Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The People's Code

code.gov

Post reply on HN
Print view View original

141–150 of 203 posts

Re: The People's Code

#141

Post by joepie91_ »

iamatworknow wrote: post #136
CiPHPerCoder wrote: post #133

Earlier quoted context omitted.

> Isn't that what we want, though? Generally. But on the other hand, no, this isn't a monoculture, where everyone wants the same exact thing. > Discussion and review, particularly with the people who are most familiar with the project (the maintainers) is what makes software better, not worse. Tell that to vim: https://github.com/vim/vim/issues/638 Tell that to node.js: https://github.com/nodejs/node/issues/5798 Tell…

I don't disagree with your or joepie91_'s points in that many (maybe most) open source project maintainers are perhaps more guarded and difficult in accepting contributions than they should be. That said, even if you submit a pull request or an issue ticket and the maintainer doesn't follow up, or is making the issue unnecessarily complicated to resolve formally and merge into the main branch, at least the record of…

> That said, even if you submit a pull request or an issue ticket and the maintainer doesn't follow up, or is making the issue unnecessarily complicated to resolve formally and merge into the main branch, at least the record of your findings is there attached to the repo as a rejected pull request or a closed issue ticket, and that can help someone who comes along after the fact who maybe experienced the same issue you did and can benefit from your comments. Maybe that same person who comes along later will have the time to fight for having the changes merged, and can use your comments as further evidence that the issue is worth reconsidering.

In my experience, this is a continuous source of frustration and anxiety. Not responding doesn't stop the notifications, and on top of that it also makes the contributor look bad by ignoring follow-ups. It's much easier and less frustrating to just not file anything in the first place.

> I stand by the idea that finding the issue, but posting it on an unrelated forum (like HN) instead of attaching it to the project itself serves no purpose than to tell others who are probably not even users of the open source code "look at this problem I found/solved, aren't I great?"

This is just flat-out bullshit, and frankly says more about you and your assumptions than about CiPHPer (who, for the record, is somebody I know personally). Have you considered that maybe CiPHPer is just tired of arguing with vendors and getting nowhere, and has now resorted to just publicizing their fuckups in the hope that maybe that will change something?

To be clear: nobody owes any vendor anything. While I personally at least attempt to disclose a vulnerability privately before going public, there is absolutely no requirement to do this. It is first and foremost the vendor's responsibility to keep their software and its dependencies up-to-date, not that of the public. Be happy that it's being reported at all, rather than just quietly sold on the black market.

The reality is that vendors have been grossly negligent of security for the past several decades, and still continue to do so, using all kinds of shit excuses about how much time and money it costs to fix something they shouldn't have fucked up in the first place. Don't be surprised when security researchers get tired of that shit, and just start dumping vulnerabilities publicly when there are indications that the vendor is negligent (like is the case here).

Again: the change here is to come from the vendors, not from the security researchers.

Re: The People's Code

#143

Post by bbatha »

sametmax wrote: post #139
OliverJones wrote: post #126

How about open source code for some makes and models of voting machine? The US Veterans' Administration health records software system is in the public domain. https://en.wikipedia.org/wiki/VistA#Licensing_and_disseminat... But it's not listed here. (It's also kind of complex. "wget; tar x; ./configure ; make" probably won't get you a running instance. Still.

That would not improve things. A voting system must be able to be checked by any citizen at any moment. Most of the citizen can't: - understand a complex code. - ensure the machine is running this code, easily, conveniently or quickly. - ensure the machine is not, or will not be hacked, by software or hardware mean. - ensure the program does calculate the votes correctly, with no bug. - do any of this in an autonomou…

Don't let perfect be the enemy of good. Opening up code in voting machine would be leagues better than leaving it closed source. At least other experts in the field could verify it.

Its also not like every citizen today can or understand all of the vote counting procedures with paper ballots, even when just constrained to their ballot.

Re: The People's Code

#144

Post by TheCoelacanth »

dx034 wrote: post #88
ohyoutravel wrote: post #57

Earlier quoted context omitted.

That is...most jobs. Unless I'm not understanding your meaning. Many jobs will fire you for, say, getting a DUI or getting arrested for drug possession or something. And many employers do drug testing. But realistically, a "limited sub-selection of possible activities" is just about everything everyone else can do, except maybe go to Cuba or smoke pot, the latter of which will get one fired at many non-government pla…

Is drug testing always legal in the US? Can drug use on weekends get you fired for any job? I lived in several European countries, and as far as I know there's no way an employer can force you to take a drug test, with the exception of people handling heavy machinery. If you are on drugs while you're at your job this will of course have consequences, but a drug test that would reveal drug use in your free time is not…

You can be fired for almost any reason in the US. There are only a few exceptions such as race, religion, sex or for reporting violations of some laws.

So, yes, in almost any job you could be required to take a drug test and be fired if you refuse.

Re: The People's Code

#145

Post by xenophonf »

officialchicken wrote: post #64
mars4rp wrote: post #48

Where is the IRS code?

Under the Department of Commerce - unsurprisingly - there is nothing from IRS. A bit more surprising and entirely missing from the list (no source code): * Department of Education * Department of Health and Human Services * Department of Housing * Department of Interior * State Department * Department of Transportation And not really expecting anything from: * Department of Defense * Department of Homeland Security

DHHS:

https://github.com/HHS

There are more if you know where to look. Some of the GitHub organizations are in their infancy, like NIAID's:

https://github.com/niaid

Others are only semi-public; these generally consist forks of software they use or private repos used for external collaboration.

I'm working on getting some of our stuff open-sourced. When it's written by contractors, the intellectual property rules can get complicated. Convincing a contractor to publish code their consultants wrote for a government project, no matter how minor, can be a tricky bit of advocacy. Sometimes they have really skewed ideas surrounding IP that must be overcome before this can happen. (Best case, our code will likely end up hosted by Internet2 or a similar foundation.)

Re: The People's Code

#146

Post by ianhawes »

Aaron1011 wrote: post #73
gkop wrote: post #68

Earlier quoted context omitted.

I agree it's overblown (based on the article). Was it sourced from a particular SHA or a "latest" link?

Oddly enough, it appears to have linked to the project's Github Pages site: ' https://igorescobar.github.io/jQuery-Mask-Plugin/js/jquery.m... (see https://web.archive.org/web/20160817080309/https://secure.do... for the original page). This still wasn't a good idea, but for a different reason - it's relying on the demo at https://igorescobar.github.io/jQuery-Mask-Plugin/ continuing to exist, and continuing to host the…

Full disclosure, this mistake was not made by the campaign directly, but rather by Revv.co, who is the payments software provider (not processor, DJT is using Stripe).

Re: The People's Code

#147

Post by pdkl95 »

Why the subsidy to Google? Sending tracking data to Google isn't appropriate for a government site.

    
      /* i='GTM-M9L9Q5' */
      /* ... */
      src='https://www.googletagmanager.com/gtm.js?id='+i
      /* ... */
Also, requiring Javascript in a single page application is a terrible design for this kind of site. Almost all of this can be static pages or traditional web frameworks. Requiring Javascript made the download much larger than necessary, slowed down the page load time a lot, and forced the page to reflow multiple times as the data arrived. A wide variety of web frameworks could have rendered and cached static pages instead of massively over-engineering the site as an "app".

Re: The People's Code

#148

Post by Alupis »

CiPHPerCoder wrote: post #138
iamatworknow wrote: post #136

Earlier quoted context omitted.

I don't disagree with your or joepie91_'s points in that many (maybe most) open source project maintainers are perhaps more guarded and difficult in accepting contributions than they should be. That said, even if you submit a pull request or an issue ticket and the maintainer doesn't follow up, or is making the issue unnecessarily complicated to resolve formally and merge into the main branch, at least the record of…

In this case: I did, and it was immediately closed without any change to the code, documentation, process, or culture.

> In this case: I did, and it was immediately closed without any change to the code, documentation, process, or culture.

You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited.[1]

> While this is an issue it does not affect us as we aren't using session cookies with slim

You then started to rant about how they don't update their dependencies "quick enough".

[1] https://github.com/samilliken/openDCIM/issues/837

Re: The People's Code

#149

Post by godelski »

sametmax wrote: post #139
OliverJones wrote: post #126

How about open source code for some makes and models of voting machine? The US Veterans' Administration health records software system is in the public domain. https://en.wikipedia.org/wiki/VistA#Licensing_and_disseminat... But it's not listed here. (It's also kind of complex. "wget; tar x; ./configure ; make" probably won't get you a running instance. Still.

That would not improve things. A voting system must be able to be checked by any citizen at any moment. Most of the citizen can't: - understand a complex code. - ensure the machine is running this code, easily, conveniently or quickly. - ensure the machine is not, or will not be hacked, by software or hardware mean. - ensure the program does calculate the votes correctly, with no bug. - do any of this in an autonomou…

Most people can't understand the code in openssl. So we shouldn't use it? Let's just make all cryptography closed source then. The average person doesn't even know what an elliptic function is.

The point is that there is a large amount of people that do. They check. Not every citizen needs to check, but it is harder for there to be an error or to hoodwink someone if there are more eyes on the code. Essentially why opensource cryptography is good too.

Essentially, it can easily be audited.

Re: The People's Code

#150

Post by pdkl95 »

JustSomeNobody wrote: post #115
utnick wrote: post #59

Earlier quoted context omitted.

Its pretty backwards if you think about it, if the places you go or people you know or mistakes you make, can easily make you lose your security clearance and therefore your career could be ruined, it makes you much easier to blackmail than under a system that was more laissez-faire

Hmmm... If that were true we'd have lots of empirical evidence, so I'd like to see some link to that.

> we'd have lots of empirical evidence

That assumes there would be many attempts at this kind of blackmail, and that any attempts that did occur were discovered and documented.

> I'd like to see some link to that.

Even if the conditions above were satisfied (which I find highly unlikely), this assumes that we (the public) have access to the documentation.

Post reply on HN