7 ms·

IMO it's not really a lack of respect as it is software vendors and managers not really being incentivised to do the right thing. Therefore even if the engineer

IMO it's not really a lack of respect as it is software vendors and managers not really being incentivised to do the right thing. Therefore even if the engineers know the right thing to do, they are unable to solicit the buy in from stakeholders to invest the development into doing the right thing because there's no recourse for doing the wrong thing but it's more expensive. And even if you do the right thing, if a competitor comes in and offers to do the "job" quicker and cheaper because they're doing the wrong thing. You may have the moral highground but that doesn't pay your employees' salaries. What we need is a better framework for punishing bad software, in an ideal world without a bunch of red tape and reducing the burden on non experts identifying what is or isn't bad behaviour.

exe34 2y ago
> What we need is a better framework for punishing bad software So like engineering licensing and insurance?
- djtango 2y ago
  I'm pretty ignorant on the ins and outs and trade offs associated with accreditation but yes that sounds like one solution. It doesn't strike me as unreasonable, software engineers are now able to cause billions in damages and/or cause loss of life via primary or secondary effects. Sure, one of software's greatest strengths was that anyone could learn it and it'll be sad to lose that but that's not really a reason for structurally enabling things like the Post Office scandal. You probably don't need accreditation to serve cat pics but things dealing with money and life/death should. But IANAL so hopefully someone else can bring better insight to this area.
  - rswail 2y ago
    > it'll be sad to lose that People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. I think we need to start thinking of an individual's persona which includes all the information about them that is online or in government (non secret) files. That needs to be considered when designing regarding regulations for software that interacts with someone's persona. So anyone can set up the equivalent of an art stand in the park (serving cat pics), but if they start either selling cat pics or selling advertising that relies on collecting information about the personas on the site, then that needs to be regulated.
    - RHSeeger 2y ago
      > People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. You can even have non-licensed people doing work, and a licensed individual signing off on the end result. They would need to review the designs and work to make sure they agree with how the work was done, because it's their license on the line if something goes wrong because of bad craftsmanship.
    - oersted 2y ago
      It doesn't need to be too dramatic. It's already a general rule never to write your own cryptographic or financial code from scratch, you reach out for established libraries or services written by experts. The law may require to use the ones that are certified if you are doing something sensitive. It doesn't need to be universal necessarily, but it should apply to public tenders for critical infrastructure at least.
      - maxwell 2y ago
        You want some government mandating your dependencies...?
        HeatrayEnjoyer 2y ago
        Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.
        maxwell 2y ago
        That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
  - raxxorraxor 2y ago
    The Post Office scandal at its core was a political/legal problem, not an engineering one. Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. There is no expertise for software that you could delegate to aside from an entity using some form of integration test.
    - tremon 2y ago
      > Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. This is becoming more and more important as the AI industry is pushing non-deterministic computing further and further. There will be court cases where the full automated decision chain will be called into question, and a default assumption of "well, we don't have any logs so we should assume the software did the right thing" terrifies me.
      - Terr_ 2y ago
        The magic word that always pops up to me is "liability." Even speaking from an IC/non-managerial place, far too many technical problems in businesses are really just symptom-alleviation (or worse, performative look-I'm-doing-something theater) for a deeper problem which involves misaligned incentives for humans.
    - hnick 2y ago
      Some of the sites we work on are insurance based. We save every step of the calculation (inputs and outputs, e.g. rates and sub-totals). An administrative user can see the entire calculation from start to end, including overrides at various steps (e.g. a manual discount), and breakdowns per state or item insured if appropriate. This seems like the acceptable bare minimum to me, rather than just showing a magic number. And it definitely helps to expose bugs.
- oersted 2y ago
  Sure, it doesn't need to up-end the whole field, but it is rather obvious that critical infrastructure should require significant compliance, particularly if it's being purchased in a public tender process where the cheapest supplier that fits the criteria is hired. Certifications like SoC 2 are already a big thing.
  - deleted 2y ago
    [deleted]
- hulitu 2y ago
  > > What we need is a better framework for punishing bad software > So like engineering licensing and insurance? How is engineering licensing and insurance punishing bad software ? Microsoft is still going strong and all they do is "checklist security".
yobbo 2y ago
> managers not really being incentivised to do the right thing It's more likely that managers are just incompetent. Not being able to distinguish between infrastructure and "decoration" means all their decisions are at best superficially motivated. The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. A framework for "punishing bad software" sounds to me to be hiding the ambition to "protect bad managers from consequences of their decisions".
- RHSeeger 2y ago
  > The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. In my career, I have never seen a manager see consequences for making the decision that values "money now" vs "avoiding things going wrong later". I do not believe that it will happen by itself.
  - yobbo 2y ago
    Well yes, agree this is how it looks now. But my perspective is that there has to be layers of mechanisms protecting them, rather than the natural order. (These mechanisms are tricky to pin-point but seem to be on the themes of mutual loyalty, avoiding embarrassment, keeping face, and so on.) Imposing some formal framework is more likely to insulate managers even further while making software developers accept legal responsibility beyond their pay.
- tacticus 2y ago
  > The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. yeah, nah. "No one ever got fired for buying IBM" after decades of incompetence the multinational contracting firms are still going fine. IBM still runs fine and they're focus is now even more in the insulting side of the business.
- deleted 2y ago
  [deleted]
M95D 2y ago
I don't work in IT and I'm not a developer, but IMO a developer should do the right thing even if that thing is not written in the specs/contract (transactions and ledger in this case). It is not the job of the developer to care about the competitiveness of the company (Fujitsu in this case), contracts, money, etc.
- pdimitar 2y ago
  You get fired for doing good work, in many places out there.

exe34 2y ago

> What we need is a better framework for punishing bad software So like engineering licensing and insurance?

djtango 2y ago
I'm pretty ignorant on the ins and outs and trade offs associated with accreditation but yes that sounds like one solution. It doesn't strike me as unreasonable, software engineers are now able to cause billions in damages and/or cause loss of life via primary or secondary effects. Sure, one of software's greatest strengths was that anyone could learn it and it'll be sad to lose that but that's not really a reason for structurally enabling things like the Post Office scandal. You probably don't need accreditation to serve cat pics but things dealing with money and life/death should. But IANAL so hopefully someone else can bring better insight to this area.
- rswail 2y ago
  > it'll be sad to lose that People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. I think we need to start thinking of an individual's persona which includes all the information about them that is online or in government (non secret) files. That needs to be considered when designing regarding regulations for software that interacts with someone's persona. So anyone can set up the equivalent of an art stand in the park (serving cat pics), but if they start either selling cat pics or selling advertising that relies on collecting information about the personas on the site, then that needs to be regulated.
  - RHSeeger 2y ago
    > People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. You can even have non-licensed people doing work, and a licensed individual signing off on the end result. They would need to review the designs and work to make sure they agree with how the work was done, because it's their license on the line if something goes wrong because of bad craftsmanship.
  - oersted 2y ago
    It doesn't need to be too dramatic. It's already a general rule never to write your own cryptographic or financial code from scratch, you reach out for established libraries or services written by experts. The law may require to use the ones that are certified if you are doing something sensitive. It doesn't need to be universal necessarily, but it should apply to public tenders for critical infrastructure at least.
    - maxwell 2y ago
      You want some government mandating your dependencies...?
      - HeatrayEnjoyer 2y ago
        Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.
        maxwell 2y ago
        That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
- raxxorraxor 2y ago
  The Post Office scandal at its core was a political/legal problem, not an engineering one. Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. There is no expertise for software that you could delegate to aside from an entity using some form of integration test.
  - tremon 2y ago
    > Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. This is becoming more and more important as the AI industry is pushing non-deterministic computing further and further. There will be court cases where the full automated decision chain will be called into question, and a default assumption of "well, we don't have any logs so we should assume the software did the right thing" terrifies me.
    - Terr_ 2y ago
      The magic word that always pops up to me is "liability." Even speaking from an IC/non-managerial place, far too many technical problems in businesses are really just symptom-alleviation (or worse, performative look-I'm-doing-something theater) for a deeper problem which involves misaligned incentives for humans.
  - hnick 2y ago
    Some of the sites we work on are insurance based. We save every step of the calculation (inputs and outputs, e.g. rates and sub-totals). An administrative user can see the entire calculation from start to end, including overrides at various steps (e.g. a manual discount), and breakdowns per state or item insured if appropriate. This seems like the acceptable bare minimum to me, rather than just showing a magic number. And it definitely helps to expose bugs.
oersted 2y ago
Sure, it doesn't need to up-end the whole field, but it is rather obvious that critical infrastructure should require significant compliance, particularly if it's being purchased in a public tender process where the cheapest supplier that fits the criteria is hired. Certifications like SoC 2 are already a big thing.
- deleted 2y ago
  [deleted]
hulitu 2y ago
> > What we need is a better framework for punishing bad software > So like engineering licensing and insurance? How is engineering licensing and insurance punishing bad software ? Microsoft is still going strong and all they do is "checklist security".

yobbo 2y ago

> managers not really being incentivised to do the right thing It's more likely that managers are just incompetent. Not being able to distinguish between infrastructure and "decoration" means all their decisions are at best superficially motivated. The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. A framework for "punishing bad software" sounds to me to be hiding the ambition to "protect bad managers from consequences of their decisions".

RHSeeger 2y ago
> The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. In my career, I have never seen a manager see consequences for making the decision that values "money now" vs "avoiding things going wrong later". I do not believe that it will happen by itself.
- yobbo 2y ago
  Well yes, agree this is how it looks now. But my perspective is that there has to be layers of mechanisms protecting them, rather than the natural order. (These mechanisms are tricky to pin-point but seem to be on the themes of mutual loyalty, avoiding embarrassment, keeping face, and so on.) Imposing some formal framework is more likely to insulate managers even further while making software developers accept legal responsibility beyond their pay.
tacticus 2y ago
> The punishment we have for this is unemployability and bankruptcy. It will happen by itself if you let it. yeah, nah. "No one ever got fired for buying IBM" after decades of incompetence the multinational contracting firms are still going fine. IBM still runs fine and they're focus is now even more in the insulting side of the business.
deleted 2y ago
[deleted]

M95D 2y ago

I don't work in IT and I'm not a developer, but IMO a developer should do the right thing even if that thing is not written in the specs/contract (transactions and ledger in this case). It is not the job of the developer to care about the competitiveness of the company (Fujitsu in this case), contracts, money, etc.

pdimitar 2y ago
You get fired for doing good work, in many places out there.