Ask HN: What is the thing you've built that you regret the most?

Someone shares an insightful story that others can learn from and your first thought is to shame them, and then without knowing the first thing about them or what else they've done with their life, you tell them the best way to atone for their sins?

This thread is such a great opportunity for learning and curiosity and yet you choose to see it only as an opportunity for moral grandstanding, possibly scaring away other people with interesting stories to tell. Why are you on this website?

What would that accomplish?

I had this realization in stages.

1. Almost all software can be abused or co-opted for surveillance purposes.

2. Some software comes already designed for surveillance purposes up front.

2a. This includes plenty of well-known mass appeal software; importantly, the customer-facing marketing copy and the investor pitch can present a completely different value proposition.

3. Software doesn't become used for surveillance or abuse by accident; there are actual human beings who make a decision to use it in this fashion, or commission it for this purpose.

3a. The "misguided programmers harming people by trying to solve social problems with technology" meme is dumb for many reasons, but it's also distracting (possibly purposefully so) from the fact that it's not software, or people who coded up the software, that are the primary culprits. The coders that were too naive or too self-interested to refuse work or blow the whistle may have some responsibility, but we should start talking about the people who made the decisions to commission or repurpose technology for bad purposes.

My first job at Microsoft was to build IronRuby, which was an implementation of Ruby on top of the Common Language Runtime. I got the job because I had built a bridge that connected MRI (Matz's Ruby Interpreter) to the CLR before I joined the company. This project ultimately failed because of a principle that we learned from the school of hard knocks: respect developers' existing code investments. Developers couldn't use it because many of Ruby's existing libraries were thin wrappers over native code, and we couldn't get them to work for many reasons.

It turns out that the project was more of a demonstration of our ability to get dynamic languages to run efficiently on the CLR. To that end, I think we were successful. But once we achieved that there was not much of a path forward so the project was eventually shuttered.

Actually, I want to think more about the theory of change here. It's conceivable that a ProPublica article could actually make the situation worse, e.g. by advertising the existence of the helmet to other abusive employers, or causing abusive employers to rework their labor practices in a way that looks better to the press but is actually worse.

If the company that makes the helmet is based in a country with good government, maybe a reasonable regulation would be to score workers on productivity, but place limitations on the scoring somehow. E.g. the helmet stops showing the worker's location when they've spent too much time in the heat. Or the helmet estimates the fraction of the workday that the worker spent offsite, but all workers who spend 20% or less of their time offsite are given a score of 20%, so the employer can't force the worker to spend more than 80% of their time onsite. I don't think productivity scoring has to be dystopian in principle; generally speaking it seems reasonable to pay people according to how productive they are.

You could also argue for regulating the helmet out of existence, but I assume in that case it would just be built somewhere else with lax regulations. So the trick is to put in regulation that creates a humane experience for workers, but not so much that Qatar is incentivized to contract the development of a new, more draconian helmet in a different locale. I don't think this should be too hard, because creating a humane experience for workers should also help productivity to a degree.

There's also a security dimension here -- you don't want abusive employers to be able to circumvent these limitations. So you could make it so the helmet only runs code which has been signed with the company's private key, or have a lot of the functionality server-side.