All of this has already been implemented for over a hundred years for other trades. Us software people have generally escaped this conversation, but I think we’ll have to have it at some point. It doesn’t have to be heavy-handed government regulation; a self-governed trades association may well aim to set the bar for licensing requirements and industry standards. This doesn’t make it illegal to write code however you want, but it does set higher quality expectations and slightly lowers the bar for proving negligence on a company’s part.
There should be a ISO-whateverthefuck or DIN-thisorother that every developer would know to point to when the software deployment process looks as bad as CrowdStrike’s. Instead we’re happy to shrug and move on when management doesn’t even understand what a CI is or why it should get prioritized. In other trades the follow-up for management would be a CYA email that clearly outlines the risk and standards noncompliance and sets a line in the sand liability-wise. That doesn’t sound particularly outlandish to me.
Bro I wouldn’t trust most companies not to store their only copy of
super_duper_important_financial_data_2024.xlsx
on an old AliExpress thumb drive attached to the CFO’s laptop in a coffee shop while he’s taking a shit.If your company has an actual DRP for if your datacenter catches fire or your cloud provider disappears, you are already doing better than 98 % of your competitors, and these aren’t far-fetched disaster scenarios. Maintaining an entire separate pen-and-paper shadow process, training people for it? That’s orders of magnitude more expensive than the simplest of DRPs most companies already don’t have.
Friendly wave to all the companies currently paying millions a year extra to Broadcom/VMWare because their tools and processes are too rigid to use with literally any other hypervisor when realistically all their needs could be covered by the free tier of ProxMox and/or OpenStack.