Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

171–180 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#171

Post by themitigating »

lolinder wrote: post #169
senorrib wrote: post #167

Earlier quoted context omitted.

Why is buying votes by using government power/money good, and buying congress votes through lobbying bad?

I didn't say that buying votes with legislation was good, I said it's the premise of democracy. Whether democracy is good is an open question. For myself, I'm with Churchill: > Many forms of Government have been tried, and will be tried in this world of sin and woe. No one pretends that democracy is perfect or all-wise. Indeed it has been said that democracy is the worst form of Government except for all those other…

I don't think the premise of democracy is using money to influence politicans. If that's true then the rich have more power.

Re: 'Securing Open Source Software Act' introduced to US Senate

#172

Post by redanddead »

buscoquadnary wrote: post #5

For those curious about what it actually is: > The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislatio…

Would it be possible that the US government create its own open source software? has that been done before?

Re: 'Securing Open Source Software Act' introduced to US Senate

#173

Post by lolinder »

themitigating wrote: post #171
lolinder wrote: post #169

Earlier quoted context omitted.

I didn't say that buying votes with legislation was good, I said it's the premise of democracy. Whether democracy is good is an open question. For myself, I'm with Churchill: > Many forms of Government have been tried, and will be tried in this world of sin and woe. No one pretends that democracy is perfect or all-wise. Indeed it has been said that democracy is the worst form of Government except for all those other…

I don't think the premise of democracy is using money to influence politicans. If that's true then the rich have more power.

Please read my original comment. That's exactly what I said:

> Where things go wrong is when money becomes involved, because then the system rewards making the wealthiest people happy, not the largest number. That's an ulterior motive.

Re: 'Securing Open Source Software Act' introduced to US Senate

#174

Post by kube-system »

yencabulator wrote: post #170
kube-system wrote: post #168

Earlier quoted context omitted.

This is about risk management process, not computer science process. The businesses processes are different. For example, if your proprietary software has a bug, you call the developer and demand they come into your office and fix it under warranty. Doesn’t work that way for some dependency downloaded from GitHub.

Practically all software is licensed/sold without any warranty. I challenge you to find even a single counterexample.

Challenge accepted, here’s one that’s publicly posted. Most are not on public websites:

https://www.vmware.com/solutions/industry/government/warrant...

Warranties aren’t common in B2C or cheap boxed software. A few hundred or a few thousand dollars is not worth anyone’s time to negotiate special terms. In big dollar B2B or B2G, software isn’t usually as-is. Contracts are negotiated that specify what will be delivered, and what remediations exist if those deliveries fall short. If you spend 7 or 8 digits on software, you can easily get a warranty.

Re: 'Securing Open Source Software Act' introduced to US Senate

#175

Post by kube-system »

leaflets2 wrote: post #162
kube-system wrote: post #106

Earlier quoted context omitted.

Government contractors expensive tools are already heavily using open source tools. The whole log4j scandal that this bill is in response to is perfect evidence of exactly that. It is not in the interest of 'proprietary' software vendors to fearmonger about OSS libraries. They too use OSS libraries just like everyone else does today. It isn't 1995 anymore where a proprietary piece of software can run on a full stack…

It's not OSS libraries they'd be worried about, as competitors, but OSS applications , I d think.

This bill is in response to a recent issue with an OSS library: log4j.

Re: 'Securing Open Source Software Act' introduced to US Senate

#176

Post by frozencell »

jrochkind1 wrote: post #104

"securing open source software act" would rationally mean funding the NSA or similar experts to help harden open source software, right? Or, hey, telling the NSA to disclose vulnerabilities they find in open source software so they can be patched, instead of sitting on them hoping nobody else notices. Right? No? Wait, what? It's just about telling the federal government to use less open source software? How does that…

> ? Or, hey, telling the NSA to disclose vulnerabilities

To not disclose them is an opportunity to legit spy whatever using scapegoats (ie. North Korea hackers did that, etc.) and to legit sue or accuse enemies of using them (if they fix it, attackers won't attack).

Re: 'Securing Open Source Software Act' introduced to US Senate

#177

Post by mistrial9 »

origin_path wrote: post #150
peteforde wrote: post #62

Earlier quoted context omitted.

Respectfully, you have a too-reasonable hunch of how decisions are made at the executive level, and because of that, you're reaching an incorrect conclusion. The primary factor driving the decision making process is not cost but risk. Many fail to remember the lengths to which companies like Microsoft, Oracle, Sun and others went to create FUD around the adoption of OSS in the public sector. It involved lobbyists, ma…

"Companies with expensive tools have an obvious interest in convincing their best customers that the competition in inherently risky." The problem is that they don't need to do this. In the open source community we're doing a great job all by ourselves. I've written open source libraries and platforms, I've also written proprietary software that uses open source. Log4j, Heartbleed, half of NPM etc weren't the work of…

> they were avoidable fuckups caused by everyone relying on critical infrastructure that wasn't really maintained

uhh rewriting history much? the reason the entire world uses openssl is because it operates correctly.

The judgement here is diluted by exaggerating the worst moments of an otherwise profoundly performant ecosystem. btw- I turned my outward facing servers off for three days for Heartbleed, so .. how to balance a serious development, with the growth of billions of devices working correctly each day for years to get here.

In a previous life I did work on internal proprietary C/C++ code bases and yes, there were ridiculous technical debts, bugs, and missed opportunities right along with correct code, insights reduced to code, and solving hard problems well.

Re: 'Securing Open Source Software Act' introduced to US Senate

#178

Post by yencabulator »

kube-system wrote: post #174
yencabulator wrote: post #170

Earlier quoted context omitted.

Practically all software is licensed/sold without any warranty. I challenge you to find even a single counterexample.

Challenge accepted, here’s one that’s publicly posted. Most are not on public websites: https://www.vmware.com/solutions/industry/government/warrant... Warranties aren’t common in B2C or cheap boxed software. A few hundred or a few thousand dollars is not worth anyone’s time to negotiate special terms. In big dollar B2B or B2G, software isn’t usually as-is. Contracts are negotiated that specify what will be delivered…

Great example. Key quotes:

> your sole remedy will be that VMware shall, at its option,

> make a U.S. Person on U.S. soil available to provide technical support (in the case of non-conformity to the aforementioned Section (b)) or refund the license or service fees you paid

> VMware receives prompt written notice of the non-conformity following delivery (in the case of Software

So,

If the product isn't accessible: they'll write down the way it isn't. Period.

If the product doesn't do what it says it does, and you notice it quickly after purchase: Either 1. they provide technical support, OR 2. they refund your purchase price. And it's VMware who decides.

If the product doesn't do what it says it does, but you don't know until later: You're still screwed.

There is no guarantee of performance or suitability for purpose here. There is no guarantee of fixing anything. At worst, "you weren't prompt". At best, yes you get your money back. On the average, maybe you're given a phone number to call, and that person will ask if you've rebooted your computer.

This is actually still really bad for risk management; you have no guarantees that anything will keep working, just that after several months of running your platform on this stack, you might get refunded the purchase price. (Which leaves open the question, does that invalidate your software license, and do you now have to emergency migrate to a different stack?)

So, what you said earlier really isn't true:

> For example, if your proprietary software has a bug, you call the developer and demand they come into your office and fix it under warranty.

Also, your earlier

> Doesn’t work that way for some dependency downloaded from GitHub.

The above is true for every single open source dependency you download from Github! You'll be refunded your $0 purchase price, immediately!

Re: 'Securing Open Source Software Act' introduced to US Senate

#179

Post by gastroturf »

peteforde wrote: post #42

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…

Paraphrasing your closing paragraph: “you may not use this software if you have not already contributed to it” (because enforcing a future is hard).

Seems a bit contradictory to the license terms. Gonna be a trick to get legislation to enforce something that isn’t in established contractual language.

Edit: on the positive incentive approach, getting double-funded with discretionary budget for every FOSS developer they hire might be a viable strategy.

Re: 'Securing Open Source Software Act' introduced to US Senate

#180

Post by Meph504 »

I won't get into the reason behind this, but I will say I found this statement horrible, and could not disagree more.

>“This important legislation will, for the first time ever, codify open source software as public infrastructure,” said Trey Herr

Open source software is no more "public infrastructure" than the efforts of volunteer organizations. The government should have no say over this matter IMO.

Post reply on HN