Hacker News Reader

Comment by neilv | Hacker News Reader

IMHO, the most concerning sign about software engineering practice isn't exactly "bloat", but the inability of the industry to do anything securely.

Consider every software security update to be a bridge falling down, due to incompetence.

In this case, the fault isn't so much individual incompetence, as collective incompetence of the field. The ecosystem is toxic, as are conventional practices, as are market incentives. Individuals might be incompetent on top of that, but the situation is nigh impossible for competent ones as well.

And there are no professional engineer licenses to pull, nor few individuals to send to jail.

View on HN

Computer security was broken during the Viet Nam conflict, as there were systems that had to accommodate multiple classification levels at the same time, and they couldn't do it with the OSs of the day. Multilevel security was developed after that, which leads to Capability Based Security.

Essentially, your current OS requires you to have absolute faith in any software that runs on your behalf. If it goes rogue, or gets confused, almost anything you could do to sabotage yourself... it can do in milliseconds.

On the other hand, if the OS didn't have that requirement, and instead let you choose what files to open, and enforced your decisions, you wouldn't have to trust your software at all.

From the point of a GUI user, they wouldn't see any difference in behavior. File Open still works like always, but the logic behind the scenes is slightly different.

Command line usage, that's a tougher nut to crack. There needs to be a standard way of defining what files you're passing on the command line.

We could stop blaming everything but the OS... but we likely won't. 8(

This is pure hyperbole. You may as well compare my broken fridge to a bridge falling down. Engineers designed that too but no one is going to jail over it.

Why is it "pure hyperbole"? Are you saying that all software is like your fridge, and that there is never a need for software that is like a bridge?

The concern is that the field of software can't seem to build a bridge when it needs to.

>The concern is that the field of software can't seem to build a bridge when it needs to.

Based on what? Software operates life critical systems 24/7 and nobody blogs about it because it’s not filled with hype technology.

I've become a strong believer that software engineers to form a guild/professional society such that we can hold ourselves accountable.

So, introduce risk to becoming a software developer? What's the upside for the developer?

A spine to push back on bad practices

Bingo. People do not understand that lawyers/doctors can tell their boss to go pound sand by saying ‘that would lose me my license and so no one will ever agree to do it’

Pointless jumping through circles.

At that point I would definitely get a JD instead.

It wouldn't impact developers who aren't working on important systems (safety, security, privacy contexts). HIPAA compliant software? Maybe they (org and, possibly, a "professional software engineer" in charge of signing off on things) should be held accountable when there's a data breach. Video game maker? Yeah, you wouldn't need a PSE. It also, if done like PE licensing, wouldn't impact the day-to-day developer. Only the ones who choose the responsibility (and usually better compensation for the responsibility).

There is risk in being a doctor, lawyer, pyschologist...

the thing is, a lot of people trust what we do and our negative impacts scale up much worse. A friend shared https://www.youtube.com/watch?v=gkJ4qv5RLRc with me today, and it made me enraged. Too many incompetent technologies are deployed.

> There is risk in being a doctor, lawyer, pyschologist...

True, but in those professions, the risk to the individual is typically offset by somehow enforcing labor-scarcity to drive up income for those in good-standing.

I think the incentives to business have to be there.

It should be more about pride of engineers shipping products that people can trust.

“Join our guild so we can punish you”

"Join our guild, make 10x, but there is a responsibility"

The point of professional livensure is gaining the leverage to hold yourself hostage.

Boss tells unlicensed employee to do something evil: employee weighs "do the right thing, and need to find a new job" vs "do the evil thing".

Boss tells a licensed employee to do something evil: employee weighs "do the right thing, and (maybe) need to find a new job" vs "do the evil thing, and maybe lose the ability to work in my field".

That's leverage to bring to your boss. "I cannot approve this, because it's evil, and approving this would get any professional stripped of their license". That puts your boss in a hot seat because now the scales are being tipped for him, worried that even if he fired you, he wouldn't be able to find anybody who would rubber stamp the evil thing.

No, the real point of guilds or licensure is to constrain the supply of those that work in the profession, generally to inflate salaries.

Licenses sound good in theory but often that just means you get more "inside the box" thinking (the kind of thinking that helps on the license/guild exams), and innovation will suffer. Would we be better off if the programming industry simply used, say C, for everything since the 70s? Some things might be better, but we'd have far less and less varied of it, I'd wager.

EDIT: I assumed guilds/licenses here are mandated (which is what a guild that issues licenses often wants to do). If licenses can be ignored, it's less of an issue.

"Join our guild because we know you're top-tier and we can collectively keep the hacks from calling themselves your equal"

A software guild wouldn't make software better, only much, much more expensive. Existing terrible practices would become enshrined in what is effectively law, and simply wrapped in additional bureaucracy that serves only to muddle and diffuse responsibility, rather than improve anything for the general public.

No, guilds makes it worse, not better.

As the article itself says, the doomsaying should be taken with a grain of salt. There are problems, and the best thing to do is improve your code, and encourage your team to focus on performance, security, etc. Lead by example. Adding bureaucracy never fixed anything, and wastes so much time money and opportunity in the process.

Yours is the logic that undermined support for unions for decades.

It's gonna take more than a Jesus-type to advocate for corporate responsibility.

While you're fucking around with security fixes, you're not generating revenue. Security incidents are an assumed risk.

> but the inability of the industry to do anything securely

And reliably. I’ve been banging this drum for a while, the castle is built on quicksand.

As general purpose software makes its way into cars, and ever more critical system start running JavaScript on non-realtime Linux with buggy drivers.

we will eventually have some kind of software caused catastrophe and then regulation will come down on us like a metric ton of bricks.

> In this case, the fault isn't so much individual incompetence, as collective incompetence of the field. The ecosystem is toxic, as are conventional practices, as are market incentives. Individuals might be incompetent on top of that, but the situation is nigh impossible for competent ones as well.

Eh, I disagree. Software engineering allows for failure where the cost of failure is low. So your mail app stops working and you have to restart it, who cares, so long as you get some neat new features faster that on the whole make your life better?

In parts of the industry where failure is costly, like medical or aviation, we operate differently.

Speed and correctness are antithetical generally, and different parts of the industry accept different trade-offs based on their risk tolerance.

The goal isn't to build something that operates perfectly at all costs, the goal is to develop systems that operate as well as they need to given external constraints.

[edit] The truth is we wouldn't have 1/10th of the cool shit we have today if we demanded absolute perfection from things that just didn't need it because we're a "profession."

Reply on news.ycombinator.com