Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Money, Public Code

publiccode.eu

Post reply on HN
Print view View original

191–200 of 216 posts

Re: Public Money, Public Code

#191

Post by pydry »

andrepd wrote: post #190
machinerychorus wrote: post #26

Earlier quoted context omitted.

I was tangentially related to the covid app stuff so I can offer some insight there: most of those apps weren't built by the state. Google provided an open-source "base app" that could be customized by the states, but most states hired third-party contractors to build an app for them. I've worked in public sector and this is typical. the states can't open source it because they don't own it, they just pay a third-par…

> This is touted as "small govt", but it really just makes things less efficient. You could say these exact words about the vast majority of PPP (public-private partnerships).

Private sector efficiency was the PPP sales pitch. Extracting rents is always the goal.

Re: Public Money, Public Code

#192

Post by cmutel »

inChargeOfIT wrote: post #118

The US is getting better about it, some more than others, but a few off the top of my head.. https://github.com/department-of-veterans-affairs https://github.com/nationalsecurityagency https://github.com/GSA https://github.com/CMSgov https://github.com/CDCgov

https://github.com/USEPA/

Re: Public Money, Public Code

#193

Post by prepend »

postalrat wrote: post #10

The state I lived in developed one of those covid tracking apps. I asked for the source code and was told it wasn't available and would never be. I talked to people working on other software developed for the state and they all think that software shouldn't be public. It seems crazy to me that taxpayers pay for this software but it doesn't belong to them. Knowing what I do know I gotta wonder if it's just about those…

I work in government (partially improving our use and creation of free and open source software) and I think there are a few different psychologies:

1) there are people who understand f/oss. Sometimes they are in power and choose it for the projects they oversee. This is small, but growing slowly. 2) there are people who don’t understand and the default is to do what their contractor says. This is huge and probably stable. 3) there are people who understand and don’t like it because of the lack of formal support and the chaos and perceived unpredictability. This is the “buy Microsoft/IBM and they will support you” group. This is large but shrinking a little. 4) there are contractors who don’t want the risk to their contracts being renewed from competitors seeing their code and being able to support. Obviously no feds in this group, but lots of feds are influenced by their contractor and take on their position. This irks me the most because its acting in the contractors benefit to the government’s detriment. I don’t understand how people in oversight positions take this position in good faith. 5) there are contractors who have IP and want to resell or reconfigure for multiple clients and would raise their bid price if they had to release under f/oss. Again, not feds, but this is a perceived fear of people with set budgets who want to get best value and their incumbent contractors are saying it’s more expensive if they have to do f/oss.

I’m probably missing some of the tech workers. But I think the biggest blocker is contractors as probably 95% of actual hands on work is done by contractors. Some perpetual who have been in place for decades. Even when the companies change, the individuals stay the same.

Re: Public Money, Public Code

#195

Post by ldoughty »

InvertedRhodium wrote: post #117
xboxnolifes wrote: post #95

Earlier quoted context omitted.

> Security by obscurity alone is discouraged and not recommended by standards bodies A layer, not the only layer. > System security should not depend on the secrecy of the implementation or its components. It is not depending on it. It is just an additional layer to delay or reduce impact.

This was the proposed scenario that the GP put forward: > If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. Which doesn't seem to suggest any mitigation other than the lack of published source code.

My post was already very long, didn't want to tangent into possible defenses which depend heavily on what exactly is in the code base...

Using log4jail as a recent example, I had a code base vulnerable to this attack, but it would not be expected that the application used a vulnerable version (we forked the popular code base), and it only was vulnerable in a specific way (which, to this day, no one has attempted to explot, as I have an alarm set up if that kind of input comes in in logs, and previously had the block at the WAF when we were vulnerable for the 4 hours it took to fix the issue.

Security by obscurity is not I good defense, it's a single layer, which buys you time. You need to have multiple layers of defense, and closed source might buy your team time to fix issues.. or make it viable to release the application while a third party takes a year on a security audit.

Re: Public Money, Public Code

#196

Post by ldoughty »

6510 wrote: post #84
ldoughty wrote: post #71

Earlier quoted context omitted.

This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway Also true, in an idea…

> However security by obscurity is a layer of defense... In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense. Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference? I could w…

I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH?

I hoped by saying "a layer of defense" indicated that there was more layers

Re: Public Money, Public Code

#197

Post by joaogante »

bumper_crop wrote: post #122

Suppose you are on a committee where you are evaluating 3 different offers to build a website for your city. Bid A is for $10m, Bid B is for $9.5m, and Bid C is for $9m. The company that made offer B knows that they will likely lose the contract so they counter. "If you let us keep the source code and it remains private, we will bid $8.5m for the contract". Since all three vendors are offering equivalent service, and…

> Pick your 10 favorite GitHub project with more than 10k stars and see who the primary contributors are.

Hugging Face transformers has >60k stars and fewer than 30 employed maintainers, many sharing other responsibilities. Arguably, part its success comes external model contributions from FAANG companies (among others), but the key ingredient was the creation of an open platform.

Disclaimer: I work there

Re: Public Money, Public Code

#198

Post by prepend »

kingcharles wrote: post #165
datavirtue wrote: post #162

Earlier quoted context omitted.

I'm stunned that I had never thought to use a FOIA request for source code until seeing your comment. This is very tempting.

From a very experienced FOIA litigator, most of the time your FOIA request will be denied and then you'll have to sue to get the records. Typical time for these cases is 2-4 years of court appearances in trial court, then another 2 years in appellate court to get a favorable decision. A buddy of mine just won one that finally set the precedent that database schemas are not security: https://twitter.com/foiachap/statu…

Also, once you finally get the zip file of source it will be a giant mess that doesn’t have build scripts, nor documentation, etc.

So you’ll win, but won’t get want you want- a way to view, understand, improve, and share.

Re: Public Money, Public Code

#199

Post by unnah »

layer8 wrote: post #76
SparkyMcUnicorn wrote: post #69

Earlier quoted context omitted.

> Hence it also increases the cost for the taxpayers Isn't that just a short-term problem? Mid to long term, it should decrease costs dramatically.

How so? Because of external contributors? Most software developed for the public sector is quite use-case specific (and the use-cases are often quite boring), so I don’t see that happening for most projects.

Consider maintenance costs over the following decades. If the software is owned by the vendor, they can ask the highest price they can get away with, and the customer (government in this case) has no option but to pay it. Of course they also have the option of stopping maintenance, or switching to another solution, but those are very expensive alternatives.

However, if the software is open source, or alternatively owned by the government, than they can ask for competitive bids for maintenance. The vendor can no longer ask huge sums for basic maintenance. The projected savings can even justify significantly higher costs at the development stage.

Re: Public Money, Public Code

#200

Post by prepend »

inChargeOfIT wrote: post #118

The US is getting better about it, some more than others, but a few off the top of my head.. https://github.com/department-of-veterans-affairs https://github.com/nationalsecurityagency https://github.com/GSA https://github.com/CMSgov https://github.com/CDCgov

Funny story about CDCgov. Probably the most common question we get is “you should use CDC instead of CDCgov.”

Someone else has @CDC as they got there first. They aren’t active so CDC tried to get in touch with them and GitHub doesn’t provide a way to contact people. That’s kind of nice actually, they respect privacy.

GitHub did offer to contact the user without sharing the users contact info. They asked if @CDC was active and if not, would they mind letting CDC.gov use it. The user responded that they are active, just not with public activity. And that they would like to keep it.

I thought the whole process was pretty nice. Github respected the user, and still tried to help. User considered and didn’t change their existing account.

Some people got upset and tried to formulate plans to “make” the user give it up, but those weren’t pursued because it would be wrong and a waste of efforts and, I think, harmful to the purpose for collaborative software.

So that’s how CDCgov exists. And I suspect there’s a similar story behind CMSgov and all the other sites where staff were too slow to set stuff up.

Post reply on HN