5 ms·

And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are

by lores 2y ago

And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.

oarsinsync 2y ago
This is chicken-and-egg though, surely. If engineers are not personally liable for the garbage they produce, the business can replace the engineer with someone more amenable to their requirements (either because the engineer lacks experience to understand why its bad, or because the engineer has fewer scruples, or anywhere in between) with relative ease. If all engineers are held personally liable for their code, when a business has faced a documented rejection, they’ll struggle to hire someone else to take on that risk.
- lores 2y ago
  You're right, and it would radically change the industry. No more wild experiments, but a very measured and ponderous rate of change. It's not necessarily a bad thing, I'm at the age where I curse aloud when I see yet another framework doing nearly all the same things but in a different way, but it's certainly a big change.
  - arethuza 2y ago
    You'd still be allowed "wild experiments" - just not where they could harm people.
    - lores 2y ago
      "Harming people" includes money loss, though. Any hacking that results in identity theft would end up at the feet of the certifying engineer.
      - int_19h 2y ago
        Good, then maybe it'll be a forcing function for companies to stop collecting personal data for their users just because they can, and we can go back to the days when the only metadata associated with an online account is its salted and hashed password.
        aitchnyu 2y ago
        You mean a hospital next door to an ammonium nitrate godown and 23andMe will be rejected by the same actuaries?
      - gorft 2y ago
        I'm not sure what you're arguing for then. Continue apace, where I get a letter every week about entire reams of my personal info leaked because some imbecile didn't set a password on their MongoDB instance?
      - em-bee 2y ago
        the german supreme court just recently decided that the involuntary publication of personal data like your phone number through a break-in already constitutes damage that the companies who experienced the break-in are responsible for. there is no need for certified engineers, just make the companies pay for being negligent. putting this on certified engineers only shifts the blame, but in the wrong direction in my opinion, because these problems happen not because the engineers are not certified, but because the company tried to save money by cutting corners.
marcosdumay 2y ago
> they have to accept being told 'no' They can always hire another engineer. They only accept it, some times, because they won't find a certified engineer that says "yes", and because they doing it themselves is a crime. That equates to a huge amount of government intervention on the lives of everybody. And even then, fails way more often than expected. Now, we are talking about a case where criminal justice failed to uphold the defendants rights to a fair trial. Most probably because of corruption. Do we really want to bring that huge amount of government intervention into this context?

by lores 2y ago

oarsinsync 2y ago

This is chicken-and-egg though, surely. If engineers are not personally liable for the garbage they produce, the business can replace the engineer with someone more amenable to their requirements (either because the engineer lacks experience to understand why its bad, or because the engineer has fewer scruples, or anywhere in between) with relative ease. If all engineers are held personally liable for their code, when a business has faced a documented rejection, they’ll struggle to hire someone else to take on that risk.

lores 2y ago
You're right, and it would radically change the industry. No more wild experiments, but a very measured and ponderous rate of change. It's not necessarily a bad thing, I'm at the age where I curse aloud when I see yet another framework doing nearly all the same things but in a different way, but it's certainly a big change.
- arethuza 2y ago
  You'd still be allowed "wild experiments" - just not where they could harm people.
  - lores 2y ago
    "Harming people" includes money loss, though. Any hacking that results in identity theft would end up at the feet of the certifying engineer.
    - int_19h 2y ago
      Good, then maybe it'll be a forcing function for companies to stop collecting personal data for their users just because they can, and we can go back to the days when the only metadata associated with an online account is its salted and hashed password.
      - aitchnyu 2y ago
        You mean a hospital next door to an ammonium nitrate godown and 23andMe will be rejected by the same actuaries?
    - gorft 2y ago
      I'm not sure what you're arguing for then. Continue apace, where I get a letter every week about entire reams of my personal info leaked because some imbecile didn't set a password on their MongoDB instance?
    - em-bee 2y ago
      the german supreme court just recently decided that the involuntary publication of personal data like your phone number through a break-in already constitutes damage that the companies who experienced the break-in are responsible for. there is no need for certified engineers, just make the companies pay for being negligent. putting this on certified engineers only shifts the blame, but in the wrong direction in my opinion, because these problems happen not because the engineers are not certified, but because the company tried to save money by cutting corners.

marcosdumay 2y ago

> they have to accept being told 'no' They can always hire another engineer. They only accept it, some times, because they won't find a certified engineer that says "yes", and because they doing it themselves is a crime. That equates to a huge amount of government intervention on the lives of everybody. And even then, fails way more often than expected. Now, we are talking about a case where criminal justice failed to uphold the defendants rights to a fair trial. Most probably because of corruption. Do we really want to bring that huge amount of government intervention into this context?