News for hackers. Stuff that matters.
Re:Some thoughts on security after ten years of Qmail 1.0 by LudoA on Wednesday January 17, 2018 @04:16AM (#16166579)
I read an article many many years ago explaining why software engineering can't be compared to mechanical engineering.

I can't find it now, but one of its points of comparison was: if a nut isn't tightened enough on a bridge, you can tighten it a bit more -- turn the nut 3 or maybe 6 millimeters more. In software engineering, if you tighten the nut only 3 millimeters instead of 6, one of the bridge's endpoints now ends in a different dimension.

I think there is a valid point to it. I'm always amazed in housing construction how things are done "approximately". A wall should be vertically straight... give or take a few centimeters. That kind of approximation doesn't work in software engineering. It has a whole other type of complexity to it.

Re:Some thoughts on security after ten years of Qmail 1.0 by jerf on Wednesday January 17, 2018 @09:08AM (#16167950)
Yeah, I've completely stopped buying this idea that software engineers just need to do what all the other engineers do to improve. Let me know when someone engineers an n-dimensional bridge.

For that matter, let me know when your engineers have built something as complex as the AWS infrastructure, by which I mean, every single service they offer, by information content (something like Kolmogorov complexity). There are some disciplines like power management that certainly have some very large and impressive things that I don't wish to diminish, but the idea that software engineering needs to go learn from all the other engineers is an idea stuck in a very 1970s view of what a "large project" looks like.

I am abundantly confident that if you took the amount of engineering done to build something like the Golden Gate bridge today, then took all those man-hours and saw how much software you could get for the same amount, that you'd be surprised how small the result is. Not that it wouldn't be a good chunk of hours to play with, and it would be much larger than many phone apps or web sites, but if you stack it up to something like a browser or a usable OS kernel I'm pretty sure you'd find that the very visually-imposing bridge is actually orders of magnitude, plural, simpler. I say this not because I don't respect civil engineers, but because I also respect just how quickly big computer projects can chew through the man-centuries. No bridges would get built if each one individually required engineering effort commensurate to a new web browser.

It's past time for programmers to get over their inferiority complex. A sober look at what the programming world does vs the other engineering fields shows that all things considered, we're doing pretty well. Still a huge amount of room for improvement, but we're not doing so badly that we need to go running off to other completely different disciplines to drag in irrelevant, if not actively harmful, practices that are unconnected to the problems we face.

Re:Some thoughts on security after ten years of Qmail 1.0 by irundebian on Wednesday January 17, 2018 @09:51AM (#16168287)
I think I agree that software engineering is more complex than building bridges if you take two comparable project. But I don't agree that software engineering is more complex than building rockets which requires - besides a lot physics know how - also deep understanding of electronics and hardware systems. And if we look at the Ariane 5, the software engineers failed.
Re:Some thoughts on security after ten years of Qmail 1.0 by imglorp on Wednesday January 17, 2018 @10:52AM (#16168854)
An even more demonstrative example, the STS might (still?) be the most complex physical system ever.

The orbiter software group managed to not kill anybody with their software although there were some 17 bugs flown. The same cannot be said of the mechanical and human management systems, which killed one crew and possibly two.

Real software projects often fails for similar reasons, when somebody says "we know it's not designed for that condition, fly it anyway".

Re:Some thoughts on security after ten years of Qmail 1.0 by pas on Thursday January 18, 2018 @06:00AM (#16176177)
Rockets reliability is largely held back by their extreme trade off toward maintenance vs robustness. When you have to check everything and replace a bunch of things between flights, you're bound to miss something.

And that of course impacts the software side too, the rocket is constantly changing, the software has to change too, bugs are guaranteed.

Re:Some thoughts on security after ten years of Qmail 1.0 by KozmoNau7 on Wednesday January 17, 2018 @05:04AM (#16166781)
If you're building houses, and your walls are a "few centimeters" off from straight, you'll get a real asswhoopin'.

Especially if you're building something with more than one story, and you expect people to actually pay for it.

Re:Some thoughts on security after ten years of Qmail 1.0 by someone454 on Wednesday January 17, 2018 @08:48AM (#16167825)
I’ve never found a perfect 90 degree angle in any house, and I’ve built portions of quite a few. Wood expands and contracts with the seasons.
Re:Some thoughts on security after ten years of Qmail 1.0 by ams6110 on Wednesday January 17, 2018 @09:35AM (#16168151)
Yeah, "a few centimeters" is a lot, but under 1/4 inch is close enough for most residential framing. Windows and doors are always shimmed to fit the rough framing for this reason.
Re:Some thoughts on security after ten years of Qmail 1.0 by w8rbt on Wednesday January 17, 2018 @12:03PM (#16169571)
That's why they make protractors for measuring and cutting external baseboard trim. I've seen a few 90 degree corners, but not many.
Re:Some thoughts on security after ten years of Qmail 1.0 by KozmoNau7 on Wednesday January 17, 2018 @09:27AM (#16168083)
Which also makes it a really silly choice for actual construction.

Brick and concrete make a lot more sense.

Re:Some thoughts on security after ten years of Qmail 1.0 by pixl97 on Wednesday January 17, 2018 @09:38AM (#16168182)
Expanding and contracting is good. Steel also expands and contracts. Bricks and un-reinforced concrete crack and crumble.
Re:Some thoughts on security after ten years of Qmail 1.0 by KozmoNau7 on Wednesday January 17, 2018 @11:24AM (#16169168)
Odd how this 1930s brick building I'm in right now hasn't crumbled apart, or even cracked from settling to any noticeable degree.
Re:Some thoughts on security after ten years of Qmail 1.0 by pixl97 on Wednesday January 17, 2018 @12:24PM (#16169758)
I'm guessing you've not been alive long enough to see the required maintenance that has been preformed on said building. People tend to miss and ignore things that aren't part of their profession
Re:Some thoughts on security after ten years of Qmail 1.0 by KozmoNau7 on Wednesday January 17, 2018 @05:02PM (#16172436)
I have bricklayers and carpenters in my friends and family, and I've been on the association board for the building, for the last 10 years.

So I know quite well what kind of maintenance is needed. We replaced the entire 6000sqm tiled roof last year, it was the original roof, 80 years old.

The maintenance needed on a brick building is fraction of what's needed on a wood building.

Re:Some thoughts on security after ten years of Qmail 1.0 by wiredfool on Wednesday January 17, 2018 @09:00AM (#16167897)
There are automated methods for determining if a bolt has been fully tightened, and they're generally specified for 100% of the bolted connections.

(The most common one is breakoff studs on the bolts, which actually speeds thing up because the wrench can grab the nut and the stud on one side of the connection and torque away till it pops)