8 ms·

>But I'm not saying it is good or bad. Wait, you exposed people to a technology, taught them how to use it, then you are not going to own the implications of t

>But I'm not saying it is good or bad. Wait, you exposed people to a technology, taught them how to use it, then you are not going to own the implications of that action without teaching them about the risks or telling them how they need to ensure they don't shoot themselves in the face or violate their duty of care? Do you understand what you are saying and the implications of that in the real world relative to the insurance contracts that they have? Your company is associated with HIPAA, you should have a much higher standard than this.

ageitgey 4mo ago
You are assuming like 12 things that aren't true in this response.
- Ucalegon 4mo ago
  Explicitly name them then.
tclancy 4mo ago
Play the ball, not the man, dude. Hectoring people on the Internet because you're stressed out about something isn't going to magically fix how you feel. Digging into their profile to make it personal is three steps too far.
- Ucalegon 4mo ago
  We are talking about one person's introduction of a technology to persons and the implications of that action within the framework of enterprise governance and risk, it is one in the same. If anything, who a person is, their knowledge of the domain and the associated implications that action has on the domain has relevancy where someone who is ignorant of implications may have more grace than someone who has the experience to know better. The passive lack of accountability or responsibility relative to that does matter given the context.
  - dumfries 4mo ago
    You have to understand that people like you, that you that keep talking about enterprise governance and risk, should facilitate business users to do these things securely. This should have always been the case but somehow it has ended up more with restricting rather than facilitating. Hopefully tools like claude code will prove the value add more easily, changing everything I hate about corp IT.
    - Ucalegon 4mo ago
      I appreciate the feeling but this isn't so much driven by principle but by business risk through contract liability or other liability that exists within whatever place you happen to be doing business. 'Adding value' is a very interesting statement and way to judge the worth of something. Adding value to who? And if that value add also causes massive harms, how do we reconcile that? So you build a brand new app with does all of the things that all of your total addressable market wants, but it also exposes all of the IP your existing clients, does that mean you will be able to achieve that TAM? Corp IT does not exist in a vacuum. Understanding the why of that isn't a 'you should just accept this' but more 'how can we make this better and avoid mistakes already made by others'. I will always point to aviation and 'bold text is written in blood' as a great model to understand all of this not as a blocker but, instead, as a building block.
      - foobar10000 4mo ago
        Note that _passenger aviation_ is commercially non-competitive. The big 4 US airlines make money on credit cards, not airfare : they lose money on airfare. So, most people who are trying to make money will not use them as a model. In general, safe businesses can only exist with government support or government prohibition of all other businesses globally - and that is a very hard bar to clear.
  - criley2 4mo ago
    There is no way to facilitate untrained users in the healthcare space to vibe code real applications touching patient data. There is no magic policy, firewall, or "facilitation technique" which can make vibe coded software reliably meet contractual and regulatory obligations with a high degree of security in the healthcare space. If you care about data privacy, especially your own protected health information, that sentence should give you a lot of comfort. In a HIPAA environment, people who are sufficiently trained on how to develop regulated software securely are called "software engineers". In my opinion, agents will replace the majority of the rest of businesses before they are good enough at agentic engineering to be able to autonomously develop software that safely and reliably can manage PHI without a single mistake. It goes without saying: never trust your PHI to any company who is vibe coding in production.
deleted 4mo ago
[deleted]

ageitgey 4mo ago

You are assuming like 12 things that aren't true in this response.

Ucalegon 4mo ago
Explicitly name them then.

tclancy 4mo ago

Play the ball, not the man, dude. Hectoring people on the Internet because you're stressed out about something isn't going to magically fix how you feel. Digging into their profile to make it personal is three steps too far.

Ucalegon 4mo ago
We are talking about one person's introduction of a technology to persons and the implications of that action within the framework of enterprise governance and risk, it is one in the same. If anything, who a person is, their knowledge of the domain and the associated implications that action has on the domain has relevancy where someone who is ignorant of implications may have more grace than someone who has the experience to know better. The passive lack of accountability or responsibility relative to that does matter given the context.
- dumfries 4mo ago
  You have to understand that people like you, that you that keep talking about enterprise governance and risk, should facilitate business users to do these things securely. This should have always been the case but somehow it has ended up more with restricting rather than facilitating. Hopefully tools like claude code will prove the value add more easily, changing everything I hate about corp IT.
  - Ucalegon 4mo ago
    I appreciate the feeling but this isn't so much driven by principle but by business risk through contract liability or other liability that exists within whatever place you happen to be doing business. 'Adding value' is a very interesting statement and way to judge the worth of something. Adding value to who? And if that value add also causes massive harms, how do we reconcile that? So you build a brand new app with does all of the things that all of your total addressable market wants, but it also exposes all of the IP your existing clients, does that mean you will be able to achieve that TAM? Corp IT does not exist in a vacuum. Understanding the why of that isn't a 'you should just accept this' but more 'how can we make this better and avoid mistakes already made by others'. I will always point to aviation and 'bold text is written in blood' as a great model to understand all of this not as a blocker but, instead, as a building block.
    - foobar10000 4mo ago
      Note that _passenger aviation_ is commercially non-competitive. The big 4 US airlines make money on credit cards, not airfare : they lose money on airfare. So, most people who are trying to make money will not use them as a model. In general, safe businesses can only exist with government support or government prohibition of all other businesses globally - and that is a very hard bar to clear.
- criley2 4mo ago
  There is no way to facilitate untrained users in the healthcare space to vibe code real applications touching patient data. There is no magic policy, firewall, or "facilitation technique" which can make vibe coded software reliably meet contractual and regulatory obligations with a high degree of security in the healthcare space. If you care about data privacy, especially your own protected health information, that sentence should give you a lot of comfort. In a HIPAA environment, people who are sufficiently trained on how to develop regulated software securely are called "software engineers". In my opinion, agents will replace the majority of the rest of businesses before they are good enough at agentic engineering to be able to autonomously develop software that safely and reliably can manage PHI without a single mistake. It goes without saying: never trust your PHI to any company who is vibe coding in production.

deleted 4mo ago

[deleted]