11 ms·
US government commits to publish publicly financed software under FOSS licenses
- ruffrey 11y agoLet's start with open sourcing the effing voting machines.
- ThomPete 11y agoSeveral companies have been started by using software developed by people working in governments and it's only fair as it's all funded by the taxpayers Because many governmental projects are politically sanctioned, done properly, this could become a great way to do R&D where the private market doesn't.
- castratikron 11y agoGreat news.
- nxzero 11y ago(Next step, open source the government policy, procedure, etc.) Laws like requiring all commits to be submitted by the author. Authors must disclose potiental conflicts of interest, affiliations, etc. Submitting commits on behalf of another entity is treason; meaning if a funder wants a policy written, they post the funds, select another entity, selected entity assigns staff, staff submits policy, etc.; All public, all real-time.
- elcapitan 11y ago>npm install xkeyscore npm ERR! 404 'xkeyscore' is not in the npm registry. npm ERR! 404 You should bug the author to publish it Hm.
- JetSpiegel 11y agoIt probably depends on left-pad
- kyled 11y agoFloating points.... Floating points everywhere!
- komaromy 11y agoWow, this is great. I hope it prevents another contractor-related debacle like healthcare dot gov.
- rtkwe 11y agoThere was a lot of things that went into that. There was a huge time crunch on the project and until the bill was signed there was only so much groundwork that could be laid because you could only make passable guesses at the final requirements.
- thegreatpeter 11y agoIf this actually works, wow
- andrewstuart2 11y agoIt seems like they've cut a wide swath for (probably) exempting the most interesting of the software that could have been developed in the open. > Applicable exceptions are as follows: > The release of the item is restricted by another statute or regulation, such as the Export Administration Regulations, the International Traffic in Arms Regulation, or the laws and regulations governing classified information; > The release of the item would compromise national security, confidentiality, or individual privacy; > The release of the item would create an identifiable risk to the stability, security, or integrity of the agency’s systems or personnel; > The release of the item would compromise agency mission, programs, or operations; or > The CIO believes it is in the national interest to exempt publicly releasing the work. [1] https://sourcecode.cio.gov/Implementation/ https://sourcecode.cio.gov/Implementation/
- spilk 11y agoThis probably excludes pretty much everything except probably the most boring things - public information websites, etc. Anything within the DoD, for instance, will at minimum be tagged "for official use only", which already exempts it from FOIA requests, so I don't see this really opening much up at all.
- JonathonW 11y agoDoD work can, in at least some cases, be open-sourced. We had some work with DARPA where open-sourcing was actually mandated in our contract (at our request), and that code was, for a while at least, in active use in the field. Although I guess research is a little different. Whether or not it's feasible is entirely dependent on the project, though. Something that's ITAR/EAR (or classified) is never going to be open-sourced.
- davb 11y agoI agree with your comment, but I think it will be easier to pass this right now with some wide exemptions and potentially expand it somewhere down the line.
- nerdponx 11y ago
- spacehome 11y agoI hope this includes voting software.
- chaostheory 11y agoI could be wrong, but in most cases the US government buys appliances from companies like Diebold and they don't develop or contract software for voting. The best that can be done is regulation to force audits of the appliances like what Nevada does with casino slots. Even that would be a huge step up.
- nxzero 11y agoMight be a reason to long-term require all software used be open source and for that matter make it easy for a user to confirm that the system in use real-time is the system that's open-sourced too.
- tajen 11y agoHow do you allow a user to confirm this in real time? Hash displayed on th screen?
- nxzero 11y agoYes, that's correct, being able to download the code, hash it, and then compare it to the hash displayed real-time would be a first step towards enabling this.
- stepanhruda 11y agothe software can easily be modified to display the hash you are expecting
- nxzero 11y agoTo start, something is better than nothing. Long-term remote inbound two part authitacation combine with like measures for hardware via meta-programming would make bypassing this very, very hard for the average hacker.
- tfigment 11y agoIt exempts prior work from this clause though it says it encourages vendors to adhere to it. I have a hard time seeing that anything really interesting will be ever released because it will likely have national security exemptions in it and like taxes many companies will find a way to avoid it.
- Karunamon 11y agoYeah.. just about anything can be declared under the umbrella of "national security" if you reach hard enough. For a true to life example, look at the NSA.
- crishoj 11y agoLooking forward to https://github.com/nationalsecurityagency/PRISM https://github.com/nationalsecurityagency/PRISM et al
- nickpsecurity 11y agoIt's funny you say that because that's the one NSA did voluntarily: http://www.informationweek.com/applications/nsa-submits-open-source-secure-database-to-apache/d/d-id/1099972 http://www.informationweek.com/applications/nsa-submits-open... https://accumulo.apache.org/ https://accumulo.apache.org/ ;)
- ismail 11y agoAlso: https://nifi.apache.org/ https://nifi.apache.org/
- nickpsecurity 11y agoHell yeah! That might be the one I was thinking of. I recall it had labeling or provenance tagging for security purposes. Both might have it, though.
- mikey_p 11y agoDon't forget https://github.com/simp https://github.com/simp
- nickpsecurity 11y agoOh yeah, I did forget about that one. Page is kind of clutterer but the glance makes me think this was the tool that automated & checks hardening guides. Am I right? And does it substitute for system monitoring/config tools that are popular or just complement them?
- mtgx 11y agoHelp us, spy you.
- moon_of_moon 11y agoWhy is this limited to software? Why not also publish publicly financed: * legal agreements * HR contracts * management presentations, best practices, and training material * marketing presentations and training material * creative output such as artwork and music so that the rest of the world can use them for free..
- justinlardinois 11y ago> creative output such as artwork and music If I'm not mistaken, all intellectual property published by the US government is public domain by law. I may be wrong or you may be referring to something else.
- tzs 11y agoClose. It's not publication by the government that is important. It's authorship. If a work is a work prepared by an officer or employee of the United States Government as part of that person’s official duties, then it is not subject to copyright in the US. It might be subject to copyright in other countries, though. If the government pays for a work to be created and published, but it is not a work prepared by an officer or employee of the United States Government as part of that person’s official duties, then it will be copyrighted and the copyright owner will be whoever it would be normally. If there is an agreement between the author and the government to assign the copyright to the government, the copyright will still be valid, and owned by the government.
- justinlardinois 11y agoI suppose you're right, but isn't that simply an issue of contract negotiation? Often when a private actor hires a contractor to create IP, part of what they're buying is ownership of the IP itself. I have no idea if the US government does this or not.
- deleted 11y ago[deleted]
- carussell 11y ago
- jMyles 11y agoIt is completely contrary to the notion of an open and free society that the government is permitted to spend taxed dollars developing anything meant for domestic use in secret, much less it being (more or less) the default policy. Looking at the exemptions carved out of this rule (assuming this source is accurate), this looks more like it is codifying the secret nature of government operations than it is opening up anything substantial. Hard to regard this as good news, although it may be another straw on the back of the government finally falling and the emergence of an actual open and peaceful world.
- dinkumthinkum 11y agoHow exactly is I "contrary to th notion of an open a d free society." I think that's just nonsense. And you think this could only be good if it leads to the government failing and a failed government obviously leads to world peace? I think some just let irrational hatred make them believe inane fairy tales.
- jMyles 11y agoThe basis for transparency is government, at least in the common law tradition, is the understanding that without it, government actors will tend to act in their own interest rather than in that of the public. Do you think that this is a reasonable belief? If so, then it logically and obviously follows both that 1) development of products by the government (to the extent that this is even the reasonable purview of information age government at all) need to be conducted in a profoundly public way and that 2) a failure to do this will result in a properly disaffected populace and shortened moral stature on the part of the government. It is no fairy tale to suggest that secrecy in government is a substantial part of the formula of government failure more generally. The only assertion I'm making that might not yet be in evidence is that, amidst the information age, this aspect of good government is more important and that its effects will be realized far more quickly.
- known 11y agoI believe it'll be BSD licence
- Dowwie 11y agoAnd after the first data journalist wave of analysis reveals an average of 10,000 redundant projects worked on by agencies at any given time, open access will go dark again.
- sitkack 11y agoThis is excellent as it puts something (sorta in writing). But the government only has a limited ability to retain copyright. If there is a wholly in-house developed program, one _should_ be able to get the source under a FOIA request.
- Eduard 11y agoWhat percentage of US government software is currently developed as FLOSS?
- niels_olson 11y agoOne of the current issues is that government-written code is pure public domain, so any contractor (SAIC) can FOIA some code the know their DoD handlers want implemented (ViSTA, written by the VA) and charge $4B. That is a tragedy of the commons if I ever saw one.
- foxhop 11y agoI want the source code of government cryptography programs.
- gryph0n 11y agoYou do realize the security lies with the keys/passwords used to encrypt, and not in the program/algorithm itself?
- rjurney 11y agoA great start. Now if only the same would be required of all code arising from federally funded research, we could massively accelerate research and development in America.
- edoceo 11y agoI want more State government to adopt this policy
- lifeisstillgood 11y agoThis has been a UK government stance for a while but the problem is that while the UK gov spends something like 8BN pa on software licenses the amount of new development is fairly low (outside of say the GDS - central cabinet office group pushing all this) So for example, my local council wants to purchase software to help track customer feedback from dozens of sources (web sites, phone ins etc). Sounds perfect for a web era, message queue based project. But my council is only interested in meeting its fiduciary duty in buying software that already exists, and has been proven to do the job required. Speculative development is out - even though pretty much everyone of 430+ councils, parishes, towns etc of the U.K. Will want something similar in the next few years. No one is willing to stump up the cash to start the open source alternative. It's a tragedy of the not commons. I think there ought to be solutions in some kind of development bonds or other financing arrangements - but it's not clear how.
- tvararu 11y ago> This has been a UK government stance for a while As further confirmation, it's cemented as one of the ten design principles behind GOV.UK: https://www.gov.uk/design-principles#tenth https://www.gov.uk/design-principles#tenth
- lifeisstillgood 11y agoYeah but still... No way to get to the majority of IT spend - even if that IT spend is wasted on licenses costing more than the cost of the capital build out
- verst 11y agoObligatory mention of 18F (https://18f.gsa.gov https://18f.gsa.gov) within the General Services Administration who develop federal government projects in the open (and have defaulted to open-sourcing since their inception). https://18f.gsa.gov/2015/01/16/open-source-for-good-government/ https://18f.gsa.gov/2015/01/16/open-source-for-good-governme...
- phkahler 11y agoLicensing problems. For new projects this sounds great, put the code either in the public domain or they pick a license. Which one? MIT/BSD, GPL/LGPL, or something else? The former can generally be incorporated into the later, but what if they pick something else that's incompatible? At least we can see what was done and learn from it I guess. And what if they require a particular license as part of the policy and it prevent government projects from extending existing OSS project? That would be a shame. The intent seems good, but the details will be everything.
- meanduck 11y agoIts only the article stating (and misleading) that softwares be Free Software but in actual the draft never once mention Free Software. So unlikely it would be GPL/LGPL/etc. Its also suprising to see that this question popped up after 500+ points.
- batbomb 11y agoGPL is discouraged in government software (speaking from DOE/NSF experience) but BSD or similar is encouraged. The path of least resistance is private/closed source, followed by open source BSD/MIT/Apache, followed by GPL/LGPL, followed by commercialization. The reason why there is a bit of resistance with open source as a default is because funding has to be traced.
- bpchaps 11y agoHeh. I submitted a FOIA request two weeks ago for code for a $100M system used for storing parking ticket data. They have 5 days to ask for an extension, but they haven't even responded with that. Guess I'm going to lawyer up again..
- MichaelApproved 11y agoWhat is the penalty for not responding in time?
- bpchaps 11y agoFor Illinois, two big things - 1. They can't reject the FOIA with "unduly burdensome" anymore, which is an incredibly common and frustrating response. 2. They can be sued for not complying, which then becomes a slow drawn out process. The upside is that it's something like 8k if the judge thinks the request was rejected/ignored intentionally or without proper followup. Example - I did a FOIA that was rejected absurdly unfairly. Going through the attorney general took about 6 months to hear a response back, which Chicago's lawyer then used essentially a mistype to throw that request out. 8 months in total there. Fast forward 6 months later and we have a court date with a lot of small things in between then and now.
- ChrisDutrow 11y agoWhy do these get rejected? Is it just people being lazy? Or people not understanding how to handle the request? Seems like a lot of work for them to go to court?
- bpchaps 11y agoA few things - 1. Definitely a lot of laziness from the FOIA officers. Some are really great, but others not so much. 2. There's no standardization in how it's handled within the city. Departments in the same buildings have very different idea of what should be rejected, their helpfulness, looseness of FOIA interpretation, etc. 3. They're truly not technical in the slightest. At one point I asked for a database dump, excluding sensitive columns and tables. The response was "Wikipedia defines a Data as:", so I had some fun explaining that one. 4. Fighting the process takes a very long time, so a rejection is an easy way to get someone to go away. 5. Not a reason, but still annoying.. They wait the maximum days to respond to your requests. Of the 50 or so I've submitted, I'd say 45 of them have been last minute. 25 times out of the 50, sure... but most? It's a lot of work if it gets to that point, yep, but I've only ever needed my lawyer to file a suit. The average FOIA might take me 5 minutes to write, so it's not really that much time - especially considering what you get for it. Here's an example one with some pretty neat data from it: https://github.com/red-bin/chitickets https://github.com/red-bin/chitickets
- rmason 11y agoI presented on this three years ago to the state government here in Michigan. It makes far more sense for the state's to do this than the Feds. Why should there be fifty different software programs to register for a state campground? Or deal with the DMV? When the Feds pass a new law some contractor ends up writing the same software fifty different times for each individual state with small differences. I believe the key is to have a plug in architecture, like WordPress, that allow each state to adopt the program for their individual laws. I think the savings could be tremendous and its entirely possible with multiple states collaborating the software could be continually improved. I failed to convince them that day but I think the tide is turning.
- atonse 11y agoIntuitively makes sense until you realize that there are similarly a lot of line of business apps that are used and implemented again and again across federal agencies. For example, every classified document has a classification level (Secret, Top Secret, with more details on it). And the functionality to roll up the classification is re-implemented by every contractor every single system. So even within ONE agency, every system's implementation is done from scratch. It's the perfect kind of thing that could've been an open source library (still in a classified network though), but still extremely valuable. It's something I built and recommended to my superiors ten years ago when I worked for a government contractor, but we didn't get much traction for various reasons. (Cynically, most contractors want the free money to reimplement it, so they aren't going to stop that gravy train.) So there is a LOT of room even within each single agency, to share code that is common to their business practices. You'll be hard pressed to find an area in any large organization (public or private) that couldn't benefit from the efficiencies of reuse.
- deathanatos 11y ago> The custom-build software will also be published to the general public either as public domain, or as Free Software so others can improve and reuse the software. > However, it is encouraged to be retroactively applicable for the existing custom-build software developed by agency employees in the course of their official duties. As much as I love FOSS, anything produced by the government — including software — is public domain, right? The government is not eligible for copyright — including FOSS licensing. While I understand that the government sometimes contracts stuff out, and those third-parties seem to enjoy a weird exception to the rule, the article seems to be including stuff developed directly by the government for the government. How do they think they have any rights to it at all?
- incompatible 11y agoPublic domain in the USA, but automatically copyrighted in practically every other country in the world.
- massemphasis 11y agoWhy would we want a 360000$ random compass application?