Hacker News Reader

Comment by vincnetas | Hacker News Reader

How many times i have seen comments comparing civil engineers and software engineers and the liabilities each have.

Civil engineer failing to comply with regulations ending up in jail vs. software engineer well, doing nothing if his software does something wrong.

So welcome to the future where software engineers will be held responsible for what they create. I think it's right direction. And don't start with 'hackers playing for fun with side projects will no longer be able to do this'. It's same for engineer building a shed in his backyard. No one will have problems if he has not done load calculations and is using that shed by him self. Only difference is that if you put it on the internet it's like building that shed in a public park. And then you have problems if you don't think what you are doing.

View on HN

People die when a civil engineer messes up. Most people don't die from a website.

That does not mean that software has no real world consequences. Otherwise, why would people be building software ?

There's a reason companies which are 100% software can be valued in the billions of dollars. Their software has huge, very real consequences.

Of course software has consequences. Not the same as infrastructure of countries though.

Companies are valued at billions not because of life and death risks but usually because it enables other companies to make money. On the other hand, basically everything done in civil engineering could be seen as having real danger implications. Bridges and tunnels of course, but even roads which can wash out and cause harm.

Also their marginal cost of delivery approaches zero. High fixed costs in creating the software and almost negligible marginal costs. The return on capital can be astronomical.

Online services have “real consequences.” But not of the type as goods in the physical world. PCI and HIPAA have tried to mitigate against some of the most egregious crossovers of failed software. GDPR scares me. Not in the “I don’t like the consequences” but in the “I don’t know what this does and how screwed I might be.” I’m very happy to be on the other side of the pond where I can safely observe the fallout. Feels like buying a first generation Apple device: I’ll wait a few years and let the early adopters go through the pain for me...

What if the software we interact with causes stress? Stress kills, just not in the same visible way as a bridge falling down.

That is going to affect how it's regulated. I'm just pointing out the comparison is not right.

Really depends on the mess up. You mess up and leak confidential info to an ex-boyfriend? Well, here you are contributing to the stats of women killed by their partners.

If software didn't have strong real-world implications the entire software market would have been just a subset of the gaming market.

I'm not a regulations fan but for me, it feels simply like something obvious materializing.

I think it's important to look at how many programs fall to risks like that. Where is the cutoff where we regulate the whole industry due to a very very small possibility of issue?

Food safety, for instance, can affect everyone because bacteria can be anywhere and a lapse in safety practices has a high chance of public sickness.

I do think some software should be regulated more than it is. Is GDPR the answer? I don't feel so.

Not all software is regulated, no one cares about your program you make at home, run or distribute as long as it doesn't do some specific stuff.

Make a calculator App and GDPR doesn't care. Make a calculator App that collects financial info and personal info and sends that info somewhere, then GDPR cares.

> Only difference is that if you put it on the internet it's like building that shed in a public park

The difference here is that code published online has no assurances of being correct or adequate to the task.

Someone building a shed in a public park is, as far as I'm aware, generally not a regular occurrence and certainly you'd agree that a building on public property could be reasonably assumed to have been built to some sort of safety standards by a public body. There's a tacit agreement that, if I enter such a structure, I can reasonably assume it won't collapse on me due to poor design.

Code, on the other hand, is published online by hundreds of thousands of developers everyday. No reasonable individual can expect that any selection of that code is likely to contain anything that can be considered production-grade. Why are we taking the liability from the irresponsible corporation whose service gets pwned because they didn't review my shitty experimental crypto before using it?

Even popular and well used libraries and software shouldn't be held to this standard. You're expecting people who are building something in their free time to bear legal responsibility for the mistakes of an organization who is paying nothing to use their software. That's beyond not fair -- that would absolutely kill open source software and completely ruin the current ecosystem where a single developer and huge enterprises are on a similar level from an access-to-technology standpoint.

Do understand, that my comment here was about software handling personal information. And not software it self but companies using/writing that software.

Reply on news.ycombinator.com