Secondly, a large percentage of developers do not have a CS degree. There's also a significant number of educations that are not specified as a CS degree, but still teach people skills with the aim of them entering the workforce to work as developers
It's also unclear how domains where software is developed as a tool, but isn't a primary focus (i.e. bioinformatics)
US has next to zero privacy protections, and unlimited investor money with zero expectations for a company to ever turn profitable. E.g. all of YCombinator's "top companies" lose hundreds of millions and billions dollars a year.
China and Russia have cheap labor and yes, zero privacy.
Edit: the same people who clamor for Russia and China-style big companies will immediately shout for government to step in if any company ever gets to the size and influence of Yandex or AliBaba.
No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. Even if all of YCombinat companies except one lose hundreds of millions, the last one can turn into a Facebook, worth hundreds of billions.
And yet, YCombinator's top companies lose billions for years and keep getting the money. What's the "proven path to profitability"? The flimsy belief that "just wait a bit and we'll have a next Facebook?"
Most of the companies that get mentioned as "big innovative companies" in HN threads have been around for 5+ or even 10+ years, lost incalculable amounts of money, never turned a profit, and we're led to believe that there's an expectation to turn a profit in any of these scenarios.
One in five US citizens is protected by a regulation that looks an awful lot like GDPR. And if history is any guide, it won't be long before that number gets a lot closer to 100%.
EU laws apply to all member states and even entities just dealing with EU members (which is why Privacy Shield is dead again, USA lied).
They do, in fact, when it does business in California. (Also, California is less than 1/5 of the country, so the reference is not just to California law.)
Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.
Physical presence is not a requirement for commerce clause nexus (though it definitely satisfies it.) I’m not sure it ever was viewed as a requirement outside of sales taxes, and the precedent establishing it as a requirement for sales taxes was overturned by the Supreme Court in South Dakota v. Wayfair (2018).
> Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.
The “fun law” is the Constitution's Commerce Clause, and that’s not actually how it works.
from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys.
I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law.
I'm totally rooting for this because its the only thing that will improve security.
Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance.
> I'm totally rooting for this because its the only thing that will improve security.
So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?
It's already hard enough to hire software engineers, how hard would it be after further restricting to only software engineers with a relevant masters? I know I'd be entirely forced out of the field, and would have to undertake a 4 year course (abroad, because here it would be 6 years) to be eligible for employment again, if that happened in my country.
As it is, I think this is going to be very similar to what is already required for some specific industries like healthcare or finance. Startups that want to operate in these industries already need to go through some certification processes of their products and services. Most startups will probably fall under the "low risk status" category until they are a big enough. If self-assessment is anything similar to what it is already required for things like PCI DSS or GDPR, then most small companies will be fine until they are big enough to care.
And by the way, there is no easy way for the EU to regulate that to write software you need a specific degree.
There is absolutely nothing good with that.
> but the software systems that control power in the hospital do not, even if they would allow hackers to shut down electricity for all ventilators
This is straight out false.
> Almost every other engineering profession needs to adhere to a variety of standards and is subject to certifications and review, except for software engineers.
This isn't a engineer certification process to begin with. This is just government overreach and regulatory capture which is going to siffle innovation because of all the legal liability created by the EU. This will burden open source projects with bureaucracy and effectively kill open source in Europe. Apple, Microsoft, they have the money to comply to all that garbage, and it will also put a huge legal burden on independent developers. Big consultancies are Big Tech are the only one happy to get rid of all the competition.
Imagine if all EU startups, the little that EU has, were forced to run their whole stack products from corporations that have the means to comply to all these regulations, do you really think that any of these startups would use open source projects like Linux, PHP, Ruby, Python, framework X or Z that didn't pay for a compliance review at first place? Startups are a thing because entrepreneurs don't have to pay big bucks to Microsoft, Accenture, Cap Gemini, ...
This is a bureaucratic Diktat under pretense of "cyber security".
"Traditional" engineering never had to deal with this much complexity. We make do, because our tooling (which itself suffers from said complexity) is somewhat decent at catching many classes of problems before they cause IRL harm: a compiler is somewhat likely to yell at you before you push the broken code to production, CI makes sure you actually ran the tests, etc. Working *on* these tools also requires a broadly similar skillset as working *with* them, whereas e.g. an architect needs an incredibly different skillset from someone building CAD software. So the tools get "better", so the software can continue growing more complex.
So all of this (and much more) effectively lets us get away with much more complexity, and I think it's the crucial bit that people calling for more regulation miss. I am a software development professional, 15 years in the industry. I am scared shitless with how all of my tools, libraries, "supply chain" - are so complex, indecipherable, opaque, impossible to understand. I've been working on this one project for over 4 years now, and I'm yet finding bugs that were introduced 3 years ago. How can *you*, as an independent outside reviewer, help me in any capacity, if it takes several months just to onboard someone, and additional domain expert knowledge (video delivery) to fully understand? If you can do it, well, I'm gonna hire you to work for me instead.
But if you can't understand it - what are you certifying? That it didn't break in your lab? We already run a staging system - thanks for double-checking, I guess?
Every other engineering profession has actual physical phenomenon that governs them, leading to concrete standards that can be applied.
Software doesnt. Debates on whether OOP or functional being 'the thing', client-side vs server-side delivery, typing or not typing, TDD or not and many more are still ongoing without any objective resolution. No side of any specific debate can objectively demonstrate their argument. Its all based on preference and biases. Even the concept of 'good practices' in any given field changes every 2 years.
In this environment, attempting to bring concrete standards in software like other engineering fields would just end up in whichever group getting the upper hand in the regulatory body or political parties enforcing their own paradigm on everyone else, at the cost of innovation and productivity.
...
This is before the fact that German business interests dominate the Euparl at this moment, and this law seems to have been crafted to cater to their interests - crippling and pushing out Open Source and private small software producers by ambiguous, brutal fines that they can never afford but the big business can. The users of these Open Source and private small software producers will have to go and become the users of the software and SaaS of these big corporations when those Open Source and small private software producers are bankrupt or pushed out.
The biggest and most evil attack on Open Source in decades.
A lot of the author's criticism is centered on the lack of a designated standards body and software standards. That seems slightly unfair, given the fact that this is still a draft law, so obviously it is still waiting to be implemented and further specified through a standardization process. In general, it should be seen as a positive when a law doesn't set out specific requirements - which might be out of date - a few years later - but rather leaves it up to a body filled with industry representatives and experts to figure out the exact standards.