Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

151–160 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#151

Post by lioeters »

thayne wrote: post #120
peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

> definitely >100% secure Did you mean <100%?

> perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount

That part confused me too - I believe it's meant to be sarcastic. There's a kind of humor that I often don't get until further reflection, which is a way of saying things that are so overboard and absurd that the speaker cannot possibly believe what they're saying. Or rather, the speaker is saying the opposite of what they mean, in order to make their point. Might be a cultural thing.

This kind of humor is even harder to recognize these days, when people honestly do believe the absurd things that they're saying.

Re: 'Securing Open Source Software Act' introduced to US Senate

#152

Post by drc500free »

kube-system wrote: post #48
peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

They're trying to destroy FOSS ...by hiring FOSS developers? I don't buy it. More like, log4j was an actual real big issue for government agencies because they use rely on tons of open source projects and haven't previously done much to make sure that that supply chain is robust. This would help to change that. Federal contractors don't need to sell proprietary software to make money -- they make more money selling F…

Seriously, the government would rather burn $50k on the manpower that makes the decision to not pay $10k in software licenses. The beltway contracting space is about selling a lot of butts in a lot of seats, and a bit of hardware that goes boom. FOSS is AMAZING for govt contractors, they can bill $250m building something using FOSS that's available as a commercial-off-the-shelf (COTS) product. They put a lot of work into ensuring the govt requirements are rigid enough that the COTS alternative is deemed unacceptable during the AoA process.

Re: 'Securing Open Source Software Act' introduced to US Senate

#153

Post by staticassertion »

peteforde wrote: post #59
staticassertion wrote: post #56

Earlier quoted context omitted.

Nobody is telling them to share their work and distribute it to others as a package . As I said, I don't think there should be any restrictions on anyone to publish code.

I don't know what your background or interest in this issue is, but I'm glad that the overwhelming majority of people do not find this perspective to be reasonable or compelling. In the meantime, if you don't like the MIT license, don't use software published under it.

Licensing is completely irrelevant to this discussion.

Re: 'Securing Open Source Software Act' introduced to US Senate

#154

Post by tomrod »

encryptluks2 wrote: post #122
tomrod wrote: post #116

Earlier quoted context omitted.

That spawned a lot of good things. Check out 18F and USDS.

There are special exceptions, but definitely not the norm.

Except for the change in acquisition and contracting behind the scenes that was driven by that colossal failure.

Have you noticed that the IRS website is accessible and searchable? That SBA is functional? Conpare that to, say, Department of Commerce, where things are a mess (currently).

The US realized it needed to pick things up a bit and, while it's still a hard space to work in, started to shift to a better playbook.

https://playbook.cio.gov/

Re: 'Securing Open Source Software Act' introduced to US Senate

#155

Post by nonameiguess »

peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

You're actually dead wrong and this is spoken like someone with no experience in this space. What actually happened was not only log4j, but then multiple pre-auth CVEs in Atlassian suite products, effectively brought down DI2E, a collaboration and developer tooling platform that was open to the Internet and used by huge numbers of unclassified DoD and IC development projects. Since it was already sunsetting and had reduced staff, most programs still haven't gotten back data that was lost when the web fronts went offline suddenly to mitigate ongoing attacks. This wasn't catastrophic, but months of work were lost

The reality is, the greatest vulnerability here isn't in government-procured software that uses OSS libraries directly. The DoD's own critical custom applications are largely as secure as secure gets. The much bigger problem is in proprietary software, like the Atlassian suite, that uses OSS libraries in its own supply chain.

In fact, the DoD has had mandates from the highest level for years to use FOSS everywhere it is available, and to require all new contractors to open source anything they create for government use that isn't classified. The only reason something like the Atlassian suite is still used is a combination of institutional inertia and the lack of comparably feature-complete FOSS alternatives (the vast majority of this kind of space going to SaaS companies that don't allow you to self-host).

Re: 'Securing Open Source Software Act' introduced to US Senate

#156

Post by jrochkind1 »

kube-system wrote: post #115
jrochkind1 wrote: post #104

"securing open source software act" would rationally mean funding the NSA or similar experts to help harden open source software, right? Or, hey, telling the NSA to disclose vulnerabilities they find in open source software so they can be patched, instead of sitting on them hoping nobody else notices. Right? No? Wait, what? It's just about telling the federal government to use less open source software? How does that…

You're just attacking the title. The description doesn't demonize OSS at all, it praises it. Risk frameworks are important, but they're not something you need the NSA to help you accomplish. It doesn't take the NSA to do things like: "Make a list of dependencies" "Make sure that they have active developers" "Check the list of dependencies for vulnerabilities" "Look in the commit history to make sure one doesn't say '…

Right, but it's focused on helping the government decide what open source not to use, rather than on actually making open source more secure.

Re: 'Securing Open Source Software Act' introduced to US Senate

#157

Post by kube-system »

jrochkind1 wrote: post #156
kube-system wrote: post #115

Earlier quoted context omitted.

You're just attacking the title. The description doesn't demonize OSS at all, it praises it. Risk frameworks are important, but they're not something you need the NSA to help you accomplish. It doesn't take the NSA to do things like: "Make a list of dependencies" "Make sure that they have active developers" "Check the list of dependencies for vulnerabilities" "Look in the commit history to make sure one doesn't say '…

Right, but it's focused on helping the government decide what open source not to use, rather than on actually making open source more secure.

The risk framework isn’t written yet, this just directs CISA to write one. While evaluating dependencies is often a part of what you’d do in a risk framework, it’s typically just one part.

Re: 'Securing Open Source Software Act' introduced to US Senate

#158

Post by Xelynega »

staticassertion wrote: post #140
yesbut wrote: post #77

Earlier quoted context omitted.

These corporate sponsored legislators are really good at writing policy that sounds good to the public but really helps their corporate sponsor's bottom lines in practice. This bill wouldn't exist if it wasn't designed by large corporate software firms looking to taint, or profit from, FOSS in some way.

Isn't it very obvious that the US government has a vested interested in software security? I see no reason whatsoever to believe that this is some sly attempt to make FOSS more expensive as opposed to the US trying to solve a very real problem.

If it were truly about software security it wouldn't be limited to open source. Whatever standards make a piece of software secure doesn't change when it's developed by a company or a community, so what's the reason they're making the distinction in law?

For that reason I agree with the conclusion of the person above, things don't happen in capitalist societies without someone getting paid for it.

Re: 'Securing Open Source Software Act' introduced to US Senate

#159

Post by yesbut »

themitigating wrote: post #88
yesbut wrote: post #77

Earlier quoted context omitted.

These corporate sponsored legislators are really good at writing policy that sounds good to the public but really helps their corporate sponsor's bottom lines in practice. This bill wouldn't exist if it wasn't designed by large corporate software firms looking to taint, or profit from, FOSS in some way.

100% sure? Why not find out if that's true because I'm sure there are exceptions.

100% sure.

Re: 'Securing Open Source Software Act' introduced to US Senate

#160

Post by yesbut »

Xelynega wrote: post #158
staticassertion wrote: post #140

Earlier quoted context omitted.

Isn't it very obvious that the US government has a vested interested in software security? I see no reason whatsoever to believe that this is some sly attempt to make FOSS more expensive as opposed to the US trying to solve a very real problem.

If it were truly about software security it wouldn't be limited to open source. Whatever standards make a piece of software secure doesn't change when it's developed by a company or a community, so what's the reason they're making the distinction in law? For that reason I agree with the conclusion of the person above, things don't happen in capitalist societies without someone getting paid for it.

well, we can't leave it to pesky kumbaya, drum circle, communist software devs that work for free to do good security. only corporate capitalist software devs care about security. duh! now help me get this encryption bill passed so we can put back doors in our encryption, you know, for the kids' safety.

/s

Post reply on HN