Live data from Hacker News

Public Money, Public Code

publiccode.eu

91–100 of 216 posts

Re: Public Money, Public Code

#91

Why do software developers always shoot themselves in the foot with regard to their economic value? Governments pay all the time for development of technology that they buy, but that doesn't mean that the IP is released. For example, the government paid Boeing to develop transport aircraft. However, that does not mean that all the drawings/plans/etc for the aircraft are made public. The government is buying a set of…

Some of us value other things ( https://en.wikipedia.org/wiki/Open-source-software_movement#... ) more than additional compensation. These ideas have roots in the original hacker culture that this site was named for - this stuff is the foundation of a lot of computer culture.

Increasingly I hear this expressed as "Technology In The Public Interest", and is a movement I strongly affiliate with because it is related to national security (as I have defined it elsewhere) [0] as resilience and sustainability. See writing [1] and institutional support [2][3] separate from notions of software freedom as traditionally carried by Stallman et al/EFF/GNU/FSF.

[0] https://news.ycombinator.com/item?id=31108570

[1] https://www.schneier.com/essays/archives/2019/01/the_public-...

[2] https://www.macfound.org/programs/technology/

[3] https://www.fordfoundation.org/news-and-stories/big-ideas/pu...

Re: Public Money, Public Code

#92

Large consulting companies like Accenture have entire divisions of their business devoted to "government". These divisions make money by developing software for governments. It is very much against their interest for this software to be open source because 1) there is visibility into their performance and 2) they can't sell very similar software to the same government if everyone knows what software they've already b…

The reason you pointed out why this won't gain traction is why it needs to gain traction.

Re: Public Money, Public Code

#93

I mean as nice as this sounds, our money is spent on all sorts of things we know nothing about. Should we all be provided with the schematics for F-35s?

Exactly! Where do you draw the line? Does CIA/NSA have to drop their shorts?

Re: Public Money, Public Code

#95

Earlier quoted context omitted.

This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway Also true, in an idea…

> However security by obscurity is a layer of defense... It's not: https://en.wikipedia.org/wiki/Security_through_obscurity#Cri... . See also: https://en.wikipedia.org/wiki/Kerckhoffs's_principle .

> Security by obscurity alone is discouraged and not recommended by standards bodies

A layer, not the only layer.

> System security should not depend on the secrecy of the implementation or its components.

It is not depending on it. It is just an additional layer to delay or reduce impact.

Re: Public Money, Public Code

#96
I work in the public sector (US), and I have been advocating for something like this since I started my career.

The ERP we use for HR/Payroll, Accounts Payable/Receivable, Utility Billing, etc. costs an exorbitant amount of money each year, and the quality of both the software and the technical support we receive is comical. And this is new deployment, too. We upgraded from an IBM AS/400-based system a couple of years ago which I honestly long to go back to now and again out of frustration.

Let me give you just one an example of how we are held hostage to a private software vendor - collecting payment for utility bills. We are forced to use one credit card processor because it's the only "partner" that the ERP vendor has for payment processing. I guarantee you that you've never heard of them before. Their software is abysmal, and last time I checked, the ERP vendor gets a flat rate for each payment they collect (in addition to the standard credit card processing % + flat fee that goes to the merchant services company). There's no alternative. It's a Windows Service that has a tendency to crash several times a day without logging anything to Event Viewer. It's known to charge a credit card, but not return a success code to back the ERP, meaning the money was collected but their bill doesn't show as being paid. It's a problem I've documented clearly and created tickets on for over seven months at this point, and it's still not been resolved. Why? They have zero motivation. It's a beast to migrate to a new ERP (multiple years and $1M+), and they treat us as if we have no leverage in pushing for prompter support or better quality software. So luckily we are still on-premise with full access to the SQL database. I have written procedures to update the payment status manually each time this happens, post the transaction to the ERP, update reference numbers, and do a few other various things that should happen automatically when it works correctly. We were scolded for digging around ourselves and doing this, but if we open a support case, it takes 2-14 days to get a response back and that's simply not feasible when these payments need to post before EOB.

There's also no open API available. We have the in-house expertise to develop integrations and try to tie systems together in ways that make sense for our environment. Nope. Whatever few integrations that exists costs tens of thousands of dollars up-front, have very lackluster support, are infrequently updated, and are very rigid in their capabilities. I've asked how we can gain access to a sandbox environment or get documentation on an API so we can test and create the integrations that these sacred "partners" are able to -- radio silence. I've even reached out to individuals who work at the company on LinkedIn asking a similar question of how an independent developer can integrate with their ERP ecosystem -- left on read, no response.

Need a customization or change? Let's schedule a series of meetings and get it quoted out. $5,000 and two months later, we now have one new line of text displayed on our water bills about the drought. This is the level of control they maintain and use to line their pockets at our expense.

And now I've noticed that over the past year or so, there's been a very aggressive push to move to a SaaS environment. Meaning we'd lose direct access to SQL, lose access to logs and other tools I use to debug/diagnose, and be reliant on (read: held hostage by) the vendor even more. Good luck getting access to any of our raw data at that point. It's vendor lock-in to an extreme.

We (the agency, but more so the tax payers by extension) are victims. And we take it willingly without any pushback because there's no alternative. If anyone reading this is interested in helping fight against this or develop an open source alternative specific to government agencies, please reach out to me (email in profile here). I'm very passionate about this, having suffered so much aggravation over the years, and would love to work on bringing about some sort of solution.

Re: Public Money, Public Code

#97
Isn’t this quite hard to implement? How do you distinguish between Saas, software and custom services. Will this implicate that Microsoft office needs to be open source just because some government is buying that software?

Re: Public Money, Public Code

#98
post #93

I mean as nice as this sounds, our money is spent on all sorts of things we know nothing about. Should we all be provided with the schematics for F-35s?

Exactly! Where do you draw the line? Does CIA/NSA have to drop their shorts?

Any hypothetical obligation-to-make-code-public act could probably be guided by the thinking that went into the parameters of FOIA exemptions, since code is, after all, information.

Re: Public Money, Public Code

#99
post #85
post #78

Earlier quoted context omitted.

Over time the use-cases will grow, and if done right you'll start being able to "borrow" from similar use-cases in other areas/governments. It WOULD likely require massive retooling as much "government code" is more like "black box machine that does X" than "fancy new web-app".

In my experience, that doesn’t happen much even between projects within a single software company, because requirements are too diverse and change too frequently. Pushing for synergies also tends to create all sorts of internal political dynamics. At best it’s a long shot, with high risk of not amortizing the cost. The rest of the world, including the open-source world, also isn’t a promising role model, with the con…

Yeah, I suspect most people are thinking "government code" is like Chrome or something, whereas most government code; most business code, hell, most code in the world is random business logic/glue code which often doesn't have much portability or usefulness.
Post reply on HN