Comment by coldtea
13 years ago
>When a disaster occurs in engineering, the lessons learned are applied to the next design.
And how does that work for software engineering thus far?
What we know of it, is that errors tend to repeat themselves, and little is learned from design to design, especially across projects and teams.
Software engineering is much more like law than civic engineering.
So, it's quite invalid to compare law (which deals with people, perceptions, norms, ever shifting societies and situations, intentions and other delicate situations) with some well known ways to build things with very tangible, hard physical constrains and behavior.
And how does that work for software engineering thus far?
Quite well, in the long run. Ten years ago we had mountains of buffer overflow-ridden web software written in C++ being replaced by SQL-injection-vulnerable Perl and PHP. Twenty-five years ago the Morris worm easily found its way onto thousands of systems.
Now, tools like Valgrind help detect buffer overflows and other memory access problems, ORMs help prevent SQL injection, stringent standards are used for development of safety-critical systems (e.g. MISRA-C), and automated testing is much more widespread. Naive software developers still make naive mistakes, but as a whole, the industry is much better protected against known mistakes.