Hacker News Reader

Comment by eggsmediumrare | Hacker News Reader

This happens because execs are cheap, farm out everything to dev shops, and the beleaguered, underqualified devs power out nonsense code to keep up with the arbitrary point quota for the sprint. No one knows how the whole system works, reqs change constantly so poorly-planned updates degrade the whole thing, and all the while actual patient data gets mixed into the big soupy pot of bullshit. Anyone who raises concerns about the situation gets to be the "compliance officer," thus passing responsibility from the people benefitting from the situation to the people who just want to keep their job.

I wonder what would happen if devs could say to their boss "no, this won't be released until we're confident in it" with legally enforced immunity to consequences.

View on HN

What you're describing is a professional licensed engineer who has to among other things take out insurance because they are ultimately responsible for their decisions.

Software development is long overdue for a legally professional software engineer license and certification process. I imagine it's going to happen down the road after something important gets burnt.

There's no chance of this happening in my view. There's way too many vested interests in the "democratisation of development" especially the likes of "coding bootcamps", limitless frameworks and tools for "code-free" development, and extremely blurred lines on things like WordPress where a "developer" could be anything from someone who can only install plugins through the front-end to crack PHP developers.

I think there's more to it than this. In traditional engineering, you only need to be licensed to sign off.

You can still effectively do exactly the same job as a licensed engineer without being licensed, you just can't sign off on work (And thus be held responsible).

The way I see it, creating a license for Software Engineers doesn't really fix the issue. It just creates a scapegoat to blame when things go wrong.

> It just creates a scapegoat to blame when things go wrong.

That's just how it works for other engineering disciplines; with the license, the scapegoat has the legal power to refuse responsibility until they're confident things won't go wrong.

Who is ever really going to be confident in signing off on complicated software systems when in effect, it's saying, "Yes this system will absolutely not break/be breached/have something happen to it". Given the complexity of modern software, it doesn't seem like a feasible solution.

Even top software companies have things break or go wrong very frequently compared to traditional engineering.

I don't see this as a good solution in the software world.

I don't think it would demand that the software be infallible. If a "new type of earthquake" happens, the Civil engineers won't be responsible for their bridges failing. In the same way, if there is reasonable effort made to ensure the system is secure by standards of the time, I don't think these theoretical individuals would be blamed for particularly novel (zero day) or unpreventable (social engineering, to at least some extent) attacks.

I learned that protected data is probably safe for a finite timescale with all currently known forms of encryption under the assumption there isn't technological advancement that severely restricts the first assessment.

And they will go wrong.

Hey can you put together this trillion piece jigsaw puzzle? Oh and we need you to sign off on it. You're sure it's not going to kill anyone right?

Works on my machine!

Then we need you to sign off on it again after we change it next week, and the week after that.

Considering the number of large, established places that don't even do code reviews - I'm okay with this being a thing.

> Oh and we need you to sign off on it

Then you say "no". Business "needs" are important for replaceable serfs with no power to say otherwise; when the business needs engineering sign-off, you tell them what they needs to do.

Healthcare.gov was a pretty high profile failure but even then nothing happened after.

Equifax also comes to mind... amongst others, but you know.

I don't see anything changing as long as it's in money's interest to stay where it is (money rules this country point blank). Right now it's in too many business's interest not to change. There are also slews of developers earning quite a bit who might be forced into career changes depending on how licensing could be implemented.

While I agree it's overdue, I'm not sure what that event would look like.

When a bridge falls down, building collapses, patients die, people take notice.

Meanwhile, we've had the social insurance numbers and banking history of 165M+ UK, US, and Canadian people leak out of sheer technical negligence [0], and it resulted in a meek settlement and hardly broke through the public consciousness.

It seems to me that until someone dies in a way that is very clearly linked directly to a woefully negligent and under-trained software engineer messing up in a very public way, the needle is not going to budge at all.

Perhaps autonomous cars? Even then I doubt it, to be honest.

[0] https://en.wikipedia.org/wiki/2017_Equifax_data_breach

This reminded me of Therac-25 [0] wherein people died or were seriously harmed by software malfunctions in a radiation therapy machine, and standards were introduced [1] to help mitigate future incidents.

[0] https://en.wikipedia.org/wiki/Therac-25

[1] https://en.wikipedia.org/wiki/IEC_62304

That has already happened too with the 737 Max fiasco...

And nothing happens at Boeing without being signed off by PE-level engineering staff and management.

So is that the remedy people are recommending here?

I would guess it's about 20 years out, honestly. The sequential and interconnected weight & cost of software failure will have to be well beyond the capacity of conventional errors & omissions insurance to tolerate; settlements will have to be business-crashing - Knight Capital level crashing - to drive this.

Today, it's well under that.

It is, of course, long overdue; Therac25 should have really gotten the effort going, but, ce la vie with a irresponsible economy. It's plausible the EU legal systems will develop this effort first. I would not be surprised to see France or Germany fully develop the idea, probably in connection with Airbus or Siemens. Anyway. Idealism around quality....

I don't think it needs to be one major event.

If I remember history correctly, there wasn't one boiler explosion that caused us to start regulating who was allowed to design boilers. It's just that as boilers became more and more popular at the end of the 19th century, people started being maimed and killed more often, and at some point we just as a society decided enough was enough.

It can’t be before something important gets burnt. There are a few ash piles out there already.

A huge number of security vulnerabilities are due to production mis-configuration rather than flaws in the development of the actual software. Software Engineers generally aren't trained in managing these production environments so you would probably want at least two different legal licenses to cover your bases.

The two are not orthogonal. I used to do some work in financial services and some of the systems were designed not to run risks in case of misconfiguration.

Software engineers generally aren’t trained in anything, to be completely honest :/

Most of them are hired based on their ability to solve simple stand-alone programming puzzles. So you can claim they are trained for that?

I don't think this is a good idea because the issue is the business practice of mindlessly collecting data and not engineering.

Will I be fined if I decide to make my own software without a license?

I'm sure nothing like that could ever happen. /s

https://www.vice.com/en_us/article/yw798m/oregon-unconstitut...

Yeah, just what the software industry needs.

Every time this comes up, people (some of whom are in this thread) end up talking about how this can't/shouldn't happen for software. After all, what, is every high-schooler or green college grad that ever wants to code their own app for a startup going to have to be professional certification?

I guess I'd argue that those people shouldn't be legally allowed near this kind of thing without that kind of a certification. Looking into all of the other engineering disciplines, that's exactly the kind of thing you see. I have a BSME, but I haven't taken the Fundamentals of Engineering exam to get my FE cert, in part because getting a PE certification requires working underneath a licensed PE for a certain number of years, which isn't the case for my current job.

I also know that by not doing so, there are certain projects that I simply can't work on. I have to imagine that there's a way to create a legally enforceable framework that falls into the same category for software engineers. Want to build a company that creates a digitally-synced notepad? Have at. Want to touch personally-identifiable medical data? Better have a licensed engineer working on that project to sign off, else your company is wide-open to liability claims with teeth. If something unreasonable gets by the signed-off engineer, they're on the hook too.

Obviously, it's a complicated problem, and reducing things to a first-order solution rarely is a catch-all, but there has to be some more professional/personal responsibility taken by the individuals building these systems, and a requirement of licensure is a way of empowering engineers in those positions to the point where it actually matters.

We could run a 2 tier system. Anyone can build apps but to build apps handling sensitive PII you need to be registered. Execs need to be liable for this to work.

> After all, what, is every high-schooler or green college grad that ever wants to code their own app for a startup going to have to be professional certification?

You answer your own question fairly well, but I'd add the observation that in licensed engineering domains, we don't always require licensed engineers. We have a licensing regime for structural engineers, but we don't require them for minor structures like gazebos or doghouses.

We could have licensed Software Engineers, but only require licensed oversight for software dealing with human lives (avionics, medical devices), PII, elections, and a few other critical cases.

I think this is a bad idea.

I developed software for medical devices and you have to do a risk analysis, formalize the software development process, declare qualifications of people, make it revision proof, have a formal testing process, ... everything is already accounted for.

Notified bodies ensure compliance. They have the problem that they cannot really evaluate the work of software engineers of course. Not even another software engineer could do that within feasible time limits. No software engineer can make sure there aren't exploits that could endanger user data. You can at most test if due diligence was ensured.

The manufacturer is responsible for ensuring safe operations of devices and yes, that includes keeping personal data safe.

But again, the problem wasn't the engineer at all, the problem is the wish for amassing data like this. Paper license or not, it rarely ensures competency and wouldn't have solved this problem.

Aside from legislative issues that ensures that user data belongs to the user the data is about, ensuring that companies don't sell and share medical data with "friends and family", ... this is probably the last step, if it is even required at all, which I would dispute. There are no guarantees if you amass data like it was done here.

Make it prohibitively expensive to leak data (compliance fines, lawsuits) and the problem will solve itself. Companies that collect data will then be begging for certification and regulation.

It would be even better if people learned to refuse to give data irrelevant to the service that they are seeking and/or if there was some sort of regulation about this (I should not have to give my name and address when returning a product for example).

Guess I should go to jail for daring to make a script for me and my friends that uploads screenshots to my server without having a professional certification, huh? Same for releasing open source software.

I would agree.

I've worked in critical infrastructure work and retain an interest in the field. A professional software engineering license should be legally required for certain classes of risk.

Ultimately the answer to an irresponsible feature ask should be:

> I will not approve implementing this feature, because in my professional training and experience, the risk exceeds the acceptable tolerances for a (spaceflight, medical, power systems) delivery. If I implement this and a failure occurs, I will be in court and my career over: I refuse.

Yeah, sounds good, until you have to pay for it.

You are willing to pay the costs of "professionalizing" software development and installing expensive gatekeepers, certifications, signoffs, and processes at every step, right?

Yes, I am.

Most of that is already in play already after about 30 people are in a group, we as an industry haven't formalized it, and there's no legal teeth around it.

Yep. And how is this not a standard errors and omissions insurance policy that tech agencies like mine should (are required) be carrying?

We spend about 15k per year for about 10mm in coverage (we are a small shop). This sort of oversight is not just an engineering one but it’s fundamental to the core ops of the business. If we are rushing under client pressure (or just running late) to the extent we take on risk to trigger liability, it’s full stop.

https://cense.ai/about Guy number two here had the background to know better. Just didn’t make it a priority. It’s unfortunate. The only way things change is when we start seeing data warehousing/collection as a liability (not an asset) and manage it accordingly. And making the penalty for error unforgivable.

Working as a contractor in the UK, most contracts stipulate you have Professional Indemnity insurance, which is for exactly this. I doubt anyone has actually made a claim for it though, the amount of other people I've worked with (who are also contractors earning £500+/day) who I wouldn't trust to even watch my laptop is atrocious.

AFAIK, this only really covers gross negligence or outright sabotage. I don't recon anyone trying to pin bad business decisions on their devs are likely to succeed in court.

When I have done independent IT ops and software work I have carried professional liability insurance, and I would recommend that everyone does.

The irony is, of course, that PL/E&O insurance for software work runs pretty cheap, presumably because liability on the part of developers of software is quite rare!

In Australia we're all insured. The only developers who aren't are employees for the companies they're writing code for. The worst thing that can happen to them is they'd be fired. The company still owns the blame.

In this case, according to their about page, it looks like the execs are the beleaguered, underqualified devs.

It is about the culture, doesn't matter who sits at the seat.

Someone has to drive that culture though, and that's classically the execs job, right?

Reply on news.ycombinator.com