People’s freedom jeopardised by new software adopted by California’s courts

We no longer have the luxury of saying "oh, it's just a CRUD app, it doesn't matter if things go wrong". Software has become too important, it has become too deeply intertwined in our daily lives. Errors and leaks from trivial little apps can have life-changing consequences for users.

If your software handles personally identifying data, there's a non-zero chance that you could ruin someone's life through negligence. Legal case management software might be an obvious example, but it's the tip of a very big iceberg.

If you have several million users, one-in-a-million edge cases are going to happen constantly. Weird things happen at scale. We need to treat every Android permission and every Facebook API call as a potential matter of life or death. We need the personal courage and the support of our peers to say "no, I will not implement that feature", "no, I will not store that user data", "no, I will not transmit that in plaintext", "no, I will not commit that to production without unit testing".

https://en.wikipedia.org/wiki/Iron_Ring

However, let's also try to compare the complexity of that software system with the complexity of a bridge. What would be more complex, that Tay Bridge or California's Odyssey? I bet on the latter and I assume that it would cost much more money and time to properly build and test software systems. It's almost only manpower, compared to concrete, steel and wood, but the costs could go up by one order of magnitude compared to what they are now.

If this approach gets mandated it would be a big slow down for every industry needing custom software. It also means we'll only need 1/10th of customers to keep our shops open, the 10% with more money. Goodbye to the small ones.

There will be the equivalent of a construction site manager, but good luck with the bugs that become apparent or are introduced after years of changes to the first accepted delivery of the project. Bridges are much more static than software.

Civil engineers have to make sure that bridges won't naturally collapse.

Software "engineers" have to ensure that no one will break their code, from the privacy and anonymity of their house, with millions of dollars in payoffs.

If bridges held millions of dollars and would be accessible from around the world, they would be breaking all the time also.

Position two: require court system software to be open source

You might reply that open source is no panacea, and that's true. But the vulnerabilities in current software are wholly different than the ones in civil (physical) engineering-- both your imagined "professional grade" proprietary court app and my imagined open source court app will have critical vulnerabilities. The question is what happens when they are found. I'd like to read a blog entry complete with screen captures by a security expert who is running the exact same software, posted after the exploit has been responsibly reported and addressed. I do not want to read an opaque statement from a company blaming its users, and I don't see how even a set of strong, effective software engineering guidelines is going to get you anything else in this case.

Edit: I said "vulnerabilities", but the logic applies equally to usability issues, data corruption, etc.

Who this gets implemented I'll quit and become a welder or something else that's outdoors and filled with less insane propositions. The BS and stupidity that gets setup by these standards organizations is crazy.

I know many people who are PEs who can testify that all of this is completely useless. It's often said by people who give these certifications that you shouldn't go into industry before getting these. That's acceptable until you hear why: you'll forget a lot of stuff that is unused in industry but used in these exams. This is horrible design at it's best.

"Engineering Standardization" in this form is good for a few things:

   1. Driving up the cost by keeping perfectly good engineers out of the field and making the industry talent starved.
   2. Creating a corrupt standardization organization that makes it so their "group" can get certificates while others cant.
   3. A reduction to the speed of new ideas entering the field. Less people allowed in all of which are brainwashed into "THIS IS THE WAY, YOU WILL OBEY" 
   4. A lack of care for checking work; "They're a professional engineer, you know better then me"
   5. Preserving irrelevant information that isn't at all related to the task at hand (A+, I'm looking at you)

Another solution is to have a simple standard: All life endangering software must either be a) formally proven by the programmers and checked by a mathematician or b) have unit testing for every possible case of every testable portion of the code.

If both of these are done then it will save far more lives then useless standards that will be actively ignored. These two standards are already where our field is naturally going and embracing that will only yield higher quality software for everyone. Using stupid standards documents that specify things like "functions can only be 80 chars wide and 100 lines long" or "no memory allocation after startup"

It also avoids forming unnatural accreditation bodies that are harmful to the industry.

Edit: I'd also be perfectly fine with something like UL for software.

There is an old joke that it's almost impossible to get someone to understand a problem that would result in a threat to their livliehood.

I don't think people need to "take responsibility" I think organisations need to be made to take responsibility.

In the UK when you purchase a physical good from the retailer the warranty for that good is between you and the retailer, the retailer then has to deal with problems up the line from suppliers, it's not perfect but it's workable.

I think software should be the same, I think if I pay Foo for a system then Foo should be responsible for the system even if it's made of parts from Bar, Fizz and Buzz, if Foo has an issue with Fizz they need to take it up with Fizz.

There is so much crap software out there in every field and the acceleration towards a world run on software continues.

Hopefully there will be an investigation and the people will find out who screwed up and why so they can be held accountable. It's tempting to say that everyone involved is "responsible" in some vague way, but that lets people off too easy. If everyone is guilty, then no one is guilty.

Assuming the software itself has no meaningful or significant bugs (a hard thing to prove), it likely IS a problem of training. I know that my travel request time went from 5 minutes to closer to an hour for the first few times I used it after we switched to a new system. And while the admins were trained properly, the rest of us just were told "Ask an admin if you need help"

Similarly, it might actually BE the third party systems. I know that every time we upgrade part of our infrastructure we have to deal with the hell of components that should, but don't, interface well. And as often as I scream profanities and talk about how much I hate a certain vendor, I also know it isn't their responsibility to ensure that their software works with a different vendor's (I do yell at our procurement people though since they should make it so).

Do I think Tyler Tech should try to help? Of course, this is bad PR. And if they were the ones providing the training, address what went wrong and update the training and possibly GUI to resolve this. But so long as they met the requirements of the contract, I see no reason they should be held responsible or penalized.

Indeed, this excuse just doesn't pass the smell test. Responsible vendors do (and not only "do", they advocate and insist on) practices like integration testing, and graduated rollouts (so that when process glitches like these inevitably slip through, they're caught when they affect 1 or 2 people -- not 50).

Never do they blame "bad inputting of data."

the green screen app was highly optimized for efficient and accurate data entry without use of a mouse. The modern alternative looked better, but a large portion of the functionality was much less efficient in comparison.

the only redeeming factor of the new application, was it allowed much of the manual data entry to be automated. This however required considerable time, technical knowledge, and industry contacts to develop and implement, which not all organizational users possessed.

This is more expensive in terms of people's times, but it's just part of the cost of adopting the new software, and should be treated as such, possibly by billing the software vendor for the additional manpower required to work with the software during the transition.

May be in the field like this some extra care should be taken to ensure that, despite possible clerical errors, the data entered is sufficiently accurate. Technically that's likely extra checks and more thoughts about clearness of UI. "Just clerical error" doesn't sound like enough justification in cases like this - software should actively help to avoid those errors, and do enough of that help.

> Because the system is so unwieldy, clerks are unable to enter data in the courtroom, she said, so that burden has fallen on other office workers. It’s created a backlog of more than 12,000 files that have not been uploaded — and that number is growing by up to 300 files a day, according to Woods.

Sounds like it's mostly a software design problem to me, rather than "clerk/user stupidity" issue:

http://www.sfchronicle.com/bayarea/article/Alameda-County-s-...

I knew various government techies who went to work for the Administrative Office of the [US] Courts. Honestly, I don't know what the chain of command was there.

I interviewed with them in 2008, and that remains, to date, the worst interview experience I have ever had. Everything they did before the interview seemed calculated to convince me to withdraw myself from consideration, and everything after seemed calculated to discourage anyone else I knew from applying.

So I felt a little frisson of schadenfreude from reading the article.

I don't think that's enough in all cases.

Does the UK passing the investigatory powers act in any way have any bearing on abuses by the legal system in other countries or are we just playing "whataboutism bingo" today?