Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

111–120 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#111

Post by kube-system »

ZainRiz wrote: post #74
peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

If they were really trying to secure the code, shouldn't the bill be called the "Securing Software Act"? It's not like closed source software is magically immune to vulnerabilities

This isn't about fixing anyone's code, it's about securing the software stack that the government is running. They already have well developed processes for addressing closed source software.

Re: 'Securing Open Source Software Act' introduced to US Senate

#112

Post by ChrisMarshallNY »

yjftsjthsd-h wrote: post #28
ChrisMarshallNY wrote: post #17

Earlier quoted context omitted.

I'm not arguing, but the standard response ( caveat emptor , basically): > pull that code in without looking at it Is no longer reasonable. The dependency chains are too vast to expect the end-user to be able to audit the whole thing. There are a couple of options: 1) Don't use open-source code, and make sure that commercial code that you use doesn't have it. 2) Have some kind of "regulated middleman" auditors, or ce…

It sounds like you want to get something for nothing. If you want software that meets some given standard, then someone has to invest the effort to make that happen. This isn't always expensive, but it's never free. So your options are indeed that if that should happen, then it has to be done by the author, an intermediate party, or the consumer. Trying to make the author pay when they're not getting anything out of…

> It sounds like you want to get something for nothing.

Not exactly sure how you read that from what I wrote. Maybe you were replying to someone else?

#1 is definitely not free. My company paid a bundle for that audit; far more, than if they had simply licensed commercial software.

#2 would require some kind of paid “middlemen.” The biggest problem would be that the money would not go to the authors, but to the auditors, instead.

Re: 'Securing Open Source Software Act' introduced to US Senate

#113

Post by pabs3 »

SllX wrote: post #44
Rebelgecko wrote: post #11

Earlier quoted context omitted.

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

My first instinct is that sovereign immunity applies. GPL is a license designed to protect the copyrights of the creator or copyright owner, but copyright itself is a privilege granted by the Federal government and protected by law. So if you sued them for violating the GPL, I’m fairly certain they could just claim sovereign immunity in court.

There is a comment about that up-thread:

https://news.ycombinator.com/item?id=32957861

Re: 'Securing Open Source Software Act' introduced to US Senate

#114

Post by javajosh »

malfist wrote: post #97
bob1029 wrote: post #96

We do B2B software in banking and this is something we've been anticipating for quite some time now. We were implicated in that log4j exploit via a (very) transitive, cross-language dependency. We killed 100% of our Java usage over this. We simply don't have enough in-house talent to make sure things are safe in that bucket. Our customers thought this was a glorious plan as well. I do think most of the pain should fa…

You ditched all java over a single bug? That seems extreme..... Did you ditch ssl over heartbleed?

Did they ditch CPUs after spectre?

Re: 'Securing Open Source Software Act' introduced to US Senate

#115

Post by kube-system »

jrochkind1 wrote: post #104

"securing open source software act" would rationally mean funding the NSA or similar experts to help harden open source software, right? Or, hey, telling the NSA to disclose vulnerabilities they find in open source software so they can be patched, instead of sitting on them hoping nobody else notices. Right? No? Wait, what? It's just about telling the federal government to use less open source software? How does that…

You're just attacking the title. The description doesn't demonize OSS at all, it praises it.

Risk frameworks are important, but they're not something you need the NSA to help you accomplish.

It doesn't take the NSA to do things like:

"Make a list of dependencies"

"Make sure that they have active developers"

"Check the list of dependencies for vulnerabilities"

"Look in the commit history to make sure one doesn't say 'People's Liberation Army -- implementing backdoor'"

Re: 'Securing Open Source Software Act' introduced to US Senate

#116

Post by tomrod »

encryptluks2 wrote: post #65
9wzYQbTYsAIc wrote: post #19

Earlier quoted context omitted.

There is this little nugget: “The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.”

Unless it specifies who this just means they'll throw a few billion to Teksystems, CGI or whoever and then say that it was a failure like HealthCare.gov

That spawned a lot of good things. Check out 18F and USDS.

Re: 'Securing Open Source Software Act' introduced to US Senate

#117

Post by pGuitar »

peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

> and definitely >100% secure proprietary offerings

how is that even possible

Re: 'Securing Open Source Software Act' introduced to US Senate

#118

Post by ncallaway »

pGuitar wrote: post #117
peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

> and definitely >100% secure proprietary offerings how is that even possible

You can manage it if you plant your tongue firmly in your cheek

Re: 'Securing Open Source Software Act' introduced to US Senate

#120

Post by thayne »

peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

> definitely >100% secure

Did you mean <100%?

Post reply on HN