3 ms·

Professionally qualified engineers in other fields seem to manage OK?

nottorp 2y ago
They work with certified components on predictable systems though. You realize that you'd need someone at MS to take liability for Windows before you can sign off anything running on Windows? Or someone at Google if you do a web app that only runs on Chrome, not to mention other browsers.
- Devasta 2y ago
  Well yeah, but the fact that no one takes responsibility for anything and just smears layers of crap on top of each other is the problem. We have build enormous houses of cards on foundations of quicksand and its causing very real harm, but no one cares because the only thing they'll face consequences for is drops in story points on their sprint or whatever else and nothing for failing to do things that actually matter.
- Symbiote 2y ago
  Some systems must have these certifications. What OS renders the monitoring screens for air traffic control systems, or railways signalling? Those both have rigorous software engineering behind them — railway signalling is the original of engineered, safety-critical logic systems, starting with mechanical interlocks in 1843. (The signalman physically couldn't move certain levers into bad configurations.)
lores 2y ago
And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.
- oarsinsync 2y ago
  This is chicken-and-egg though, surely. If engineers are not personally liable for the garbage they produce, the business can replace the engineer with someone more amenable to their requirements (either because the engineer lacks experience to understand why its bad, or because the engineer has fewer scruples, or anywhere in between) with relative ease. If all engineers are held personally liable for their code, when a business has faced a documented rejection, they’ll struggle to hire someone else to take on that risk.
  - lores 2y ago
    You're right, and it would radically change the industry. No more wild experiments, but a very measured and ponderous rate of change. It's not necessarily a bad thing, I'm at the age where I curse aloud when I see yet another framework doing nearly all the same things but in a different way, but it's certainly a big change.
    - arethuza 2y ago
      You'd still be allowed "wild experiments" - just not where they could harm people.
      - lores 2y ago
        "Harming people" includes money loss, though. Any hacking that results in identity theft would end up at the feet of the certifying engineer.
        int_19h 2y ago
        Good, then maybe it'll be a forcing function for companies to stop collecting personal data for their users just because they can, and we can go back to the days when the only metadata associated with an online account is its salted and hashed password.
        2y ago

They work with certified components on predictable systems though. You realize that you'd need someone at MS to take liability for Windows before you can sign off anything running on Windows? Or someone at Google if you do a web app that only runs on Chrome, not to mention other browsers.

Devasta 2y ago
Well yeah, but the fact that no one takes responsibility for anything and just smears layers of crap on top of each other is the problem. We have build enormous houses of cards on foundations of quicksand and its causing very real harm, but no one cares because the only thing they'll face consequences for is drops in story points on their sprint or whatever else and nothing for failing to do things that actually matter.
Symbiote 2y ago
Some systems must have these certifications. What OS renders the monitoring screens for air traffic control systems, or railways signalling? Those both have rigorous software engineering behind them — railway signalling is the original of engineered, safety-critical logic systems, starting with mechanical interlocks in 1843. (The signalman physically couldn't move certain levers into bad configurations.)

lores 2y ago

And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.

oarsinsync 2y ago
This is chicken-and-egg though, surely. If engineers are not personally liable for the garbage they produce, the business can replace the engineer with someone more amenable to their requirements (either because the engineer lacks experience to understand why its bad, or because the engineer has fewer scruples, or anywhere in between) with relative ease. If all engineers are held personally liable for their code, when a business has faced a documented rejection, they’ll struggle to hire someone else to take on that risk.
- lores 2y ago
  You're right, and it would radically change the industry. No more wild experiments, but a very measured and ponderous rate of change. It's not necessarily a bad thing, I'm at the age where I curse aloud when I see yet another framework doing nearly all the same things but in a different way, but it's certainly a big change.
  - arethuza 2y ago
    You'd still be allowed "wild experiments" - just not where they could harm people.
    - lores 2y ago
      "Harming people" includes money loss, though. Any hacking that results in identity theft would end up at the feet of the certifying engineer.
      - int_19h 2y ago
        Good, then maybe it'll be a forcing function for companies to stop collecting personal data for their users just because they can, and we can go back to the days when the only metadata associated with an online account is its salted and hashed password.
        2y ago