Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

411–420 of 466 posts

Re: I found a vulnerability. they found a lawyer

#411

Earlier quoted context omitted.

What makes you think they don't retain them in-house?

What makes you think you don't need speed dial in-house? ;)

In my experience the in-house lead attorney is usually sitting in the corner of the CEO's office. Seems silly to phone them up. :)

Re: I found a vulnerability. they found a lawyer

#412

Earlier quoted context omitted.

What makes you think they don't retain them in-house?

Depends on the usage... in-house counsel may open up various liabilities of their own, depending on how things present.

Fair point. I'm always fascinated by the conversations I've had with counsel and the perspectives they offer on things.

Re: I found a vulnerability. they found a lawyer

#413

Earlier quoted context omitted.

You couldn't do that with civil engineering, because checking if a bridge was built correctly is actually really hard, and it's why it's such a process for engineers to sign off on phases of construction.

You could look at the blueprints and calcs that were used to build it and inspect it, which they do. There’s no fundamental difference. Firms will self enforce engineering rigor because it’s a waste of money not to. Making it more stringent when lives are at stake makes sense, thats the only reason you could use to separate them. Also that can even get blurry in eg avionics software.

Looking at blueprints will not tell you if a bridge was built correctly. It will tell you if a bridge could have been built correctly.

Re: I found a vulnerability. they found a lawyer

#414
post #377

Earlier quoted context omitted.

Why the glib dismissal when you most certainly live in a country where the use of titles like 'doctor', 'dentist', 'officer' or 'lawyer' is most certainly regulated? This isn't really that exceptional and as someone from a place where not just anyone can call themselves engineer I'm always baffled when people think that it is.

Your comment completely misses the point of my question. Those countries are regulating the title not the profession. Here is the difference: the Doctors have a liability for their medical practice, the real Engineers meaning those doing Bridges and Buildings that can kill thousands of people if they fall, have a professional obligation and responsability on the outcomes of their designs and implementation. I can gua…

> no Software Engineer from Portugal to Germany will be willing to guarantee the behavior and fitness for purpose, of any System or Software product they develop

Then they shouldn't call themselves engineers.

It's not really a big deal and I don't understand the confusion around this.

Re: I found a vulnerability. they found a lawyer

#415

Earlier quoted context omitted.

Exactly this - I had a role in a multinational, US-founded company, however - I was based in Canada - our title had the name "engineer" contained within it. We were NOT by any means certified professional engineers according to any regulatory body - we were great at our jobs, but that was the reality. We were NOT allowed to refer to our job title when deployed to the province of Quebec, which has strong regulations a…

And the people of Quebec are much safer for it. /s This divide between Canada and the US has existed since the birth of software engineering as a thing. Where is the evidence the protected name has done anything useful for either Canadian software engineers or its citizens?

It's really hard to disentangle the myriad of factors that go into the differences that we see in life expectency and quality of life between Canada and the United States but it wouldn't surprise me that this is one of those ones that accounts for some miniscule amount of the difference.

Re: I found a vulnerability. they found a lawyer

#416
post #309

Earlier quoted context omitted.

>It is countries like US where anyone can call themselves whatever they feel like that have devalued our profession. How have they devalued the profession when the labor of that professions is worth the most in the US?

Professional labour value isn't synonymous with late stage capitalism without ethics or morals. Now if you mean for own much one is willing to sell themselves to late stage capitalism, producing low quality products and entshtification, maybe that is the bang for buck right there.

>Now if you mean for own much one is willing to sell themselves to late stage capitalism

The government is the one selling you out to late stage capitalism through rampant inflation, business and fiscal regulations and deregulation, offshoring, and various nefarious policies on housing and labor migration.

People just adapt to survive by taking the best paying jobs, since voting clearly doesn't help them.

Don't tell me you're not developing SW for the highest bidder and would take the salary of a fast food worker out of class empathy just to stick it to the evil capitalist.

Re: I found a vulnerability. they found a lawyer

#417
post #414

Earlier quoted context omitted.

Your comment completely misses the point of my question. Those countries are regulating the title not the profession. Here is the difference: the Doctors have a liability for their medical practice, the real Engineers meaning those doing Bridges and Buildings that can kill thousands of people if they fall, have a professional obligation and responsability on the outcomes of their designs and implementation. I can gua…

> no Software Engineer from Portugal to Germany will be willing to guarantee the behavior and fitness for purpose, of any System or Software product they develop Then they shouldn't call themselves engineers. It's not really a big deal and I don't understand the confusion around this.

>> Then they shouldn't call themselves engineers

That is the whole point. :-) Real Software Engineers do not exist other than in title. Some institutions and governments are arbitraging those who can use the title...

Re: I found a vulnerability. they found a lawyer

#418

Earlier quoted context omitted.

> By even flagging the issue and the potential fallout, I’ve put my career at risk. Simple as. Not your company? not your problem? Notify, move on.

I read that post as him talking about their company, in the sense of the company they were working for. If that was the case, then an exploit of an unfixed security issue could very much affect them either just as part of the company if the fallout is enough to massively harm business, or specifically if they had not properly documented their concerns so “we didn't know” could be the excuse from above and they could…

No i mean, 'a company you own'. At the end of the day you're just a worker getting paid to produce output. cross your I's and dot your T's and whatever else and then clock out.

Re: I found a vulnerability. they found a lawyer

#419

Earlier quoted context omitted.

The problem with software is that it's all so, so decentralized. If you're building a bridge in South Dakota, there's somebody in South Dakota building that bridge. That person has to follow South Dakota laws, and those laws can require whatever South Dakota regulators want, including sign-offs by professional engineers. If you're a South Dakota resident signing up for a web portal, the company may have no knowledge…

Bridges are only built on-site. They're designed and engineered elsewhere, frequently overseas.

They’re however designed and engineered for a specific jurisdiction and its laws/building codes

Re: I found a vulnerability. they found a lawyer

#420
post #390

Earlier quoted context omitted.

That is the thing software can kill, or destroy lives in presence of bugs. Again, sign any legal documents as engineer, and a court visit might turn into reality.

If Oracle, IBM or Microsoft after 50 years, and employing thousands of Software Engineers ...include the standard disclaimers on their Software, I dont think those in title only should make much fuss of the Software Engineer badge...

Then maybe you shouldn't be allowed to rely on such software not causing utter carnage when you're implementing some infrastructure thing via software?

Also note that such warranty disclaiming "fitness for any purpose" is not possible if you sell for money software that you say is for such an infrastructure situation, at least in e.g. Germany. That's not from the license but from the sale though.

Post reply on HN