My professional responsibility to complain about software (#1287)

Topics/tags: Technology, Autobiographical

People who know me know that I complain about software and software-related processes. I complain a lot.

Our recommendation system pulls incorrect data? I complain. Our encryption system is vulnerable to man-in-the-middle attacks? I complain. Our backup software does not provide a natural way to restore/identify hidden files and does not correctly restore soft links? I complain. Our student information system chooses the wrong category for certain classes? I complain. Our accommodations system’s UI encourages less-secure behaviors? I complain. Our protocol for reserving rooms raises privacy issues? I complain. [1]

Here’s the thing. As far as I know, it’s my professional responsibility to complain [3]. What do I mean by that?

I’m a member of the Association of Computing Machinery (ACM). The ACM has a Code of Ethics. As a member of the ACM, I have an obligation to do my best to follow the code. Here are two relevant parts of the code.

2.5 Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks.

Computing professionals are in a position of trust, and therefore have a special responsibility to provide objective, credible evaluations and testimony to employers, employees, clients, users, and the public. Computing professionals should strive to be perceptive, thorough, and objective when evaluating, recommending, and presenting system descriptions and alternatives. Extraordinary care should be taken to identify and mitigate potential risks in machine learning systems. A system for which future risks cannot be reliably predicted requires frequent reassessment of risk as the system evolves in use, or it should not be deployed. Any issues that might result in major risk must be reported to appropriate parties.

2.7 Foster public awareness and understanding of computing, related technologies, and their consequences.

As appropriate to the context and one’s abilities, computing professionals should share technical knowledge with the public, foster awareness of computing, and encourage understanding of computing. These communications with the public should be clear, respectful, and welcoming. Important issues include the impacts of computer systems, their limitations, their vulnerabilities, and the opportunities that they present. Additionally, a computing professional should respectfully address inaccurate or misleading information related to computing.

All the examples above fall within these categories. If our recommendation system pulls incorrect data in one situation, what else might it be doing incorrectly? That’s risky. It falls under 2.5. People who use our encryption software should know about man-in-the-middle attacks and understand their vulnerability. Complaining about it falls under 2.7.

So, the next time you hear me complain about software, remember, It’s my professional responsibility!

Or maybe I’m just a curmudgeon.

On a somewhat more serious note, there are other reasons I raise concerns about software. Most importantly, the people who have created or installed the software aren’t always aware of flaws. In some cases, once they hear about the flaw, it’s an easy fix. Reporting on flaws folks already know about may give them additional incentive to fix those flaws. If one person complains, you can ignore that person. If a hundred people complain, it’s much harder to ignore them.

The people who develop and support software are rarely the people who use such software. I’ve had many instances in which I’ve complained about something, and the response was, I didn’t know people did that.

Reporting on flaws also helps people learn and think about deeper issues. For example, it can help people develop more of a security mindset. I often complain about UI issues. How do people learn to develop better UIs if they don’t hear what’s wrong with the current one?

As in the recent instance of my response to the common use of arrow buttons to mean submit on some Qualtrics forms, I sometimes try to provide guidance on how to repair flaws. However, I don’t always have enough knowledge of the underlying system to provide suggestions.

So, I have lots of reasons to complain. Perhaps I shouldn’t use the word complain. Maybe raise issues. Raise concerns. Mention issues.

But I’m a curmudgeon. Complain sounds like the right word.

[1] Yes, all of these are issues we face. And they are all issues I’ve complained about. Few have been addressed. Many are out of our control, since they are inherent in the software we’ve chosen [2].

[2] Or that someone has chosen for us.

[3] Just like the title of the musing suggests.

Version 1.0 of 2024-06-04.