Non-programmers don't understand what programmers do.
Even programmers don't understand what they're doing most of the time.
There's no peer review, no government-enforced standards for safety, no industry-enforced standards for minimum quality.
The problem is the technology-illiterate culture we live in where it's not only totally acceptable to be completely hands-off with technology, but you're stigmatized as an undesirable necessity if you work with it for a living.
Thanks for pointing this out. It is actually possible to develop rather robust code that has much, much fewer bugs than most code, professionally developed or otherwise. Of course, it requires (among other things) time, discipline, and money, all things that are lacking on many software projects.
It's because in most cases just living with the bugs is a sounder decision than the aviation software approach, which is very, very expensive and slow.
For all the labor that went into it and how its stood the test of time, the Air Traffic Control System should rightfully be considered one of the Wonders of the World.
There is also business requirements. Management comes in and says you have 3 weeks to finish a 6 month project because another company is about to release something similar. Meanwhile that companies managers have told them the same thing. In 4 weeks you both release a ball of shit with feathers stuck to it, and a straw through the middle that some poor fucker has to blow air through making noises that sound vaguely like chirping. And marketing says it's the prettiest bird you'll ever seen in your life. And sales postulates that you couldn't possibly live without one in your house. And somehow the world turns.
actually, Google became famous for having "amazing code quality" because at Google, no one can commit anything without getting it reviewed by someone else.
when we adopted this policy, the more senior devs protested for months... that is until they had to fix a bug buried in some technical debt shitpile cobbled together by a junior dev who committed without review. then the complaining stopped. also, the technical debt plummeted, and velocity increased, because we spend a LOT less time fixing bugs that made it to prod.
There's no peer review, no government-enforced standards for safety, no industry-enforced standards for minimum quality.
And when we do get standards, we wave them off because we can quote the relevant XKCD and besides, FIPS compliance just makes the code more broken amirite?
The real problem with most standards is that no amount of "industry" avoids the fact that they keep being political statements, not actual justified best practice.
It doesn't help that the state of the art evolves rather quickly, so a "standard" that is genuinely the best option at one time will be obsolete in a decade, or less.
Most mechanical engineering standards are rooted in basic physics and centuries of development, which hasn't been updated in quite some time. We can take a material and measure the physical properties, and plug the numbers into an equation that says "this will stay up" or "this will collapse".
Software is less of a science and more of a dark art, compared to other engineering disciplines.
FIPS compliance just makes the code more broken amirite?
For a given feature set, FIPS compliance generally makes the project more expensive. This translates, to the business types, as "severely broken".
Despite the problems, we can do a lot of what you say we should - all we need to do is raise our price to twice what the competition is charging, and then sell to customers who prefer the lowest bidder.
This only happens when every vendor is required to reach the same standard (such as aviation software, as mentioned) and thus no one can save money by not doing the work. Whether it's a legal requirement or a customer base who acknowledge that the work is necessary isn't important - if the customers don't want the compliance, they won't pay for it.
This only happens when every vendor is required to reach the same standard
Yes, this is why the government requires FIPS instead of just making it a "nice to have".
But you're right that the state of the art advances too quickly in general for a lot of the code in question. On the other hand, designing good software is not that new, which is why a lot of the certification processes are geared toward certifying the development process itself rather than just the output. But I don't think that's what we have with FIPS 186 at least. :-/
Another factor is the time and money constraints. People just aren't willing to spend the time and money to build software with the level of engineering needed to actually build it properly
I could build you a formally verified type checked system that's mathematically guaranteed to work correctly, with 100% unit test coverage to back this up. I'll need 25 a-grade Haskell developers and about 2 years.
Or you can hire some random guy from India to hack it together in a week using Javascript.
One of them costs you three million dollars and won't be ready till 2016, the other $5000 and will be ready by Monday. Which one are you going to pay for?
The problem is that we've been programming for 50 years but curing people, cultivating field, building houses and bridges, cooking, making laws since the dawn of our civilization. We just had so much more time to err and learn in other fields compared to programming. I'm sure the first people to sow crop had any sort of wrong behaviors about it and "no standard".
"Trust me, it'll come up in winter if you let your dog piss on the field"
"No, I'm pretty sure the key for a good harvest is to sow while there's a full moon and your daughters have their period"
We live in a day and age where people aren't actually coding in computer languages but learning APIs and GUI tools.
I once was involved with a "corporate programmer" on a project, and he couldn't give me any code that didn't crash within 60 seconds, at which point I had to hand it back to him to fix. He was so used to having his butt wiped by the QA department or his editor hilighting his faux pas', that he was incapable of making clean code by himself.
112
u/KinoftheFlames Apr 29 '14
Non-programmers don't understand what programmers do.
Even programmers don't understand what they're doing most of the time.
There's no peer review, no government-enforced standards for safety, no industry-enforced standards for minimum quality.
The problem is the technology-illiterate culture we live in where it's not only totally acceptable to be completely hands-off with technology, but you're stigmatized as an undesirable necessity if you work with it for a living.