4 ms·

I'm pretty ignorant on the ins and outs and trade offs associated with accreditation but yes that sounds like one solution. It doesn't strike me as unreasonabl

I'm pretty ignorant on the ins and outs and trade offs associated with accreditation but yes that sounds like one solution. It doesn't strike me as unreasonable, software engineers are now able to cause billions in damages and/or cause loss of life via primary or secondary effects. Sure, one of software's greatest strengths was that anyone could learn it and it'll be sad to lose that but that's not really a reason for structurally enabling things like the Post Office scandal. You probably don't need accreditation to serve cat pics but things dealing with money and life/death should. But IANAL so hopefully someone else can bring better insight to this area.

rswail 2y ago
> it'll be sad to lose that People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. I think we need to start thinking of an individual's persona which includes all the information about them that is online or in government (non secret) files. That needs to be considered when designing regarding regulations for software that interacts with someone's persona. So anyone can set up the equivalent of an art stand in the park (serving cat pics), but if they start either selling cat pics or selling advertising that relies on collecting information about the personas on the site, then that needs to be regulated.
- RHSeeger 2y ago
  > People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. You can even have non-licensed people doing work, and a licensed individual signing off on the end result. They would need to review the designs and work to make sure they agree with how the work was done, because it's their license on the line if something goes wrong because of bad craftsmanship.
- oersted 2y ago
  It doesn't need to be too dramatic. It's already a general rule never to write your own cryptographic or financial code from scratch, you reach out for established libraries or services written by experts. The law may require to use the ones that are certified if you are doing something sensitive. It doesn't need to be universal necessarily, but it should apply to public tenders for critical infrastructure at least.
  - maxwell 2y ago
    You want some government mandating your dependencies...?
    - HeatrayEnjoyer 2y ago
      Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.
      - maxwell 2y ago
        That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
        gorft 2y ago
        Innovation like calculating numbers incorrectly and getting people sent to jail? Or maybe just another hundred slow, rent-seeking React web apps that'll disappear when the series B money dries up, if we're lucky. We must have different ideas of what innovation is.
        gizmo686 2y ago
        So, outsource the core government function of regulation to "the public". Who exactly do you imagine is going to actually do this public verification, and where is their paycheck going to come from. Some software is critical infrastructure and needs to be treated as such. We are not special. Every other engineering discipline has gone through this same process as and arrived at the inevitable conclusion that government regulation is essential, but only after causing unthinkable damage to the public first
- deleted 2y ago
  [deleted]
raxxorraxor 2y ago
The Post Office scandal at its core was a political/legal problem, not an engineering one. Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. There is no expertise for software that you could delegate to aside from an entity using some form of integration test.
- tremon 2y ago
  > Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. This is becoming more and more important as the AI industry is pushing non-deterministic computing further and further. There will be court cases where the full automated decision chain will be called into question, and a default assumption of "well, we don't have any logs so we should assume the software did the right thing" terrifies me.
  - Terr_ 2y ago
    The magic word that always pops up to me is "liability." Even speaking from an IC/non-managerial place, far too many technical problems in businesses are really just symptom-alleviation (or worse, performative look-I'm-doing-something theater) for a deeper problem which involves misaligned incentives for humans.
- hnick 2y ago
  Some of the sites we work on are insurance based. We save every step of the calculation (inputs and outputs, e.g. rates and sub-totals). An administrative user can see the entire calculation from start to end, including overrides at various steps (e.g. a manual discount), and breakdowns per state or item insured if appropriate. This seems like the acceptable bare minimum to me, rather than just showing a magic number. And it definitely helps to expose bugs.

rswail 2y ago

> it'll be sad to lose that People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. I think we need to start thinking of an individual's persona which includes all the information about them that is online or in government (non secret) files. That needs to be considered when designing regarding regulations for software that interacts with someone's persona. So anyone can set up the equivalent of an art stand in the park (serving cat pics), but if they start either selling cat pics or selling advertising that relies on collecting information about the personas on the site, then that needs to be regulated.

RHSeeger 2y ago
> People will still be able to learn how to program and actually program. But if they take money or deal with people's private information, then they'll need to comply with the standards that will be regulated. You can even have non-licensed people doing work, and a licensed individual signing off on the end result. They would need to review the designs and work to make sure they agree with how the work was done, because it's their license on the line if something goes wrong because of bad craftsmanship.
oersted 2y ago
It doesn't need to be too dramatic. It's already a general rule never to write your own cryptographic or financial code from scratch, you reach out for established libraries or services written by experts. The law may require to use the ones that are certified if you are doing something sensitive. It doesn't need to be universal necessarily, but it should apply to public tenders for critical infrastructure at least.
- maxwell 2y ago
  You want some government mandating your dependencies...?
  - HeatrayEnjoyer 2y ago
    Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.
    - maxwell 2y ago
      That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
      - gorft 2y ago
        Innovation like calculating numbers incorrectly and getting people sent to jail? Or maybe just another hundred slow, rent-seeking React web apps that'll disappear when the series B money dries up, if we're lucky. We must have different ideas of what innovation is.
      - gizmo686 2y ago
        So, outsource the core government function of regulation to "the public". Who exactly do you imagine is going to actually do this public verification, and where is their paycheck going to come from. Some software is critical infrastructure and needs to be treated as such. We are not special. Every other engineering discipline has gone through this same process as and arrived at the inevitable conclusion that government regulation is essential, but only after causing unthinkable damage to the public first
deleted 2y ago
[deleted]

raxxorraxor 2y ago

The Post Office scandal at its core was a political/legal problem, not an engineering one. Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. There is no expertise for software that you could delegate to aside from an entity using some form of integration test.

tremon 2y ago
> Software needs to be transparent, a human expert worker needs to be able to verify the result a software generates within reasonable time. This is becoming more and more important as the AI industry is pushing non-deterministic computing further and further. There will be court cases where the full automated decision chain will be called into question, and a default assumption of "well, we don't have any logs so we should assume the software did the right thing" terrifies me.
- Terr_ 2y ago
  The magic word that always pops up to me is "liability." Even speaking from an IC/non-managerial place, far too many technical problems in businesses are really just symptom-alleviation (or worse, performative look-I'm-doing-something theater) for a deeper problem which involves misaligned incentives for humans.
hnick 2y ago
Some of the sites we work on are insurance based. We save every step of the calculation (inputs and outputs, e.g. rates and sub-totals). An administrative user can see the entire calculation from start to end, including overrides at various steps (e.g. a manual discount), and breakdowns per state or item insured if appropriate. This seems like the acceptable bare minimum to me, rather than just showing a magic number. And it definitely helps to expose bugs.