If you’ve been around the web development community for a while, you’ve likely encountered this comic from XKCD. In said comic, aeroplane designers and construction engineers are shown boasting about the safety of their fields, while some software engineers are shown panicking when asked about voting software.
With the presumed message being that software engineering is less ‘professional than other fields, because we’re still unsure about the security/quality of our work, and consider normal people’s worries about it as not unfounded.
But is this really accurate or fair? Is the attitude towards voting software here really a bad thing? Are software engineers unique in regards to these attitudes?
Personally, I’d say the answers to all three questions is no. The comic is not fair on software engineering, and the way it’s often interpreted is too harsh on the field as a whole.
For starters, comparing voting security to plane safety isn’t a fair comparison. Plane safety is certainly super important and all, but fundamentally, the idea behind a plane is a good one. It’s a vehicle that transports people and objects through the air using principles easily understandable to those in the field.
And the know how to make said form of transport safe is perfectly logical too. There’s nothing in aeroplane safety that provides conflicting requirements or logical problems.
Voting software is not like this. The idea isn’t just difficult to do right, it might well be impossible to get right.
That’s because the requirements there are in direct conflict with each other. You want polling to be anonymous enough that no one can know who anyone voted for, while simultaneously being secure enough that no one can vote multiple times. Oh, and the user needs to know their vote went through correctly, and have complete trust in the whole process.
That’s not just difficult to achieve, it may be flat out impossible. Such voting software isn’t just a hard technical problem, it’s a flawed, nigh impossible one on a conceptual level too.
And many of those issues aren’t technical, they’re social. People not trusting the software isn’t something you can fix with UI design, it’s a problem tied to the majority of the population not really understanding computers. It doesn’t mean if the software was written in a scientifically perfect way that can be 100% verified, most people don’t have the foggiest idea what any of that means. Verifying their vote is incorrect isn’t really a technical problem either, since they never know for sure if it was counted with a computer/machine based solution. Nor is having confidence in the system itself.
So you’re stuck regardless of what you do, and no engineering certifications or deep level knowledge will save you. People don’t use paper ballots because they can’t grasp the tech needed for a computerised solution, but because the former is better to solve the problem, and can be understood by any old moron.
Every field has examples of this. Every field has ideas which make sense at first glance, but which prove to be fundamentally flawed the more you look into them.
Like flying cars. Just like online voting, this too is an idea almost anyone can come up with. Just like online voting, it too has obvious benefits.
But just like online voting, it’s a questionable idea that may turn out to be incredibly challenging to do right. For one thing, planes aren’t cars, and the ability to drive a car doesn’t mean you can pilot a plane.
And they’re also far more dangerous when they go wrong too, as well as easy to mess up when driving. Add this to regulations, ease of use, etc and a flying car might be a risky or even impossible proposal.
So automotive and aviation engineers would probably dissuade this one too. Just like a software engineer would worry about voting machines and software, one of these other engineers would worry about putting their lives at stake in a mini plane/helicopter driven by someone with just a regular old driving license.
Such problems and use cases are everywhere, in every field. They’re not exclusive to software engineering or web development.
As is negativity about your own field and how it’s managed. Think programmers are the only ones who believe their craft is full of amateurs, hot air and poorly thought out ideas?
Think again. Teachers believe the same thing about teaching, perhaps even more so.
Virtually everyone there hates the administrators, curriculum, policies like No Child Left Behind’, many attempts at ‘modern’ techniques, etc. Almost everyone there knows the field is full of snake oil salesmen peddling pseudoscience to schools and colleges.
And they’ll gleefully tell you at every opportunity. Ask a teacher what should be done to improve teaching, and it sure won’t be what’s happening at the moment.
Same with online marketing. Ask people there what they think of the state of their industry and how their competitors (or even company) are doing okay, and they too will regale you with stories about poorly planned campaigns, people with no idea what they’re doing, and con artists taking everyone for a ride. Hell, they’ll say that about Google too.
So neither a lack of confidence in questionable ideas nor a disdain for the situation in your field is unique to programming/software engineering.
And nor is the presence of said confidence a good sign overall. Again, plenty of professionals in other industries tout how well their area of expertise works and how safe/secure/fantastic everything is while things fall apart around them.
The fact software engineers don’t isn’t a sign of low standards, it’s a sign of humility, something which more people need to know in general.
There’s also an interesting point made in this article, in that physical design/engineering and software engineering have different threat models. Put simply, the latter is often under deliberate attack from malicious actors, while the former mostly has to deal with accidents, natural disasters and the laws of physics.
Which is especially true of voting setups. We do have to worry about security risks when it comes to voting machines and online systems, because those will be common targets for enemy nation states, spies and political extremists. Attacks on those are cheap, fairly easy for well resourced opponents, don’t put their own staff at risk of retaliation and are less likely to cause an international incident when they get uncovered.
Meanwhile if say, Russia tried to attack the physical polling infrastructure at election time, that would be suicidally stupid on their part. If they tried a Watergate type scenario and broke into the polling stations/counting locations and tried to stuff ballots, there’d be a huge uproar, massive amounts of international condemnation against them, and the potential for economic sanctions, political sanctions or outright war.
So a physical system can be designed to work within the laws of physics without much worry of attackers, whereas an online or software based solution has to be hardened against said attacks.
Either way, the comic is misguided, and just cherry picks examples that would get the same reaction in other fields elsewhere.
Thanks for reading!
