3 ms·

> This isn't unique to just aviation btw but most industries Most of us work in tech. Imagine an auditor coming in and trying to sort out if one of the most co

> This isn't unique to just aviation btw but most industries Most of us work in tech. Imagine an auditor coming in and trying to sort out if one of the most complex systems at your company is "safe." What's safe? Every previously known failure mode and every new one you're going to be blamed for when it happens.

xdfgh1112 1y ago
That's literally the security industry and third party security assessments are routine in tech.
- _DeadFred_ 1y ago
  Having been in both in software/IT capacities, having done PCI certified software, medical device software (requiring FDA approval), no. Not even close. MAYBE, MAYBE the insurance company assessments/audits are kind of related to what you are talking about. But not really. But not the FAA ones. They are such a different beast with so much brain power involved along with people with a combined centuries of experience in this stuff, it's hard to explain without being around it.
- watwut 1y ago
  Yeah, but security industry is mostly a joke full of fraudsters. There are parts of it that work well, but most of it is theater and not that much competence. Which is fine for low states they deal with and not fine with planes.
hgomersall 1y ago
It's not about declaring things to be safe. It's about having documented and adhered to processes that show safety is taken seriously at every point in the design, manufacture and maintenance of safety critical systems.
_DeadFred_ 1y ago
I thought FDA regulated device software certification was hard, PCI certification just annoying. FAA certification is on another level from those. There's so many moving parts to aircraft certification honestly I was surprised when a new design would get type design certification. Which is why Boeing tries to do things like shoehorn in a new airplane under an older airplane type design (MAX) so they don't have to get a whole new type design approved.
burnt-resistor 1y ago
That's what an (effective) audit is, conducted by technically-competent auditors. These do exist, and while some of their checklists include some bullshit, not all of it is bullshit when there are qualitative reviews of exceptions and of the soundness of processes.

xdfgh1112 1y ago

That's literally the security industry and third party security assessments are routine in tech.

_DeadFred_ 1y ago
Having been in both in software/IT capacities, having done PCI certified software, medical device software (requiring FDA approval), no. Not even close. MAYBE, MAYBE the insurance company assessments/audits are kind of related to what you are talking about. But not really. But not the FAA ones. They are such a different beast with so much brain power involved along with people with a combined centuries of experience in this stuff, it's hard to explain without being around it.
watwut 1y ago
Yeah, but security industry is mostly a joke full of fraudsters. There are parts of it that work well, but most of it is theater and not that much competence. Which is fine for low states they deal with and not fine with planes.

hgomersall 1y ago

It's not about declaring things to be safe. It's about having documented and adhered to processes that show safety is taken seriously at every point in the design, manufacture and maintenance of safety critical systems.

_DeadFred_ 1y ago

I thought FDA regulated device software certification was hard, PCI certification just annoying. FAA certification is on another level from those. There's so many moving parts to aircraft certification honestly I was surprised when a new design would get type design certification. Which is why Boeing tries to do things like shoehorn in a new airplane under an older airplane type design (MAX) so they don't have to get a whole new type design approved.

burnt-resistor 1y ago

That's what an (effective) audit is, conducted by technically-competent auditors. These do exist, and while some of their checklists include some bullshit, not all of it is bullshit when there are qualitative reviews of exceptions and of the soundness of processes.