Hacker News Reader

Comment by EdSharkey | Hacker News Reader

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established.

Our community cannot continue operating in the hacker mode wherever money is involved.

View on HN

So now people who are self taught excellent programmers are unemployable without paying a 60,000 tax into the hands of private institutions but morons who graduated from diploma mills in countries with lax educational standards are entirely safe.

I'm also sure that nobody will act to artificially limit the supply of legally employable programmers just to enrich the few at the expense of the rest of us.

I'm also sure that such guilds wont be run by the least talented bureaucrats possible unfit to produce code themselves!

Further I guess we can just cancel open source software.

This is a terrible terrible terrible idea. The cure is worse than the disease.

I don't think anyone is arguing that all computer programmers need to be accredited. The argument being put forward is that if you are deploying software in certain specific fields then your code should be signed off by a certified professional before it is allowed to be perform it's intended function (which in this case is handling financial transactions).

I am an engineer. There are codified regulations that I am required to comply with by law. Hypothetically if I certify the design of a structure and later on I was found to be have been negligent in performing my duties as a practicing professional engineer then Me, the company I work for (or both of us) are up for huge liabilities.

You can't build a $31M Bridge without the design being certified yet you can build software to handle $31M dollars of transactions just fine.

None of this would stop open source contributions. If you want to contribute code to some financial processing software submit your pull request and have the (professionally certified) reviewer sign off on it after doing his job (i.e reviewing it).

Edit: Here's a quote from William LeMessurier it's part of an ethics case study I learnt about at university (http://www.theaiatrust.com/whitepapers/ethics/study.php)

"If you’ve got a license from the State and a certification from the University first and now you’re gonna [sic] use the license to hold yourself out as a professional, you have a responsibility beyond yourself, if you see something that is a social risk...good heavens this thing would kill thousands! You must do something. You must do something"

Now a bug in this particular piece of code isn't going to kill someone but $31M is a lot of money to have stolen. No one in this topic is even thinking of the consequences. It could ruin multiple peoples lives losing that much money. A lot of people just seem to be content with this lawless "wild west" world of programming. Personally I think we should be striving for a higher level of professional and ethical standards.

>>> The argument being put forward is that if you are deploying software in certain specific fields then your code should be signed off by a certified professional before it is allowed to be perform it's intended function (which in this case is handling financial transactions).

This is already the case. Try working in aerospace.

There is a good likelihood that any substantial software effort by an accredited individual touches on a multitude of software written by less accredited people most of which he has never reviewed some of which nobody even knows who wrote it.

The discretion you desire ought to be enforced by the people who are responsible for that 31 million dollars not a set of standards imposed from on high.

If they fail and lose other peoples money or even lives the court is in the best position to correct this on a case by case basis.

Any set of standards imposed from on high are likely to evolve slowly and work poorly as it is difficult to fully specify the problem without in each case fully using understanding the code, the problem space, and the risks.

Ex a standard codified a few years ago would probably specify safe ways to write c but forbid rust.

We can fully specify safe and proper ways to build bridges because we have been building bridges for thousands of years while software development is less understood and still in Flux.

I don't think we could effectively turn software development into engineering even if this was desirable.

That just makes the price of a "programmer" go up. And the normal people responsible for putting together said requirements know that in the end it would just make their IT costs go up, so therefore they don't (which is fine with me)

Darn right, it's costly!

But how else will we rope in foolish devs from doing foolish things like eval() in the context of a user's wallet except by policing our community?

You can expect businesses to do it...

Meant to say can't there, darn phone keyboard...

Or work move to countries without red tape around the job. Unlike masonry, software is easily shipped.

I think we should not require person to be certied rather the code to be certified by a body. I think we already have this for Infra like PCIDSS and there private companies. Now if some one setup a company and work insure for cerified code it will be great

And people should demand for such static analysis like now we do ask https connections

https://www.owasp.org/index.php/Source_Code_Analysis_Tools

What you are proposing:

(1) Is bad economics. In most cases, getting rid of occupational licensing would create wealth. To take law/lawyers as an example, see http://www.econtalk.org/archives/2011/09/winston_on_lawy.htm...

(2) Would have the practical effect of taking away my livelihood and ability to work. Would have radically altered my life, personally, for the worse.

Status quo sounds like it's your thing, which is cool.

I just want to posit that the world doesn't care about what we, the developer community, thinks. All they care about is what we DO. And, if we're going to keep acting like unethical mercenaries, and then something truly tragic happens (like mass deaths) as a result of our mistakes or malice, then your livelihood will be affected anyways.

So, do you want to get ahead of this thing and define the parameters of our reordering? Or, would you like some clueless politicians and bureaucracies to decide our fate?

I think you're vastly underestimating the number of deadly mistakes doctors and lawyers and other such licensed professionals make every day. Just look at Enron!

Maybe such a system would keep out the very worst programmers but I doubt someone hacking on Ethereum smart contracts falls into that bucket anyways.

Are you arguing for self-taught doctors to practice their quackery, then? Shall we accept freelance surgeons having out gall bladder and appendixes with whatever whiskey, x-acto knife, needle and thread they have at-hand?

What exactly are you arguing for here? Obviously, humans are imperfect and corrupt - but you can impose some order and ethics and error correction into any community when you get organized.

OP said one of the creators of Etherium was responsible for the bug, how much more 'expert' can you get? The problem is one of programmer craft, or the lack thereof.

My point is that your suggestion is unlikely to have helped prevent this specific incident or others like it.

A guild or professional association keeps quacks and idiots out, it doesn't solve the problem of experienced competent people occasionally making subtle mistakes.

Ok, you're saying that a guild won't prevent human error, especially in something intricate like software development. But there are actual historical examples that run counter to your claim. Other disciplines DO have error correcting standards and practices that catch and prevent errors from flowing downstream. Architects and accountants for example, have such well-established standards that those standards got codified into laws in most countries. I suspect that you believe that software development is not, or cannot ever be, an engineering discipline for reasons.

Thing is, you might not be able to imagine software development can be treated as an engineering discipline, but that doesn't stop others from trying to. And if lawmakers decide to get involved, then 'trying' suddenly becomes 'doing', whether you think that's proper or not.

Regarding 'subtle mistakes', do you consider performing an eval() on an unvalidated input string in the context of someone else's publicly addressable wallet a subtle mistake?

Check out all of the definitions of 'ethics' in the dictionary and then try to say the developers who wrote the original buggy code and the white hats who did the damage control were acting ethically. How deep does the corruption go? Is Etherium corrupt down to first principles and all its founders morally bankrupt?

One of the things a guild does is codify ethical standards for the group, and that is something all software developers sorely need.

We are, I would argue, the most important group of workers on the planet today. Shouldn't we get our act together and mature as a discipline?

That's already the case. You won't be able to enter without a degree or 10 years of experience.

Depends on the industry. I worked in the games industry with characters that didn't have their high school diploma.

I have a bachelors degree in CS and was working in banking and finance firms with <1 year of experience. No, it wasn't aerospace or quantum physics, but I did have to get cleared by a few 3-letter agencies before I could touch the codebase.

Things haven't changed, programmers are in high demand everywhere.

It is a very interesting thought.

Any Germans care to comment? They have the closest systems, I would think.

What do you mean? I've been working as a developer in Germany for 5 years now, and I'm only now getting a CS degree. There is a vocational training for software developers, bit it's nowhere near required.

Reply on news.ycombinator.com