Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How would we regulate software engineers?

tavisharmstrong.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: How would we regulate software engineers?

#51

Post by slg »

marichards wrote: post #42
slg wrote: post #30

Earlier quoted context omitted.

I think one of the main problems with ethics is the abstract nature of software and development. Let's say you create an encryption algorithm. That algorithm can be used by terrorists and pedophiles or it can be used by banks and civil disobedients. Or let's say you create an encryption breaking algorithm. That algorithm can be used by law enforcement and the judicial system or it can be used by identity thieves and…

This kind of argument applies to anything, even paper. Encryption is just a tool. A pipe can be used to hide and carry water, it can also be tampered with to poison someone or conceal explosives.

Which is why we don't force an ethical code on those producing pipes. We instead decided to regulate their finished product. However if someone on HN suggests regulating encryption, they aren't met with the most open arms.

Re: How would we regulate software engineers?

#52

Post by codygman »

tarmstrong wrote: post #29
catuscoti wrote: post #22

Free speech. First Amendment covers source code and similar expressions. Regulating free speech is virtually impossible. That is where the whole project stops.

There are regulations that affect the work of software engineers. PCI DSS is one that I am familiar with. Perhaps unfortunately, if your software interacts with the real world (like payments infrastructure), you have to heed regulation. This tends not to affect people who are casually writing software or working on many open source projects, but it does impact large companies like Google. (I like to think of this as…

> (I like to think of this as pretty similar to the Haskell IO monad. At some point you have to break out of your cozy side-effect free code and actually do something. At that point you have to deal with the messy real world.)

And Haskell is excellent for dealing with the aforementioned messy real world. Better than any of the previous languages (for 1000+ loc) I've worked with.

Re: How would we regulate software engineers?

#53

Post by michaelt »

nickpsecurity wrote: post #44
devoply wrote: post #28

Earlier quoted context omitted.

You can make software a predictive profession, by adding an order of magnitude of cost to every software development effort. 10x. It's not that it can't be done. It's the market is not suitable for that sort of development. It's a management problem, not a software engineer problem. There are a huge number of combinations of various statements that have to be iterated over meticulously. If you want to write tests for…

"You can make software a predictive profession, by adding an order of magnitude of cost to every software development effort. 10x. " This is a recurting myth. The field of high-assurance software delivers it on a regular basis in regulated markets. They built tools and reusable modules that drove costs down a lot. Still high cost vs throwing crap together. So, methods were invented far as the 80's to get most of thos…

  This is a recurting myth.
"Comprehensive formal verification of an OS microkernel" by Gerwin Klein et. al. (2014) [1] reports that it took 20 person-years to perform a comprehensive formal verification of the seL4 microkernel, which was designed, coded, documented and tested in 2.2 person years.

Did they mess it up and take 19 person-years longer than they needed to? I don't know much about this stuff but I thought Klein's work was pretty state-of-the-art? Are there better ways of doing this stuff?

[1] http://www.nicta.com.au/pub?doc=7371

Re: How would we regulate software engineers?

#54

Post by goalieca »

headcanon wrote: post #38

I think its difficult to find this kind of regulation for SE partially because its so new and not well understood compared to other engineering professions. What is software engineering? The kinds of things that would regulate, say, programming an operating system kernel is not the same thing as someone who makes wordpress templates. Yet both would describe themselves broadly as Software Engineers. What is the differ…

Wordpress template guy is doing a trade while kernel guy is engineering.

Re: How would we regulate software engineers?

#55

Post by [deleted] »

tarmstrong wrote: post #27
wildmusings wrote: post #17

The first thing needs to be a culture change: "move fast and break things" is not an acceptable philosophy when you're dealing with millions of people's private conversations.

OP here. I work at a company that is able to move quickly, and yes, sometimes breaks things in the process. Tradeoffs between speed and safety are fine to make, in my opinion. It does seem like it would be useful to regulate things like ethical conduct, though. Maybe this dictates what systems are ok to move quickly and break and which systems aren't. What do you think?

[deleted]

Re: How would we regulate software engineers?

#56

Post by tarmstrong »

goalieca wrote: post #54
headcanon wrote: post #38

I think its difficult to find this kind of regulation for SE partially because its so new and not well understood compared to other engineering professions. What is software engineering? The kinds of things that would regulate, say, programming an operating system kernel is not the same thing as someone who makes wordpress templates. Yet both would describe themselves broadly as Software Engineers. What is the differ…

Wordpress template guy is doing a trade while kernel guy is engineering.

Not all programmers (engineer or otherwise) are guys -- probably worth keeping that in mind if you want this to be a welcoming community for everyone (:

Re: How would we regulate software engineers?

#57

Post by nickpsecurity »

michaelt wrote: post #53
nickpsecurity wrote: post #44

Earlier quoted context omitted.

"You can make software a predictive profession, by adding an order of magnitude of cost to every software development effort. 10x. " This is a recurting myth. The field of high-assurance software delivers it on a regular basis in regulated markets. They built tools and reusable modules that drove costs down a lot. Still high cost vs throwing crap together. So, methods were invented far as the 80's to get most of thos…

This is a recurting myth. "Comprehensive formal verification of an OS microkernel" by Gerwin Klein et. al. (2014) [1] reports that it took 20 person-years to perform a comprehensive formal verification of the seL4 microkernel, which was designed, coded, documented and tested in 2.2 person years. Did they mess it up and take 19 person-years longer than they needed to? I don't know much about this stuff but I thought K…

I already told you what it took in numerous projects plus one company's regular work to deliver low-defect software. Vastly lower than that. That means something is missing in either your data ir mine. Thing is, the NICTA papers clearly tell us why:

1. They were mathdmatically proving equivalence of spec, security policy, C code, and assembly. Latter two were state of the art methods requiring more time and brains. Not necessary in most projects to achieve low defects or 0-days.

2. The methods were new. When that happens in formal developmemt, most of the work goes into building tooling and even figuring out how to apply the methods to the class of problem. The seL4 and L4.Verified reports said exactly that predicting that reuse of that tooling would drop cost dramatically. It did drop to a quarter later with COGENT. LOCK, Cleanroom, Praxis, etc reused existing tools and methods where possible to avoid huge costs.

3. Cleanroom, Eiffel, Ada, or even Haskell all cost similar to regular development in commercial use despite knocking out many issues more easily. That they achieve low defects and cost should already establish my claim (strong QA is affordable) as baseline.

Re: How would we regulate software engineers?

#58

Post by ForHackernews »

tarmstrong wrote: post #19
ForHackernews wrote: post #10

Software engineers are not professionals like doctors, lawyers, or chartered accountants. Real professionals have a degree of autonomy and their primary obligation is to the ethical standards of their profession, not to their employers.

> their primary obligation is to the ethical standards of their profession, not to their employers. OP here. The intended subtext of my post was that it would be nice if our industry had ethical standards as well. (:

That would be nice. It also seems unrealistic in the current climate. What you're suggesting is setting up some kind of Software Engineering Guild, which would require a fundamental shift away from the naive individualism we see today and toward a recognition of collective interests.

Re: How would we regulate software engineers?

#59

Post by goalieca »

tarmstrong wrote: post #56
goalieca wrote: post #54

Earlier quoted context omitted.

Wordpress template guy is doing a trade while kernel guy is engineering.

Not all programmers (engineer or otherwise) are guys -- probably worth keeping that in mind if you want this to be a welcoming community for everyone (:

Sorry, i'm canadian buddy. I do call my wife and her girl friends "you guys" from time to time.

Re: How would we regulate software engineers?

#60

Post by tarmstrong »

goalieca wrote: post #59
tarmstrong wrote: post #56

Earlier quoted context omitted.

Not all programmers (engineer or otherwise) are guys -- probably worth keeping that in mind if you want this to be a welcoming community for everyone (:

Sorry, i'm canadian buddy. I do call my wife and her girl friends "you guys" from time to time.

I'm Canadian too. I sometimes use "you guys" when speaking to a group that has women in it; I don't use "guy" in the singular when talking about generic technical roles because it implies that being a guy is part of the job. In many cases this is effectively true due to sexism in the industry, so it's not something to take lightly.

I don't think this is what you intended, to be clear! But I do think that is how it would be interpreted, even by Canadian women.

Post reply on HN