[parkerhiggins]

I've found that there isn't a lot of discussion or research around this subject. Shoutout to engprax, a compliance company, for clearly approaching the issue.

Is it actually an issue though? Software engineers by design (?) are not capital "P" professionals. There's no certification or board underwriting our work. Software engineering/developers have had the latitude to "move fast" and represent the only "professional" trade that has the ability to "try again" (with a deployment) versus a structural engineer for example.

> Dr Junade Ali CEng FIET, the Principal Investigator of the study, said: “Recent developments demonstrate the fundamental importance of software engineers being free to raise the alarm when they become aware of potential wrongdoing; unfortunately our research has highlighted that software engineers are not sufficiently protected when they need to do so. From software engineers facing mass retaliation for speaking up and banned gagging clauses still being used, to ‘industry-standard’ software development metrics not considering the public’s risk appetite; this investigation has highlighted systematic and profound issues with society-wide impact, given how integral computers are to all our lives.

With the ubiquitous nature of software in modern society are we at the point were we need certification? The development and certification of "industry-standards"? This theme, balancing innovation with responsibility, is throughout the the Biden Administration's Executive Order on the Safe, Secure, Trustworthy Development and Use of Artificial Intelligence (Order).

Who is really responsible though? The developers who wrote the code? Or the executive who ordered the change?

There's are plenty of examples of this in recent history. Where engineers/developers released code they knew was harmful/fraudulent but did so anyway under fear of retaliation.

> FTX (Nishad Singh) https://www.reuters.com/technology/how-secret-software-chang...

> Pollen https://blog.pragmaticengineer.com/pollen/#:~:text=Later%2C%....

I wonder where this is going to go.

[creer]

> Is it actually an issue though?

The corporations (companies, not trade associations) should care - even if the engineers tough it out. It's often an issue to them. Besides avoiding costly incoming litigation, corporations shouldn't be in the business of encouraging fiefdom, empire building, all the way to outright racism or harassement in groups. None of this overall helps the corporation achieve its objectives. While a manager is busy hiring only their friends or whatever other hobby they have, they are not doing their job.

Conflicts of interest do appear when a corporation estimates a person or group does a very effective "technical" job in spite of their hobbies. Then there's a dilemna: rebuild that group or tolerate the BS a little longer. Even then, they really should care.

[tekla]

> Who is really responsible though? The developers who wrote the code?

Yes. The person who wrote the shit is responsible as much as the person who ordered the change.

[JohnFen]

I could not agree more.

We are all responsible for our actions and the results our actions cause. "I was just following orders" in no way absolves anyone of that responsibility.

That you may pay a price for doing the right thing doesn't make avoiding doing it acceptable.

[partdavid]

This might be the first time you've considered the question, but it's not novel. The ACM has a code of ethics required for membership. A compatriot of mine has focused on encouraging employers to pay for their engineers' ACM memberships, and require membership, as a way of advancing ethical standards in the profession.

Of course it's not perfect, but it's not like it's the first time it's occurred to someone to address.

[terminous]

> The ACM has a code of ethics required for membership.

The ACM has never taken action against an ACM member for an ethics violation that was not directly related to research misconduct in an ACM publication (edit: or inappropriate behavior at an ACM conference). Unlike a medical board or bar association, the ACM has no capacity, resources, or staff tasked to enforce even research ethics violations outside of ACM publications, much less ACM members day-to-day work they don't submit to a publication. And even then, it is up to the peer reviewers and editors of that publication. Otherwise, it remains just a list of suggestions.

At one time the ethics code said ACM members should respect terms of service, which means no bots or web scraping, but that was never enforced. You can find tons of research in ACM publications that uses web scraping of big sites that prohibit it in the ToS. The ACM certainly doesn't have capacity to police ethics violations by ACM members in industry. And if it started to do so, I suspect you'd see ACM membership plummet by those who fear they could be next.

[throw_m239339]

> Is it actually an issue though? Software engineers by design (?) are not capital "P" professionals. There's no certification or board underwriting our work. Software engineering/developers have had the latitude to "move fast" and represent the only "professional" trade that has the ability to "try again" (with a deployment) versus a structural engineer for example.

You're turning the word professional into a euphemism, it isn't. It's a profession when you are paid to do the task. Industries have already plenty of regulation by sectors, there is no need for more regulation, it already exists. A "software engineer" wide certification will only create more gatekeepers in a domain that has too many of them already. There are already certifications within each industries that software developers serve. I'm absolutely opposed to any sort of certification process for software engineering itself. Within a certain sector? Banking? Avionics? Cars? Sure. And these already exist.

Every time something shady is talked about on HN you have a bunch of people coming in and talking about "Think of the children, there needs to be a certification for deploying a freaking blog on a server". Just No.