Slashdot Mirror
Why Buggy Software Gets Shipped
astonishedelf writes to mention an article in the Guardian about the hard reality of why buggy code is sold on retail shelves. From the article: "The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two, a new hire on the team or a customer, who is shocked that any software company would ship a product before every last bug is fixed. Every time Microsoft releases a version of Windows, stories are written about how the open bug count is a five-digit number. People in group two find that interesting. But if you are a software developer, you need to get into group one, where I am."
99% of the time it's because upper managment either promised the customers features that could not be implemented or gave the programmers too little time and/or resources to finish the job. While not software development, I am having to deal with a similar problem right now. We are moving our website to a new CMS system. So we have to move all of the content from our old pages to the new system using a slow, buggy, web based system. In the beginning we were told by IT that we had until June 5 to complete the move, so we scheduled our time accordingly. Things progressed slowly but in time to meet the deadline. Then Tuesday morning we get a call from the assholes in PR that we have to have everything done by this Friday. We just had our remaining time cut in less than half. There is no way we can get done, so the site will be incomplete. PR gets no blame and we look bad.
How about making a list of known bugs available to your customer prior to purchase?</i> I don't think the Board of Directors on any publicly traded company will allow this. The problem with many traded companies (and I'm using publicly traded companies since MS is mentioned) would be that the company wouldn't likely meet financials. Hence many pouring out shoddy programs. Imagine the trading price of MS if it did ship a list of known bugs alongside their products... I would think consumers would wait for a stable product before buying. Even if they did ship what they deemed a stable product, whose to blame for someone finding a flaw? The programmer who didn't have an insight to think outside the box similar to the hacker (and I use that term in its purest sense) who broke the product? Speaking of MS...
From: Microsoft Security Response Center <secure@microsoft.com>
To: "xxxx" <xxxx@hushmail.com>
Cc: Microsoft Security Response Center <secure@microsoft.com>
Thank you for the update with regards to your findings. We are still
going through the repro stages of the case and there appears to be some
confusion over the concern. Do you happen to have a network trace of the
behavior that I could work with our development teams in reviewing to
ensure that we are looking at the same concern and avoid any possible
confusion on the matter?
Thanks,
Adrian
Microsoft Security Response Center
I've broken MS' MSRPC in a real bad way. There are no ifs ands or buts. I passed the information off to Microsoft instead of passing code to a full disclosure list. I've replicated this over and over, remotely and locally. I know for a fact because of the architecture of networking they will never be able to fix this. So what would you think as a consumer about to purchase a product with a hole that can never be filled.
Infiltrated dot Net
How very black and white of you. So the large Investment Bank shouldn't ever put its new trading system in place, which has the potential to make them hundreds of millions of dollars, because of a couple of small, esoteric display bugs in the GUI?
The real world is all about risk/benefit analysis. The only places that ship guaranteed bug-free code are those where human life is directly affected by the output of that code. For anything other than trivially simple systems the cost/benefit analysis will rule out formal code proof in anything but the most necessary of circumstances.
The gift of death metal does not smile on the good looking.
And if our IT staff had the same intelligence, competence, and vision as our management team, we'd kill over 10,000 people a week.
The Independent: Reverend Spooner Arrested in Friar Tuck Incident - ISIHAC, Historical Headlines
Group 3 consists of people who acknowledge that fixing all bugs is impossible, and that judgement is necessary in deciding which bugs need to be fixed... but nevertheless contend that within the personal computer software culture in the United States, these judgements consistently err in the direction of shipping software with too many bugs.
The personal computer software culture in the United States is much like that of automakers in the United States circa the sixties, who insisted that the low quality of U. S. autos was the result of the best and wisest judgement... and that public toleration of low quality, as reflected in good sales and profits, validated their judgement.
Good sales and high profits, that is, until overseas competitors began to ship high-quality cars to the U. S.
"How to Do Nothing," kids activities, back in print!