Hacker News Reader

Comment by tcmart14 | Hacker News Reader

Unfortunately, most of us are the reasons why this is the problem. A lot of us on HN are developers and software engineers who pioneered the technology for a paycheck or are using this technology for a paycheck. The only way it stops is if engineers start refusing and the software community as a whole sticks to a code of ethics that prevents this.

Some of us in this thread that are decrying survelliance of all types are going to go back to work on the next work day at Google, Facebook, Amazon or some other company. When the boss man comes in and says "can you implement this feature" and it is about getting user analytics, you will say "yes sir/ma'am" and do it with a smile.

View on HN

> The only way it stops is if engineers start refusing

I find it sad that this is seen as a reasonable statement: totally idealistic, hideously unrealistic, and it is awfully close to virtue signalling.

You might as well say that the prisoners dilemma is solved by asking everybody to not cheat.

Any solution has to be robust to the variety of engineers that exist: including the antisocial, the people doing it for the lulz or $, those that don’t give a shit about anyone but themselves, and the plain clueless that are simply unaware of the outcomes/implications of their work.

Clearly expecting engineers to just solve the problem hasn’t happened, so it won’t happen. Currently the only solutions I can see are based on legal restrictions upon our government organisations to protect ourselves from our own authorities.

Doctors usually take an oath to do no harm when they become doctors. Is a similar thing for engineers so hard to imagine?

First software engineering would need to be codified and licensed as an actual engineering profession.

Yet the 20th century showed us a big list of examples of doctors breaking their oath, by conducting human experiments and so on… A few examples on different scales: [1][2][3][4]

[1]: https://en.wikipedia.org/wiki/Tuskegee_Syphilis_Study

[2]: https://en.wikipedia.org/wiki/Guatemala_syphilis_experiments

[3]: https://en.wikipedia.org/wiki/Unit_731

[4]: https://www.businessinsider.com/the-military-tested-bacteria...

Of course some doctors are going to break their oath and do horrible unethical things, particularly in extreme situations such as wartime and under totalitarian regimes. But that's a dumb argument, you might as well say, well, people are always going to steal so let's not have any laws on stealing. The vast majority of doctors in a functioning society will uphold their oath first because they believe in it and second because their career depends on following it.

Look at how many doctors stood up to say that the lab leak theory shouldn't be censored.

Look how many doctors are publicly stating that mandatory vaccination and vaccine passports are a violation of human rights and medical ethics.

Not too many. And certainly not the majority.

They're out there - but they are pariahed, smeared, and even getting death threats.

The problem with most of the statement is that it is subjective. It is not a black and white issue of ethics of mandatory vaccines. Arguments with merits exist on both sides the argument. And mandatory vaccination with the exclusion of religious and sound medical reasons (can't because of chemo therapy), have existed outside of COVID and has ruled in courts to be valid. However this is not a discussion on the ethics of medicine.

>this is not a discussion on the ethics of medicine.

It's a discussion of ethics. So...

I maintain that the fact doctors are so silent on important issues - however subjective they may be to you - shows that trusting in a code of ethics rather than _actual impartial oversight and accountability_ is daft.

And that applies equally as much to engineers and tech.

An Oath and law are completely different things (you won't go to jail for breaking your oath and you can very much go to jail even if you did not break it). In fact laws and oath are the two opposing sides in this very thread! Robocat is advocating for laws, and bobsmooth responds arguing in favor of oath.

Issue is that there will be always those that will accept if someone refuse, for higher amount of money or bit of "nudge" (pressure). Let's not forget that even now we have black, gray and white hackers...

Doctors are a completely invalid comparison. Is your healthcare system hurting people? Yes, of course it is.

With a doctor, the patient and their family is highly motivated to ensure the doctor is doing their best to avoid harm in a high stakes and high cost transaction.

When you get doctors more removed from patients (say large commercial medical organisations or vaccines or medicines), then “doctors” can often make the same selfish decisions against the diffuse interests of those they affect.

And the implication that engineers are the only vital part in an organisation that has the agency of choice is amazing. Equivalent statements could be:

  * The only way it stops is if managers start refusing

  * The only way it stops is if shareholders start refusing

Those statements are clearly ludicrous, yet somehow it makes sense that engineers are responsible for choice?

I do believe us engineers need to try and act responsibly, and I do think using social pressure against unethical engineers is valid. But some anarchistic belief in self-policing is totally unrealistic. Likewise ethical guidelines do not seem to really help much in other professions like accountancy, legal or journalism. Our legal, regulatory, and political systems are there to help mitigate these types of issue.

In my country, software developers can't call themselves engineers unless they have an engineering degree.

>But some anarchistic belief in self-policing is totally unrealistic.

Engineers in my country are held to ethical standards with legal backing.

https://www.peo.on.ca/public-protection/complaints-and-illeg...

How is that even relevant? You are just changing the subject.

I'm sure truely authoritarian societies have professional engineering societies with ethics and rules about who can call themselves what.

How does your point relate to protection against state surveillance?

>But some anarchistic belief in self-policing is totally unrealistic.

I'm telling you that Canada has this. There are 12 professional engineering organizations in Canada, all are self-governing, all have legal backing to enforce sanctions against engineers that act unethically.

>truely authoritarian societies

Canada has its issues but I wouldn't call it authoritarian.

The point wasnt to only assign fault at engineers but to show that the problem is more broad then its the "governments fault" or "corporations fault." That we assign agency to these vast things but dont acknowledge individuals.

This is not the first instance of suggesting something like this. Look at the history of the ASCE and the AME which held very different views of engineering. ASCE more sticking to principle and the AME sticking more to business loyalty. Ultimately, there has been some happy medium reached. This has not existed and software and should. But the idealistic nature of the ASCE impacted most of the engineering fields even though it did not get it's way 100%. So you can call it idealistic and unreasonable, but a similar approach has worked to some degree.

In general all types of dilemma situations are solved to a substantial degree by allowing people to communicate with each other and then individuals arriving at appropriate actions.

I am not advocating against regulations or the like but saying that individuals are of the hook because „I don’t matter anyway“ is a recipe for ongoing disaster.

We need all types of push back against injustice, unfairness, and plain stupidity. Making excuses doesn’t help anyone.

Golden handcuffs are enough to rationalize anything eh

Computer science needs more funding for research at "Layer 8" of the OSI Networking model. There are some baby steps taking place due to cybersecurity failures, where software supply chains are being forced to self-document (Software Bill of Materials) via US Executive Order. This will have far-reaching implications for everyone working in the tech industry.

Some of these tools can be adapted to create formal models of concerns that are today relegated to "ethics" and "law", which have near-zero chance of keeping pace with software evolution. Social Network Analysis has several decades of work on graph theory applied to social systems, including knowledge work, law enforcement and intelligence, most famously applied by Palantir. There are reusable OSS libraries for SNA.

We need to get to the point where a CI/CD test or simulator failure can flag the introduction of code/policy that places positive social futures at existential risk. Then the proposed changes can be escalated for human governance review. In the meantime, we rely on policy frameworks, threat models and watchdogs from places like EFF, https://twitter.com/evacide

The Geneva conventions on war need to include a section of data security. It must be illegal to take over another governments data during war.

All government databases should have a self destruct knob in case the government falls.

A self destruct knob? Lmao you realize that there is no single spot where all this data is stored right?

Yes, but there can be a single spot where the self destruct sequence is keyed up.

Though obviously there would be no guarantee the command could be related to remote stations.

Unfortunately "refusing" is usually a luxury for the already-rich, and who aren't under an immigrant visa.

Easy to say, hard for many people to do.

Lets say your a civil engineer working on a bridge. If your employer asked you to remove a support beam to save costs but you knew it had serious impacts on the safety would you do it? Knowing that your stamp would be on it and if an issue happened, you could be held responsible? Why is it in other fields of engineering there are actions that are not acceptable, but in software it is virtually non-existent.

Software engineers want the title of "engineer" but none of the responsibilities. Where's the rubber stamp equivalent for software?

Exactly. And developers are essentially engineers from a problem solving point. I think this is why Grace Hopper pushed so hard to help coin the term "software engineer" with the idea of trying to capture some of the ideas of what engineering should be and incorporate it into the world of software. The fact is there is no rubber stamp. This is why I think we have some of the instances of security breeches where we do.

There's a certain amount of inflation that has happened to job titles.

Previously, my last 4-5 job titles have included the word "manager", yet I have never performed any managerial tasks. My current title includes the word "engineer", yet there is no engineering in my job description.

I fix bugs, implement workflows and rules, and onboard customers on a platform. I don't consider that engineering, that's operations.

Regardless of the title. There can still be a code of ethics in a trade.

Because software engineering is easy to get into, but hard/impossible to master. You cannot limit it via the requirement of a license. Your country would put itself at a disadvantage in the software space and the projects would move elsewhere. Putting your country at such a disadvantage is a big deal considering that software is likely going to be the most important field in the future due to automation (ie it'll be a part of almost every other field that produces stuff).

while that's somewhat true, it doesn't solve the problem. Asking for people to sacrifice themselves for others with no reward is not sustainable.

If a gov't wants software written, there will be somebody willing to write it.

Only checks and balances, and high transparency within the gov't can work in the long term.

Yes. But we do have measures. Why not start our own firms with these ethics and refuse to work for entities that do. And dog food our own responsible privacy respecting code. Maybe it means we need to stop chasing the higher and higher paychecks, but none of these entities can survive if we choose to not apply to work for them and do something else. The point is, there is a point where engineers are at fault just as much as companies and governments. Continuing to build these things and say "well the bad man in the business suit told me too" has to stop if we really want to tackle this problem. Legislation won't help, we can't compete with corporate donors.

It's very hard for people to not take a higher paycheck. That higher paycheck may be the difference between paying off debts and not paying off debts. It may be the difference between sending your child to a good school or a bad school. It may be the difference between not being screwed over or being screwed over during your next hospital visit. It may be the difference between a family member dying or being treated.

Yes but what is the other alternative? People say legislation. But we all know we can't out compete the businessmen/businesswoman and stock holders. The only tangible alternative is to just not do the work. Unless someone has a plan to crowd source the lobbying money to make the legislation, I see no other path.

> just not do the work.

And how exactly is this person supposed to pay their rent and food costs?

"Don't do the work" isn't a viable solution for a lot of people. Pressure has to be put on the decision makers AND law, not the poor dude who is just trying to feed their family.

If you have enough rent saved up for a year, you might have the luxury of being able to say no.

It's not just that it's hard to refuse a bigger paycheck, but that everyone needs to refuse it. If 95% of people who could implement something refuse to do so on moral grounds - that won't be an impediment to the thing getting done.

When I grumble about collecting needless data, conditioning users to insecure practices or similar ethical concerns, my manager usually drops it. There - I think I've made some difference.

If you have an source of developers, where you can discard 95% without effect, could you please find me a haskell developer, sysadmin and a ee engineer woking in kicad? Salary - good in Eastern Europe. I'd prefer those that do have morals and standards. Thank you very much.

95% of developers refusing to build, won't stop PRISM or FAANG by not building. What it can do (along some explanations and reasoning), is to unrecognizably change the landscape, change availability and perception of privacy and security, and in a roundabout way, maybe even stop or at least reduce PRISM, FAANG, et al. data collation.

Currently, about 5% of websites respect their user's data? What if it was 95%?

Exactly. You do not need 100% or 95%. You just need enough to start changing the culture and landscape. Some of those people with industry experience but with values steeped in privacy and security will go on to educate (literally in academia) and mentor junior developers/engineers. It can be about trying to get enough support to change the landscape to create a feedback loop of a culture of developers/engineers taking into mind how their actions in a source file impact the end user's privacy and security.

So if 1 person throws out a styrofoam cup, we all should just say screw it and do it too?

Just because some people may not have any guiding principles doesn’t mean everyone should abandon principles.

That is another way to look at it.

Bad analogy. Disposing of a cup properly doesn't threaten your life.

Quitting work without alternatives would put many people in grave danger, including not being able to receive hospital care, or not having a place to live.

Yeah, it's long too late. Even if all US SWE's manage to deny the bullshit (which will absolutely never happen) companies can just pull in any variety of third worlders who will leave their entire lives behind overnight for 1/5th of the pay current US SWE's are making.

Pandora's box has been opened, and we're going to be in for some interesting times.

"When the boss man comes in and says "can you implement this feature" and it is about getting user analystics, you will say "yes sir/ma'am" and do it with a smile."

However, this not the behaviour of someone who is seeking to be promoted. There are those who of "us" who have taken or are taking the initiative to go beyond what the boss asks them to do in hopes of being promoted. To be persuasive as evidence for promotion, this "extra work" must support the bottom line of the company the same as "the boss's orders". Hence "us" includes more than only the employees who "show up to collect a paycheck" and dutifully follow instructions, but are otherwise opposed supporting to the bottom line of the company.

Going further, is it safe to say some of "us" have already been promoted for supporting the company's bottom line and some of "us" are in fact managers. "We" are effectively the "boss man".

This line is intriguing: "The only way it stops is if engineers ..."

This seems to imply a underlying belief that "no one/nothing can stop us". As such, only "self-regulation" will work. Am I reading this wrong.

I think you bring up some good concepts here with working above and beyond for promotion. That sometimes we do voluntary build these tools in hope of some reward even if it is not specifically asked for. And maybe not even directly as a job but for a resume project. I think quiet a few here would probably agree twitter to some degree has had a negative impact on society or conversation. Yet, many of us build something to scrape data and utilize for something, put it on github not thinking how that tool could be misused.

Also bringing into scope of "us" being moved into management. While I do meant boss man to be interpreted more liberally. "Boss man" can be a direct manager/supervisor (who may be an MBA or a prior engineer him/herself), it can be the CEO or shareholders. But yes, in some case those of us become the "boss man" and ask for these features or do not get in the way when someone higher asks for them.

To answer the last line, it surely is not the "only thing" that can stop us. Regulation can work also as has been brought up. But I fail to see where years of screaming for regulation has materialized in anything meaningful, at least in the US. The quickest way would be self-regulation. Adhering to a code of ethics or principles voluntarily.

For sure not. When I worked at a multinational very big company in Europe, and my manager requested to add this little feature to track all users, of course I refused citing the law and regulations. Certainly no smile of complicity. What he got was a top 10 list of best performers, but not the list of the worst performers.

Can you clarify this for me? I feel like I could walk away with two different interpretations?

"What he got was a top 10 list of best performers, but not the list of the worst performers."

I interpret this to mean either you were on the list of 10 best performers or that he received a list of performs to perhaps replace you with.

Also, my case might be more true in America where there does not appear to be many laws regarding privacy. As far as I know, the EU is leading the way in this.

Exactly this. It's high time we recognise that we, the programmers, are indeed the baddies.

Not necessarily baddies but that we play a major part in this too. I fail to see Trump or Biden sitting behind a compiler writing the code. I do see Mark Zuckerberg, a programmer, running a company he founded doing mass data collection.

Zuckerberg a programmer? I think that's quite a reach, to call him a programmer.

Zuckerberg did write a lot of the initial code. Does make him a programmer among many other things.

Engineers should build software to create a future more transparent government instead.

Hahaha, so profoundly true - especially the last paragraph!

Reply on news.ycombinator.com