Earlier quoted context omitted.
One of the issues is that laws are made on paper and then everyone needs to figure out how to map it to software. Instead, laws should be codified in software and legal APIs should be binding. This would do wonders for efficiency, but also force laws to be cleaned up, be consistent, simple and logical.
I don't even know what this would entail. Reality is continuous and subjective; computers are not. And there's no reason that "legal APIs" would be any more cleaned up, consistent, simple or logical than our current legal system.
Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
381–390 of 434 posts
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#382Earlier quoted context omitted.
Only the programmed end result in code would be legally binding. Lawmakers would have a big interst in making sure the code is correct and provide incentives/change procedures accordingly. The inmates in this article would be released immediately after the code-law is implemented; you could apply new tax laws (i.e. as a config file) to your accounting software. Why maintain an obfuscated legal text when you need it i…
The legal text is the specification. What you're suggesting is the equivalent of the classic "the spec is whatever the implementation does", and would erase the distinction between correct, incorrect, and undefined behaviour.
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#383Earlier quoted context omitted.
Mail, or asking another prisoner with communication to the outside to ask their contact to call the lawyer and have them come visit.
If somebody is objecting to this comment based on it being wrong, I'd love to hear any corrections. Perhaps unfairly, I suspect it's more of an objection to the setup being described.
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#384> “When they legislate these things, they need to be appropriating enough money to make sure they work,” a source said. They estimated fixing the SB1310 bug would take roughly 2,000 additional programming hours. 40 hours a week times 52 weeks is 2080 hours. Subtract a few weeks for vacations and holidays, and you get a little less that 2000 hours. So, basically, this is a little more than one programmer-year of effor…
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#385Earlier quoted context omitted.
The onerous budget item we are talking about here is a feature that multiply days sentenced by 0.7 if the inmate completes one checkbox item. You know, just to keep things in perspective.
Right, so that's just * a UI change to check the box this information is on * UI change to view whether the box is already checked or not * a data model change to store the information * business logic change that modifies some critical code that calculates when someone should be released * security/access control change to decide who is allowed to check this box * auditing logic to keep logs of this stuff * possibly…
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#386Earlier quoted context omitted.
>I have to say that sounds exactly how this kind of software should be built. You see this in every topic. Every "muh pride in muh trade" person says something like this about the relevant trade but the fact of the matter is that the world runs on off-brand duct tape, harbor freight tools, walmart jeans, economy tires, and all sorts of other "value" solutions and the race to the bottom is what has given us much of th…
We don't say "perfection is impossible" when it comes to bridges collapsing. We understand that yes, on rare occasion a bridge WILL collapse, but we go and find the people responsible, and we still hold them accountable. This is a level of accountability that basically every other field of engineering is held to, and they've all risen to the challenge and left the "off-brand duct tape" behind. Even within programming…
Yes we do. People on the internet might not but look at the formal documentation that goes with any bridge plans. It will talk about factors of safety, various loads, environmental conditions and establish a set of constraints outside of which the bridge is not expected to perform as advertised.
>speed traders are dealing with million-dollar stakes and a single mistake can make the news
It's really easy to put HFT a pedestal when you can't inspect it up close but I assure you that for every Citadel and P72 there is half a dozen firms with sloppy software that goes absolutely crazy if non-ideal but foreseeable things happen. These people are making money hand over fist (kind of) by building to the minimum. There's one firm I want to name because of how much everything they have is held together with duct tape but they're nice guys so I won't.
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#387Earlier quoted context omitted.
Right, so that's just * a UI change to check the box this information is on * UI change to view whether the box is already checked or not * a data model change to store the information * business logic change that modifies some critical code that calculates when someone should be released * security/access control change to decide who is allowed to check this box * auditing logic to keep logs of this stuff * possibly…
Ok, but you must be charging by the hour if you think this is anywhere near 2000 hours of work
2. What I described is not the actual fix, it is the temporary stopgap. The prison department isn't going to pay someone to click checkboxes all the time for tens of thousands of inmates each year. They will want this info to be set automatically -- e.g. an integration from whatever software system(s) are used to track completion of the coursework to this system, so you are not hiring another employee to sit and click all the time nor do you need to create reporting procedures to get that info into the hands of the person who is clicking. The appropriate design then requires automation, which will require security controls, and it's a pain. It could easily be more than a year of work, again depending on how many systems they need to integrate against, what types of sign off/controls are required, how much paperwork is required, etc.
For example, maybe the coursework has no software tracking, in which case they need to throw up a portal and have the people running the course fill out who did what, and then throw up another portal to have someone else review that.
Lots of stuff ends up being passed around by ftp or csv uploads. I've seen horror stories. So it really depends on how they plan to do this integration -- the manual button clicking was just an example of a least effort system that relied on a lot of manual labor, but perhaps this is not in their budget either.
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#388Earlier quoted context omitted.
If my tax $ goes to it, it should have source available (excepting natsec). it would be nice to get some value out of it. If it's well written, I could learn how a large scale project works. If not, I can have something to petition and voice my concerns about, inform about vulns, etc.
You exempt national security, and suddenly everything is national security. Look at the FISA “courts”. Not arguing against it. State secrets are needed in some instances. Just pointing out that if you exempt something , there’ll be people who’ll construe as much as they can under than exemption. Is there any solution to that?
I agree though, it's a tough problem I haven't fully thought through. I can see an argument saying "well if a vulnerability was found and a violent felon/terrorist was released early, that would be _bad!_". Hell, a DMV appointment software could have a vulnerability allowing a drivers license to someone who then commits a terrorist act. I wouldn't put that past a politician to claim under "national security". Of course, as mentioned below, these vulnerabilities would probably be limited in scope if the devices are airgapped (which it better be!). But something tells me they likely aren't all airgapped.
But I genuinely hope that if such a thing were to happen, there would be more good eyes on it than bad ones. Personally I'd look at whatever was in my preferred language. Granted, it would be to learn from it, not to find vulnerabilities, but something tells me there are vulnerabilities in gov't systems even I know are bad.
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#389Earlier quoted context omitted.
Software is just a tool, it can be used to build good or bad things. It would be hard to see this in e.g. Scandinavian countries, where incarceration is seen as rehabilitative rather than punitive. In the US, racial discrimination, free market extremism along with "tough on crime" laws have created unimaginably cruel systems; together with private prisons, the goal has been on cutting costs rather than rehabilitating…
I don't think tools cancel themselves out, and I suspect that nothing "is just" anything. Even if ideas like "the medium is the message" are partially true and then just partially applicable, that should give us pause when we try to cross out tools in our morality equations. - https://en.wikipedia.org/wiki/The_medium_is_the_message
Re: Whistleblowers: Software keeping inmates in Arizona prisons beyond release dates
#390> “When they legislate these things, they need to be appropriating enough money to make sure they work,” a source said. They estimated fixing the SB1310 bug would take roughly 2,000 additional programming hours. 40 hours a week times 52 weeks is 2080 hours. Subtract a few weeks for vacations and holidays, and you get a little less that 2000 hours. So, basically, this is a little more than one programmer-year of effor…
> an apparent implicit economic calculation that one programmer-year is more valuable than the freedom that is being denied to an unknown number of people whom society deems less important I’m surprised this doesn’t create a massive liability for the state.
That would basically result on patients not getting their ostomy bags on time, and I can't even imagine what would follow afterwards. What would be the reactions of patients and their relatives, what levels of stress would hospitals' employees would be subjected to, and so on.
I left the company some months after that, and I don't know what was the final decision, but they'd been warned.
Maybe one day some set of ethical standards will be considered non-functional requirements as important as robustness, security and others.
With technicians being responsible for warning their managers, managers being responsible for assessing risks and documenting their decisions, everything being made transparently and everybody being accountable.