Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I changed the law with a GitHub pull request

arstechnica.com

Post reply on HN
Print view View original

111–120 of 124 posts

Re: How I changed the law with a GitHub pull request

#111

Post by captainwhoreal »

skohan wrote: post #87
gammateam wrote: post #25

I've been wanting this for a long time, I wanted to take it further though: I want draft laws, I want to see all representatives as contributors and be able to see their contributions and changes to draft laws. the House should have a master branch that submits pull requests to another repository, the other chamber having one too The Governor/President gets to approve PR's from that jurisdiction It would become SUPER…

I'm very much in favor of leveraging the advantages of version control software for legal text. Git seems perfect for this, but GitHub is a terrible choice to host it. Surely we don't want a large corporation owning the platform on which our laws are enshrined. It seems like it would be much better for this to be self-hosted.

To be fair GitHub should be nationalised. This way people could be given accounts as future mean of production and also use them to participate in the Democratic process. It is a no brainer if you ask me.

Re: How I changed the law with a GitHub pull request

#112

Post by acdha »

jasonh3 wrote: post #108
acdha wrote: post #101

Earlier quoted context omitted.

> meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos). … which would immediately be noticed by everyone using the repo. How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?

I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer. > How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key? If the user's github credentials were compromised (lots of ways for that to happen which don't involve the…

> If the user's github credentials were compromised (lots of ways for that to happen which don't involve their system/keys being compromised, like using the same password across sites), then using GPG signatures would still allow cloners to check/detect problems since they wouldn't have the maliciously-updated github GPG key (or they might be one of the few folks still using the Web of Trust).

This assumes that the attacker wouldn't simply upload their own key to public keyservers with the same email address. I would be shocked if more people would notice the use of an additional key than would notice, say, Git's warning when history changes between different repos.

The big win is having multiple copies with independent access control. I'm not opposed to using GPG but in practice the benefits are fairly minimal and there's a massive usability hit for anything involving GPG. In the case of a legal code that's probably justified but it's probably well into diminishing returns.

Re: How I changed the law with a GitHub pull request

#113

Post by dalore »

skohan wrote: post #87
gammateam wrote: post #25

I've been wanting this for a long time, I wanted to take it further though: I want draft laws, I want to see all representatives as contributors and be able to see their contributions and changes to draft laws. the House should have a master branch that submits pull requests to another repository, the other chamber having one too The Governor/President gets to approve PR's from that jurisdiction It would become SUPER…

I'm very much in favor of leveraging the advantages of version control software for legal text. Git seems perfect for this, but GitHub is a terrible choice to host it. Surely we don't want a large corporation owning the platform on which our laws are enshrined. It seems like it would be much better for this to be self-hosted.

Git is decentralized so it doesn't really matter where it's hosted. Github works since it's free, but everyone who checks out the source will have the full git history and so also becomes another repository. Easy to move a git repo to somewhere else.

Re: How I changed the law with a GitHub pull request

#114

Post by [deleted] »

speleding wrote: post #90
skohan wrote: post #87

Earlier quoted context omitted.

I'm very much in favor of leveraging the advantages of version control software for legal text. Git seems perfect for this, but GitHub is a terrible choice to host it. Surely we don't want a large corporation owning the platform on which our laws are enshrined. It seems like it would be much better for this to be self-hosted.

Github does not own git, it only owns the UI that they've built on top of it. You can simply clone the repo and take it somewhere else and you can find an open source UI replacement to put on top too (e.g. Gitlab). Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.

[deleted]

Re: How I changed the law with a GitHub pull request

#115

Post by all2 »

r3bl wrote: post #109
all2 wrote: post #106

Earlier quoted context omitted.

Good luck with that. There are too many belief sets, even for things like basic freedoms, for everyone to fall under a single law effectively. Any effort to do so will lead to tyranny.

I think you've missed a key word in the comment you're replying on: fictional Constitution. It's just a process that would lead to some interesting outcome. Nobody's suggesting anything about enforcing that outcome to anyone.

Oh. Fair enough.

Re: How I changed the law with a GitHub pull request

#116

Post by jasonh3 »

acdha wrote: post #112
jasonh3 wrote: post #108

Earlier quoted context omitted.

I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer. > How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key? If the user's github credentials were compromised (lots of ways for that to happen which don't involve the…

> If the user's github credentials were compromised (lots of ways for that to happen which don't involve their system/keys being compromised, like using the same password across sites), then using GPG signatures would still allow cloners to check/detect problems since they wouldn't have the maliciously-updated github GPG key (or they might be one of the few folks still using the Web of Trust). This assumes that the a…

Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :)

* : Last I checked, the two most popular Linux distros I'm familiar with (CentOS and Ubuntu) only make their iso hashes available via http-only served files that are GPG signed

Re: How I changed the law with a GitHub pull request

#117

Post by acdha »

jasonh3 wrote: post #116
acdha wrote: post #112

Earlier quoted context omitted.

> If the user's github credentials were compromised (lots of ways for that to happen which don't involve their system/keys being compromised, like using the same password across sites), then using GPG signatures would still allow cloners to check/detect problems since they wouldn't have the maliciously-updated github GPG key (or they might be one of the few folks still using the Web of Trust). This assumes that the a…

Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :) * : Last I checked, the two most popular Linux distros I'm familiar with (CentOS and Ubuntu) only make their iso hashes available via http-only served files that are GPG signed

Those distributions use GPG but they also use pre-deployed signing keys rather than, say, trusting any @debian.org key on a public keyserver. When you're centralizing trust like that anyway, the differences between that and a canonical Git repo don't seem to be especially significant from a practical standpoint.

Re: How I changed the law with a GitHub pull request

#118

Post by gammateam »

azernik wrote: post #80
gammateam wrote: post #61

Earlier quoted context omitted.

Existing platforms have limitations My main problem is that many laws are written as: “Hereby strikes section b of USC1788(1)(iii) and replaced the word or with and” And with this kind of system it would be standardized already on how to see what the modifications look like, or at least jump to that old version of the law easily When the final laws are all merged together after a passed bill makes simple instructions…

The California legislature has this feature - the default landing page gives you that legal diff format, but if you hit the "Today's Law as Amended" tab you get a handy word-oriented diff: https://leginfo.legislature.ca.gov/faces/billCompareClient.x...

Nice! I would like to move the goal post a BIT further, and also have annotations of case law that actually used any of those clauses.

Re: How I changed the law with a GitHub pull request

#119

Post by WorldMaker »

skohan wrote: post #98
speleding wrote: post #90

Earlier quoted context omitted.

Github does not own git, it only owns the UI that they've built on top of it. You can simply clone the repo and take it somewhere else and you can find an open source UI replacement to put on top too (e.g. Gitlab). Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.

> Github ... owns the UI that they've built on top of it That's the problem though. In principal, if they only use pure-git operations in the process, it would be easy to move at any point. But if they leverage the entire Github platform, i.e. PR discussion, issue tracking etc, then important parts of the legal history will be bound to the github platform. And that's not great. Github is free for public projects for…

There are technical solutions that could be used here. You can JSON dump the PR contents and Issue contents, for example, into another repository (or a branch in the same repository). It wouldn't be hard to automate that process with the GitHub API.

That doesn't solve the interop problem that would exist in trying to implement secondary UI systems that can redisplay that information usefully, but ETL of that sort is full of options and developers with experience.

JSON dumps of GitHub information would be useful to more open source projects beyond legislative history. I think a good automated solution could be generally useful, if someone wanted to invest in it.

Re: How I changed the law with a GitHub pull request

#120

Post by sushid »

gambler wrote: post #107
speleding wrote: post #90

Earlier quoted context omitted.

Github does not own git, it only owns the UI that they've built on top of it. You can simply clone the repo and take it somewhere else and you can find an open source UI replacement to put on top too (e.g. Gitlab). Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.

What stops GitHub from banning certain IPs from accessing their service?

Presumably a federal government contract can have these clauses built-in.

They also have self-hosted enterprise contracts so I'm sure something like that could be done if the government were interested.

Post reply on HN