Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Money, Public Code

publiccode.eu

Post reply on HN
Print view View original

71–80 of 216 posts

Re: Public Money, Public Code

#71

Post by ldoughty »

postalrat wrote: post #10

The state I lived in developed one of those covid tracking apps. I asked for the source code and was told it wasn't available and would never be. I talked to people working on other software developed for the state and they all think that software shouldn't be public. It seems crazy to me that taxpayers pay for this software but it doesn't belong to them. Knowing what I do know I gotta wonder if it's just about those…

This is the kind of issue that causes all that government bloat...

If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens.

One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway

Also true, in an ideal world, the software should be free from such vulnerabilities.

However security by obscurity is a layer of defense... And there might be other controls in place too to help.. e.g. a git repo behind SSO...

If I accidentally check in a CSV of a data dump, or my access Keys, etc... It doesn't immediately become a data leak/issue.. I have at least some time to reconcile that.. but if the repo is publicly accessible, the moment it hits the wire someone can copy that data...

One might follow up: "Well, they should not make the code if they are not competent enough to write it and host it"

Would be nice as well! But sadly there is only so many developers that can do this kind of work with a very high level of security and competence... By requiring governments to make this code freely available, you could basically assume two outcomes: nothing the government has on you will be secret, including sealed records and private information. In addition, IT workers would be paid 7-figures with 5-10 years of experience, as every government project that touches software now needs 5+ highly trained workers to avoid gigantic lawsuits.. and no one could get an entry level job in government because one bad commit could cause an 8-figure lawsuit

And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

Re: Public Money, Public Code

#72

Post by bombcar »

HideousKojima wrote: post #59
bartvk wrote: post #50

Earlier quoted context omitted.

I don't see what corruption has to do with it. I'm a subcontractor and usually the contractual terms are dictated by my clients. If I get the chance however, I put forth my terms and these say that I'm the author of the code and thus the copyright holder.

When I've done freelance work and have been able to write the contract, I include a clause that the client receives "a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the work and such derivative works, and to sublicense any or all of the foregoing rights to third parties," effectively giving them unli…

Would that let them GPL or even MIT the code? It would seem so.

Re: Public Money, Public Code

#73

Post by openthc »

Many States in the USA have implemented a "track-and-trace" program for their cannabis. The States use this information for enforcement. These programs have many bugs -- observable/repeatable bugs. Then enforcement uses the data from the buggy software to cite businesses for failures of their "track-and-trace" requirements. (eg: the system magically restores weight to zero-weight lots, or marks dead trees as alive).

In Washington State they started with BioTrackTHC; couldn't share the code cause it's a proprietary and a security risk; however they were dumping parts of the database as CSVs so folk could check that (and confirm some bugs!). Then WA switched to LeafData (MJ Freeway) and wouldn't share that code either; continued to share similar data-dumps. Now WA has moved to just uploading CSVs to the State system in code they wrote themselves -- and still won't share the code (and now are doing even less to share the data).

It's frustrating when viable open source solutions exist and are actively ignored by the State agencies (we were blocked from even participating in workgroups about the future of T&T (which don't really matter, they didn't even follow the recommendations of their own workgroups))

Re: Public Money, Public Code

#74

Post by tommyage »

Im currently working as a software architect for the government. The software we are developing is not beneficial to any citizen. Additionally, there is no staff to review and merge improvements. And merges need to get tested by regression as well, so bringing it to production would be cumberstone. Nonetheless, if we use another piece of software, we are preferring solutions where the code is open sourced. There needs to be enterprise support, though. And most of our colleagues are also pushing to pay our consultancies to improve these pieces of software.

Our use cases with these solutions are kind of essential, so there are no possibilties to "give back".

Any federal agency is supposed to cover one aspect of the government services. Developing individual software, which cover national laws.

Also note that our software is almost 90% legacy code. And new solutions need to work around these quirks.

Re: Public Money, Public Code

#76

Post by layer8 »

SparkyMcUnicorn wrote: post #69
layer8 wrote: post #51

While I generally agree, publishing code commonly requires additional effort and diligence, such as checking the licensing situation of third-party code used, possibly anonymizing the devs involved, maintaining the public repository and credentials, dealing with all the communication from the public caused by publishing the code, and so on. Hence it also increases the cost for the taxpayers, and that needs to be fact…

> Hence it also increases the cost for the taxpayers Isn't that just a short-term problem? Mid to long term, it should decrease costs dramatically.

How so? Because of external contributors? Most software developed for the public sector is quite use-case specific (and the use-cases are often quite boring), so I don’t see that happening for most projects.

Re: Public Money, Public Code

#77

Post by bombcar »

giobox wrote: post #21

I've often wondered if we need to radically change the State's relationship with the software it produces. As Robert Lessig famously observed, "code is law" in a world controlled by computers. There is increasingly a strong argument I feel in States directly employing software engineers much like they typically employ armies of civil servants to implement policy. Why is software treated as something to be outsourced…

Mainly because the government has no expertise in the area, so you have to convince politicians (who have no expertise in the area) that it is important, against those who DO have funding and will fight it as being "insecure" and various other buzzwords.

Governments often don't even employ the armies of civil servants anymore, lots and lots of stuff is contracted out.

The way around this might be to convince some of the smaller "tech wannabe" states to enact something, and let it grow from there.

Re: Public Money, Public Code

#78

Post by bombcar »

layer8 wrote: post #76
SparkyMcUnicorn wrote: post #69

Earlier quoted context omitted.

> Hence it also increases the cost for the taxpayers Isn't that just a short-term problem? Mid to long term, it should decrease costs dramatically.

How so? Because of external contributors? Most software developed for the public sector is quite use-case specific (and the use-cases are often quite boring), so I don’t see that happening for most projects.

Over time the use-cases will grow, and if done right you'll start being able to "borrow" from similar use-cases in other areas/governments.

It WOULD likely require massive retooling as much "government code" is more like "black box machine that does X" than "fancy new web-app".

Re: Public Money, Public Code

#80

Post by UncleEntity »

ldoughty wrote: post #71
postalrat wrote: post #10

The state I lived in developed one of those covid tracking apps. I asked for the source code and was told it wasn't available and would never be. I talked to people working on other software developed for the state and they all think that software shouldn't be public. It seems crazy to me that taxpayers pay for this software but it doesn't belong to them. Knowing what I do know I gotta wonder if it's just about those…

This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway Also true, in an idea…

> And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

If they give you a tank they have one less tank to do stuff with but if they give you a copy of software they still have the ability to do stuff with the software.

There’s a whole bunch of software out there that has been open sourced by government agencies like nasa and you don’t see satellites falling out of the sky on a regular basis.

Post reply on HN