Live data from Hacker News

What Should We Do to Prevent Software from Failing?

sloanreview.mit.edu

71–80 of 128 posts

Re: What Should We Do to Prevent Software from Failing?

#71
post #39

Speaking as someone who builds mission critical software, licensing is not the answer to this problem. Occupational licensing only serves to raise barriers to entry and crowd out competition without raising quality. To put my opinion bluntly, Bernie Madoff had a license. The things you should do to prevent catastrophic failure: - Reduce your attack surface as much as possible. - Automate your infrastructure, human in…

This is all very reasonable, but assumes that avoiding catastrophic failure is the most profitable course of action.

Re: What Should We Do to Prevent Software from Failing?

#72

Earlier quoted context omitted.

I've heard the analogy of a software developer to a mechanic, and I like it much more. Developer = Mechanic Computer = Car Make = Language Model = Platform Year = Version A mechanic is licensed by ASE to work on cars in the USA and there are 50 different certifications [1], depending on the type of car/truck/bus. I don't want to see software development go this route, where developers have to get multiple certificati…

I don't like car analogies. A software engineer is like a plumber you link up lots of small components, weld them together and then the data flows through the application (at least that is the idea).

I don't like either of these analogies. Work of SE is much more complicated. I guess a developer who just mashes things together on the front end is kind of like a plumber.

However, if you work with the backend, you need to worry about data access, any concurrency issues, performance problems. Generally tradesman follow relatively simple guidelines, which may change at a slower pace....tech on the other hand changes insanely quickly.

Re: What Should We Do to Prevent Software from Failing?

#73
The first question when anyone proposes licensing as a solution to anything in this field should always be what the objective criteria will be for granting a licence. Until there is some authority qualified to answer that question on a credible technical basis, any legally mandated licensing scheme will just be a tool for lawyers, "thought leaders", insurance firms and other people who don't actually make useful software to beat up those who do.

Re: What Should We Do to Prevent Software from Failing?

#74
I think software systems whose failure directly jeopardizes human lives should be engineered, and should be defined and enforced legally. Systems that don't directly risk human life should not be so constrained.

Defining that standard and enforcing it is a huge task which could easily go very wrong.

Businesses would of course be free to apply the "engineered" standard to any systems they choose to. Outside of mission-critical systems operating at gigantic scale (FAAMANG-level) I doubt it would often be profitable to do that.

The hypothetical standard would also be less relevant when building proofs-of-concept, so long as the POC is not usefully deployable (if it is there's risk of someone deploying it despite it being unsafe).

In the end, most software does not put human lives directly at risk. Acting like it does would waste resources and doom many small businesses whose profit margins couldn't absorb the costs of genuine engineering (it could kill several companies I have worked for).

Even software systems that do risk human lives don't do so in all subsystems - as far as I know, painting a mural in your skyscraper's lobby requires no engineers to be involved. Similar distinctions may be reasonable in sufficiently-isolated components of software packages that do some life-protection tasks. Maybe allow a formal verification to show that subsystem X cannot impact the critical subsystems and therefore does not need the same level of rigor?

Re: What Should We Do to Prevent Software from Failing?

#75
post #70

Earlier quoted context omitted.

A key difference between physical engineering and software engineering is that the economics of over-engineering to improve safety margins are wildly different. For physical engineering, the costs of substantially decreasing failure risk (e.g. via increasing strength, different materials, more complex design, etc) is approximately linear. For software engineering, that cost is something closer to quadratic or worse.…

Try to solve an aerospace problem with this "simple" approach. No, you don't get to add strength willy-nilly, or just swap materials on a hunch. You're working with safety factors which sometimes are less than 1 (come back for references), and those physical properties of materials are notoriously stubborn to changes. You know, some Richard Feynman once quipped "nature can't be fooled, dammit" - that extends to "wate…

safety factor less than 1? you're planning that the thing will break early?

Re: What Should We Do to Prevent Software from Failing?

#77
post #66
post #39

Speaking as someone who builds mission critical software, licensing is not the answer to this problem. Occupational licensing only serves to raise barriers to entry and crowd out competition without raising quality. To put my opinion bluntly, Bernie Madoff had a license. The things you should do to prevent catastrophic failure: - Reduce your attack surface as much as possible. - Automate your infrastructure, human in…

> Occupational licensing only serves to raise barriers to entry and crowd out competition without raising quality. To put my opinion bluntly, Bernie Madoff had a license. Almost every country in the world established at one point or another some kind of licensing for various professions. I think the barrier of "this is all bullshit" is a bit higher than one bad apple for something found to be a good idea by so many p…

Look at teaching in the United States. All states require teacher licensing at public schools. However private schools do not and get better outcomes. Same thing with many unions for trades. I have yet to see any evidence a union electrician or plumber is better than a non-union worker, however unions do all they can to keep competition off the market.

Re: What Should We Do to Prevent Software from Failing?

#78
post #24

Only when the cost of failure exceeds the cost of quality will we see real improvements. The company producing the software should bear this burden. Licensure for software developers will only benefit the professional liability insurance industry.

We can also reduce the effort to write better code. Certain language and tooling features make quality easier.

I think that's the key. There was ADA now there's Rust. If you can have GC on your system there are plenty of other languages that make strong static typing and other compile time guarantees that beat any analyzed C++.

Re: What Should We Do to Prevent Software from Failing?

#79
post #66
post #39

Speaking as someone who builds mission critical software, licensing is not the answer to this problem. Occupational licensing only serves to raise barriers to entry and crowd out competition without raising quality. To put my opinion bluntly, Bernie Madoff had a license. The things you should do to prevent catastrophic failure: - Reduce your attack surface as much as possible. - Automate your infrastructure, human in…

> Occupational licensing only serves to raise barriers to entry and crowd out competition without raising quality. To put my opinion bluntly, Bernie Madoff had a license. Almost every country in the world established at one point or another some kind of licensing for various professions. I think the barrier of "this is all bullshit" is a bit higher than one bad apple for something found to be a good idea by so many p…

Sure, this report does a good job summarizing the tradeoffs of occupational licensure. If I were to highlight a section to read it would be pages 13 and 14.

https://obamawhitehouse.archives.gov/sites/default/files/doc...

Re: What Should We Do to Prevent Software from Failing?

#80
post #72

Earlier quoted context omitted.

I don't like car analogies. A software engineer is like a plumber you link up lots of small components, weld them together and then the data flows through the application (at least that is the idea).

I don't like either of these analogies. Work of SE is much more complicated. I guess a developer who just mashes things together on the front end is kind of like a plumber. However, if you work with the backend, you need to worry about data access, any concurrency issues, performance problems. Generally tradesman follow relatively simple guidelines, which may change at a slower pace....tech on the other hand changes…

You don't "need" to do any of that on the back-end either to launch a product. Not sure what distinction between FE and BE you think there is here. One messes up an application on the server, the other messes up an application on the client. And there are plenty of avenues for being a clueless plumber on the backend, like using Ruby on Rails + "gem install devise" for authn + "gem install carrierwave" when the boss tells you they want avatars, without having much idea how anything actually works.
Post reply on HN