Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If Software Is Funded from a Public Source, Its Code Should Be Open Source

linuxjournal.com

Post reply on HN
Print view View original

161–170 of 277 posts

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#161

Post by GlenTheMachine »

Wowfunhappy wrote: post #157
GlenTheMachine wrote: post #143

Earlier quoted context omitted.

When we do release code, that's more or less how it works. The issue is that, basically 100% of the time, anything being released to the public has to go through a release process. If you produced it as an employee of one agency (eg the Air Force), but if was paid for by a different agency (eg DARPA), then it also needs to go through a similar release process on the sponsoring agency's side. Typically, this has to ha…

It doesn't strike me as a huge loss to society if source code updates are only released, say, once per year. It's not ideal but it's not terrible either. (Of course, if the updates aren't happening at all because of opaque internal procedures, that's a different story.)

What usually happens is that it doesn't get released at all. It isn't worth the effort.

I've got tons of code I've written over the years that, if I could just throw it onto github, I would. But since it would take me six weeks of pain, I don't. Some of that code I'm kind of proud of, or was at the time I wrote it, anyway. I wrote an rviz app a decade before ROS took off.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#162

Post by lowercased »

ip26 wrote: post #131
ar_lan wrote: post #102

Earlier quoted context omitted.

I used to work in a state government job as a student intern, and they said they wanted an internal directory for some various tasks. You can think of it like an inventory manager sort of website, purely on our intranet. The mad lad my lead was, said we would need a database for retaining some of the basic data we needed to keep track of. Nothing all that special, just a few tables, and by nature nothing sensitive wo…

I guess in their defense, databases were pretty famous for being a huge attack surface for many years.

mis or poorly configured, yes. "sa" and no password on MSSQL, with direct connection to public internet - saw those for years. PostgreSQL/MySQL configured to only listen to localhost connections, and properly escaped/prepared queries running to them, with "minimally needed security access" credentials - haven't seen many problems with those (that were the fault of the database).

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#163

Post by lowercased »

GlenTheMachine wrote: post #161
Wowfunhappy wrote: post #157

Earlier quoted context omitted.

It doesn't strike me as a huge loss to society if source code updates are only released, say, once per year. It's not ideal but it's not terrible either. (Of course, if the updates aren't happening at all because of opaque internal procedures, that's a different story.)

What usually happens is that it doesn't get released at all. It isn't worth the effort. I've got tons of code I've written over the years that, if I could just throw it onto github, I would. But since it would take me six weeks of pain, I don't. Some of that code I'm kind of proud of, or was at the time I wrote it, anyway. I wrote an rviz app a decade before ROS took off.

Would there be some way of just automatically releasing everything in a git repo after X days (30? 60? 90?) unless some action is taken? Commit/push like normal, and some other process pushes to a public repo after X days, but anyone can review and block in the meantime for security reasons when needed?

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#164

Post by GlenTheMachine »

lowercased wrote: post #160
kemiller2002 wrote: post #125

Earlier quoted context omitted.

I used to be a contractor and worked on a web application distributed across multiple web servers. We needed a state server at the time to hold some cached information and share it among the servers. Now there was a rule that said a web server was not directly allowed to communicate with the database. Okay I get it, that makes sense. The state server we were going to use to store some application metadata had the wor…

I'm having to switch CentOS servers over to RHEL servers because... support(?) Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And.…

There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so.

Digital cameras were at that time strictly prohibited from even being on the premises.

So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured.

At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room.

So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously.

So they ask: “did you procure these computers through government procurement office.” To which he says, yes, of course, there's no other way to do it.

They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#165

Post by natechols »

m0zg wrote: post #154
natechols wrote: post #152

Earlier quoted context omitted.

I've always assumed that Intuit lobbying alone will be sufficient to kill this idea.

I think Intuit is just a scapegoat in this case. Incomprehensible tax code is a rich environment for corruption.

Totally true, but I've certainly seen claims that Intuit actually lobbies against simplifying the tax code.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#166

Post by daveheq »

Wrong; our military, CIA, and FBI are all funded by public money; should they all be open too? No. There's plenty of software that's publicly funded that should not be open source, and much of that wouldn't make sense anyway as it's proprietary.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#167

Post by baroffoos »

Wowfunhappy wrote: post #132
GlenTheMachine wrote: post #91

Government scientist here. IANAL, but my understanding is that all software written by US government civil servants is in the public domain. It cannot be copyrighted or otherwise licensed (although the government can patent things). This does not necessarily mean that it is available to the public, as noted in the other comments; it may be classified, considered For Official Use Only, or restricted from release by IT…

> The bigger problem, though, is that much of the US government just isn't technically set up to release software (as opposed to documents). Setting up a git repository, in the DoD, is an utter nightmare. Every single patch has to be pushed through a public release process that can take weeks or months and involves review by as many as ten to fifteen different offices, few if any of which even know anything about sof…

I was told by one government contractor that it takes forever to review the code and pull out any hard coded passwords.

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#168

Post by MadWombat »

m0zg wrote: post #146
analog31 wrote: post #134

Earlier quoted context omitted.

It should just be a giant function: def foo(**kwargs): return how_much_you_owe

It really should be a provably unambiguous ruleset that would take in the person's circumstances and numbers and spit out a number, yes. I understand that your post is a joke, but that'd be an _awesome_ thing to have for everyone, especially if coupled with some adversarial tech to find and close loopholes. Which is, ironically, why this isn't going to happen.

> provably unambiguous ruleset

I think that statement is against the very idea of tax law :)

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#169

Post by MadWombat »

vanderZwan wrote: post #29
AlexandrB wrote: post #16

Earlier quoted context omitted.

> Should the IRS, NSA, CIA, and FBI code all be open source? Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.

Also, electronic voting. Not that electronic voting booths will ever be a good idea, but forcing them to open source their stuff will hopefully deter people from even trying (and if not it will make it even more blatantly visible that these things are terrible). It's just like the biggest argument for open source in science: it is required for proper accountability.

> Not that electronic voting booths will ever be a good idea

Why not?

Re: If Software Is Funded from a Public Source, Its Code Should Be Open Source

#170

Post by Consultant32452 »

jsymolon wrote: post #151
Consultant32452 wrote: post #53

Earlier quoted context omitted.

What do I get for sending in a malformed e-file that breaks the mainframe? There's some REALLY old code in the IRS processing systems and it would surprise me if any of it stood up to modern security designs. Also, you don't want to reveal how you determine who to audit.

> who to audit. Doesn't have to be complicated, pull 10% of the "simple" forms, 90% of complicated. Simple forms would be the 1040EZ, 1040s w/ std deductions & no other "business" forms.

I highly doubt that the real code is random in that way. I'm sure there's some random aspect, but not all. If you're committing tax fraud, it's very valuable to know how to avoid tripping up the "audit this account" triggers.
Post reply on HN