This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
When an industry reaches maturity, it generally comes with a slew of regulations, approved methods, standards (followed... or not) and ways of doing things. Such is the case with the automotive industry. These operating rules, generally put in place to protect the public, are often governed by the authorities. For example, to bring a car to market, an automaker must prove that its product meets the minimum safety standards required by the laws in force in the state where the vehicle will be used. Over the years, carmakers have slowly found themselves obliged to carry out numerous crash tests, adapt their cars' emission control systems, install airbags and integrate safe braking systems. Governing authorities require automakers to follow proven best practices in the manufacturing and design of automobiles. From one year to the next, these standards become more and more stringent, and therefore safer, which lets us carry a whole little family around in a minivan without fearing for the occupants' safety.
Can the computer industry take inspiration from the standards of the automotive manufacturing sector?
Why not? In the automotive world, independent agencies hand out awards for the design of the safest cars. Manufacturers then shout from the rooftops, in their ads, that their products have won this or that award. Aren't we seeing a lack of pride on the part of software vendors? Is it really a lack of pride, or simply a legislative gap? And yet, just as some carmakers apply their own, stricter safety standards, some IT solution providers still choose quality over price. However, nothing forces them to. So in some situations, best practices can quickly be set aside "until the rest is done". In the end, the product hits the market without ever having undergone any security validation. As long as commercial application development isn't governed by a "development code" that explicitly spells out the standards and rules a piece of software must meet before going to market, the industry will stand still. What's more, it can't be blamed for its behaviour: the costs of securing software can be prohibitive. Of course, fixing security issues after a piece of software has been released will generally turn out to be much more expensive. But...
Finally, allow me to ask a question. Would you agree to drive a car that had never undergone any road safety testing?
It's up to us to make sure the authorities see this issue clearly. It's up to us, as citizens, to demand that the situation change. The automotive industry, even though it has nothing to do with our sector, went through the "same" challenges the computer industry is facing today. The result is quite simple: safer cars and massive user (driver) awareness campaigns have greatly helped reduce the road toll. The same means can easily be applied to the computing world. All we have to do is follow the example...