If Software Is Funded from a Public Source, Its Code Should Be Open Source • Hacker News Board

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#71

Post by dragonwriter » Mon, Feb 04, 2019, 7:11 PM UTC

tracker1 wrote: post #55

dragonwriter wrote: post #47

Earlier quoted context omitted.

> Should the IRS, NSA, CIA, and FBI code all be open source? No, works made by or under hire for the federal government should be public domain, from a copyright standpoint, not exclusively owned but licensed under an open source license. But on the other hand, I think your real question has nothing to do with ownership or licensing, but whether or not they should be publicly disclosed. In many cases the answer is “n…

And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? Should the government have to pay tens of millions and years of waiting to re-create said software?

> And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software?

I think there is a good argument for anything where the government is acquiring software rather than paying for service that the acquired software (even if it zero percent modified) should be under a permissive open source license (or even acquired into the public domain), and the source code should be a disclosable public record except to the extent it would be covered by privacy, security, or other existing exceptions to public records laws.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#72

Post by tracker1 » Mon, Feb 04, 2019, 7:12 PM UTC

uberman wrote: post #14

Would this not imply that if "my" government funded some software that "your" government would be free to take it? I'm not sure I'm keen on subsidizing "your" government all that much. What would stop the people of/under "your" government from freeloading off the people of/under "my" government?

So, if YOUR government uses Linux, but doesn't participate in Linux development, it's bad for everyone else? Most Linux users aren't contributing to Linux itself. And likely less than half are making any significant contribution to Open Source Software at all. It's still useful software, and I still appreciate everyone that does work on it.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#73

Post by rtkwe » Mon, Feb 04, 2019, 7:13 PM UTC

AlexandrB wrote: post #16

ecshafer wrote: post #5

I am an open source advocate, but I don't really agree here. Should the IRS, NSA, CIA, and FBI code all be open source? Here are some cases where closed source software, with some security by obscurity could be helpful. Another example would be some software around designing nuclear systems. But as an example maybe a software funded by the national weather service to run simulations, that aught to be open source (per…

> Should the IRS, NSA, CIA, and FBI code all be open source? Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.

There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited. Releasing that risks big bad actors working around the limitations of whatever algorithms it contains.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#74

Post by tracker1 » Mon, Feb 04, 2019, 7:14 PM UTC

dragonwriter wrote: post #71

tracker1 wrote: post #55

Earlier quoted context omitted.

And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? Should the government have to pay tens of millions and years of waiting to re-create said software?

> And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? I think there is a good argument for anything where the government is acquiring software rather than paying for service that the acquired software (even if it zero percent modified) should be under a permissive open source license (or even acquired into the public domain), and t…

So, you'd rather spend millions and years of time extra than to use closed source software?

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#75

Post by zbruhnke » Mon, Feb 04, 2019, 7:14 PM UTC

PurpleBoxDragon wrote: post #56

zbruhnke wrote: post #42

Earlier quoted context omitted.

Man it would be pretty amazing to be able to submit a Pull Request to the IRS. Matt Cutts if you're reading this please help! On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that

By hiding the code, it makes security through obscurity far more possible. If you force the code to be public, very poor security will be discovered far faster and be more of an issue to the public. While this will also make abusing security flaws easier, I think there is also a real benefit to forcing it to be public that could potentially outweigh the risks of doing such.

I agree with this in principle (in fact I had a long argument with the former CTO of Citi about this during the heartbleed fiasco) but I also worry that if noone is willing to put in the effort to fix flaws or they are not reported properly then fixing them could go un-funded while flaws were easier to discover.

Maybe the answer is very good logging of anyone who has cloned the repos etc. but right now when we have a government that uses whether or not they're going to fund important parts of our infrastructure (like Air Traffic Controllers) as a bargaining chip I have some skepticism around them being willing to fund ongoing maintenance of some of these products.

Despite the fact that things being in the open SHOULD curb this from happening I've read enough legislation (yes, I actually do like to read legislation) to know that that probably is not true when it comes to the government

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#76

Post by O1111OOO » Mon, Feb 04, 2019, 7:14 PM UTC

AdrianB1 wrote: post #59

kerkeslager wrote: post #36

Most posts on this thread are focusing on exceptional cases where there are obvious reasons not to open the source, such as defense, but huge amounts of publicly-funded code is locked up for no reason whatsoever. Let's discuss some use cases that make more sense: 1. healthcare.gov 2. Stoplights/traffic control cameras. 3. Voting machines. 4. Electrical grid. 5. IRS.

There is more than one country in the world. Let's say country A is paying for some software and open source it, the rest of the world can get it. That may be fair if everyone is doing the same and contributing fairly (hard to assess that), but if countries A,B,C are the only ones contributing (paying) and everyone else just use, then it is not fair or sensible. More than that, there is no "public paid", just "tax pa…

> if countries A,B,C are the only ones contributing (paying) and everyone else just use, then it is not fair or sensible.

There's Open Source and then there's the Licensing of Open Source. Just because the source is available does not automatically mean it's free to use under any circumstance.

Licensing is a separate and complicated issue.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#77

Post by zbruhnke » Mon, Feb 04, 2019, 7:14 PM UTC

dragontamer wrote: post #49

zbruhnke wrote: post #42

Earlier quoted context omitted.

Man it would be pretty amazing to be able to submit a Pull Request to the IRS. Matt Cutts if you're reading this please help! On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that

> On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that Any more nefarious things that can be done with your Linux OS server talking to your Open Source Chromium / Firefox web browser? Open Source doesn't necessarily mean less secure.

Agreed that it does not necessarily mean less secure ... see my comment below

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#78

Post by dhcrain » Mon, Feb 04, 2019, 7:15 PM UTC

I work on Medicare software for a state that is funded by CMS[1] and it is freely available to any other state that also is funded by CMS. This has happened, we handed over the code base to another state and they are implementing it.

[1]https://www.cms.gov/

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#79

Post by tombert » Mon, Feb 04, 2019, 7:15 PM UTC

dragonwriter wrote: post #60

mulmen wrote: post #15

Earlier quoted context omitted.

Providing the source does not mean giving the public commit access.

Having government acquired code be open source licensed from the vendor to the government doesn't even mean the government publicly discloses the code. It does mean the government is free to do so , or to hire another vendor to work on it without restriction.

Wouldn't FOIA mandate that it's released if it's not confidential? I'm seriously asking; I'm not an expert in these things.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#80

Post by dragonwriter » Mon, Feb 04, 2019, 7:15 PM UTC

rtkwe wrote: post #73

AlexandrB wrote: post #16

Earlier quoted context omitted.

> Should the IRS, NSA, CIA, and FBI code all be open source? Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.

There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited. Releasing that risks big bad actors working around the limitations of whatever algorithms it contains.

> There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited

That's perhaps a good reason for that part of the software to not be published and/or FOIA disclosable, but that's orthogonal to how it is licensed. If it's an original government work now it would be public domain (which is more open than open source), but still potentially confidential and nondisclosable.