Secure Coding mailing list archives

Re: Interesting article ZDNet re informal software development quality


From: George Capehart <gwc () acm org>
Date: Wed, 07 Jan 2004 00:24:04 +0000

On Tuesday 06 January 2004 03:28 pm, Crispin Cowan wrote:

<snip>


IMHO, this article makes the grave error of assuming that the
author's favorite methods are the only viable path to software
quality. It ignores the empirical result that open source's
apparently ad hoc methods are quite capable of producing quality
software artifacts. Rather than whinge about lack of compliance with
failed methods, software engineering researchers would do well to
study the methods used by successful open source projects, and
attempt to abstract new methods that may help to produce quality
artifacts. Arguably, newer methods such as XP (Extreme Programming)
are doing exactly that.

I agree with the sentiments.  I'd like to take them a step further, 
though.  I spent a lot of time in the manufacturing envrionment and led 
several BPR projects.  They all had a quality component to them, but 
used different (quality) methodologies.  After a while I came to 
believe that for quality (as for security), process is important.  The 
nature of the process is not anywhere nearly important as is the 
discipline and focus of the process.  What I mean is this:  Whether it 
be waterfall, RUP, XP, or whatever, if quality(/security) is important 
to the process, it will be there.  If quality(/security) is *not* 
important to the process, it will not be there, even if the process is 
CMM Level 5.

My (rapidly devaluing) $0.02 USD.

/g








Current thread: