People writing software need to take responsibility for how the software is used, especially when it can impact people's lives to this degree. You can't just blame third party software or the people entering data.
There is an old joke that it's almost impossible to get someone to understand a problem that would result in a threat to their livliehood.
I don't think people need to "take responsibility" I think organisations need to be made to take responsibility.
In the UK when you purchase a physical good from the retailer the warranty for that good is between you and the retailer, the retailer then has to deal with problems up the line from suppliers, it's not perfect but it's workable.
I think software should be the same, I think if I pay Foo for a system then Foo should be responsible for the system even if it's made of parts from Bar, Fizz and Buzz, if Foo has an issue with Fizz they need to take it up with Fizz.
There is so much crap software out there in every field and the acceleration towards a world run on software continues.
If you wanted to use a library in a project, you would have to
- a) read the entire thing to see if you can find any bugs that the devs missed, or
- b) roll your own solution which will probably have even more bugs, or
- c) find an equivalent library that has a paid version without the "as-is" clause.
Can you imagine it in the automotive,aeronautical, transport etc?
The present system is a pass the parcel of blame with no one taking any responsibility, tonnes of shit, insecure systems written and designed poorly.
Eventually something will give.
This. This is the most important point I've read so far. The key word here is "imagine."
I think even we, as an industry, don't quite grok the degree to which software truly has eaten the world -- and the degree to which it now is every bit as important, as life-or-death, as things like cars, airplane travel, or even medicine. We hold these goods to certain standards because we deem them extremely critical -- too important to be left to the de facto standards set by the operation of a wild-west market. It's about time the notion of standards-free software shocked people as much as the notion of standards-free engineering in any other systemically critical industry.
I'd prefer self-established standards set by the industry to government-imposed standards set by lay bureaucrats. But the latter is coming eventually if the former never does.
Surgeons are not liable for, for example, hip replacement implants from a decade ago that are now known to have problems, but they would be responsible if they continued using the implants after they were recalled. They also purchase malpractice insurance. How is this any different than following security advisories and purchasing liability insurance?
Hopefully there will be an investigation and the people will find out who screwed up and why so they can be held accountable. It's tempting to say that everyone involved is "responsible" in some vague way, but that lets people off too easy. If everyone is guilty, then no one is guilty.
Assuming the software itself has no meaningful or significant bugs (a hard thing to prove), it likely IS a problem of training. I know that my travel request time went from 5 minutes to closer to an hour for the first few times I used it after we switched to a new system. And while the admins were trained properly, the rest of us just were told "Ask an admin if you need help"
Similarly, it might actually BE the third party systems. I know that every time we upgrade part of our infrastructure we have to deal with the hell of components that should, but don't, interface well. And as often as I scream profanities and talk about how much I hate a certain vendor, I also know it isn't their responsibility to ensure that their software works with a different vendor's (I do yell at our procurement people though since they should make it so).
Do I think Tyler Tech should try to help? Of course, this is bad PR. And if they were the ones providing the training, address what went wrong and update the training and possibly GUI to resolve this. But so long as they met the requirements of the contract, I see no reason they should be held responsible or penalized.
Indeed, this excuse just doesn't pass the smell test. Responsible vendors do (and not only "do", they advocate and insist on) practices like integration testing, and graduated rollouts (so that when process glitches like these inevitably slip through, they're caught when they affect 1 or 2 people -- not 50).
Never do they blame "bad inputting of data."