'Securing Open Source Software Act' introduced to US Senate
hsgac.senate.gov
'Securing Open Source Software Act' introduced to US Senate
1–10 of 187 posts
Re: 'Securing Open Source Software Act' introduced to US Senate
#2So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?
Re: 'Securing Open Source Software Act' introduced to US Senate
#3So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?
That’s really the question, isn’t it? The article makes it sound like hiring “open source devs” may be part of the strategy, which essentially amounts to anyone with a public GitHub repo.
Re: 'Securing Open Source Software Act' introduced to US Senate
#4So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?
Don't worry about it. It's just code for 'government departments only get to use software from giant corps with well known and unpatched bugs now'.
Re: 'Securing Open Source Software Act' introduced to US Senate
#5For those curious about what it actually is:
> The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability. Additionally, the legislation requires the Office of Management and Budget (OMB) to issue guidance to federal agencies on the secure usage of open source software and establishes a software security subcommittee on the CISA Cybersecurity Advisory Committee.
So basically just another framework to evaluate risk for use by the Federal Government. A nothing burger as it were. Which I am on one hand glad about, because I don't like the government starting to get involved in Open Source which is at it's core "Here's some code I wrote or whatever", but it also isn't doing anything for security.
Re: 'Securing Open Source Software Act' introduced to US Senate
#6Seems like they are taking the right approach. Instead of trying to regulate OSS, they're funding CISA to help make it more secure.
Re: 'Securing Open Source Software Act' introduced to US Senate
#7For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…
It sounds innocuous enough, but could the real motivation be to make open source software so expensive to use that all government agencies "choose" to use closed source software?
(This is a genuine question, I'm honestly not sure what the consequences, intended or otherwise, could be?)
Re: 'Securing Open Source Software Act' introduced to US Senate
#8FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasingly leveraging software defects, and the impact and scrutiny will only grow.
If you want to avoid having to pass tests, having to maintain insurance, having to do a bunch of bullshit, all just to be a software engineer, get started on fixing things now.
It is absurd that anyone can anonymously provide open source code, with no assurances whatsoever, and that can end up in critical software. And you might be saying "well, it's up to people to audit their dependencies" - and maybe you're right. But I would challenge that everyone has the right to publish code for distribution purposes with zero responsibility.
Publishing code to Github? Sure, go for it, anyone can do it. Publishing packages to package distributors ? No, that crosses a line. I don't want legal requirements, I don't want identification requirements, just to publish and distribute code.
If we want to avoid that we're going to need to step it up - that means, yeah, basic measures like strong 2FA to distribute packages should be a requirement. Signing packages should be a requirement. Acknowledging and triaging vulnerabilities should be a requirement. If you aren't willing to do the above, which is frankly trivial, you shouldn't be allowed to publish software for distribution purposes.
I think we need to start taking a bit more responsibility for the work we do. "NO WARRANTY" doesn't mean "No obligations", it just means no one has a legal right to pursue damages due to your software, you should still do some things.
edit: K I'm rate limited so I can't have this conversation with all of you, thanks again Dang
Re: 'Securing Open Source Software Act' introduced to US Senate
#9So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?
Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?
Re: 'Securing Open Source Software Act' introduced to US Senate
#10FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…
I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal issues, but not exclusively - if people share their code for free, they don't owe anyone anything. If you don't like that, you're free to offer them enough money to actually accept your standards.