in reply to Programmers should be board-certified, just like doctors, lawyers, and CPAs
in thread "Buffer Overflow" rant in Risks Digest

5 minutes after such a liability law was passed, I would decide never to post code publically to places like PerlMonks, and not to post code to places like CPAN.

Even if I was perfectly sure that I wrote code with no mistakes, there is no way I want to have to prove that in a court that is hard for me to get to because some idiot in South Dakota refused to understand that the bug is in their code, not mine. And, of course, I am not perfectly sure. Reasonably sure? Yes. But if you are writing software for monitoring hearts, and you use code I gave away for fun, then should be your responsibility to validate that the code is sufficient to your needs before you use it.

I think you will find that, no matter how you cut it, this is a thorny issue.

  • Comment on Re (tilly) 1: Programmers should be board-certified, just like doctors, lawyers, and CPAs

Replies are listed 'Best First'.
Re 2: Programmers should be board-certified, just like doctors, lawyers, and CPAs
by dragonchild (Archbishop) on Jan 08, 2002 at 03:00 UTC
    If:
    • you post code and
    • you claim it is certified
    You should be held liable. But, if either is not true, then you shouldn't be held any more liable than you can be right now.

    ------
    We are the carpenters and bricklayers of the Information Age.

    Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

[reply]
      I have a more modest proposal for you.

      If I sell you code, or anything with software in it, I am liable for any damages caused by my bugs and cannot disclaim it. If I come to any kind of licensing arrangement for a fee, the same should be true. This proposal, while it runs completely counter to the directions that software companies want to push the world, is in line with the concept of implied warranties that apply in virtually every other industry. Were Microsoft selling cars, it would have to pay for the equivalent of viruses in that technology. Why shouldn't it have to pay for having virus-prone software?

      But I guarantee you that given a choice, software companies will never accept liability for anything. There are good reasons why not. In fact it is exactly this issue which led to the current state of affairs in software. It is exactly parallel issues with, for instance, cars that led to lemon laws and implied warranties. (The avoidance of which caused software companies to avoid actually selling anything...)

      Therefore if we want companies to create secure software, someone needs to be liable. We just have to do it carefully so that open source software when given away does not cause liability. (Note that open source software, when sold, would then have liability associated with it. Presumably people wishing to do that would therefore have incentives to audit what they are selling...)

[reply]
        Cost centers and profit centers. *ponders* Hrmmm... So? There are large implied cost centers to licensing doctors. Yet, hospitals won't accept any Joe off the street to put on a bandaid in their ER, let alone do open heart surgery. Why? Because it's the law that only board-certified doctors can perform medicine.

        Why is there a problem here, in a profession where it is theoretically possible to guarantee that the product is defect-free. This is the very profession where certification should be something which is embraced! Why the resistance?

        ------
        We are the carpenters and bricklayers of the Information Age.

        Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

[reply]

In Section Meditations