licensing software engineers? i don't like the sound of this...

[Q Classic]

http://uk.biz.yahoo.com/031209/290/egmuy.html
and
http://www.sdtimes.com/news/093/story1.htm

the rationale:

“We license civil engineers to have confidence their bridges will support a certain amount of weight over a certain period of time. But is it bomb-proof? We need to define software in those terms,” Moritz explained. “Maybe the bridge isn’t bomb-proof but is earthquake-proof, so that it maintains its integrity under stress. We need to define software in those terms.”

now, there are valid points...

While he acknowledged that IT budgets vary widely even within vertical markets, a programmer at a small community credit union, for instance, should be held to the same standard as one working for Bank of America. “If that credit union is connected to the ATM backbone, what kind of damage can be caused” by software that was open to vulnerabilities, Moritz wondered.

i don't like the idea. i don't think it'll help matters much at all. microsoft hires licensed programmers and software engineers. the consumer has to pay through the nose, more than already; it won't help microsoft's security too much, being the gigantic target it is... idiot users will still download stupid spywares, or unwittingly turn their computers into spam redistributors...

[Kuciwalker]

huh?

[Urban Ranger]

Originally posted by Q Cubed
i don't like the idea. i don't think it'll help matters much at all. microsoft hires licensed programmers and software engineers.

You surely mean "certified." I cannot recall any "licensing" of programmers a la doctors and engineers. But most of these certificates are unreliable and some of them are jokes.

Originally posted by Q Cubed
the consumer has to pay through the nose, more than already

That has nothing to do with costs but with MS being a monopoly.

Originally posted by Q Cubed
it won't help microsoft's security too much, being the gigantic target it is... idiot users will still download stupid spywares, or unwittingly turn their computers into spam redistributors...

It's all a matter of design. If you design programs to be small, have clearly defined tasks, and keep everything tight, you can have secure software. Think DES.

[notyoueither]

Yeah right, and require only licensed engineers to contribute to *nix?

Can you say open sourse = dead?

[Neutrino]

Licenses can help ensure the software engineers have a proper grasp of good software development processes which reduce the likelihood of late, costly, buggy software.

[notyoueither]

Originally posted by Urban Ranger


You surely mean "certified." I cannot recall any "licensing" of programmers a la doctors and engineers. But most of these certificates are unreliable and some of them are jokes.

Most of MS's programmers are university graduates, as far as I know. At least, I think that's why they recruit all the major CompSci campuses in NA.

[Urban Ranger]

Originally posted by notyoueither
Yeah right, and require only licensed engineers to contribute to *nix?

Can you say open sourse = dead?

I say most of the contributors to *nix can pass the exams without breaking out much sweat. It's a matter of following sound and robust protocols and paradigms.

The fundamental design of Windows and other MS software is insecure.

[notyoueither]

The day that licensed, regulated, engineers are the only ones who can release code is the day that open source is deader than that parrot in the Monty Python skit.

MS won't mind at all, their programmers already earn engineer's saleries. In fact, I would think MS would gain from tightening up the rules for entry.

[Urban Ranger]

Originally posted by notyoueither
Most of MS's programmers are university graduates, as far as I know.

It doesn't matter, it's the way MS design and develop programs. If software engineers need license to do certain things and need to be personally responsible for them, like civil and structural engineers do now, they probably will have second thoughts and refuse to put their names down to authorise development efforts they consider insecure.

[notyoueither]

As far as I've heard, nobody is secure. Everyone has holes. It is just a matter of how big a bulls-eye you are wearing and how many people are trying to hack you.

[Urban Ranger]

Originally posted by notyoueither
The day that licensed, regulated, engineers are the only ones who can release code is the day that open source is deader than that parrot in the Monty Python skit.

No, the current engineering system does not work that way, which is the closest parallel to programming.

[notyoueither]

Oh really, how many community efforts do you see having bridges built to their specifications?

[Urban Ranger]

Originally posted by notyoueither
As far as I've heard, nobody is secure. Everyone has holes. It is just a matter of how big a bulls-eye you are wearing and how many people are trying to hack you.

That's not true (okay, I am limiting the discussion to remote, outside intruders vs a networked computer). There are formal methods to prevent security holes. Even if you don't use formal methods, there are existing methodologies to prevent security flaws.

Of course, it's a different story when general computer/network security is concerned.

[Urban Ranger]

Originally posted by notyoueither
Oh really, how many community efforts do you see having bridges built to their specifications?

How many community of engineers are there to build bridges in their spare time?

[notyoueither]

And the point of the whole issue is network security, isn't it?

/me points at the opening post

[notyoueither]

Originally posted by Urban Ranger
How many community of engineers are there to build bridges in their spare time?

Not many. Just like most of the contributors to *nix would be unqualified to even apply for a license [I am making a large assumption here based on my knowledge of open source enthusiasts and how few of them have a university degree in CompSci or EE].

[St Leo]

http://www.gnu.org/philosophy/right-to-read.html

Right to Read by Richard Stallman

This article appeared in the February 1997 issue of Communications of the
ACM (Volume 40, Number 2).

(from "The Road To Tycho", a collection of articles
about the antecedents of the Lunarian Revolution,
published in Luna City in 2096)

For Dan Halbert, the road to Tycho began in college--when Lissa Lenz
asked to borrow his computer. Hers had broken down, and unless she
could borrow another, she would fail her midterm project. There was
no one she dared ask, except Dan.


This put Dan in a dilemma. He had to help her--but if he lent her his
computer, she might read his books. Aside from the fact that you
could go to prison for many years for letting someone else read your
books, the very idea shocked him at first. Like everyone, he had been
taught since elementary school that sharing books was nasty and
wrong--something that only pirates would do.


And there wasn't much chance that the SPA--the Software Protection
Authority--would fail to catch him. In his software class, Dan had
learned that each book had a copyright monitor that reported when and
where it was read, and by whom, to Central Licensing. (They used this
information to catch reading pirates, but also to sell personal
interest profiles to retailers.) The next time his computer was
networked, Central Licensing would find out. He, as computer owner,
would receive the harshest punishment--for not taking pains to prevent
the crime.


Of course, Lissa did not necessarily intend to read his books. She
might want the computer only to write her midterm. But Dan knew she
came from a middle-class family and could hardly afford the tuition,
let alone her reading fees. Reading his books might be the only way
she could graduate. He understood this situation; he himself had had
to borrow to pay for all the research papers he read. (10% of those
fees went to the researchers who wrote the papers; since Dan aimed for
an academic career, he could hope that his own research papers, if
frequently referenced, would bring in enough to repay this loan.)


Later on, Dan would learn there was a time when anyone could go to the
library and read journal articles, and even books, without having to
pay. There were independent scholars who read thousands of pages
without government library grants. But in the 1990s, both commercial
and nonprofit journal publishers had begun charging fees for access.
By 2047, libraries offering free public access to scholarly literature
were a dim memory.


There were ways, of course, to get around the SPA and Central
Licensing. They were themselves illegal. Dan had had a classmate in
software, Frank Martucci, who had obtained an illicit debugging tool,
and used it to skip over the copyright monitor code when reading
books. But he had told too many friends about it, and one of them
turned him in to the SPA for a reward (students deep in debt were
easily tempted into betrayal). In 2047, Frank was in prison, not for
pirate reading, but for possessing a debugger.


Dan would later learn that there was a time when anyone could have
debugging tools. There were even free debugging tools available on CD
or downloadable over the net. But ordinary users started using them
to bypass copyright monitors, and eventually a judge ruled that this
had become their principal use in actual practice. This meant they
were illegal; the debuggers' developers were sent to prison.


Programmers still needed debugging tools, of course, but debugger
vendors in 2047 distributed numbered copies only, and only to
officially licensed and bonded programmers. The debugger Dan used in
software class was kept behind a special firewall so that it could be
used only for class exercises.


It was also possible to bypass the copyright monitors by installing a
modified system kernel. Dan would eventually find out about the free
kernels, even entire free operating systems, that had existed around
the turn of the century. But not only were they illegal, like
debuggers--you could not install one if you had one, without knowing
your computer's root password. And neither the FBI nor Microsoft
Support would tell you that.


Dan concluded that he couldn't simply lend Lissa his computer. But he
couldn't refuse to help her, because he loved her. Every chance to
speak with her filled him with delight. And that she chose him to ask
for help, that could mean she loved him too.


Dan resolved the dilemma by doing something even more unthinkable--he
lent her the computer, and told her his password. This way, if Lissa
read his books, Central Licensing would think he was reading them. It
was still a crime, but the SPA would not automatically find out about
it. They would only find out if Lissa reported him.


Of course, if the school ever found out that he had given Lissa his
own password, it would be curtains for both of them as students,
regardless of what she had used it for. School policy was that any
interference with their means of monitoring students' computer use was
grounds for disciplinary action. It didn't matter whether you did
anything harmful--the offense was making it hard for the
administrators to check on you. They assumed this meant you were
doing something else forbidden, and they did not need to know what it
was.


Students were not usually expelled for this--not directly. Instead
they were banned from the school computer systems, and would
inevitably fail all their classes.


Later, Dan would learn that this kind of university policy started
only in the 1980s, when university students in large numbers began
using computers. Previously, universities maintained a different
approach to student discipline; they punished activities that were
harmful, not those that merely raised suspicion.


Lissa did not report Dan to the SPA. His decision to help her led to
their marriage, and also led them to question what they had been
taught about piracy as children. The couple began reading about the
history of copyright, about the Soviet Union and its restrictions on
copying, and even the original United States Constitution. They moved
to Luna, where they found others who had likewise gravitated away from
the long arm of the SPA. When the Tycho Uprising began in 2062, the
universal right to read soon became one of its central aims.

Author's Note

This note was updated in 2002.


The right to read is a battle being fought today. Although it may
take 50 years for our present way of life to fade into obscurity, most
of the specific laws and practices described above have already been
proposed; many have been enacted into law in the US and elsewhere. In
the US, the 1998 Digital Millenium Copyright Act established the legal
basis to restrict the reading and lending of computerized books (and
other data too). The European Union imposed similar restrictions in a
2001 copyright directive.


Until recently, there was one exception: the idea that the FBI and
Microsoft will keep the root passwords for personal computers, and not
let you have them, was not proposed until 2002. It is called "trusted
computing" or "palladium".


In 2001, Disney-funded Senator Hollings proposed a bill called the
SSSCA that would require every new computer to have mandatory
copy-restriction facilities that the user cannot bypass. Following
the Clipper chip and similar US government key-escrow proposals, this
shows a long-term trend: computer systems are increasingly set up to
give absentees with clout control over the people actually using the
computer system. The SSSCA has since been renamed to the CBDTPA
(think of it as the "Consume But Don't Try Programming Act").


In 2001 the US began attempting to use the proposed Free Trade Area of
the Americas treaty to impose the same rules on all the countries in
the Western Hemisphere. The FTAA is one of the so-called "free trade"
treaties, actually designed to give business increased power over
democratic governments; imposing laws like the DMCA is typical of this
spirit. The Electronic Frontier
Foundation asks people to explain to the other governments why
they should oppose this plan.


The SPA, which actually stands for Software Publisher's Association,
has been replaced in this police-like role by the BSA or Business
Software Alliance. It is not, today, an official police force;
unofficially, it acts like one. Using methods reminiscent of the
erstwhile Soviet Union, it invites people to inform on their coworkers
and friends. A BSA terror campaign in Argentina in 2001 made veiled
threats that people sharing software would be raped in prison.

When this story was written, the SPA was threatening small
Internet service providers, demanding they permit the SPA to monitor
all users. Most ISPs surrender when threatened, because they cannot
afford to fight back in court. (Atlanta Journal-Constitution, 1 Oct
96, D3.) At least one ISP, Community ConneXion in Oakland CA, refused
the demand and was actually sued. The SPA later dropped the suit,
but obtained the DMCA which gave them the power they sought.


The university security policies described above are not imaginary.
For example, a computer at one Chicago-area university prints this
message when you log in (quotation marks are in the original):

"This system is for the use of authorized users only. Individuals using
this computer system without authority or in the excess of their authority
are subject to having all their activities on this system monitored and
recorded by system personnel. In the course of monitoring individuals
improperly using this system or in the course of system maintenance, the
activities of authorized user may also be monitored. Anyone using this
system expressly consents to such monitoring and is advised that if such
monitoring reveals possible evidence of illegal activity or violation of
University regulations system personnel may provide the evidence of such
monitoring to University authorities and/or law enforcement officials."

This is an interesting approach to the Fourth Amendment: pressure most
everyone to agree, in advance, to waive their rights under it.

[Urban Ranger]

The Stallman article is railing against the DMCA and CBDTPA, not against software engineer licensing.

[notyoueither]

Programmers still needed debugging tools, of course, but debugger
vendors in 2047 distributed numbered copies only, and only to
officially licensed and bonded programmers. The debugger Dan used in
software class was kept behind a special firewall so that it could be
used only for class exercises.

How do you prevent unlicensed programmers from releasing code?

[notyoueither]

In short, it aint anything like conventional engineering, because the 'engineer' does not need anyone else's money or materials to have his concept built.

[Whoha]

Originally posted by notyoueither


How do you prevent unlicensed programmers from releasing code?

you can't but the idea is that the computer won't run unlicensed code. Ran into this in a Highschool cs class way back, all the crap they had installed on the computer wouldn't let us create files(lamer compiler needed to create 10 or so temp files), move them around,etc.

This was done in response to legitimate concerns though, the year eariler we were all either trading music or playing games on the computers. This shared drive was full of simpsons wav files. Some diligent person managed to install napster on EVERY SINGLE COMPUTER in the school. Some idiot in 8th period printed a bunch of porn on the school printer and just left it there. Because those bozos didn't have their act together they had to ban all of the 8th period class from ever touching a computer there again. All in all, a great time to be a student at that particular school.

And sure enough, as soon as the protections were ganked, for that room anyway we played games every once in a while.

[Gatekeeper]

Originally posted by Urban Ranger
The Stallman article is railing against the DMCA and CBDTPA, not against software engineer licensing.

True. Still, it sent shivers down my spine, FWIW.

Gatekeeper

[Mr. Harley]

The licensing is a control issue, as per Q-Cubed supposition. Both so people who get their degree have an economic advantage, and so the software companies have someone to blame.

Ever bother to read your licensing agreements for your software? Not only that, there is a standard business model legislation, whose name escapes me, that is suggesting to all state legislatures that they pass a similar code of strict non-liability (why you always see though disclaimers about except when permitted/prohibited by state law) - I believe Virginia and one other state already did. Programs are not secure in part because the software industry has gotten immunity from traditional liability law.

If an automobile company sells me a defective car, they have to fix it. If it's widespread, the term is a recall. If I get injured by the fault, then I collect my economic and punitive damages from them if I can prove it (i.e. Ford Explorers) Look at the crap MS has put out, security wise, and tell me that people who have been harmed by their shoddy products should not have the right to sue. Plus it would get all the class-action vultures out of the medical field, they'd be too busy chasing Microsoft.

[Urban Ranger]

Originally posted by notyoueither
How do you prevent unlicensed programmers from releasing code?

No you can't, just like you can't people from doing unauthorised civil works. However, most people know you shouldn't do unauthorised civil works, so I suppose the idea is most people should eventually know they use programs without a licensed software engineer's approval at their own risk.

Of course, there then are exceptions. For example, in Vancouver, you can build certain houses and structures without prior approval. So a similar structure can be put in place for software.

[Urban Ranger]

Originally posted by shawnmmcc
Ever bother to read your licensing agreements for your software? Not only that, there is a standard business model legislation, whose name escapes me, that is suggesting to all state legislatures that they pass a similar code of strict non-liability (why you always see though disclaimers about except when permitted/prohibited by state law) - I believe Virginia and one other state already did.

That's the dreaded UCITA.

Originally posted by shawnmmcc
Programs are not secure in part because the software industry has gotten immunity from traditional liability law.

That's why UCITA must die. Die, die, die!

[Asher]

Originally posted by Urban Ranger
That has nothing to do with costs but with MS being a monopoly.

Following this gorgeous train of logic, Apple should have a dirty cheap OS, since they do not have a monopoly...?

Yet it is obviously much more expensive than Windows is. Interesting.

It's all a matter of design. If you design programs to be small, have clearly defined tasks, and keep everything tight, you can have secure software.

They're only secure like that if you keep them in safes and don't let them interact with eachother.

That's one of those wonderfully nice theories that is bullshit in the real world.

[Asher]

Originally posted by Urban Ranger
I say most of the contributors to *nix can pass the exams without breaking out much sweat. It's a matter of following sound and robust protocols and paradigms.

The fundamental design of Windows and other MS software is insecure.

The fundamental design isn't insecure at all. In fact, the fundamental design of Windows is more secure than most Linux systems (real access control lists, for example). The problems are rather simple, but are often ignored or overlooked by zealots eager to slam MS:

Windows by default is designed for ease of use. Linux is not. Lots of the "security issues" people raise with Windows isn't a "fundamental design problem" of Windows like you keep harping about, it's the fundamental usage patterns of the users. Like having to be logged in under Administrator to install lots of programs -- this isn't a restriction of Windows, its a restriction of the laziness of people and therefore of the developers who make the products.

The entire hooplah about how secure Linux is is bullshit. Just recently, kernel.org was hacked and somebody inserted backdoors into the Linux sourcecode. Debian's servers were recently hacked. Newsforge.net has a weekly advisory listings for all of the security flaws in open source projects that week.

The mainstream press ignores open source vulnerabilities and hypes up the fear factor whenever an MS one is found -- because the people who watch their news and read their papes don't give a **** about Linux.

[Asher]

Originally posted by Gatekeeper
True. Still, it sent shivers down my spine, FWIW.

Gatekeeper

It should, Richard Stallman is a fanatical maniac who constantly tells bullshit to further his cause. He's far worse than the Microsoft PR department.

Take this paragraph for example:

Until recently, there was one exception: the idea that the FBI and
Microsoft will keep the root passwords for personal computers, and not
let you have them, was not proposed until 2002. It is called "trusted
computing" or "palladium".

The man either doesn't know what the hell Palladium is or he's intentionally spreading bullshit again.

The man's got an axe to grind with MS, he tells blatant lies but his rabid followings of under-sexed Linux zealots froth at the mouth and believe them because they believe Bill Gates is Satan and Microsoft is hellbent on world domination for the sake of ****ing people over.

[Asher]

Personally, I think this is a good idea.

IIRC, Texas is already contemplating adding software engineers to their engineering groups.

There's a reason it's called software engineering, and not computer programming. These things are fundamentally different and 99% of the people in this world equate them to the same thing.

Software Engineering is the practice of architecting programs. You design the components, how they work, and how they work together. You also map out the timelines, milestones, etc. and do research for how it should be done: extreme programming, waterfall, etc? Which language should it be in? Which API sets to use? What OS to use? etc.

Computer Programming is typing code. These people are commonly known as "codemonkeys".

Software Engineering jobs almost always require a university degree in computer science or software engineering, Computer Programming jobs are frequently obtained by people with a technical college diploma (not degree) or lots of practical experience in programming.

A rough analogy is to compare programmers to mechanics, and software engineers to mechanical engineers.

For example, at my university there are programming courses, and there are software engineering courses. The programming languages ones are about programming and are in the CompSci department. The software engineering ones are actually in the engineering department (SENG) and "responsibility" is heavily emphasized, and none of the course material involves programming.

[Sarxis]

Originally posted by Neutrino
Licenses can help ensure the software engineers have a proper grasp of good software development processes which reduce the likelihood of late, costly, buggy software.

Maybe yes, for certain applications (like the ATM backbone issue). But for video games, and other recreational and non-critical programs? Why be bothered?