Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

31–40 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#31

Post by not2b »

xxpor wrote: post #25
Rebelgecko wrote: post #11

Earlier quoted context omitted.

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

where it gets really goofy is the US gov work doesn't have copyright itself, so wouldn't any work done by them be PD, regardless of the underlying license?

If they extend an existing GPL work, the work as a whole is GPL, even if their added code is PD.

Re: 'Securing Open Source Software Act' introduced to US Senate

#33

Post by JohnFen »

ChrisMarshallNY wrote: post #17
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I'm not arguing, but the standard response ( caveat emptor , basically): > pull that code in without looking at it Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing. There are a couple of options: 1) Don't use open-source code, and make sure that commercial code that you use doesn't have it. 2) Have some kind of "regulated middleman" auditors, or ce…

> Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing.

The end user shouldn't have to audit the whole thing. The software that includes the dependencies should audit their dependencies.

If that burden is unworkable (and in a lot of cases, it is), that's a sign that the software needs to shed a lot of the dependencies.

Re: 'Securing Open Source Software Act' introduced to US Senate

#34

Post by JohnFen »

staticassertion wrote: post #14
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I think a lot of people will disagree, which is cool and I'm fine with that but I do hope that this discussion can be had. > The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it Why is it that there is no standard applied to those who publish code for distribution purposes? Why do we want that to be the case? Again, publishing to Github o…

> Why is it that there is no standard applied to those who publish code for distribution purposes?

What does "publish code for distribution purposes" mean? That sounds like all published code.

Does that mean that I can't put my own hobby code up in public? That's a sure-fire way to kill the community dead.

> You chose to do that, you chose to distribute it, you didn't have to do that.

I think the burden is more properly on the people who choose to download and use it, knowing what it is.

Re: 'Securing Open Source Software Act' introduced to US Senate

#35

Post by mistrial9 »

Longlius wrote: post #26
RobotToaster wrote: post #9

Earlier quoted context omitted.

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

GPL only requires you to provide source code when you provide an executable program. If their internal software isn't released outside the organization, then source code does not need to be either.

google famously used this clause and that was near twenty years ago.. things have evolved in GPL land

https://en.wikipedia.org/wiki/GNU_General_Public_License

Re: 'Securing Open Source Software Act' introduced to US Senate

#36

Post by amatwl »

failrate wrote: post #24
buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

"Oh, great, more STIGs." How about they take some millions and PAY THE OSS PROJECTS?

In my experience, the hesitancy to contribute/ pay open source projects comes more from the contractors versus the government.

Re: 'Securing Open Source Software Act' introduced to US Senate

#38

Post by peteforde »

staticassertion wrote: post #8

FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…

> It is absurd that anyone can anonymously provide open source code, with no assurances whatsoever, and that can end up in critical software.

While you're welcome your position and your ideas on how to solve these problems, I believe that the logic you're applying punishes the provider and not the consumer. Nobody is forcing anyone to use OSS without auditing every damn line, if that's their requirement.

Telling people that share their hard work with strangers for free that they have an ethical responsibility to accept vague "obligations" - as defined by lobbyists and politicians - is not an idea with wings.

Re: 'Securing Open Source Software Act' introduced to US Senate

#39

Post by m463 »

RobotToaster wrote: post #9
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Might depend on whether copyright applies to the agencies, since the GPL depends on copyright itself.

Re: 'Securing Open Source Software Act' introduced to US Senate

#40

Post by kmeisthax »

RobotToaster wrote: post #9
yazzku wrote: post #2

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Yes. The US federal government has voluntarily relinquished their sovereign immunity and they can and often do get sued for copyright violations. Of course, given that the NSA/CIA have the luxury of classification, the resulting lawsuit will be even more complicated than a normal copyright lawsuit (which is already one of the most expensive and frustrating parts of law to litigate).

States are where you need to worry. Occasionally a state decides to pass a law[0] saying they can't be sued for certain copyright violations. Because of how the US constitution is set up, states (and nothing smaller than them) are allowed to just say they can't be sued, which lets them crime with impunity.

[0] https://www.npr.org/2020/03/24/820381016/in-blackbeard-pirat...

Post reply on HN