Obviously, the fact that most software development shops get specs wrong or write incomplete specs isn’t a justification for ceasing to use them or try to make them better, right?

Thanks to Ted for noting the connection between security and all this debate over software development methodologies. To quote him “secure systems are about controlling mis-use.” And yet most functional and technical specs still focus only on describing the (proper) function of the software under normal conditions, not its misuse under abnormal conditions.

The bigger story is the way that many wealthy and high profile manufacturers that have operated outside of the tech industry are now becoming, in essence, software publishers – think “smart TV,” “smart auto,” “smart coffee maker,” “medical devices,” etc. In theory, these wealthy manufacturing concerns should extend their quality engineering to the software that runs their hardware. In practice – not so much.

Paul

There are many ways to solve this problem. Lightweight, iterative planning is one way. But, we could get better at planning. We could improve the system at what I assume is the business analyst layer — better requirements gathering, better writing, better communication.

Now I will give the requisite example of building a bridge. If my bridge blueprints weren’t functional, I would get a more capable/thorough/experienced civil engineer, not get rid of the blueprint.

I’m currently at a company which has a process in place with multiple levels of requirements, security reviews, architecture reviews, compliance reviews. And yet, the project has timeframes that are so short that were we to spend enough time to completely and properly do the requirements, we would be in breach of contract. The business need to get functionality out is sufficiently great that we can tolerate issues we will have to address later on.

This tension between correctness and business needs is present throughout the industry. Skyrim needed to be released to make money. The fact that it had large numbers of defects did not kill it. Sony’s Playstation Network experienced a significant security breach, but I can imagine the project meetings before the PS3 launch: “Shortchanging analysis will not kill the company, but failing to launch this console will.” And, in the end, they were right. The PS Network breach was very painful, but not terminal.

You would never start building a house and then halfway through decide to build a car but often this is metaphorically what happens.