Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

41–50 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#41

Post by kmeisthax »

xxpor wrote: post #25
Rebelgecko wrote: post #11

Earlier quoted context omitted.

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

where it gets really goofy is the US gov work doesn't have copyright itself, so wouldn't any work done by them be PD, regardless of the underlying license?

My gut feeling is no, because the work is still a derivative work of a privately-owned copyrighted work, and private copyright does not dissolve when the government touches it. If you could separate the governments' code from the GPL code, then it would be automatically public domain, but the combination is still GPL.

However I'm not aware of any case law proving this.

Re: 'Securing Open Source Software Act' introduced to US Senate

#42

Post by peteforde »

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis.

To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help" senators write OSS bills.

Do you honestly think Rob fucking Portman woke up one day with strong opinions about FOSS?

Make no mistake: this is a thinly veiled late-stage attempt to displace the growing dominance of OSS-based solutions to the sorts of problems that the government and military used to pay 8 and 9 figures a year to EDS to solve.

An actual, good-faith bill that seeks to address these issues would attempt to incentivize/punish orgs that use FOSS without making meaningful contributions to it.

Re: 'Securing Open Source Software Act' introduced to US Senate

#43

Post by dimitrios1 »

9wzYQbTYsAIc wrote: post #21
sullivanmatt wrote: post #12

Earlier quoted context omitted.

Not a complete nothing burger; a lot of people here work for companies that sell to the Feds or host FedRAMP-authorized SaaS solutions. There will definitely be private-sector impact from that risk framework, though I'm not saying that's necessarily a good or a bad thing.

Additionally, “The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.” So we should definitely expect at least some minute changes to the open source economy, itself.

This is the worst part. "Experience developing open source software" is both entirely vague and specific at the same time, likely conjuring up an image of some developer with green boxes on a GitHub repo or something, which is terrible. This is going to force the creation of some sort of silly criteria for what constitutes that experience, of which suits in federal agencies, and the political pressure and politicians they are behest to, will likely have no concept of less-popular open source communities, which will detract from the ethos of open source and ultimately, and more importantly, freedom.

Re: 'Securing Open Source Software Act' introduced to US Senate

#44

Post by SllX »

Rebelgecko wrote: post #11
RobotToaster wrote: post #9

Earlier quoted context omitted.

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

My first instinct is that sovereign immunity applies. GPL is a license designed to protect the copyrights of the creator or copyright owner, but copyright itself is a privilege granted by the Federal government and protected by law. So if you sued them for violating the GPL, I’m fairly certain they could just claim sovereign immunity in court.

Re: 'Securing Open Source Software Act' introduced to US Senate

#45

Post by unity1001 »

staticassertion wrote: post #8

FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…

> Modern civic engineers went without any significant regulation, and then that changed

There is no analogy. The only reason why other engineering disciplines are not adopting software practices is because the other engineering fields are not easy to iterate. You build a bridge. And then you could maybe get some funding to improve one part of it a decade afterwards. Because it is too expensive and cumbersome to do it.

When IoT, AI, nanomachines, 3D printing proliferate, you will see how that will change. Devices and buildings will be possible to iterate, and they will have versions that get incremented as they are improved.

...

As for obligations, the existing law already covers it. From GDPR to payments compliance, everything is there. And a lot of the best practices are invented and standardized by Open Source, actually.

...

What Open Source still lacks is the mindset to approach end-users and consumers and be able to get them on board. Open Source needs to take the route of 'no backwards compatible changes', and even 'add, never deprecate' (like JSON project) along with the habit of hiding complexity from end users and making things easy.

Then we can create a truly Open Source world in which there will be infinite new possibilities.

Re: 'Securing Open Source Software Act' introduced to US Senate

#46

Post by tazjin »

dimitrios1 wrote: post #43
9wzYQbTYsAIc wrote: post #21

Earlier quoted context omitted.

Additionally, “The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.” So we should definitely expect at least some minute changes to the open source economy, itself.

This is the worst part. "Experience developing open source software" is both entirely vague and specific at the same time, likely conjuring up an image of some developer with green boxes on a GitHub repo or something, which is terrible. This is going to force the creation of some sort of silly criteria for what constitutes that experience, of which suits in federal agencies, and the political pressure and politicians…

Anyone owning at least three Hacktoberfest t-shirts qualifies.

Re: 'Securing Open Source Software Act' introduced to US Senate

#47

Post by verisimilitudes »

adastra22 wrote: post #27
rtev wrote: post #3

Earlier quoted context omitted.

That’s really the question, isn’t it? The article makes it sound like hiring “open source devs” may be part of the strategy, which essentially amounts to anyone with a public GitHub repo.

No the people hired will be IBM consultants and such with long lists of meaningless qualifications and no GitHub profile.

No the people hired will be IBM consultants and such with long lists of meaningless qualifications and no MicroSoft profile.

Re: 'Securing Open Source Software Act' introduced to US Senate

#48

Post by kube-system »

peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

They're trying to destroy FOSS ...by hiring FOSS developers?

I don't buy it. More like, log4j was an actual real big issue for government agencies because they use rely on tons of open source projects and haven't previously done much to make sure that that supply chain is robust. This would help to change that.

Federal contractors don't need to sell proprietary software to make money -- they make more money selling FOSS software.

Re: 'Securing Open Source Software Act' introduced to US Senate

#49

Post by gus_massa »

ChrisMarshallNY wrote: post #17
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

I'm going to disagree, I think. The problem isn't on the push side, it's on the pull side. People throwing random-quality code in github is fine. People deciding to amalgamate that into distributions and publish it is fine. The problem is that somewhere someone who is supposed to be held to some standard decided to pull that code in without looking at it, and that is the problem. NO WARRANTY is partially about legal…

I'm not arguing, but the standard response ( caveat emptor , basically): > pull that code in without looking at it Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing. There are a couple of options: 1) Don't use open-source code, and make sure that commercial code that you use doesn't have it. 2) Have some kind of "regulated middleman" auditors, or ce…

>> pull that code in without looking at it

> Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing.

Each open source project is different. For example I'm using:

Racket: Only the main distribution that is created by the development team and a few packages, and ver few additional packages, like 1 or 2 for viewing the assembler version of the compiled functions.

Python: Also only the official distribution, NumPy and perhaps 1 or 2 more packages. The batteries are included, so it's not necessary to download too much.

LaTeX: As many packages as I can add, my coworkers hate me. Each package has a different author and chains to more and more packages. But I'm using MiKTeX and I thrust the maintainer whoever he is [1]

[1] I had to google the name of the maintainer. He is Christian Schenk, I was convinced his name was Michael or something like that.

Re: 'Securing Open Source Software Act' introduced to US Senate

#50

Post by throwbigdata »

kube-system wrote: post #48
peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

They're trying to destroy FOSS ...by hiring FOSS developers? I don't buy it. More like, log4j was an actual real big issue for government agencies because they use rely on tons of open source projects and haven't previously done much to make sure that that supply chain is robust. This would help to change that. Federal contractors don't need to sell proprietary software to make money -- they make more money selling F…

More or less of a big issue than the revolving door of Microsoft bugs?
Post reply on HN