CNet posted an article about a speech given by Oracle's Chief Security Officer Mary Ann Davidson at WWW2006 last week. She was specifically criticizing the "patch" mentality of software and made an analogy to civil engineering, "What if civil engineers built bridges the way developers write code?" The problem with such an analogy is that there are many PC manufacturers out there, requiring various patches, but the laws of physics are equally accessible to everyone. In another sense, design engineers are frequently hindered by vendor lock-in and proprietary data formats.
I entirely agree with Ms. Davidson's point that bad software is becoming a nationality security issue. Ms. Davidson and I may disagree on the scope of what constitutes bad software, though. Ms. Davidson appears to have centered on hacking. I would expand the scope to include anti-competitive business practices such as vendor lock-in.
I can see this as an issue in the CAD industry in at least three areas. First, it is a matter of sovereignty when a nation to allows its data to be stored in proprietary data formats. Data subject to national security laws should not be secondarily subject to the dictates of a commercial software vendor. Second, the data created at taxpayer expense should generally be considered a public good and available to the public in non-commercial data formats. The exception, of course, is data important to national security but even this eventually passes into the public domain. Third, once a CAD vendor stops functioning as a business or dissolves entirely, the availability of user data stored in that vendor's proprietary format depends on a number of factors that the user may have no control over such as the affordability of licenses for extinct packages, availability of equipment to run the old software, availability of operators with the expertise to run the dead CAD package, etc. Military airplanes (thankfully) are now around for generations so the design data should not be subject to the format de jure.
Ms. Davidson also discussed the possibility of the regulation of the software industry. I found this point somewhat disturbing. When the government begins regulating industries the unstated goal of the corporate parties is to hinder future competition by setting high regulatory hurdles for new comers. In the case of an industry involving critical dangers, such as nuclear power, the regulations are no doubt a good thing. In other industries, like telecommunications, it probably not good for the public to have the industry very regulated. So where does online banking fall along the continuum?
I am sure customers want there data secure from hackers, but I am equally sure that customers do not want to prop up a banking monopoly through software regulation. For this point, I point to the growing P2P lending business which is nothing more than individuals exercising their right to contract. Ms. Davidson's position within Oracle makes me suspicious of her motive behind these statements. She may be correct, but I am suspicious of self-interest when her company grew under the very conditions she now advocates regulating away.
Why, then, should I advocate a difference in the CAD industry? I think a root of the problem CAD interoperability problem stems from the political necessity of the sharing the benefits of multi-billion dollar contracts over many jurisdictions. Thus, interoperability should be addressed as a political problem not just as a technical problem.
