Live data from Hacker News

Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

kjzz.org

381–390 of 434 posts

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#381

Earlier quoted context omitted.

One of the issues is that laws are made on paper and then everyone needs to figure out how to map it to software. Instead, laws should be codified in software and legal APIs should be binding. This would do wonders for efficiency, but also force laws to be cleaned up, be consistent, simple and logical.

I don't even know what this would entail. Reality is continuous and subjective; computers are not. And there's no reason that "legal APIs" would be any more cleaned up, consistent, simple or logical than our current legal system.

Wait until you hear about “case law”. Just because it’s not on the law books doesn’t mean it’s not legally binding. If a court rules something unconstitutional or whatever, the law sometimes remains on the books instead of being removed. “Why bother writing and passing a bill to repeal a law when the court said it’s unenforceable?”

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#382

Earlier quoted context omitted.

Only the programmed end result in code would be legally binding. Lawmakers would have a big interst in making sure the code is correct and provide incentives/change procedures accordingly. The inmates in this article would be released immediately after the code-law is implemented; you could apply new tax laws (i.e. as a config file) to your accounting software. Why maintain an obfuscated legal text when you need it i…

The legal text is the specification. What you're suggesting is the equivalent of the classic "the spec is whatever the implementation does", and would erase the distinction between correct, incorrect, and undefined behaviour.

In other words: “it’s not a bug. it’s a feature!”

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#383

Earlier quoted context omitted.

Mail, or asking another prisoner with communication to the outside to ask their contact to call the lawyer and have them come visit.

If somebody is objecting to this comment based on it being wrong, I'd love to hear any corrections. Perhaps unfairly, I suspect it's more of an objection to the setup being described.

I’m not sure why you’re being downvoted. You did offer a reasonable answer. I think other people are reacting emotionally, the same way I did, because they are morally outraged at the perceived situation.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#384
post #290

> “When they legislate these things, they need to be appropriating enough money to make sure they work,” a source said. They estimated fixing the SB1310 bug would take roughly 2,000 additional programming hours. 40 hours a week times 52 weeks is 2080 hours. Subtract a few weeks for vacations and holidays, and you get a little less that 2000 hours. So, basically, this is a little more than one programmer-year of effor…

I understand that there's a lot of work that could go into this sort of thing (mocks, accessibility, testing)... but is 2000 hours really a defensible number? It sounds like there's new per-inmate data and calculations for inmate eligibility and sentencing credit. But 2000 hours worth of work? Even sand-bagging it sounds like way too much.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#385
post #358

Earlier quoted context omitted.

The onerous budget item we are talking about here is a feature that multiply days sentenced by 0.7 if the inmate completes one checkbox item. You know, just to keep things in perspective.

Right, so that's just * a UI change to check the box this information is on * UI change to view whether the box is already checked or not * a data model change to store the information * business logic change that modifies some critical code that calculates when someone should be released * security/access control change to decide who is allowed to check this box * auditing logic to keep logs of this stuff * possibly…

Ok, but you must be charging by the hour if you think this is anywhere near 2000 hours of work

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#386

Earlier quoted context omitted.

>I have to say that sounds exactly how this kind of software should be built. You see this in every topic. Every "muh pride in muh trade" person says something like this about the relevant trade but the fact of the matter is that the world runs on off-brand duct tape, harbor freight tools, walmart jeans, economy tires, and all sorts of other "value" solutions and the race to the bottom is what has given us much of th…

We don't say "perfection is impossible" when it comes to bridges collapsing. We understand that yes, on rare occasion a bridge WILL collapse, but we go and find the people responsible, and we still hold them accountable. This is a level of accountability that basically every other field of engineering is held to, and they've all risen to the challenge and left the "off-brand duct tape" behind. Even within programming…

>We don't say "perfection is impossible" when it comes to bridges collapsing.

Yes we do. People on the internet might not but look at the formal documentation that goes with any bridge plans. It will talk about factors of safety, various loads, environmental conditions and establish a set of constraints outside of which the bridge is not expected to perform as advertised.

>speed traders are dealing with million-dollar stakes and a single mistake can make the news

It's really easy to put HFT a pedestal when you can't inspect it up close but I assure you that for every Citadel and P72 there is half a dozen firms with sloppy software that goes absolutely crazy if non-ideal but foreseeable things happen. These people are making money hand over fist (kind of) by building to the minimum. There's one firm I want to name because of how much everything they have is held together with duct tape but they're nice guys so I won't.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#387
post #358

Earlier quoted context omitted.

Right, so that's just * a UI change to check the box this information is on * UI change to view whether the box is already checked or not * a data model change to store the information * business logic change that modifies some critical code that calculates when someone should be released * security/access control change to decide who is allowed to check this box * auditing logic to keep logs of this stuff * possibly…

Ok, but you must be charging by the hour if you think this is anywhere near 2000 hours of work

1. Once you work for a big bureaucracy, you realize how slow this stuff is. In terms of how much actual work it takes, it depends very much on the condition of the test environment -- whether it has been maintained and how much effort is required to get back up and running. Plus, how much paperwork is involved in dealing with the government agency that contracts this out. I can easily see a situation in which you don't even accept jobs that are less than 2000 hours as it's not worth it.

2. What I described is not the actual fix, it is the temporary stopgap. The prison department isn't going to pay someone to click checkboxes all the time for tens of thousands of inmates each year. They will want this info to be set automatically -- e.g. an integration from whatever software system(s) are used to track completion of the coursework to this system, so you are not hiring another employee to sit and click all the time nor do you need to create reporting procedures to get that info into the hands of the person who is clicking. The appropriate design then requires automation, which will require security controls, and it's a pain. It could easily be more than a year of work, again depending on how many systems they need to integrate against, what types of sign off/controls are required, how much paperwork is required, etc.

For example, maybe the coursework has no software tracking, in which case they need to throw up a portal and have the people running the course fill out who did what, and then throw up another portal to have someone else review that.

Lots of stuff ends up being passed around by ftp or csv uploads. I've seen horror stories. So it really depends on how they plan to do this integration -- the manual button clicking was just an example of a least effort system that relied on a lot of manual labor, but perhaps this is not in their budget either.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#388

Earlier quoted context omitted.

If my tax $ goes to it, it should have source available (excepting natsec). it would be nice to get some value out of it. If it's well written, I could learn how a large scale project works. If not, I can have something to petition and voice my concerns about, inform about vulns, etc.

You exempt national security, and suddenly everything is national security. Look at the FISA “courts”. Not arguing against it. State secrets are needed in some instances. Just pointing out that if you exempt something , there’ll be people who’ll construe as much as they can under than exemption. Is there any solution to that?

I suppose a congressional committee separate from the intelligence community that can (hopefully) objectively decide whether something will directly damage our national security.

I agree though, it's a tough problem I haven't fully thought through. I can see an argument saying "well if a vulnerability was found and a violent felon/terrorist was released early, that would be _bad!_". Hell, a DMV appointment software could have a vulnerability allowing a drivers license to someone who then commits a terrorist act. I wouldn't put that past a politician to claim under "national security". Of course, as mentioned below, these vulnerabilities would probably be limited in scope if the devices are airgapped (which it better be!). But something tells me they likely aren't all airgapped.

But I genuinely hope that if such a thing were to happen, there would be more good eyes on it than bad ones. Personally I'd look at whatever was in my preferred language. Granted, it would be to learn from it, not to find vulnerabilities, but something tells me there are vulnerabilities in gov't systems even I know are bad.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#389
post #73

Earlier quoted context omitted.

Software is just a tool, it can be used to build good or bad things. It would be hard to see this in e.g. Scandinavian countries, where incarceration is seen as rehabilitative rather than punitive. In the US, racial discrimination, free market extremism along with "tough on crime" laws have created unimaginably cruel systems; together with private prisons, the goal has been on cutting costs rather than rehabilitating…

I don't think tools cancel themselves out, and I suspect that nothing "is just" anything. Even if ideas like "the medium is the message" are partially true and then just partially applicable, that should give us pause when we try to cross out tools in our morality equations. - https://en.wikipedia.org/wiki/The_medium_is_the_message

I’m not sure what you mean by tools canceling themselves out. Are you talking about the balance between the good and bad things done with tools? If so, I do agree with you. Eg guns are tools that clearly don’t have a net benefit and controlling their manufacture and possession seems OK to me.

Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates

#390
post #290

> “When they legislate these things, they need to be appropriating enough money to make sure they work,” a source said. They estimated fixing the SB1310 bug would take roughly 2,000 additional programming hours. 40 hours a week times 52 weeks is 2080 hours. Subtract a few weeks for vacations and holidays, and you get a little less that 2000 hours. So, basically, this is a little more than one programmer-year of effor…

> an apparent implicit economic calculation that one programmer-year is more valuable than the freedom that is being denied to an unknown number of people whom society deems less important I’m surprised this doesn’t create a massive liability for the state.

I've had the opportunity of participating on the design phase of an application to control the distribution of ostomy bags for a network of public hospitals. I was a bit shocked when I knew that the decision-makers were about to cut functionality intended to provide workarounds in case of system failures, so that employees could keep delivering bags upon request.

That would basically result on patients not getting their ostomy bags on time, and I can't even imagine what would follow afterwards. What would be the reactions of patients and their relatives, what levels of stress would hospitals' employees would be subjected to, and so on.

I left the company some months after that, and I don't know what was the final decision, but they'd been warned.

Maybe one day some set of ethical standards will be considered non-functional requirements as important as robustness, security and others.

With technicians being responsible for warning their managers, managers being responsible for assessing risks and documenting their decisions, everything being made transparently and everybody being accountable.

Post reply on HN