Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

21–30 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#21

Post by 9wzYQbTYsAIc »

sullivanmatt wrote: post #12
buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

Not a complete nothing burger; a lot of people here work for companies that sell to the Feds or host FedRAMP-authorized SaaS solutions. There will definitely be private-sector impact from that risk framework, though I'm not saying that's necessarily a good or a bad thing.

Additionally,

“The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.”

So we should definitely expect at least some minute changes to the open source economy, itself.

Re: 'Securing Open Source Software Act' introduced to US Senate

#22

Post by yjftsjthsd-h »

staticassertion wrote: post #14
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I think a lot of people will disagree, which is cool and I'm fine with that but I do hope that this discussion can be had. > The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it Why is it that there is no standard applied to those who publish code for distribution purposes? Why do we want that to be the case? Again, publishing to Github o…

> Why is it that there is no standard applied to those who publish code for distribution purposes?

Because it's rude to make demands of someone who is doing you a favor.

Because a system that adds costs to profit-free work will collapse.

Because your "distribution" line-in-the-sand doesn't exist. I assume you're thinking of NPM or pypi, but ex. Debian doesn't ask people before including their packages, and ex. nixos pulls directly from those "non-distribution" channels.

> My point is that they don't legally owe anyone anything but we should impose a moral standard in lieu of a legal one. If you are saying "here's this code, I've packaged it up and sent it out for distribution" I think it should be perfectly fine for us to say "did you do the bare minimum to make this code acceptable for others to use?".

Okay; let's also make a moral standard of paying people when we derive value from their work. I think it should be perfectly fine for us to say "did you do the bare minimum to repay the person who gave you this code to use?".

> I don't get why we say "you have no ethical obligations in open source", why do we do that? Who benefits? I get not having legal obligations, but once you're distributing code for use it seems absurd to say that you have no ethical obligations.

We do that because we benefit. Making things easy for the people who are giving their work away for free helps foster an ecosystem where people keep giving stuff away for free.

> You chose to do that, you chose to distribute it, you didn't have to do that.

Yes, that's the point. We'd like people to keep giving things away even though they don't have to. If you try to impose costs on them for doing that, you'll alter the incentives so that they do the rational thing and stop giving stuff away, and/or start charging for it.

Re: 'Securing Open Source Software Act' introduced to US Senate

#23

Post by Cyberdog »

RobotToaster wrote: post #9
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

When government agencies behave within the law, it is by coincidence, if not an accident which will soon be rectified.

Re: 'Securing Open Source Software Act' introduced to US Senate

#24

Post by failrate »

buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

"Oh, great, more STIGs." How about they take some millions and PAY THE OSS PROJECTS?

Re: 'Securing Open Source Software Act' introduced to US Senate

#25

Post by xxpor »

Rebelgecko wrote: post #11
RobotToaster wrote: post #9

Earlier quoted context omitted.

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

where it gets really goofy is the US gov work doesn't have copyright itself, so wouldn't any work done by them be PD, regardless of the underlying license?

Re: 'Securing Open Source Software Act' introduced to US Senate

#26

Post by Longlius »

RobotToaster wrote: post #9
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

GPL only requires you to provide source code when you provide an executable program. If their internal software isn't released outside the organization, then source code does not need to be either.

Re: 'Securing Open Source Software Act' introduced to US Senate

#27

Post by adastra22 »

rtev wrote: post #3
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

That’s really the question, isn’t it? The article makes it sound like hiring “open source devs” may be part of the strategy, which essentially amounts to anyone with a public GitHub repo.

No the people hired will be IBM consultants and such with long lists of meaningless qualifications and no GitHub profile.

Re: 'Securing Open Source Software Act' introduced to US Senate

#28

Post by yjftsjthsd-h »

ChrisMarshallNY wrote: post #17
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I'm not arguing, but the standard response ( caveat emptor , basically): > pull that code in without looking at it Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing. There are a couple of options: 1) Don't use open-source code, and make sure that commercial code that you use doesn't have it. 2) Have some kind of "regulated middleman" auditors, or ce…

It sounds like you want to get something for nothing. If you want software that meets some given standard, then someone has to invest the effort to make that happen. This isn't always expensive, but it's never free. So your options are indeed that if that should happen, then it has to be done by the author, an intermediate party, or the consumer. Trying to make the author pay when they're not getting anything out of it is a great way to kill FOSS outright. That's not to say that "open-source code" is some boogeyman that has to be kept away, it just means that you gotta pay someone to make it meet your standards. Heck, offer the original author a contract and you'll solve the problem for everyone, and other problems besides.

Re: 'Securing Open Source Software Act' introduced to US Senate

#30

Post by slaymaker1907 »

buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

It sounds extremely similar to the executive order from Biden last year. For what it's worth, I think some parts of that are valuable such as productive a bill of materials for all the software that gets shipped. That way figuring out of if some product uses a vulnerable version of log4j is very simple and independent of particular programming languages.
Post reply on HN