{"id":2661,"date":"2011-06-03T12:23:17","date_gmt":"2011-06-03T16:23:17","guid":{"rendered":"http:\/\/judykat.com\/ken-judy\/?p=2661"},"modified":"2011-09-30T08:04:12","modified_gmt":"2011-09-30T12:04:12","slug":"success-failure-future-software-development","status":"publish","type":"post","link":"https:\/\/judykat.com\/ken-judy\/success-failure-future-software-development\/","title":{"rendered":"A plea to my fellow developers and our employers [Harm]"},"content":{"rendered":"

\"waterRevelations today about a security breach at Sony Pictures<\/span>. If the claims are true, the company failed to take even minimal steps to protect the identities of their users. Passwords were stored in plain text.<\/p>\n

There are many reasons why this happens: naive business sponsors, inexperienced or pliable developers, poorly thought out or narrowly defined requirements, lack of regard for user privacy, and simple schedule pressure that leads to mistakes and cut corners.<\/p>\n

It is unacceptable to assume stored user information is not sensitive simply because your site doesn’t do anything sensitive with it. <\/p>\n

People re-use passwords. They shouldn’t but they do. They may only be signing up with you for access to white papers but that username and password may crack facebook, paypal, capital one, or any number of other websites.<\/p>\n

We can’t treat websites as something less than software, cram as many front facing features into them with as little time and investment as possible and expect a serviceable, safe, and usable consumer experience. <\/p>\n

We can’t treat developers as disposable widgets that are there to “work hard” and “do what they’re told” and expect them to watch our back by behaving as ethical professionals and crafts people. <\/p>\n

We can’t expose customers to this kind of risk and expect to retain them as customers.<\/p>\n

The best way to encourage new and onerous legal obligations is to act irresponsibly because there is no current legal obligation to do otherwise.<\/p>\n

There is a historical pattern. A new field starts generating significant wealth and the resulting products and services become widely adopted by society. As a result of that success, failure becomes more visible, more frequent, destroys more wealth and harms more people.<\/p>\n

The industry, practitioners and the government step in to reduce the failure rate. The typical result is government licensing of practitioners and regulation of businesses, accreditation of training organizations, and professional bodies with codes of practice and certifications. <\/p>\n

I’m not against any one of these things if they evolve gradually. <\/p>\n

But if we create another “software crisis.” This time one that affects the safety of large swaths of society or the wealth creation their trust of the internet represents. Then these things will happen too rapidly, too thoughtlessly. <\/p>\n

So, here’s my plea to product people and executive sponsors:<\/p>\n