Hacker News Reader

Comment by ams6110 | Hacker News Reader

I think what we're seeing are the same sorts of things that led to building codes, fire codes, licensing of architects and civil engineers.

After so many building collapses, bridge collapses, or disastrous fires, people finally demanded that "build whatever you want, however you want" is not OK if you are making something for use by the general public.

I think ultimately we're going to see legislation requiring licenses/certifications for software designers and software companies and software service providers. Like a civil engineer is licensed and personally liable for designs he approves.

It's coming. People will only tolerate the current shitshow that is our industry for so long.

View on HN

It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code with each disastrous fire and fire will not actively try to outsmart you next time.

Security OTOH is anti-inductive because you're dealing with intelligent attackers adjusting their methods. In this environment, security code and certifications will just become another pile of papers for bureaucrats to verify after your data was leaked anyway.

But maybe it will at least force manufacturers to make their products' software updateable.

I disagree.

The attackers can't get the data if you don't store that data to begin with. Voila!

I think there should be legislation that simply restricts who can store which data, as well as legislation that forces open-sourcing of critical infrastructure software.

We can't even agree on a very weak version: if you store personally identifiable information about me, you MUST share it with me. It does not matter if you're a local corner store or the CIA. You may not store personally identifiable information about me without telling me all about what you're storing.

I bring it up and conversation shuts down. Nobody likes it. Therefore, I submit that what you're saying won't happen either.

I think it's predictable if certain data is stored that others will want it.

Maybe this is extreme - but the rule should be not to store it at all if possible.

> But maybe it will at least force manufacturers to make their products' software updateable.

Hopefully, those updates will NOT be performed remotely by the manufacturers though. Imagine a self-driving car company rushing a quick-and-dirty fix to each of its cars remotely. I'm hoping that at least some certification institute will be sitting in between both parties to make sure everything is tested correctly before it's pushed to the consumer.

There are many ideas to make this workable.

How about this: Did you test your code for buffer overflows? If not, you're negligent.

Maybe you need to submit an affidavit that the code has ben tested, a log from an outside testing service (similar to a building inspector, but for code quality), or some other step to verify that something has been done. For the record, building inspections have flaws, too, but they sure help in spite of those issues!

Many other ideas, but that one is simple to communicate.

> I think ultimately we're going to see legislation requiring licenses/certifications for software designers and software companies and software service providers.

What will these licenses test us? I have no problem finding a software engineer guilty of negligence writing bad code because they were too lazy (but proving it is very difficult, what is the definition of "lazy"), but that means everyone is guilty! There are toooooo many corner cases, and we depend on upstream and downstream system to be non-faulty and 100% reliable.

Physical quality control is a lot easier to implement, so if someone fabricated lab inspection results they can go to jail because science doesn't lie right?

Now look at C++, even if we fix all the warning messages from the compiler, doesn't mean someone didn't cast the right type at runtime and boom (what about underflow, overflow, not freeing memory, reuse the wrong pointer)? We lost Mars Probe in 1999 because of a simple inch-to-meter conversion error. We don't have a formal verification system that we can all agree on.

It should be coming, but we can't make any assumptions. This kind of standard won't happen on it's own. People need to fight for this standard to make it happen. The worrying thing is that Facebook and Google have an unprecedented amount of power to resist external restrictions on what they can build and how they can use it. Simply attempting to pass legislation may not be enough.

As a FLOSS contributor/developer, I don't like this idea. Having to apply for and receive a license to write programs or modify existing ones would pretty much kill any FLOSS project not backed by a company.

In addition, how would this be enforceable? Unlike a civil engineer, where there's some amount of physical presence required in what they do, SW engineers can literally be anywhere in the world and still be productive and it seems that this system could easily be gamed.

But there were always security regulations: PCI DSS, SOC 2, HIPPA, ISO 30001

Reply on news.ycombinator.com