this post was submitted on 22 Jul 2024
258 points (95.1% liked)
Programming
17423 readers
26 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This might help in some regard, but this will also create a bottleneck of highly skilled highly expensive Engineers with the accountability certificate. I've seen what happens when this is cornerstone even without the accountability that would make everything even more expensive: the company wants to cut expenses so there's only one high level engineer per five or so projects. Said engineer has no time and no resources to dig into what the fuck actually happens on the projects. Changes are either under reviewed or never released because they are forever stuck in review.
On the other hand, maybe we do move a tad bit too fast, and some industries could do with a bit of thinking before doing. Not every software company should do that, though. To continue on the bridge analogy, most of software developers are more akin to carpenters even if they think about themselves as of architects of buildings and bridges. If a table fails, nothing good is going to happen, and some damage is likely to occur, but the scale is very different from what happens if a condo fails
But a company that hires carpenters to build a roof will be held liable if that roof collapses on the first snow storm. Plumbers and electricians must be accredited AFAIK, have the final word on what is good enough by their standards, and signing off on shoddy work exposes them to criminal negligence lawsuits.
Some software truly has no stakes (e.g. a free mp3 converter), but even boring office productivity tools can be more critical than my colleagues sometimes seem to think. Sure, we work on boring office productivity tools, but hospitals buy those tools and unreliable software means measurably worse health outcomes for the patients.
Engineers signing off on all software is an extreme end of the spectrum, but there are a whole lot of options between that and the current free-for-all where customers have no way to know if the product they're buying is following industry standard practices, or if the deployment process is "Dave receives a USB from Paula and connects to the FTP using a 15 year-old version of FileZilla and a post-it note with the credentials".
True, there is a spectrum of options, and some will work much better than what we have now. It's just that when I read about holding people accountable I don't quite imagine it's going to be implemented in the optimal way, not in the first hundred years or so
All of this has already been implemented for over a hundred years for other trades. Us software people have generally escaped this conversation, but I think we'll have to have it at some point. It doesn't have to be heavy-handed government regulation; a self-governed trades association may well aim to set the bar for licensing requirements and industry standards. This doesn't make it illegal to write code however you want, but it does set higher quality expectations and slightly lowers the bar for proving negligence on a company's part.
There should be a ISO-whateverthefuck or DIN-thisorother that every developer would know to point to when the software deployment process looks as bad as CrowdStrike's. Instead we're happy to shrug and move on when management doesn't even understand what a CI is or why it should get prioritized. In other trades the follow-up for management would be a CYA email that clearly outlines the risk and standards noncompliance and sets a line in the sand liability-wise. That doesn't sound particularly outlandish to me.
Heck, there are already ISO language standards, and there's ISO Software Lifecycle standards, it's absolutely not a leap to move into standards adhering processes. It's not like there's no desire to do it either, code standards alone, how many times have you had discussions about style guides and coding standards company wide? It makes things more consistent and easier for different developers to maintain.
Semi related, I see a lot of non-iso standard SQL that's a pain if you do migrations or refactors, often even just sucks to read through (old school oracle joins look really strange and aren't clear compared to iso standard joins). I really wish people would adhere to the standards as much as possible.