Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Money, Public Code

publiccode.eu

Post reply on HN
Print view View original

211–216 of 216 posts

Re: Public Money, Public Code

#211

Post by ygjb »

RobertoG wrote: post #186
ygjb wrote: post #116

Earlier quoted context omitted.

> How can they pay for something and not own it? Have you ever purchases software? Any media, recorded performance, or book? I don't mean to be rude here, but this question shows a complete lack of awareness of the problem space. There are a number of contributing factors to why most government software is not open source, but here are some of my direct observations as a consultant to government departments, an emplo…

I have read your long comment and I'm less than convinced by any of your arguments. Specifically, I would say that number three is mostly false. The companies that receive those contracts are not, at least in my experience, small local shops (and there is an argument that they should be), but instead big consulting companies that know the correct people and procedures. >>"Alot of folks in government (including me whe…

> Specifically, I would say that number three is mostly false. The companies that receive those contracts are not, at least in my experience, small local shops (and there is an argument that they should be), but instead big consulting companies that know the correct people and procedures.

Define small local shops? I have worked on procurement processes in the United States at the municipal, state, and federal level, but my experience is largely based in the Canadian market. These are companies that have 100-1000 employees, working on technologies tightly scoped to specific municipal, state/provincial programs, and in some cases Federal programs. Some industries include prisons, agricultural programs, energy programs (hydro-electric, oil, gas, nuclear), and a broad cross section of infrastructure projects.

You can disagree or be unconvinced, but even a basic google search highlights the significant issues with procurement, and the fact that we have old and current laws on the books to address these concerns is evidence enough that procurement practices and influence from politicians and industry need regulation.

Simply put, procurement is about finding the right proposition for governments, and demonstrating to taxpayers that they are getting best value, while rewarding the individuals and industries that supported the elected officials and beaurocrats. This isn't a personal opinion, it's well supported by documentation in the industry.

> The point of the endeavor is precisely to change that.

I 100% agree, and I avidly support these kinds of initiatives; my comment didn't discount that, it was an explanation of why public code, developed internally, or by contractors, isn't necessarily suitable for open source release. Not all of the reasons are technical or legal, some are due to organizational or social pressure.

Re: Public Money, Public Code

#212

Post by kingcharles »

prepend wrote: post #198
kingcharles wrote: post #165

Earlier quoted context omitted.

From a very experienced FOIA litigator, most of the time your FOIA request will be denied and then you'll have to sue to get the records. Typical time for these cases is 2-4 years of court appearances in trial court, then another 2 years in appellate court to get a favorable decision. A buddy of mine just won one that finally set the precedent that database schemas are not security: https://twitter.com/foiachap/statu…

Also, once you finally get the zip file of source it will be a giant mess that doesn’t have build scripts, nor documentation, etc. So you’ll win, but won’t get want you want- a way to view, understand, improve, and share.

Or you'll find its just a mess of hundreds of off-the-shelf components glued together, none of which the government has the source code for :(

So basically you're right - you'll get an unbuildable clusterfuck.

Re: Public Money, Public Code

#213

Post by IIsi50MHz »

reillyse wrote: post #49

Large consulting companies like Accenture have entire divisions of their business devoted to "government". These divisions make money by developing software for governments. It is very much against their interest for this software to be open source because 1) there is visibility into their performance and 2) they can't sell very similar software to the same government if everyone knows what software they've already b…

You just told me more about what Accenture does than I got from poking around their content-free website when a HR person from there reached out to me unprompted. At the, I figured that if they claim to be in seemingly every industry, but can't articulate what they do, it wasn't worth replying.

Re: Public Money, Public Code

#214

Post by Mohammatnur »

bombcar wrote: post #72
HideousKojima wrote: post #59

Earlier quoted context omitted.

When I've done freelance work and have been able to write the contract, I include a clause that the client receives "a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the work and such derivative works, and to sublicense any or all of the foregoing rights to third parties," effectively giving them unli…

Would that let them GPL or even MIT the code? It would seem so.

Oh

Re: Public Money, Public Code

#215

Post by hyperdimension »

kingcharles wrote: post #165
datavirtue wrote: post #162

Earlier quoted context omitted.

I'm stunned that I had never thought to use a FOIA request for source code until seeing your comment. This is very tempting.

From a very experienced FOIA litigator, most of the time your FOIA request will be denied and then you'll have to sue to get the records. Typical time for these cases is 2-4 years of court appearances in trial court, then another 2 years in appellate court to get a favorable decision. A buddy of mine just won one that finally set the precedent that database schemas are not security: https://twitter.com/foiachap/statu…

You might be able to use this website. I've always wanted to use it, but haven't come up with something "interesting enough" to submit a request for:

https://www.muckrock.com/foi/

It helps you with the process of FOIA requests, and if/when granted, hosts the responses online publicly.

Re: Public Money, Public Code

#216

Post by 6510 »

ldoughty wrote: post #196
6510 wrote: post #84

Earlier quoted context omitted.

> However security by obscurity is a layer of defense... In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense. Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference? I could w…

I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH? I hoped by saying "a layer of defense" indicated that there was more layers

The developer is the attack vector. We give him some hand money, put a gun to his head and instruct him to make a backdoor.
Post reply on HN