Hacker News Reader

Comment by tluyben2 | Hacker News Reader

How would that work practically? I am sometimes for regulation but I cannot fathom what it would look like.

People seem to be under the impression that regulation inevitably means "someone has to review/audit every single change that was made to any aspect of a product". But in practice there can be all kinds of provisions, from the weak to the strong.

A weak provision may be that at least a minimum of development and testing has to take place, with requirements on record-keeping and naming of responsible persons: For a simple device, or a simple software, this might take the form of a checklist or a questionnaire which you have to take before uploading code to the App-Store.

Yes, this seems very straightforward to fake, but at least then you have deliberately cheated a system designed to catch errors, and not "just written shitty code" (or built a flimsy mechanical device... when applying this scheme to non-software world). Which, I think, would already help a lot to make people accountable for their products/inventions/...

{for, example: with CE certifications, you, as a producer only state that you have built your products according to some harmonized standards, but the conformance itself is not tested by a third party}

With increasing security/privacy requirements, the mandated measures can could then be ramped up. Maybe scaled by permissions of an application (accesses otherwise protected data?), the ability to process sensitive date or maybe number of users?

The extremes measure would be a full line-by-line review on every change, when software is life-sustaining or a fault may have catastrophic (death of people, like running a pacemaker or steering a huge plane).

As a producer, CE certification is very disconcerting. I started out with the mindset of "how can I be certain that I'm compliant?", and the best answer is that it simply doesn't work like that. It's more of a question of whether you have enough paperwork to cover yourself in the (pretty unlikely) event of litigation.

There's some testing you can do, and you can sort of guess which product categories fit you exactly and apply those, but if your product is really innovative this is vague. You end up just putting a declaration of conformity in the box and a sticker on the product and hoping for the best.

I liked the CE process and thought it was pretty clear. You need to identify hazards and classify them according to probability of occurance and severity, then take appropriate measures to reduce the risk of harm. It's all spelled out pretty well without being a precise code (like NEC or UL 508A or something), so it's flexible enough to apply to whatever domain you're in.

This is how medical devices are regulated. The FDA doesn't micro manage or guide your development. They just say "you must have a quality management system spelled out and stick to it. However it's written you must obey it. "

There's a little more to it. There's some CFR standards that you must adhere to (it's been 12 years, so I don't recall the CFR part number off the top of my head).

We have all our code inspected and pen tested under different regulations and certification rules; if you would take that even a bit broader, no software would be written anymore; all programmers would be busy checking code.

And this software is not 'that' critical (financial). I would actually agree that life or dead software should be checked line by line by experts, software and well described processes. I would even insist that critical software that can be formally verified should be formally verified. But for a broader range of software this is not possible and well, I don't think it should be needed for innocent software like, say, games.

What could work for non critical software is having to pay for bugs if software is faulty based on the severity of the bug. I would be very much against the kind of liability that involves again kind of indirect damages, so the maximum of damage is limited to what you paid. Most people do not want that but you would want to have some or all money back in case of neglect (bugs that do not properly get fixed) without forgoing your license. That will kill companies (if turned back the clock with this rule, MS + Oracle notably) but then again, they won't cut corners like what happens now.

ANAE, but one form it could take is via a government or independent expert body with a mandate to inspect and certify code in some meaningful way before it reaches the consumer.

All code? I'm pretty sure you just ground the industry to an halt, if even Flappy Bird must be inspected and certified.

If it's just code used in critical situation, then you're not really talking about the same thing as pjmlp.

Self-driving car code is a critical situation, surely? Isn't that what we were talking about?

The code is likely useful in many other ways than just self-driving cars.

Ancestor in this thread said:

> I support software being regulated just like everything else, not only on life critical situations.

Maybe there is a line that is "critical", but not "life critical", but ancestor's statement was pretty damn broad.

Reply on news.ycombinator.com