Experimental Software

The thought occurs to me that, when it comes to software licensing issues, there exists an analogue which really should have been explored long ago, but which I do not recall any conversation about. In particular, there is one thing in particular, and that is the idea that software is trusted with all of our data, even data on which lives can depend. And yet somehow, the concept of "Aircraft-grade" doesn't apply to software in these cases at all.

For people who aren't aware, the building of aircraft is a fairly well regulated industry; I hope I don't have to suggest why. Not only are all the parts supposed to be aircraft-grade, but there is a large body of tests that software must go through before it is declared worthy of FAA certification. If the aircraft is NOT certified safe by the FAA, then you know before you get it in it that what you have is unregulated and it may be no safer than the worst mechanic or part in it. Certified aircraft, such as airliners, are tested for reliability, and as long as they are kept up in accordance with FAA rules, you can be fairly sure that they are worthy of your trust. (They do have a pretty good record with this, too, in spite of the occasional story of airliners crashing--which is made louder and more noteworthy in fact because it happens so rarely.)

I cannot think of a single good reason why software that covers critical sections of computing should not be required by law to be tested by an independent agency for its stability. This would ideally replace the EULA's indemnifying clauses entirely, as the company would in fact be required to account for the faults in its software. In contrast, if a piece of software does not have the testing, because it is an amateur effort or work in progress, it should be clearly marked EXPERIMENTAL--with the understanding that if you use it, you are not allowed to blame the maker.

Ideally, there would be other classifications as well, some with stability testing, some without. Anything where user data is being used MUST have some kind of classification, whether certified or experimental; the user themselves will come to believe in the difference between certified and experimental software, making certification desirable for companies, while at the same time, the fact of testing and the requirement for legal responsibility will dissuade con artists from abusing it.

Would Microsoft or Apple approve of such a scheme? Maybe, but not easily. Microsoft in particular is probably not set up in such a way that any part of its OS, much less the whole thing in total, can be completely certified. However, if a top-notch OS was "certified" and especially if the other OSes were not, then I'm sure they would be more than happy to hold that over everyone's heads with glee.

What should be certified? A quick list.

• Kernel (sans drivers, but including driver architecture)
• Registry (for Windows)
• User Interface (sans plugins)
  
• File system
• Network stack
• OS initialization daemon (The process which starts applications at boot-time)
• Password/Identity managers
• Network security
• Any server process (ssh, ftp, http, samba, filesharing, remote file storage, remote desktop, etc)
• Commercial file editors
• File compression tools (zip, rar, tar/tgz, 7z, etc)

Possible useful certifications:

• Certified User Application (will not lose user data)
• Experimental User Application (registered but not guaranteed)
• Not Classified: User Application (Not registered; use caution)
  
• Certified OS component (will not crash and lose data or damage hardware)
• Experimental OS Component (registered but not guaranteed)
• Not Classified: OS Component (If you aren't a developer, you just shouldn't)
• Certified Isolated Application (Does not use user data; games and graphics programs)
• Experimental Isolated Application (...)
• NC: Isolated Application (...)
  
• Certified Secure User/Network Application (Data is securely stored or transmitted)
• Experimental User/Network Application (...)
• NC: User/Network (...)