Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

11–20 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#11

Post by Rebelgecko »

RobotToaster wrote: post #9
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

Re: 'Securing Open Source Software Act' introduced to US Senate

#12

Post by sullivanmatt »

buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

Not a complete nothing burger; a lot of people here work for companies that sell to the Feds or host FedRAMP-authorized SaaS solutions. There will definitely be private-sector impact from that risk framework, though I'm not saying that's necessarily a good or a bad thing.

Re: 'Securing Open Source Software Act' introduced to US Senate

#14

Post by staticassertion »

yjftsjthsd-h wrote: post #10
staticassertion wrote: post #8

FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I think a lot of people will disagree, which is cool and I'm fine with that but I do hope that this discussion can be had.

> The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it

Why is it that there is no standard applied to those who publish code for distribution purposes? Why do we want that to be the case? Again, publishing to Github or some source repository is fine, that should never ever be restricted, but publishing with the express intent for others to use it? I don't get why we're trying to ensure that that's something that shouldn't at least imply the bare minimum of assurances.

> if people share their code for free, they don't owe anyone anything

My point is that they don't legally owe anyone anything but we should impose a moral standard in lieu of a legal one. If you are saying "here's this code, I've packaged it up and sent it out for distribution" I think it should be perfectly fine for us to say "did you do the bare minimum to make this code acceptable for others to use?".

I don't get why we say "you have no ethical obligations in open source", why do we do that? Who benefits? I get not having legal obligations, but once you're distributing code for use it seems absurd to say that you have no ethical obligations. You chose to do that, you chose to distribute it, you didn't have to do that.

And while I do think that the obligation exists regardless, I also feel that if we don't step it up here, these things are going to be forced on us. I'd rather we do it ourselves.

Re: 'Securing Open Source Software Act' introduced to US Senate

#15

Post by mwint »

staticassertion wrote: post #14
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I think a lot of people will disagree, which is cool and I'm fine with that but I do hope that this discussion can be had. > The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it Why is it that there is no standard applied to those who publish code for distribution purposes? Why do we want that to be the case? Again, publishing to Github o…

> but we should impose a moral standard in lieu of a legal one

I agree with you, but these moral obligations tend to get enshrined in law eventually (or quickly! See Covid)

Re: 'Securing Open Source Software Act' introduced to US Senate

#16

Post by staticassertion »

mwint wrote: post #15
staticassertion wrote: post #14

Earlier quoted context omitted.

I think a lot of people will disagree, which is cool and I'm fine with that but I do hope that this discussion can be had. > The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it Why is it that there is no standard applied to those who publish code for distribution purposes? Why do we want that to be the case? Again, publishing to Github o…

> but we should impose a moral standard in lieu of a legal one I agree with you, but these moral obligations tend to get enshrined in law eventually (or quickly! See Covid)

They're gonna get enshrined into law eventually one way or the other. If we do it ourselves and we're effective at limiting the damage we cause we'll be able to maintain control over our own processes. If we don't it will be taken out of our hands.

Re: 'Securing Open Source Software Act' introduced to US Senate

#17

Post by ChrisMarshallNY »

yjftsjthsd-h wrote: post #10
staticassertion wrote: post #8

FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I'm not arguing, but the standard response (caveat emptor, basically):

> pull that code in without looking at it

Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing.

There are a couple of options:

1) Don't use open-source code, and make sure that commercial code that you use doesn't have it.

2) Have some kind of "regulated middleman" auditors, or certification authorities, that can certify (and probably hash) "approved" open-source chains.

They both suck. I worked for a company that did #1. They hired a company (can't remember the name, but it started with "P") that scanned our entire codebase, looking for open source.

#2 is likely to result in either corruption, or "roadblocks," where we can't use new fixed libraries, because the chain hasn't been audited, yet.

Re: 'Securing Open Source Software Act' introduced to US Senate

#18

Post by thomaslangston »

RobotToaster wrote: post #7
buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

It sounds innocuous enough, but could the real motivation be to make open source software so expensive to use that all government agencies "choose" to use closed source software? (This is a genuine question, I'm honestly not sure what the consequences, intended or otherwise, could be?)

Nah. You'd just need to use the old versions that had gone through a security audit and had some enterprise level Long Term Support contracts available.

IBM will offer quotes for whatever is required within 2 quarters or less.

Re: 'Securing Open Source Software Act' introduced to US Senate

#19

Post by 9wzYQbTYsAIc »

yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

There is this little nugget:

“The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.”

Re: 'Securing Open Source Software Act' introduced to US Senate

#20

Post by nimbius »

buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

the legislation seems a little pointlessly broad. "open source" is just software at the end of the day so it can easily be covered by existing STIG guidelines. these already work with Ubuntu and Redhat.

https://en.wikipedia.org/wiki/Security_Technical_Implementat...

Open source doesnt need a special response process, and the only reason you'd want one is if youre old guard like Symantec, F5, VMWare, or Veritas and starting to become alarmed at the amount of business you're losing to open source now that "devops" is starting to catch on and a recession is in effect.

Post reply on HN