Secure Coding mailing list archives

Re: Interesting article ZDNet re informal software development quality


From: Crispin Cowan <crispin () immunix com>
Date: Thu, 08 Jan 2004 14:48:19 +0000


Alun Jones wrote:


I hate to say it, but maybe it's time for developers to become accredited
professionals, and for employers to insist on getting qualified developers,
rather than picking anyone who's read a book on C.


What would they be accredited of?

Professional civil engineers are accredited of knowing the right 
cookbooks that determinstically produce safe buildings. They sign their 
designs, so that if a building or a bridge falls down, you know who to 
blame: if it was built according to the engineer's design spec, you 
blame the engineer for a defective design. If the builder deviated from 
the design spec (which is what happened when that large terrace 
collapsed and killed bunches of people at a party in Chicago 20 years 
ago) then you blame the builder for kludging the design.


None of this can work for "professional" software "engineers". There is 
no cookbook for reliable software. A programmer can follow all of the 
best practices, and still produce software that crashes & burns. Worse, 
there is controversy over what the "best" practices are, so you can't 
even hold a programmer accountable to a single procedure.


So what is it that we would be accrediting?

Crispin

--
Crispin Cowan, Ph.D.  http://immunix.com/~crispin/
CTO, Immunix          http://immunix.com
Immunix 7.3           http://www.immunix.com/shop/









Current thread: