What Should We Do to Prevent Software from Failing?

"All of these professionals have years of schooling and relevant work experience and have passed rigorous certification exams. [...] To start, coders who work on critical infrastructure should have a professional accreditation framework that issues licenses."

"mit.edu"

Uh, huh.

Re: What Should We Do to Prevent Software from Failing?

#7

Post by skaomatic » Mon, May 20, 2019, 3:51 PM UTC

Only when the cost of failure exceeds the cost of quality will we see real improvements. The company producing the software should bear this burden.

Licensure for software developers will only benefit the professional liability insurance industry.

Re: What Should We Do to Prevent Software from Failing?

#8

Post by ozim » Mon, May 20, 2019, 4:00 PM UTC

Nothing new under the sun... MISRA C and Autosar were introduced around 1998, so we can also say standards for safe software are there for decades (around 2 decades but always). You still get companies skipping best practices, guidlines, etc.

What is funny you get the same stuff in construction industry. Companies take shortcuts, architects take shortcuts and there are buildings, bridges collapsing.

I just don't like dichotomy "proper engineers, mechanical, construction", "kids in the fog, software devs". There are tons of reliable software, and tons of buildings that might collapse tomorrow because of wind/temperature/vibrations which never were considered by any builder or architect...

Re: What Should We Do to Prevent Software from Failing?

#9

Post by brootstrap » Mon, May 20, 2019, 4:01 PM UTC

naringas wrote: post #4

ah, here we go fast forward 25 years and we'll need a government approved license to open dev tools in a browser. I hope I am wrong.

Yeah i think this is the 'software engineers are not REAL engineers'. There is a fair argument on both sides and the article raises an interesting point. Perhaps the root cause is how new & rapid all this tech has come across our world. Folks have been building things thousands of years right?

We've only been building scalable docker microservice agile jira lambda functions for a few years now. Curious to see where time takes us. Change takes a while to come along, companies and people have been getting hacked for many years but i havent heard any whispers of change.

Re: What Should We Do to Prevent Software from Failing?

#10

Post by efficax » Mon, May 20, 2019, 4:05 PM UTC

The analogy between software "engineering" and structural engineering is used a lot to point out the failures of software. I think this analogy is a category mistake caused entirely by the misapplication of the word "engineer" to software developers.

We have already solved large areas of common classes of bugs at the language level, through strong static typing, memory safety and safe concurrency (Rust is the vanguard here but there are lots of languages that tackle these problems in effective ways).

Institutional inertia (technical debt) is the only reason why we can't apply these solutions to all software. I work on a PHP app with code that goes back 15 years. To convert it to rust we'd have to invest basically the same as the operating cost of the company. That'll never happen.

Once "safe" languages are used, there are still bugs of course. But what are those bugs? Failures of thought, plain and simple. Structural engineers work within the limits of physical reality and these constraints greatly limit the range of possible creation, thus also the range of possible failure.

Software has limits too, in memory, storage and processing capacity. But otherwise it works entirely in the realm of pure thought.

Well defined specifications that can be turned into concrete tests can solve a lot of these problems, too. (But this is also very expensive).

But even if you have specs and tests, there is no magic formula for ensuring your ideas are always sound. If the idea is wrong you can't even write tests to ensure it's correct. "Correctly" functioning components can have complex, difficult to predict side-effects when composed into complex systems.

We do have everything we need to write highly reliable software. But solving the software failure problem is the same task as solving the erroneous thinking problem. I don't know that we meat-sacks can "solve" that problem.