3 ms·

I don’t think you’ll find anyone who would disagree with the premise that we should improve software quality. Yes, even the people who value iteration speed and

I don’t think you’ll find anyone who would disagree with the premise that we should improve software quality. Yes, even the people who value iteration speed and shipping. All things being equal, better quality is always better, because of course it is. The problem arises when all things are not equal, and something needs to give. Perfect quality is generally not attainable or even desirable, because it sacrifices things in other areas that we care about even more. Sometimes the value of something is high enough that we will pay the price for it failing in some cases. That’s just how we do a cost-benefit analysis. I say this even though I work in software security, where most of my job exists and is made difficult by “bad” quality, and a lot of my effort goes into figuring out how to improve that. Depending on the circumstances, I may advocate for the balance to be adjusted in favor of more security (at the expense of something else) and sometimes I may actually decide that this is counterproductive. That’s really my actual response to the comment. However, as you probably noticed, I didn’t reply with that. I called it low-quality. In fact I think the whole discussion is low-quality, not because it is not a real point, but because it’s not interesting. I understand and appreciate that you have worked on software quality throughout your career. I want you to be proud of your efforts in this area. And it’s completely reasonable to point to that and go “this is what’s missing from our industry”. It’s not actually very novel or actionable. So, despite me not actually voting on the thread, I felt it was not valuable. When I was in high school I happened to be pretty decent at physics. In fact I won some awards and was nationally ranked. This is kind of like your situation, except of course my skills were less general and also more ephemeral. But it’s as if I, given my arguably decent understanding of physics, went “the problem with climate change is that we’re using too much energy”. First of all, this doesn’t actually use any of those skills to proclaim. Even someone who failed high school could probably tell you that. But secondarily, and more importantly, I haven’t actually said anything useful. My knowledge of mechanics is great but solving climate change is a huge problem, both deeply technical but also social and political. It’s a lot harder than going “stop applying force over distance to things”. The same is true for preventing exploits: I’m sure you’re great at writing apps that have low defect rates, but when it comes to protecting against nation-state threats there’s a whole lot going on beyond “let’s not make any mistakes”. More relevant would be a discussion about, say, memory safety, or auditing, or whatever that is actually on-topic and actionable. What you’ve posted is something that is really just a “hear hear here’s an obvious problem let’s fix it” which invites nothing beyond people who will do nothing but agree with you, or somehow twist it into their pet peeve and rant against it. Neither is against the rules but I think it doesn’t make for insightful conversation, so I’m telling you about it now.

ChrisMarshallNY 2y ago
Point taken. But I feel that the root cause is attitude and encouragement. Sort of “the wolf you feed” kind of thing. That’s not really something that can be addressed by technology or even education. That’s the kind of thing that we handle with social infrastructure. Peer pressure, cultural norms, “tribal knowledge,” etc. In my mind, the best way to approach that, is by contributing small, almost “throwaway” human-interaction-level “course corrections.” We set the examples we want others to follow, and talk about why we do stuff, as opposed to always making it about how. Some of the most valuable lessons that I learned about Quality, in my career, were offhand comments, made by folks that lived Quality, and demonstrated the required mindset.
- saagarjha 2y ago
  One of the specific things I’d also like to emphasize, being in this industry, is that people often misjudge how to make their software secure. Yes, it involves caring and some level of quality of course, but you can write a perfect, well-designed, award winning app that people love with all the care that goes into that. That won’t stop NSO Group from completely and utterly hacking it. So to some extent yes it is a problem of not caring enough about your software but I want to make it clear that it’s not something your average developer can fix if they just tried harder. You need someone who is an expert in this stuff involved. This is different from UI design in that you can kind of work through it yourself with the appropriate amount of effort. In security, if you don’t actually know what you’re doing, you will do it wrong regardless of how hard you try. Even the people who know what they’re doing make plenty of mistakes. There is some basic tribal knowledge that I’m sure you’re familiar with (“parse, don’t validate”, “principle of lowest privilege”, “type systems and memory safety prevent bugs”) but you can’t really peer pressure someone into making secure software if they’re past the point of not being completely incompetent.
  - ChrisMarshallNY 2y ago
    Sounds like what is needed, is humility, and maybe folks that know how to do it, making the information more accessible. That’s not always something folks want to do. Information is valuable.

ChrisMarshallNY 2y ago

Point taken. But I feel that the root cause is attitude and encouragement. Sort of “the wolf you feed” kind of thing. That’s not really something that can be addressed by technology or even education. That’s the kind of thing that we handle with social infrastructure. Peer pressure, cultural norms, “tribal knowledge,” etc. In my mind, the best way to approach that, is by contributing small, almost “throwaway” human-interaction-level “course corrections.” We set the examples we want others to follow, and talk about why we do stuff, as opposed to always making it about how. Some of the most valuable lessons that I learned about Quality, in my career, were offhand comments, made by folks that lived Quality, and demonstrated the required mindset.

saagarjha 2y ago
One of the specific things I’d also like to emphasize, being in this industry, is that people often misjudge how to make their software secure. Yes, it involves caring and some level of quality of course, but you can write a perfect, well-designed, award winning app that people love with all the care that goes into that. That won’t stop NSO Group from completely and utterly hacking it. So to some extent yes it is a problem of not caring enough about your software but I want to make it clear that it’s not something your average developer can fix if they just tried harder. You need someone who is an expert in this stuff involved. This is different from UI design in that you can kind of work through it yourself with the appropriate amount of effort. In security, if you don’t actually know what you’re doing, you will do it wrong regardless of how hard you try. Even the people who know what they’re doing make plenty of mistakes. There is some basic tribal knowledge that I’m sure you’re familiar with (“parse, don’t validate”, “principle of lowest privilege”, “type systems and memory safety prevent bugs”) but you can’t really peer pressure someone into making secure software if they’re past the point of not being completely incompetent.
- ChrisMarshallNY 2y ago
  Sounds like what is needed, is humility, and maybe folks that know how to do it, making the information more accessible. That’s not always something folks want to do. Information is valuable.