News for hackers. Stuff that matters.
Re:SELinux is unmanageable; just turn it off if it gets in y... by beefield on Wednesday April 27, 2022 @05:39AM (#31178048)
I would argue that the fundamental problem is that the companies selling software "engineering" products do not actually take any responsibility that the product they have engineered works as intended. (see: https://www.snopes.com/fact-check/car-balk/ )

And of course, the main reason they do not take the responsibility is that the customers won't pay for it.

It is kind of interesting. We are very good at making bridges that do not fail unexpectedly, even if there is unlimited amount of unknown failure modes when working with physical materials. And on the software side, well, managing to come up with a fizzbuzz without failure modes is used to screen people on interviews. What would be similar for bridge engineers? Here is a hammer, nail and two pieces of wood. Can you make the two pieces of wood stick together?

Re:SELinux is unmanageable; just turn it off if it gets in y... by _moof on Wednesday April 27, 2022 @08:14AM (#31178936)
There are a limited number of known failure modes when working with physical materials. We know the properties of materials and we know the physics.

The equivalent to fizzbuzz would be something like a free body diagram.

Re:SELinux is unmanageable; just turn it off if it gets in y... by viccuad on Wednesday April 27, 2022 @07:09AM (#31178507)
The engineer building the bridge is liable. Hence, you get engineers with qualifications (instead of a random person with X years in Y), and those qualifications certify they know what they are doing.
Re:SELinux is unmanageable; just turn it off if it gets in y... by auto on Wednesday April 27, 2022 @08:21AM (#31178991)
Which in my opinion brings up the certification argument, but I, as I’m sure others, have found that most certifications mean nothing in regards to whether someone can actually do the job. Is the key component missing in hiring in our industry a vastly more rigorous/extensive/difficult testing and certification protocol?
Re:SELinux is unmanageable; just turn it off if it gets in y... by ThenAsNow on Wednesday April 27, 2022 @12:41PM (#31182304)
I'm an engineer in physical disciplines, and I don't think it's a certification issue. It's more that "engineering" in the software world is conflated with craftsmanship. The word "engineering" as used in relation to software is basically interchangeable with "technical work". Let me hasten to add, this is not intended to be pejorative or haughty, rather an observation.

Whether it's bridges, aircraft, or other complex engineered systems outside of software, there is a fundamental commitment to correctness, as assessed against physical principles such as conservation laws and both high-level and low-level verification criteria. Some software orgs (I think mostly in safety-critical systems) apply this kind of rigor, but most software development does not. Just look at the pushback on this site for development systems that increase rigor at the expense of "development velocity", such as memory-safe languages, powerful type systems, formal methods, etc. No civil engineer is going to be OK "shipping" their product without stress analyses, material property knockdowns, and the like.

My suspicion is that the root of this lies in an inability to systematically reason about software the same way we can about physical systems today. The tools and principles for correct-by-construction software are more primitive and harder to use than their equivalents in the physical realm. Also, lack of rigor in software still gets you a lot of powerful software and society seems remarkably tolerant of shitty software outcomes.

All software doesn't need to be engineered, the same way no one engineers a hand-crafted piece of furniture. But our software infrastructure ought to be, and it surely is not today. It will be awesome when software engineering starts living up to its billing, as I hope it one day does.

Re:SELinux is unmanageable; just turn it off if it gets in y... by sgron on Wednesday April 27, 2022 @08:46AM (#31179181)
Yes, and in other engineering disciplines this level of rigor does exist. https://en.wikipedia.org/wiki/Engineer_in_Training
Re:SELinux is unmanageable; just turn it off if it gets in y... by someguydave on Wednesday April 27, 2022 @08:25AM (#31179022)
which is why bridges and buildings certified by qualified engineers have never collapsed
Re:SELinux is unmanageable; just turn it off if it gets in y... by erikbye on Wednesday April 27, 2022 @08:31AM (#31179068)
Both types of structures have collapsed.
Re:SELinux is unmanageable; just turn it off if it gets in y... by steelframe on Wednesday April 27, 2022 @09:35AM (#31179681)
I'm pretty sure someguydave was being sarcastic.
Re:SELinux is unmanageable; just turn it off if it gets in y... by someguydave on Wednesday April 27, 2022 @09:51AM (#31179879)
indeed.

I don’t believe any particular test or qualification wards off mistakes

Re:SELinux is unmanageable; just turn it off if it gets in y... by geodel on Wednesday April 27, 2022 @10:49AM (#31180573)
I guess, that person is just being sarcastic. However besides certification, qualification etc I think huge factor is cost of IT project is variable. And even worst failures are mainly delays, extra budget or moving work to different vendor/product. So companies can save money without endangering lives.
Re:SELinux is unmanageable; just turn it off if it gets in y... by taneq on Wednesday April 27, 2022 @08:55AM (#31179254)
A bridge, even a fancy modern one, is pretty simple compared with the software running on a 90s-era computer, much less a modern computer. Fizzbuzz is probably about equivalent to building a simple engine out of a box of parts.