6 ms·

You want some government mandating your dependencies...?

HeatrayEnjoyer 2y ago
Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.
- maxwell 2y ago
  That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
  - gorft 2y ago
    Innovation like calculating numbers incorrectly and getting people sent to jail? Or maybe just another hundred slow, rent-seeking React web apps that'll disappear when the series B money dries up, if we're lucky. We must have different ideas of what innovation is.
  - gizmo686 2y ago
    So, outsource the core government function of regulation to "the public". Who exactly do you imagine is going to actually do this public verification, and where is their paycheck going to come from. Some software is critical infrastructure and needs to be treated as such. We are not special. Every other engineering discipline has gone through this same process as and arrived at the inevitable conclusion that government regulation is essential, but only after causing unthinkable damage to the public first
    - exe34 2y ago
      software "engineers" love the cachet but hate the idea that they might also have to uphold the values and responsibilities of engineering. I say we regulate the word engineer the same way it is in many countries for real engineering. if you don't want to progress beyond code monkey, you can be a software developer and innovate yet another react clone. if you want to be called an engineer, you learn and follow the regulations.
    - maxwell 2y ago
      Forcing transparency isn't outsourcing anything.
  - M95D 2y ago
    Enabling public verification is not the same as required verification.
oersted 2y ago
At least when you are building key infrastructure for the government, directly or indirectly through third parties. I don’t think it’s unreasonable. And it is not as absolute as you make it sound. Only dependencies for specific critical functions may be regulated. And they don’t have to literally force a whitelist of dependencies on you, just whichever has been certified as appropriate for that purpose.
- svieira 2y ago
  This is how you get FIPS 140 [1], which for those not in the know is a US Federal standard that mandates encryption which is _less_ secure the the current state of the art and has been for decades. (Yes, there's a new version which was approved 5 years ago and which is still rolling out [2]). [1]: https://en.wikipedia.org/wiki/FIPS_140 https://en.wikipedia.org/wiki/FIPS_140 [2]: https://csrc.nist.gov/Projects/fips-140-3-transition-effort https://csrc.nist.gov/Projects/fips-140-3-transition-effort
  - gizmo686 2y ago
    At the same time, turning on FIPs mode is the way we discover that some of our modules were using MD5 in security critical places. Because the government actually enforces FIPS, people (primarily Red Hat I think), now actually put in the bare minimum of engineering effort so that when you set fips=1, the system will actually enforce the policy (unless you go out of your way to override it, or use a non distribution provided crypto stack). Sure, now that the infrastructure for this has been built, it can be configured to require stronger crypto then FIPS does, but that infrastructure would never have been built without the likes of FIPS, and the government mandating it's use. And I know this because even with all of the hard engineering work done of building that infrastructure, there are no commonly used stronger policies; because the only people who actually care are the ones forced to care by the likes of FIPS. Our electrical standards might not the safest way of wiring buildings, and not what we would come up with if we wrote the standards today. But they are orders of magnitude safer then what electricians would be doing without the standards.
- maxwell 2y ago
  Who maintains the mandated dependencies? Who performs certification? What prevents regulatory capture?
danaris 2y ago
This isn't (or doesn't have to be) about laws specifying how all software has to be made. What they need to specify is the standards for software that certain types of organizations can use. Like government agencies, government contractors, medical organizations, construction and engineering firms, and probably some other kinds of large private businesses, depending on their industry. Basically, if the software your organization uses can cause the level of destruction that Horizon did, it needs to have specific certifications, or you can't use it. In order for such software to be certified, it needs to meet certain clearly-defined standards of quality, potentially including having all the technical leads of some level (or just all the developers, depending on various factors) be licensed, and have their licenses on the line of something like this scandal occurs. It's not a panacea, and it would definitely be an absolute bear to get the terms of all of it defined both clearly and in a way that is likely to actually produce a quality product, but IMO it is likely to be worth it in the long haul.
- exe34 2y ago
  think of it as accreditation profiles. the highest is for life threatening cases like flight/medical, the lowest might be government expenses.
  - danaris 2y ago
    While I personally love that idea, I suspect it's too complex to fly in actual attempts to get something like this in place.
    - exe34 2y ago
      the same could be said for aerospatial regulations, and we still manage to do them. civil constructions are mindbogglingly complicated and we still manage. all it takes is enough people to die, and/or for rich people to lose enough money and it'll become the rule.
- maxwell 2y ago
  Transparency and competition seem to work better than certifications and credentials. Just mandate open source if using public money.

Yes. Legally mandated supply requirements have been an element in every other engineering sector for decades or centuries. If you're building an airplane you can't purchase from any random aluminum supplier, there's an authorized list.

maxwell 2y ago
That would seem to result in industry consolidation and declining innovation. Software isn't made of physical materials anyway, it's speech. How about instead we impose open source requirements to enable public verification of critical systems?
- gorft 2y ago
  Innovation like calculating numbers incorrectly and getting people sent to jail? Or maybe just another hundred slow, rent-seeking React web apps that'll disappear when the series B money dries up, if we're lucky. We must have different ideas of what innovation is.
- gizmo686 2y ago
  So, outsource the core government function of regulation to "the public". Who exactly do you imagine is going to actually do this public verification, and where is their paycheck going to come from. Some software is critical infrastructure and needs to be treated as such. We are not special. Every other engineering discipline has gone through this same process as and arrived at the inevitable conclusion that government regulation is essential, but only after causing unthinkable damage to the public first
  - exe34 2y ago
    software "engineers" love the cachet but hate the idea that they might also have to uphold the values and responsibilities of engineering. I say we regulate the word engineer the same way it is in many countries for real engineering. if you don't want to progress beyond code monkey, you can be a software developer and innovate yet another react clone. if you want to be called an engineer, you learn and follow the regulations.
  - maxwell 2y ago
    Forcing transparency isn't outsourcing anything.
- M95D 2y ago
  Enabling public verification is not the same as required verification.

oersted 2y ago

At least when you are building key infrastructure for the government, directly or indirectly through third parties. I don’t think it’s unreasonable. And it is not as absolute as you make it sound. Only dependencies for specific critical functions may be regulated. And they don’t have to literally force a whitelist of dependencies on you, just whichever has been certified as appropriate for that purpose.

svieira 2y ago
This is how you get FIPS 140 [1], which for those not in the know is a US Federal standard that mandates encryption which is _less_ secure the the current state of the art and has been for decades. (Yes, there's a new version which was approved 5 years ago and which is still rolling out [2]). [1]: https://en.wikipedia.org/wiki/FIPS_140 https://en.wikipedia.org/wiki/FIPS_140 [2]: https://csrc.nist.gov/Projects/fips-140-3-transition-effort https://csrc.nist.gov/Projects/fips-140-3-transition-effort
- gizmo686 2y ago
  At the same time, turning on FIPs mode is the way we discover that some of our modules were using MD5 in security critical places. Because the government actually enforces FIPS, people (primarily Red Hat I think), now actually put in the bare minimum of engineering effort so that when you set fips=1, the system will actually enforce the policy (unless you go out of your way to override it, or use a non distribution provided crypto stack). Sure, now that the infrastructure for this has been built, it can be configured to require stronger crypto then FIPS does, but that infrastructure would never have been built without the likes of FIPS, and the government mandating it's use. And I know this because even with all of the hard engineering work done of building that infrastructure, there are no commonly used stronger policies; because the only people who actually care are the ones forced to care by the likes of FIPS. Our electrical standards might not the safest way of wiring buildings, and not what we would come up with if we wrote the standards today. But they are orders of magnitude safer then what electricians would be doing without the standards.
maxwell 2y ago
Who maintains the mandated dependencies? Who performs certification? What prevents regulatory capture?

danaris 2y ago

This isn't (or doesn't have to be) about laws specifying how all software has to be made. What they need to specify is the standards for software that certain types of organizations can use. Like government agencies, government contractors, medical organizations, construction and engineering firms, and probably some other kinds of large private businesses, depending on their industry. Basically, if the software your organization uses can cause the level of destruction that Horizon did, it needs to have specific certifications, or you can't use it. In order for such software to be certified, it needs to meet certain clearly-defined standards of quality, potentially including having all the technical leads of some level (or just all the developers, depending on various factors) be licensed, and have their licenses on the line of something like this scandal occurs. It's not a panacea, and it would definitely be an absolute bear to get the terms of all of it defined both clearly and in a way that is likely to actually produce a quality product, but IMO it is likely to be worth it in the long haul.

exe34 2y ago
think of it as accreditation profiles. the highest is for life threatening cases like flight/medical, the lowest might be government expenses.
- danaris 2y ago
  While I personally love that idea, I suspect it's too complex to fly in actual attempts to get something like this in place.
  - exe34 2y ago
    the same could be said for aerospatial regulations, and we still manage to do them. civil constructions are mindbogglingly complicated and we still manage. all it takes is enough people to die, and/or for rich people to lose enough money and it'll become the rule.
maxwell 2y ago
Transparency and competition seem to work better than certifications and credentials. Just mandate open source if using public money.