time. The standards could also help codify more meta things, like vulnerability policies, reporting and outages. This would be helpful to form a dataset which you can use to properly codify best practices later. The main problem is that this increases the bar for doing software development, but you can get around this by distinguishing serious software industries from others (software revenue over a certain size, industries like fintech, user data handling etc)
  - int_19h 2y ago
    The industry will be 80 years old soon. If it's not "mature enough", it's only because of the pervading culture. For comparison, electrical engineers started introducing things like national standards for plugs by 1915.
    - nottorp 2y ago
      Plugs? You mean various forms of rpc and more or less well specified data interchange formats like xml or json? We have them.
      - int_19h 2y ago
        XML and JSON is more like standardizing the voltage (and even there the fact that we still have both shows that it's very much a moving target).
- pjmlp 2y ago
  Thankfully not every country out there has such liberties with "enginnering" titles, but yeah that is a problem.
  - int_19h 2y ago
    It's not the title that's the problem. It's the part where people and go write software that gets deployed at scale in an environment where bugs can cause very real and significant damage (monetary or otherwise).
    - pjmlp 2y ago
      The title is part of the problem, because it reveals the culture, slapping cool titles without upping oneself to what those titles actually mean. As for the rest, anything that brings computing to level of the rest of other professionals, has my signature. A Software Engineering professor of mine used to say, many applications are akin to buying shoes that randomly explode when tying shoelaces, whereas a minor defect on real shoes gets a full refund.
      - nyarlathotep_ 2y ago
        > The title is part of the problem, because it reveals the culture, slapping cool titles without upping oneself to what those titles actually mean. The irony is there are actual disciplines in software that are worthy of being called "engineering"--how the hell does an engine ECU work with the level of precision that it does? ABS systems? Hell, how about most electronic control systems on an airplane? These are some of the most impressive feats in software development, and I've heard near 0 about any of them. Yet the "industry" is hyper-focused on mashing together "containerized" monstrosities to put strings in databases, or to find a new way to add a chatbot to something that doesn't need it.
        Terr_ 2y ago
        I'd argue that really says more about capitalism, wealth distribution, and the financialization of everything, as opposed to software stuff per se-- In another area it might be the complete insufficiency of formal botany credentials among Dutch companies growing and trading tulips.

arethuza 2y ago

Professionally qualified engineers in other fields seem to manage OK?

nottorp 2y ago
They work with certified components on predictable systems though. You realize that you'd need someone at MS to take liability for Windows before you can sign off anything running on Windows? Or someone at Google if you do a web app that only runs on Chrome, not to mention other browsers.
- Devasta 2y ago
  Well yeah, but the fact that no one takes responsibility for anything and just smears layers of crap on top of each other is the problem. We have build enormous houses of cards on foundations of quicksand and its causing very real harm, but no one cares because the only thing they'll face consequences for is drops in story points on their sprint or whatever else and nothing for failing to do things that actually matter.
- Symbiote 2y ago
  Some systems must have these certifications. What OS renders the monitoring screens for air traffic control systems, or railways signalling? Those both have rigorous software engineering behind them — railway signalling is the original of engineered, safety-critical logic systems, starting with mechanical interlocks in 1843. (The signalman physically couldn't move certain levers into bad configurations.)
lores 2y ago
And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.
- oarsinsync 2y ago

delfinom 2y ago

Yes? Plenty of non-software engineers do it daily. You start off by having a Professional Liability insurance policy, your company will generally pay for it unless you are a consultant/contractor in which case you bring your own policy. Depending on size of operation, your employer may even indemnify you in the employment contract specifically for even negligence lol. You then do your job correctly. The laws only go after you for liability if you were negligent, i.e. you skipped protocol and policies, you skipped best practices and couldn't justify it, etc. If you weren't negligent and just made an error, great, your insurance covers you. Insurance can also cover negligence too depending on policy, lol https://www.nspe.org/resources/professional-liability/liability-employed-engineers https://www.nspe.org/resources/professional-liability/liabil...

jack_riminton 2y ago
Yes and they do non-software engineering Are we going to have international protocols and policies on the best language to use, how to do SQL queries and CSS? no

gpderetta 2y ago

Professional liability insurance and legal insurance as a minimum.

teamonkey 2y ago
I'm fairly sure Fujitsu do have liability insurance in some form. In a situation like this an insurer is strongly motivated to prove that the company is not at fault, because it doesn't want to pay the bond. The company is also strongly motivated, even though insured, to prove that the company is not at fault, because it doesn't want to have its future insurance rates affected or be sued by the insurer for breaches of terms. Either way, it doesn't help the people affected. Not unless they have personal insurance against workplace computer system errors, in which case their insurance provider is also not motivated to pay out, or to battle a corporation as large as Fujitsu unless there's chance of a class-action suit.

pjmlp 2y ago

Yes, that is exactly part of being a Professional Software Engineer entails, and why there are universities assessed by Enginnering Order, and professional exams. Lets stop glueing "engineering" to any job title where someone knows how to write a bunch of code lines.

arethuza 2y ago
The important bit is that if you screw up badly enough then your professional qualification is removed and you can't do that type of work any more. [NB I am frequently reminded of this point by my wife who is a solicitor].
- pjmlp 2y ago
  I am aware of that, because I happen to be from a country with an Engineering Order. Another important part is that one might be liable when signing contracts as the responsible Engineer in a project delivery.
nyarlathotep_ 2y ago
Don't understand how this isn't the dominant perspective on this. This title inflation of calling web programmers "engineers" is absurd.