Hacker News Reader

Comment by lores | Hacker News Reader

And on top of all-certified components, it also requires the chief engineer to have veto power over the system. If business or client asks for features that are potentially insecure (and that's going to be a lot of features), they have to accept being told 'no'. I'm not seeing that happen easily in the software industry.

View on HN

This is chicken-and-egg though, surely. If engineers are not personally liable for the garbage they produce, the business can replace the engineer with someone more amenable to their requirements (either because the engineer lacks experience to understand why its bad, or because the engineer has fewer scruples, or anywhere in between) with relative ease.

If all engineers are held personally liable for their code, when a business has faced a documented rejection, they’ll struggle to hire someone else to take on that risk.

You're right, and it would radically change the industry. No more wild experiments, but a very measured and ponderous rate of change. It's not necessarily a bad thing, I'm at the age where I curse aloud when I see yet another framework doing nearly all the same things but in a different way, but it's certainly a big change.

You'd still be allowed "wild experiments" - just not where they could harm people.

"Harming people" includes money loss, though. Any hacking that results in identity theft would end up at the feet of the certifying engineer.

Good, then maybe it'll be a forcing function for companies to stop collecting personal data for their users just because they can, and we can go back to the days when the only metadata associated with an online account is its salted and hashed password.

You mean a hospital next door to an ammonium nitrate godown and 23andMe will be rejected by the same actuaries?

I'm not sure what you're arguing for then. Continue apace, where I get a letter every week about entire reams of my personal info leaked because some imbecile didn't set a password on their MongoDB instance?

the german supreme court just recently decided that the involuntary publication of personal data like your phone number through a break-in already constitutes damage that the companies who experienced the break-in are responsible for. there is no need for certified engineers, just make the companies pay for being negligent. putting this on certified engineers only shifts the blame, but in the wrong direction in my opinion, because these problems happen not because the engineers are not certified, but because the company tried to save money by cutting corners.

> they have to accept being told 'no'

They can always hire another engineer. They only accept it, some times, because they won't find a certified engineer that says "yes", and because they doing it themselves is a crime.

That equates to a huge amount of government intervention on the lives of everybody. And even then, fails way more often than expected.

Now, we are talking about a case where criminal justice failed to uphold the defendants rights to a fair trial. Most probably because of corruption. Do we really want to bring that huge amount of government intervention into this context?

Reply on news.ycombinator.com