C/C++ Users Journal, February 2006

"My definition of an expert in any field is a person who knows enough about what's really going on to be scared."

— P.J. Plauger, Computer Language, March 1973

I'm getting far enough along in my career now (read: nearing the end of it) to start quoting myself. The quote above, at least, has percolated around the Internet for several years now. It is sometimes listed as part of a set of cynical quotes, but it was not my intention to be cynical when I first uttered that sentiment. I thought I was simply being honest. (But then, some people equate cynicism with a lack of dissimulation.)

I've been doing some heavy debugging of late, which is what reminded me of that utterance. There's nothing like wading through 15 years of accumulated code to keep you humble. Sometimes I stand in awe of the sheer complexity that has accreted over the years—it can be a real asset. But after a day spent tripping across past kludges, oversights, and sheer botches, I also see the creeping atherosclerosis that dooms most nontrivial software. Don't get me wrong, our stuff is pretty good. And we make a point of cleaning up messes as we find them, so the rate of accretion is low. (Sometimes it's even negative for periods of time.) Nevertheless, at any point, those of us who know enough about what's really going on inside our software know what spots to be worried about. And so it is with all software.

Somewhere around here, the true cynics start to recite the usual canards about how immature the software business really is. To hear them talk, you'd think that there isn't a useful program running anywhere in the world. A million lines of code contains (pick one) dozens, hundreds, or thousands of bugs; so you can't possibly trust the output now, can you? And yet, on a personal scale, I can see that the dozen odd computers in our little enterprise run for weeks at a time without crashing. They format documents, balance my checkbook, host Minesweeper sessions, and even compile code with adequately verifiable reliability. So on a cultural scale, it's not surprising that productivity has been climbing at an impressive rate in all societies that make broad and deep use of computers. There's a clash of realities here that bears examining.

What I really dislike is the analogy to bridge building. This particular branch of civil engineering is held up as the paragon of rational design and construction. The odious comparison usually begins with the lead in, "If people built bridges the way they design software these days..." But in fact, people do build bridges much the same way we work. Except that they can get away with safety factors of 10 or more, and the attendant extra costs that go with them. And every bridge is purposely built for one particular site—no worries about "portability." Nevertheless, your typical nontrivial bridge can have dozens of bad rivets, or welds, or bolts. Design flaws get paved over in the field (sometimes literally) at added expense. And the darned things still fall down from time to time. When they do, officials do a quick survey that shows that 30 percent of all bridges in the state are at risk because of lack of maintenance. The bridge is rebuilt at a premium; the back maintenance still doesn't get funded; and quite a few experts worry every time they drive an SUV full of kids across certain spans. Sound familiar?

The fact is that every field strikes a balance between getting things done well enough for now and keeping lifetime costs down. If that balance is practical, like in bridge building and computer programming, you have an industry. If it isn't, you don't. The software biz has definitely been good enough, by many metrics, for several decades now. (That wasn't always so. Thirty years ago, I was regularly asked what sort of business computer to buy for a friend. My answer was none, if you wanted to keep the friend.) Of course, "good enough" changes over time. The emphasis in our field has shifted strongly toward security and reliability. More lives now depend on software working right, and a bored teenager in Romania can spend all night pounding the ports of a PC in your rec room (along with a million others). It's harder to just pretend that things are fine, and there's no reason to be scared.

Of course, the last time I was in New Orleans, I remember looking up at those levees and feeling scared, too.

P.J. Plauger
Senior Contributing Editor
pjp@plauger.com