Let's blame the dev who pressed "Deploy"

[aum]

Yesterday I was browsing /r/programming and came across a blog post titled “After CrowdStrike, Programmers Deserve Consequences.” The author opens up with a comparison of Software Engineers to an Anesthesiologist or a Structural Engineer, and tells a personal story about his friend who got stuck in a hospital due to the CrowdStrike outage. And it’s true—software bugs can kill people. Mistakes in airplane autopilot software, or malfunction in equipment run by software—can cost the lives of people.

 

But then the author engages in an absurd rant about how the entire software engineering industry is a “bit of a clusterfuck”, and makes a delusional claim how software engineers should bear the responsibility for bugs and outages. It’s not the first time I hear these arguments. I remember when VW emission scandal was revealed, people had the same arguments: the developer(s) who coded the bypass—should be responsible. I’ll explain, in the end of the article, why I don’t think developers should be responsible, but for now, let me give you some more figures to blame.

 

We can start with the CEO. When you argue with CEOs why they deserve such a big pay and bonuses, they will usually say something along the lines of: “Entrepreneurship implies huge risk and lays the responsibility for failure on the shoulders of the founder/CEO”. And it’s true. Founders/Entrepreneurs bear a lot of risk. They go on raising money, getting into debt, take the role of running a company and they, usually, enjoy the result of their success—which is translated to a nice salary—or bear the consequences of failure. At least they used to.

 

I remember times when leaders had dignity and self-respect. They would go on stage and apologize. They would take responsibility and outline an action plan. Some even stepped down from their position as a sign of failed management. But today? Today, they hide behind an army of PR people who write blunt, soulless, unsympathetic press releases, blame their customers and compare their employees to a number in a balance sheet. They no longer care about serving the public, but rather generating profit for investors.

 

And, usually, they fail upwards. George Kurtz, the CEO of CrowdStrike, used to be a CTO at McAfee, back in 2010 when McAfee had a similar global outage. But McAfee was bought by Intel a few months later, Kurtz left McAfee and founded CrowdStrike. I guess for C-suite, a global boo-boo means promotion.

 

But if C-suite fail upwards, then the next obvious party to blame is the Customer. We could blame United or Delta that decided to run EDR software on a machine that was supposed to display flight details at a check-in counter. Sure, it makes sense to run EDR on a mission-critical machine, but on a dumb display of information? Or maybe let’s blame the hospital. Why would they run EDR on an MRI Machine?

 

We should blame the IT department in these companies. Unless we understand that the IT department was simply trying to check a box in a stupid regulation imposed by the government. So it makes sense to blame the Government. A government that creates absurd regulations by senile people whose familiarity with technology is limited to their TV remote. Have you seen the absurd questions by the US senate to tech entrepreneurs?

 

Politicians are good at what they do—creating regulations. The companies are then left at the mercy of implementing these regulations. I imagine an IT specialist trying to explain to his manager how it makes no sense to install EDR software on an MRI machine, but his manager has no clue about it and simply tries to follow the regulation. So maybe we should blame the middle management? The same middle management who cuts corners because they need to demonstrate KPIs, or fulfill unrealistic deadlines that they, themselves, created?

 

Or, we cane go a level higher and blame the board. The board who cares only about one thing: $$$. How can we save dollars? Let’s fire, sorry layoff, some engineers. Clearly, these overpaid peasants don’t deserve the money they are getting paid, and we can remove some of them. Or better, replace them with AI. I won’t be surprised if this outage was caused by CorwdStrike trying to “optimize” it’s pipeline but firing laying off some QA engineers and or replacing them with AI.

 

But the truth is, we can’t blame any of the above. They are the innovators, the entrepreneurs, the backbone of our economic systems. They all fail upwards. The white knights of our modern society. Smartest, most successful individuals whose words and practices should be taken without questions as if they spread the message of God himself.

 

No, we can’t blame them. Instead, we should blame the peasants. These dirty developers who make a lot of, unjustified, money, whose work can be replaced by AI.

 

You want to gate keep the word “Engineer”? You want to compare Software Engineers to Structural Engineers? Then I have a shocking discovery for your. A Structural Engineer won’t sign off a design that was made under pressure or with cut corners. He will shift the blame to the construction if they decide to use a different type of steel or cheaper screws. And if you decide to replace an Anesthesiologist with AI, then good luck to you.

 

The reason why Anesthesiologists or Structural Engineers can take responsibility for their work, is because they get the respect they deserve. You want software engineers to be accountable for their code, then give them the respect they deserve. If a software engineer tells you that this code needs to be 100% test covered, that AI won’t replace them, and that they need 3 months of development—then you better shut the fuck up and let them do their job. And if you don’t, then take the blame for you greedy nature and broken organizational practices.

 

Because blaming software engineers is nothing more than satisfying the bloodthirsty public for your organizational malpractices. Sure, you will get the public what they want, but you won’t solve the root cause of the problem—which is a broken pipeline of regulations by people who have no idea what are they talking about, to CEOs who are accountable only to the board of directors, to upper and middle management who thinks they know better and gives zero respect to the people who actually do the work, while most of the latter just want to work in a stable environment where they are respected for their craft.

 

Source