4 ms·

We need a software building code. This wouldn't be allowed to happen with non-software. The fact that anyone can build any product with software, make it work t

We need a software building code. This wouldn't be allowed to happen with non-software. The fact that anyone can build any product with software, make it work terribly, and when it fails impacts the lives of thousands (if not millions), needs to be stopped. We don't allow this kind of behavior with the electrical or building code. Hell, we don't even allow mattresses to be sold without adding fire resistance. The software that is critical to people's lives needs mandatory minimum specifications, failure resistance, testing, and approval. It is unacceptable to strand 150,000 people for weeks because a software company was lazy (just like it was unacceptable to strand millions when CrowdStrike shit the bed). In addition to approvals, there should be fines to ensure there are consequences to not complying.

nathanaldensr 7mo ago
I have no idea why you'd been downvoted. Everything you said is common sense. I guess this is a case of "it's hard to get a man to understand something if his paycheck depends upon him not understanding it."
- deleted 7mo ago
  [deleted]
- coryrc 7mo ago
  Or maybe it's "the NFPA doesn't need to prevent against your wires suddenly becoming aluminum because somebody discovered new math" like "DSA encryption has been broken" affects software.
- pas 7mo ago
  EU has the NIS2 directive, the CRA (cybersecurity resiliency act), and a few sector specific ones (DORA for financial, MDR/IVDR for medical/diagnostical, and there's probably a bunch more) these are slowly but surely pushing manufacturers/sellers/distributors to try to do the right things it requires transparency about support period commitment, a bug tracker program, issuing updates (I guess in case there's a CVE), doing risk assessment during development, etc., and requirements kick in based on turnover (or headcount). and it seems like the correct approach, these are already things good products come with
knollimar 7mo ago
It's great to assert "we need" but I implore you to consider the downsides first. I work for an electrical contractor and I don't think being annoyed by shitty UI is nearly the same problem as electrical fires. Why govern the whole set of software with 1 set of rules? Software isn't safety critical until it is, but we already have code to regulate software on electrical equipment, planes, etc. Why do you recommend software have a code? I'd much rather each individual thing that's safety critical have regulations around software in place than have to learn a 4000 page manual that changes every time you cross a jurisdiction, where enforcement varies, etc. Software engineers can't even agree on best practices as is. Imo, put the code around the safety critical thing (e.g. cars, planes, buildings). Restricting "critical" software will only get abused the way essential workers did during covid. Also keep in mind the way buulding code gets enforced: you get an inspection upon completion or milestones. Software has a tendency to evolve and need maintenance or add features after; I don't want to trust this to a bureacrat. I don't like google or apple getting involved on "their platform" and I certainly don't want an incompetent government getting involved. Before we have a software code, let's make and adopt some guidelines we can agree to. In construction, plenty of builders have their own sets of internal rules that are de facto codes. When one of those gets popular enough for life safety software, let's consider pushing for that.
- 0xbadcafebee 7mo ago
  The solar power industry was born, rolled out products, learned from their failures, and implemented electrical and building code changes, in a third of the time that the software industry has existed. We already know what the failures are. We already know what the solutions are. We know it because people have been born and died in the span of time we have been dealing with these same problems. There is no need to assemble guidelines (that no company would follow anyway without being forced to). > Software engineers can't even agree on best practices as is. I'm not talking about "best practice"; I'm talking about, before you ship a build to customers, you must at least run it once to look for errors. This is kid stuff, yet the companies don't do it, and subsequently half the flights in the USA are delayed for weeks. There is no need to argue about this, there is no question that there are basic practices that should be considered malpractice not to do. We must make this law or they will continue to disregard these basic practices and we will continue to suffer for it. > Software has a tendency to evolve and need maintenance or add features after That is a flaw in business practice, it has nothing to do with software itself. I can run a suite of Perl programs today that I wrote 20 years ago, and they run flawlessly. No need for maintenance, it just works. The reason is, we just happened to treat this one language as something that should not break, and should last a long time. No reason we couldn't treat other software the same way. The fact that other software doesn't is a choice by a lazy industry and uncaring business models, and this choice needs to be challenged, the way every industry has had to be challenged by codes (the reason codes exist is industry cannot be trusted to "do the right thing", they need to be forced). But despite this, codes change all the time. The electrical code changes as solar progresses. Building codes change as we learn new things or new materials are introduced. The codes do change slowly, precisely so the work is well thought-out, coordinated, and safe, which nobody can say about modern software. The time for move fast and break things needs to end.
chasil 7mo ago
The two long-term existing environments are Misra-C and ADA. https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/Ada_(programming_language) https://en.wikipedia.org/wiki/Ada_(programming_language) ADA is particularly strong in aviation. https://www.adacore.com/industries/avionics https://www.adacore.com/industries/avionics Rust would also be a contender, but it's "the new kid on the block."
- MisterTea 7mo ago
  Ada is a name, not an all cap abbreviation.
HeyLaughingBoy 7mo ago
There are lots of "software building codes" IEC-62304, MISRA, DO-178C, etc. Problem is that the vast majority of software doesn't fit into those categories. And as you mention, since you can build any product with software, you would have to have categorization for any new standards to make sense.
bilsbie 7mo ago
That’s the wrong lesson. Rather we should control things we own and not them control us.
M95D 7mo ago
I think a better ideea would be that software should not have disclaimers. Authors should assume full responsibility in court if their work misbehaves.
GorbachevyChase 7mo ago
Software is a bit unique in that in almost all cases there are no consequences to responsible parties for malpractice. Shipping defects is the standard of care. Not so for doctors, plumbers, and hair stylists. It’s why I’m so surprised by the AI slop criticism. Humans had no code standards to begin with, at least, not compared to standards of care in licensed professional services.
misswaterfairy 7mo ago
> We need a software building code. This wouldn't be allowed to happen with non-software. The fact that anyone can build any product with software, make it work terribly, and when it fails impacts the lives of thousands (if not millions), needs to be stopped. Uncle Bob had a bit to say about this a while ago[1], and is largely what his Clean Code philosophy is trying to achieve, despite the detractors. To the detractors and down-voters... If you're complaining about over-abstraction, arguing about the 'better language' to use, or that 'Clean Code' doesn't work - you're missing the point by a few hundred miles. The whole point of 'Clean Code' is to establish a body of ethics software 'engineers' collectively agree to, and rigorously follow to avoid "killing 10,000 people with a little software failure". If you think you can make a better 'Clean Code', do so! That's the whole point about ethics debates. But! You need to proffer an alternative and prosecute why your version is better than Clean Code. [1] (19:47-24:33) https://www.youtube.com/watch?v=7EmboKQH8lM&t=1187s https://www.youtube.com/watch?v=7EmboKQH8lM&t=1187s

nathanaldensr 7mo ago

I have no idea why you'd been downvoted. Everything you said is common sense. I guess this is a case of "it's hard to get a man to understand something if his paycheck depends upon him not understanding it."

deleted 7mo ago
[deleted]
coryrc 7mo ago
Or maybe it's "the NFPA doesn't need to prevent against your wires suddenly becoming aluminum because somebody discovered new math" like "DSA encryption has been broken" affects software.
pas 7mo ago
EU has the NIS2 directive, the CRA (cybersecurity resiliency act), and a few sector specific ones (DORA for financial, MDR/IVDR for medical/diagnostical, and there's probably a bunch more) these are slowly but surely pushing manufacturers/sellers/distributors to try to do the right things it requires transparency about support period commitment, a bug tracker program, issuing updates (I guess in case there's a CVE), doing risk assessment during development, etc., and requirements kick in based on turnover (or headcount). and it seems like the correct approach, these are already things good products come with

knollimar 7mo ago

It's great to assert "we need" but I implore you to consider the downsides first. I work for an electrical contractor and I don't think being annoyed by shitty UI is nearly the same problem as electrical fires. Why govern the whole set of software with 1 set of rules? Software isn't safety critical until it is, but we already have code to regulate software on electrical equipment, planes, etc. Why do you recommend software have a code? I'd much rather each individual thing that's safety critical have regulations around software in place than have to learn a 4000 page manual that changes every time you cross a jurisdiction, where enforcement varies, etc. Software engineers can't even agree on best practices as is. Imo, put the code around the safety critical thing (e.g. cars, planes, buildings). Restricting "critical" software will only get abused the way essential workers did during covid. Also keep in mind the way buulding code gets enforced: you get an inspection upon completion or milestones. Software has a tendency to evolve and need maintenance or add features after; I don't want to trust this to a bureacrat. I don't like google or apple getting involved on "their platform" and I certainly don't want an incompetent government getting involved. Before we have a software code, let's make and adopt some guidelines we can agree to. In construction, plenty of builders have their own sets of internal rules that are de facto codes. When one of those gets popular enough for life safety software, let's consider pushing for that.

0xbadcafebee 7mo ago
The solar power industry was born, rolled out products, learned from their failures, and implemented electrical and building code changes, in a third of the time that the software industry has existed. We already know what the failures are. We already know what the solutions are. We know it because people have been born and died in the span of time we have been dealing with these same problems. There is no need to assemble guidelines (that no company would follow anyway without being forced to). > Software engineers can't even agree on best practices as is. I'm not talking about "best practice"; I'm talking about, before you ship a build to customers, you must at least run it once to look for errors. This is kid stuff, yet the companies don't do it, and subsequently half the flights in the USA are delayed for weeks. There is no need to argue about this, there is no question that there are basic practices that should be considered malpractice not to do. We must make this law or they will continue to disregard these basic practices and we will continue to suffer for it. > Software has a tendency to evolve and need maintenance or add features after That is a flaw in business practice, it has nothing to do with software itself. I can run a suite of Perl programs today that I wrote 20 years ago, and they run flawlessly. No need for maintenance, it just works. The reason is, we just happened to treat this one language as something that should not break, and should last a long time. No reason we couldn't treat other software the same way. The fact that other software doesn't is a choice by a lazy industry and uncaring business models, and this choice needs to be challenged, the way every industry has had to be challenged by codes (the reason codes exist is industry cannot be trusted to "do the right thing", they need to be forced). But despite this, codes change all the time. The electrical code changes as solar progresses. Building codes change as we learn new things or new materials are introduced. The codes do change slowly, precisely so the work is well thought-out, coordinated, and safe, which nobody can say about modern software. The time for move fast and break things needs to end.

chasil 7mo ago

The two long-term existing environments are Misra-C and ADA. https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/Ada_(programming_language) https://en.wikipedia.org/wiki/Ada_(programming_language) ADA is particularly strong in aviation. https://www.adacore.com/industries/avionics https://www.adacore.com/industries/avionics Rust would also be a contender, but it's "the new kid on the block."

MisterTea 7mo ago
Ada is a name, not an all cap abbreviation.

HeyLaughingBoy 7mo ago

There are lots of "software building codes" IEC-62304, MISRA, DO-178C, etc. Problem is that the vast majority of software doesn't fit into those categories. And as you mention, since you can build any product with software, you would have to have categorization for any new standards to make sense.

bilsbie 7mo ago

That’s the wrong lesson. Rather we should control things we own and not them control us.

M95D 7mo ago

I think a better ideea would be that software should not have disclaimers. Authors should assume full responsibility in court if their work misbehaves.

GorbachevyChase 7mo ago

Software is a bit unique in that in almost all cases there are no consequences to responsible parties for malpractice. Shipping defects is the standard of care. Not so for doctors, plumbers, and hair stylists. It’s why I’m so surprised by the AI slop criticism. Humans had no code standards to begin with, at least, not compared to standards of care in licensed professional services.

misswaterfairy 7mo ago

> We need a software building code. This wouldn't be allowed to happen with non-software. The fact that anyone can build any product with software, make it work terribly, and when it fails impacts the lives of thousands (if not millions), needs to be stopped. Uncle Bob had a bit to say about this a while ago[1], and is largely what his Clean Code philosophy is trying to achieve, despite the detractors. To the detractors and down-voters... If you're complaining about over-abstraction, arguing about the 'better language' to use, or that 'Clean Code' doesn't work - you're missing the point by a few hundred miles. The whole point of 'Clean Code' is to establish a body of ethics software 'engineers' collectively agree to, and rigorously follow to avoid "killing 10,000 people with a little software failure". If you think you can make a better 'Clean Code', do so! That's the whole point about ethics debates. But! You need to proffer an alternative and prosecute why your version is better than Clean Code. [1] (19:47-24:33) https://www.youtube.com/watch?v=7EmboKQH8lM&t=1187s https://www.youtube.com/watch?v=7EmboKQH8lM&t=1187s