Critical software engineering is a race to the bottom across many domains. Healthcare, banking, flight systems, etc.
Edit: I'd add this goes double when working on safety-critical code, or anything touching protected health data, or payment/financial data. It's just too toxic and valuable to leave to a chance change.
I agree, although in reality it's not chiefly developers themselves who are responsible for quick, lazy approaches, is it? Developers are typically the parties most pained by technical debt. If the discipline of software development is to become software engineering in earnest, there will have to be some pressure all the way up the management chain— pressure strong enough to outweigh software's low cost of iteration. I imagine this is really rare outside of highly regulated industries and very specific applications, and even with a formalized software engineering discipline, many companies will prefer sloppy software development and many competitive markets will 'select for' such companies.
I'd agree with you, except... ooh, a new, shiny, untested language / framework / platform to rewrite the codebase in!
I think the temptation to rewrite also reflects how messy and unworkable we let codebasee get— sometimes that impulse is more about the pain of working with the existing codebase than anything else.
Occasionally, usually because initial requirements were sorely lacking or changed, you can simplify the system via rewrite.
More often, everyone ends up realizing they didn't actually understand that last 5% of edge cases.
And then you've either replaced the working system with a 95% complete solution (so common in modern software) or you produce a system equally ugly once you handle that last 5%.
Lol HN.
Outside of civil/structural disciplines, PE is not required for engineering.
Mechanical, Chemical, Electrical, Nuclear don't require it.
I've literally never met an Aerospace engineer with a PE, and they build planes 'n sht.
---
It's a pure resume padder, like Cisco or AWS certifications.
You're just proving my point in that it's a CTO that dismisses the argument in a rather childish way. They would be the one to be told 'no' by the now-professional software engineers when their license and livelihood is on the line while being pressured to do something that goes against their recommendation. Funny how that power dynamic changes when there's something real on the line and not just an inflated title, huh?
Perhaps if those aerospace and software engineers that attempted to blow the whistle at Boeing were successful and were empowered via their license to say enough and stop development on MCAS, there wouldn’t be 300+ dead people because of a software change rammed through by management. The licensure ain’t just window dressing. It has real, actual impact on real human lives. Don’t be so dismissive.
A certificate would not change the status quo at this point.
Software developers/engineers are - for the most part - seen as essentially blue collar workers. Replaceable gears that MBAs can just "scale up" or "down" to fit their currently desired velocity. Let's ignore the fact that this fundamentally isn't true, but it's what they believe.
The work they do is decided by MBAs, and the time they have to implement these changes is heavily influenced by other MBAs.
Adding a certificate to this mix will change literally nothing
> I bristle at my title containing "engineer" as I don't have a PE
because it is aggressively ignorant of facts.
I have no comment on the potential utility of a PE requirement, software or otherwise.
If there's anything that the software industry needs most is a code of ethics. Companies are built on software that exploits, tricks and deceives their users. They release borderline malware and get rich doing it, either by having complicit investors or fooling them with false valuations. They cover their asses with dishonest PR, and lobby governments to keep the party going. This happens in the largest tech giants and tiny startups alike. And don't get me started on the gaming industry and their predatory practices.
We often exculpate engineers as being cogs in the machine, but they're ultimately choosing to work in these places, and enable this behavior.
The world would be a much better place if software engineers were required to take and uphold the equivalent of the Hippocratic Oath. We don't expect less from health professionals. Why should we from IT ones when the world is run by software?
Maybe there's improvement to be had, but this is not a difference between disciplines.
If one exists, I would like to see your argument that SWEs are adhering to it, and that the software industry is behaving ethically.
Some programmers (evident in the replies) even think it should exist for their profession, a very worrying idea.
And then a lot of "real" engineering now require software anyway: self-driving cars (written in part by people who are hacking together webapps by pulling in thousands of NPM dependencies) comes to mind.
The future is honestly a bit scary looking.
On the bright side things are going to get "interesting". At some point in the past we had many "Uber but for ...". Soon we'll have "Clownstrike but for fridges", "Clownstrike but for cars", etc.
Should be fun.
That absolutely can work, and does for plenty of industries, but it also creates the potential for a false sense of security until planes start falling out of the sky.
My frustration, and disappointment, in the software industry has generally been the complete unwillingness at scale for us to take on the responsibility to ensure safety and reliability without regulations enforcing it. Plenty of this responsibility (blame?) falls on companies led by individuals who are solely focused on profit and self-interest, but we have to own some of the responsibility as we're the ones agreeing to write and ship bad code.
I prefer the idealistic view that each individual can make a change through choice, but the reality is that choice is a privilege that isn't evenly distributed across the population. For example some can afford to not shop at Walmart, others can not - paradoxical as it may be from a local economics perspective.
Regulation is the typical blunt instrument to move the incentives to the business leaders rather than the individual. Other commenters don't think regulation is the answer, but I think most agree doing nothing won't change the status quo soon enough.
While I personally agree with the sentiment of your comment in general, this piece really is part of the blind spot in my opinion.
The assumption here is that everyone has to get all of their for from a grocery store, and the only question is what quality of products you can afford. It doesn't have to be that way, and wasn't until very recently in human history.
We almost always have alternatives. They just often seem so extreme as to not be feasible. People can grow their own food though. And at least in the US, we could go without a huge portion of the crap we spend money on every year. We just choose not to. There's absolutely nothing wrong with that choice, but its important to realize it is a choice.
A good example of this is an urban single parent of multiple kids, time and space are likely very scarce and choices are limited.
Understanding why this happens would be an interesting research project. Part of it might be information asymmetry with customers (shiny new features are very visible at sale time and reliability is totally unknown, so customers tend to weight known features over unknown reliability), and part might be principle agent issues (the decision maker who bought the software will have collected their bonus and retired long before the data breach can be attributed to them), and part might be that the market simply hasn't caught up to the negative consequences of all this change and careless companies will be purged by the market in the future.
I'm not terribly fond of regulation as a solution either. It tends to overconstrain industries, prevent innovation, and leave a hole at the lower end of the market that eventually makes products unaffordable. But there should be some quality mechanism that incentivizes decision makers to do the right thing and invest in quality even when there's a cost in features.
Cute fantasy about pinning everything on management but people do remember the old adage that "shit rolls downhill" don't they? What that will result in is very onerous processes and certifications mandated by "those in charge" on the people at the bottom to generate ironclad proof of no wrongdoing, at least for themselves. Maybe that is ultimately what this industry needs but it is also going to result in a work environment which really sucks a lot.
When management actively makes decisions to prioritize profit over security, for example, they should be held personally liable when a security issue occurs. I'm not really sure what a reasonable argument for that not being the case would look like.
If such a setup did result in a shitty work environment, people would ultimately have the option to not work at certain companies or to work for themselves. We can't assume that people must work for big tech and limit ourselves to what works in that sandbox.
Leaders of an electric company shouldn't be held liable for a lightning strike that starts a fire, for example. But they should be held liable if they purposely decide not to spend the money it takes to maintain power lines and a tree branch that should have been trimmed falls and starts a fire.
There would be consequences of such a system that change what we have today, but I wouldn't expect that to mean we couldn't possibly have things like electric companies.
Management is just making decisions based on what the companies value and companies are just valuing what their shareholders value which is more money for the shareholders.
The best way to fix it would be to reform the stock market system so that companies aren't beholden to uninvolved third parties looking to make a quick buck. Only active employees should own stock in companies and sit on company boards.
This would also require reforming the retirement system so retirement money isn't just dumped into the stock market. It needs to instead go somewhere safe and just sit. Retirement funds being in the stock market creates a huge inflationary feedback loop by demanding constant increases in profits which cause companies to raise prices which causes retirement funds to need to be bigger which causes them to demand more profit increases.
Take CrowdStrike for example. If the company and its leadership wasn't so well shielded from financial and legal liability they likely wouldn't have had a process that allowed rolling out an untested update to the entire world at once. Instead, they have a CEO that did effectively the same thing at McAfee before allowing it at CrowdStrike and the company will likely get little more than a financial slap of the wrist.
Would it solve everything? Absolutely not, and other actions like changes to the stock market could help. But it surely would make a difference if leadership and companies knew they could actually be ruined if they are provably negligent or culpable in damages caused.
This is used as a configuration and data exchange format despite having no formal definition, resulting in different results based on the parser used, and a weak typing system that has caused many bugs in many applications that use it. This despite the fact that many better, more reliable configuration and data interchange systems existed even before YAML got popular.
The Crowdstrike incident is worth billions and people may have died. If you look to the engineer you won't be able to recover billions. Hospitals must absolutely be on the hook as they are the direct interface to their customers; hospitals in turn can sue Crowdstrike.
An event worth billions must have billions in liability in order to prevent perverse incentives. Otherwise hospitals will just say "well McKinsey said it was a good bet, so what gives?"
For those who weren't around, Sophos antivirus was the leading "enterprise-strength" security software around. When I started at Google in 2009, all corp-issued Windows laptops had it. Sometime in 2011, we got an internal email to immediately install a critical system update and reboot our machines. When they rebooted, they didn't have Sophos anymore. Then came another e-mail that said that Windows laptops would only be renewed for critical business exceptions, and everybody else was supposed to switch over to Mac or Linux laptops instead. Note that the first Chromebooks started shipping 3 months later.
A couple days later the full report came out, and a partial version was released to the public. The tl;dr was that Tavis Ormandy (then Google's lead security researcher) had done some cursory pentesting on Sophos, and found that it had so many security holes that it was architecturally impossible to make secure. Rather than attempt to bandage the problem, the company decided it was better to give up on Windows entirely.
[1] https://www.forbes.com/sites/andygreenberg/2011/08/04/google...
That's how _bad_ things are.
I bought Cloudflare stock after this because it's obvious to me their customers aren't really thinking.