Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I changed the law with a GitHub pull request

arstechnica.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: How I changed the law with a GitHub pull request

#101

Post by acdha »

jasonh3 wrote: post #100

It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos). Hopefully DC (and others) will look at doing GPG signatures[0,1] so that they don't have to trust github's authentication as much. Github has a nice GUI that reflects signatures with…

> meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos).

… which would immediately be noticed by everyone using the repo. How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?

Re: How I changed the law with a GitHub pull request

#102

Post by dgreisen »

jasonh3 wrote: post #100

It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos). Hopefully DC (and others) will look at doing GPG signatures[0,1] so that they don't have to trust github's authentication as much. Github has a nice GUI that reflects signatures with…

There are a number of technical limitations to gpg signatures. Your hypothetical attacker who has access to github can simply add his/her key and show up as a verified committer. gpg signatures have many other issues including metadata corruption, not to mention the nearly insurmountable issues around key management. As mentioned below, we have internal systems that allow us to audit/authenticate the repository. We will be rolling out a UELMA-compliant authentication scheme based on TUF in the next several months that will allow the public to authenticate the repository.

Re: How I changed the law with a GitHub pull request

#103

Post by dgreisen »

skohan wrote: post #98
speleding wrote: post #90

Earlier quoted context omitted.

Github does not own git, it only owns the UI that they've built on top of it. You can simply clone the repo and take it somewhere else and you can find an open source UI replacement to put on top too (e.g. Gitlab). Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.

> Github ... owns the UI that they've built on top of it That's the problem though. In principal, if they only use pure-git operations in the process, it would be easy to move at any point. But if they leverage the entire Github platform, i.e. PR discussion, issue tracking etc, then important parts of the legal history will be bound to the github platform. And that's not great. Github is free for public projects for…

We take long-term access to the law very seriously. For the reasons you give, we rely only on native git operations. PRs are a convenient interface, nothing more.

Re: How I changed the law with a GitHub pull request

#104

Post by [deleted] »

gammateam wrote: post #68
rhizome wrote: post #66

Earlier quoted context omitted.

Yep. Like in the Delaware URL posted by GP, in the first few lines we see, "This section amends Section 18-101..." which is not linked. I don't know if this platform allows one to link to a specific version of a law, but it would seem like a logical next step to help it happen one way or another. A lot of it is probably automatable.

Oh thats too perfect Thanks! All the other comments have been “hey the system you described has been around for many years, with all the problems you described but I didnt notice those just going to make a rebuttal to your idea for rebuttal’s sake”

[deleted]

Re: How I changed the law with a GitHub pull request

#105

Post by all2 »

baroffoos wrote: post #46
gamblor956 wrote: post #36

Earlier quoted context omitted.

They have what you describe, and moreover such a thing has existed in paper form since th this country was formed. Real time access to laws as they are drafted is a Really Bad Idea. Good ideas need time to incubate. The system you want would lead to the sound byte version of legislating.

I can just imagine shitty news websites exploding over someones draft/brainstorm and hyper criticism of unfinished work.

This is why the Constitution was drafted behind closed doors. The contributors needed room to have dumb ideas.

Re: How I changed the law with a GitHub pull request

#106

Post by all2 »

peanutz454 wrote: post #58
bytematic wrote: post #29

Earlier quoted context omitted.

I would love to see a constitution drafted for a fictional country.

Our better still, a fictional Constitution for all humans on Earth.

Good luck with that. There are too many belief sets, even for things like basic freedoms, for everyone to fall under a single law effectively.

Any effort to do so will lead to tyranny.

Re: How I changed the law with a GitHub pull request

#107

Post by gambler »

speleding wrote: post #90
skohan wrote: post #87

Earlier quoted context omitted.

I'm very much in favor of leveraging the advantages of version control software for legal text. Git seems perfect for this, but GitHub is a terrible choice to host it. Surely we don't want a large corporation owning the platform on which our laws are enshrined. It seems like it would be much better for this to be self-hosted.

Github does not own git, it only owns the UI that they've built on top of it. You can simply clone the repo and take it somewhere else and you can find an open source UI replacement to put on top too (e.g. Gitlab). Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.

What stops GitHub from banning certain IPs from accessing their service?

Re: How I changed the law with a GitHub pull request

#108

Post by jasonh3 »

acdha wrote: post #101
jasonh3 wrote: post #100

It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos). Hopefully DC (and others) will look at doing GPG signatures[0,1] so that they don't have to trust github's authentication as much. Github has a nice GUI that reflects signatures with…

> meaning that anyone who gained access to the github repo could forge them (and do more than fixing typos). … which would immediately be noticed by everyone using the repo. How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?

I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer.

> How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?

If the user's github credentials were compromised (lots of ways for that to happen which don't involve their system/keys being compromised, like using the same password across sites), then using GPG signatures would still allow cloners to check/detect problems since they wouldn't have the maliciously-updated github GPG key (or they might be one of the few folks still using the Web of Trust).

Furthermore, it's possible to have a local system compromise that doesn't give access to GPG keys, as keys could either be password protected or kept on a separate system that's primarily used for signatures (not extreme for a system that distributes law).

Also, signatures not only protect the latest commit, they also sign the previous commit hash(es), protecting previous commits and preventing a history rewrite. Without them, a history rewrite that left recent commits unchanged but modified some text could have the chance to go unnoticed.

EDIT: small clarity tweak

Re: How I changed the law with a GitHub pull request

#109

Post by r3bl »

all2 wrote: post #106
peanutz454 wrote: post #58

Earlier quoted context omitted.

Our better still, a fictional Constitution for all humans on Earth.

Good luck with that. There are too many belief sets, even for things like basic freedoms, for everyone to fall under a single law effectively. Any effort to do so will lead to tyranny.

I think you've missed a key word in the comment you're replying on: fictional Constitution.

It's just a process that would lead to some interesting outcome. Nobody's suggesting anything about enforcing that outcome to anyone.

Re: How I changed the law with a GitHub pull request

#110

Post by [deleted] »

gammateam wrote: post #25

I've been wanting this for a long time, I wanted to take it further though: I want draft laws, I want to see all representatives as contributors and be able to see their contributions and changes to draft laws. the House should have a master branch that submits pull requests to another repository, the other chamber having one too The Governor/President gets to approve PR's from that jurisdiction It would become SUPER…

[deleted]
Post reply on HN