10 ms·

Bulgaria Passes a Law Requiring Open Source

537 points by bozho 10y ago

lamarkia 10y ago
It mentions "OpenOffice", which is now defunct. In any case it is good. Future procurements will show how well the law is applied.
- venomsnake 10y ago
  This is Bulgaria. We treat laws as something below "vague recommendations".
- bozho 10y ago
  Although not strictly "defunct", point taken - changed it to LibreOffice.
- garaetjjte 10y ago
  OpenOffice isn't defunct, it is still in development: https://www.openoffice.org https://www.openoffice.org.
  - xvilka 10y ago
    It's nothing, compared with LibreOffice development pace.
    - garaetjjte 10y ago
      Yes, but it is still alive. And even LibreOffice copied feature introduced in Apache OpenOffice by IBM(sidebar). But OpenOffice cannot copy code from LO due to license incompatiblity.
chme 10y ago
Would be nice if bigger nations like USA, UK/GB, Germany would adopt this policy and have to open source the exploits and root kits that where develop with tax payers money. Open source XKeyscore, yay!
- mlnox 10y ago
  The UK government's digital services implement Open Standards for most of the code they develop. While this isn't something that third party vendors have to do, GDS/PDS/MOJDS/HMRCDigital are all rapidly reducing the amount of work external vendors do for government anyway. https://github.com/alphagov https://github.com/alphagov
  - bozho 10y ago
    Yes, in the linked presentation I mention GDS as a good example. The US also has a lot of opensource projects.
- Sylos 10y ago
  I think, the USA even already has a law like that, except that projects that were started prior to that law don't have to be open-sourced, so that's how XKeyscore is protected...
breakingcups 10y ago
This is very interesting, I wish more countries followed suit. In my ideal fantasy world, at some point other countries might have a look at one of the open source projects of Bulgaria and collaborate when the goals align closely.
- aorth 10y ago
  It would be cool to have a Bulgarian version of the US Government's 18F: https://18f.gsa.gov/ https://18f.gsa.gov/ They have public standards for government websites, server HTTPS configs, website user interfaces, etc. On GitHub! https://github.com/18F https://github.com/18F
stanislavb 10y ago
"The fact that something is in the law doesn’t mean it’s a fact, though."..."companies will surely try to circumvent it." Yeah, this is very well said. Most laws in Bulgaria are either not enforced or "avoidable" :)
blahi 10y ago
Every law passed by Bulgarian parliament serves only one purpose - to put pressure on somebody, so people in the shadows can get a slice. edit: A new government agency is tasked with enforcing the law Ah, I see now.
- bluetomcat 10y ago
  The GERB party doesn't do any politics or strategic decisions in favour of the nation. Its sole purpose is to keep bureaucracy high and its favoured companies busy by distributing EU funds through "power channels". More bureaucracy means easy money for that same "elite".
  - vminkov 10y ago
    You are totally right about the power channels, but the truth is they are focused on the construction sector. The old commies who stand behind this are not that confident when working with IT and that is one of the biggest reasons the law passed. They still don't acknowledge or don't care that it will be harder for them to steal from IT public tenders.
  - blahi 10y ago
    There is no party which does politics or strategic decisions in Bulgaria. ALL of the political scene is usurped by ex-intelligence officers and they suffocate any possible alternative in infancy. It is quite depressing and I don't think there is a way out.
- vminkov 10y ago
  I know the people who stand behind this and believe me, they have 0 (zero) dependence on the oligarchy and moreover they are a team of experts who have been in the private sector until recently. This law is one against the status quo.
  - blahi 10y ago
    There have been plenty of experts with 0 dependency from the oligarchy. They all either failed or started dancing to the tune. Even if they have pure intentions, they will get manipulated, used and eventually thrown out while the agency will serve as a means to block companies who don't know the right people.
bluetomcat 10y ago
You wouldn't know the background motivating this decision unless you have been a frustrated user of the nearly non-functional software of Bulgarian state institutions. Ludicrous amounts of money are paid by the government to a selected niche of companies for developing all kinds of useless websites which barely work under load and have abysmal implementations with blatant security holes. This law can act as a safeguard against such "epic failures", so that the taxpayers can be aware of what they are actually paying for. 300k euros for a static website? Let's hope it's over.
- netcan 10y ago
  I hope it helps, but it doesn't seem like a sure thing on the face of it. To the extent these big, expensive government projects are similar to smaller “dumb-customer” projects, I don’t think this will help. Anything that requires working with a hard to work with organization is “expensive” in one way or another. You need to sell them the project, which could take months or years. You need to figure out what they need, which will be difficult and you’ll be wrong because no one knows, nevermind articulating it . You’ll be forced to take numerous long cuts to meet unnecessary requirements. There will be iterations, slow progress, long waits for client input, training… The companies who succeed at this are the ones who are experts in this process. They sell well. They’re good at “managing the process” and winning when a project is 3 years overdue, over budget, the spec is on iteration 46, and no one can remember the original goal. OTOH, if the government is developing software, why shouldn’t it be open source. At the least, its good transparency.
  - bluetomcat 10y ago
    Yes, this is mostly about preventing taxpayer rip-off for trivial software. Similar fraud schemes are exploited in almost every infrastructure development project. The government would repave a road with 1/3 of the official budget and the rest would be shared among the officials and shady business owners. The Bulgarian government is unable to undertake a surveillance project of any substantial scale simply because it lacks the technological expertise.
  - unusximmortalis 10y ago
emilecantin 10y ago
> It means that whatever custom software the government procures will be visible and accessible to everyone. After all, it’s paid by tax-payers money and they should both be able to see it and benefit from it. I've been thinking that way for a long time, nice to see I'm not alone. Let's hope other jurisdictions follow suit.
jdimov10 10y ago
Out of context, this may sound like mildly cheerful news. It is not. Bulgaria is a doomed shithole, which has for many decades been ran by a murderous communist mafia, controlling every aspect of the economy and the legal system, while licking many foreign asses with equal dexterity (US / NATO, Russian, European, Ukrainian, Saudi, Israeli, Turkish - everyone whose ass is worth licking, Bulgarian "politicians" do it in order to secure _personal_ gains). But, yay, open-source. Sure. Whatever.
- jdimov10 10y ago
  Gosh, you people think I'm kidding about this! You think I'm sketching a tasteless comic or something full of foul language just for kicks.. If anything, I've put it too kindly! It is A LOT worse than this.
  - blahi 10y ago
    It is a lot worse than this. It is jaw dropping terror.
- bozho 10y ago
  That is irrelevant to the topic. Yes, there are big problems, but they are not fixed overnight. They are fixed slowly and patiently by introducing ever more transparency and safeguards.
  - jdimov10 10y ago
    No, they are not fixed slowly and patiently. There is ONLY one way to "fix" these "problems" and, unfortunately, it is the exact opposite of slowly and patiently. That's how absurd Bulgaria is.
    - bozho 10y ago
      Revolutions normally don't fix problems, they create new ones.
onestone 10y ago
I remember the CEO of Information Services JSC (the de-facto Bulgarian monopolist in governement software procurement), prof. Mihail Konstantinov, making the ridiculous claim on TV that "We can't release the source code of the elections counting software. Anyone who has the source can hack into the system, even children know that. If you don't understand that, you should tear your diploma". Glad to see that morons such as him will no longer have the final say.
- bozho 10y ago
  Actually, we made sure that the e-voting provisions in the new electoral code explicitly require the whole software to be open source. Especially for voting this is mandatory, otherwise there is no trust.
  - onestone 10y ago
    That's awesome to hear. Many thanks for your efforts :)
  - bluetomcat 10y ago
    And how do you ensure that the actual deployed code doesn't differ from the one posted on GitHub?
    - bozho 10y ago
      From the electoral code, rough translation: "Independent observers are allowed to verify whether the digital fingerprint of the system in the data centers matches the publicly announced one"
      - vladimirralev 10y ago
        The more people insist such verification is possible, the less you should trust them, they don't understand the issues[1]. It might be possible to come up with some provably verifiable scheme but they are very sophisticated and revised often because people still come up with ways to skew them[2]. [1] https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI [2] https://evoting.bismark.se/verifiable-electronic-voting/ https://evoting.bismark.se/verifiable-electronic-voting/
leandot 10y ago
That is great news, hope it works out well.
donkeyd 10y ago
I've personally seen the Dutch government spend millions implementing open source software. This was something that could've been fixed for a fraction using a closed source solution. After a couple of years, the project was canceled and the closed source solution was implemented anyway. I'm not saying that using OSS is a bad thing. I don't, however, think that 'OSS only' is the solution to the problem at hand.
- lucb1e 10y ago
  More background please? Because unless they were cutting corners in a huge way (probably security-wise), I don't see how open source would be so much more expensive than closed source. The statement that "[it] could've been fixed for a fraction using closed source" seems very weird since there are no fundamental differences in how one writes open or closed source code.
  - donkeyd 10y ago
    They were implementing an ESB. There wasn't any internal knowledge on it, so they had started a joint venture with a business that provided consultants. For some reason (not exactly sure why), the project went past its deadline by about 2 years. My own employer at the time also provided an ESB, though it was closed source. We had a lot of experience with the product, and therefore could've implemented it quickly and for a fraction of the price (like we'd done before). Unfortunately, no information on this is available online, for reasons I understand. When they canceled the project, apparently they ended up hiring my employer anyway.
- bluehazed 10y ago
  All this means is that new implementations of software created by contractors will required to be licensed differently than before (with an OSS license), so that contracted work is able to be audited by the public.
  - donkeyd 10y ago
    To me, it seems like this is not just about software created by contractors: > develop, upgrade or implementation of information systems and e-services Implementation infers that also OOTB software should be open source. To me this could lead to forced use of inferior OSS, or to costly implementations of OSS where there are only few experts.
anaolykarpov 10y ago
If facebook, google, twitter and others are able to run their world scale software on OSS solutions without being hacked, I am sure that OSS can power some national scale software as well.
- kowdermeister 10y ago
  They ARE being hacked from time to time :) But they also know that and they run bug-bounty programs.

537 points by bozho 10y ago

It mentions "OpenOffice", which is now defunct. In any case it is good. Future procurements will show how well the law is applied.

venomsnake 10y ago
This is Bulgaria. We treat laws as something below "vague recommendations".
bozho 10y ago
Although not strictly "defunct", point taken - changed it to LibreOffice.
garaetjjte 10y ago
OpenOffice isn't defunct, it is still in development: https://www.openoffice.org https://www.openoffice.org.
- xvilka 10y ago
  It's nothing, compared with LibreOffice development pace.
  - garaetjjte 10y ago
    Yes, but it is still alive. And even LibreOffice copied feature introduced in Apache OpenOffice by IBM(sidebar). But OpenOffice cannot copy code from LO due to license incompatiblity.

chme 10y ago

Would be nice if bigger nations like USA, UK/GB, Germany would adopt this policy and have to open source the exploits and root kits that where develop with tax payers money. Open source XKeyscore, yay!

mlnox 10y ago
The UK government's digital services implement Open Standards for most of the code they develop. While this isn't something that third party vendors have to do, GDS/PDS/MOJDS/HMRCDigital are all rapidly reducing the amount of work external vendors do for government anyway. https://github.com/alphagov https://github.com/alphagov
- bozho 10y ago
  Yes, in the linked presentation I mention GDS as a good example. The US also has a lot of opensource projects.
Sylos 10y ago
I think, the USA even already has a law like that, except that projects that were started prior to that law don't have to be open-sourced, so that's how XKeyscore is protected...

breakingcups 10y ago

This is very interesting, I wish more countries followed suit. In my ideal fantasy world, at some point other countries might have a look at one of the open source projects of Bulgaria and collaborate when the goals align closely.

aorth 10y ago
It would be cool to have a Bulgarian version of the US Government's 18F: https://18f.gsa.gov/ https://18f.gsa.gov/ They have public standards for government websites, server HTTPS configs, website user interfaces, etc. On GitHub! https://github.com/18F https://github.com/18F

stanislavb 10y ago

"The fact that something is in the law doesn’t mean it’s a fact, though."..."companies will surely try to circumvent it." Yeah, this is very well said. Most laws in Bulgaria are either not enforced or "avoidable" :)

blahi 10y ago

Every law passed by Bulgarian parliament serves only one purpose - to put pressure on somebody, so people in the shadows can get a slice. edit: A new government agency is tasked with enforcing the law Ah, I see now.

bluetomcat 10y ago
The GERB party doesn't do any politics or strategic decisions in favour of the nation. Its sole purpose is to keep bureaucracy high and its favoured companies busy by distributing EU funds through "power channels". More bureaucracy means easy money for that same "elite".
- vminkov 10y ago
  You are totally right about the power channels, but the truth is they are focused on the construction sector. The old commies who stand behind this are not that confident when working with IT and that is one of the biggest reasons the law passed. They still don't acknowledge or don't care that it will be harder for them to steal from IT public tenders.
- blahi 10y ago
  There is no party which does politics or strategic decisions in Bulgaria. ALL of the political scene is usurped by ex-intelligence officers and they suffocate any possible alternative in infancy. It is quite depressing and I don't think there is a way out.
vminkov 10y ago
I know the people who stand behind this and believe me, they have 0 (zero) dependence on the oligarchy and moreover they are a team of experts who have been in the private sector until recently. This law is one against the status quo.
- blahi 10y ago
  There have been plenty of experts with 0 dependency from the oligarchy. They all either failed or started dancing to the tune. Even if they have pure intentions, they will get manipulated, used and eventually thrown out while the agency will serve as a means to block companies who don't know the right people.

bluetomcat 10y ago

You wouldn't know the background motivating this decision unless you have been a frustrated user of the nearly non-functional software of Bulgarian state institutions. Ludicrous amounts of money are paid by the government to a selected niche of companies for developing all kinds of useless websites which barely work under load and have abysmal implementations with blatant security holes. This law can act as a safeguard against such "epic failures", so that the taxpayers can be aware of what they are actually paying for. 300k euros for a static website? Let's hope it's over.

netcan 10y ago
I hope it helps, but it doesn't seem like a sure thing on the face of it. To the extent these big, expensive government projects are similar to smaller “dumb-customer” projects, I don’t think this will help. Anything that requires working with a hard to work with organization is “expensive” in one way or another. You need to sell them the project, which could take months or years. You need to figure out what they need, which will be difficult and you’ll be wrong because no one knows, nevermind articulating it . You’ll be forced to take numerous long cuts to meet unnecessary requirements. There will be iterations, slow progress, long waits for client input, training… The companies who succeed at this are the ones who are experts in this process. They sell well. They’re good at “managing the process” and winning when a project is 3 years overdue, over budget, the spec is on iteration 46, and no one can remember the original goal. OTOH, if the government is developing software, why shouldn’t it be open source. At the least, its good transparency.
- bluetomcat 10y ago
  Yes, this is mostly about preventing taxpayer rip-off for trivial software. Similar fraud schemes are exploited in almost every infrastructure development project. The government would repave a road with 1/3 of the official budget and the rest would be shared among the officials and shady business owners. The Bulgarian government is unable to undertake a surveillance project of any substantial scale simply because it lacks the technological expertise.
- unusximmortalis 10y ago

emilecantin 10y ago

> It means that whatever custom software the government procures will be visible and accessible to everyone. After all, it’s paid by tax-payers money and they should both be able to see it and benefit from it. I've been thinking that way for a long time, nice to see I'm not alone. Let's hope other jurisdictions follow suit.

jdimov10 10y ago

Out of context, this may sound like mildly cheerful news. It is not. Bulgaria is a doomed shithole, which has for many decades been ran by a murderous communist mafia, controlling every aspect of the economy and the legal system, while licking many foreign asses with equal dexterity (US / NATO, Russian, European, Ukrainian, Saudi, Israeli, Turkish - everyone whose ass is worth licking, Bulgarian "politicians" do it in order to secure _personal_ gains). But, yay, open-source. Sure. Whatever.

jdimov10 10y ago
Gosh, you people think I'm kidding about this! You think I'm sketching a tasteless comic or something full of foul language just for kicks.. If anything, I've put it too kindly! It is A LOT worse than this.
- blahi 10y ago
  It is a lot worse than this. It is jaw dropping terror.
bozho 10y ago
That is irrelevant to the topic. Yes, there are big problems, but they are not fixed overnight. They are fixed slowly and patiently by introducing ever more transparency and safeguards.
- jdimov10 10y ago
  No, they are not fixed slowly and patiently. There is ONLY one way to "fix" these "problems" and, unfortunately, it is the exact opposite of slowly and patiently. That's how absurd Bulgaria is.
  - bozho 10y ago
    Revolutions normally don't fix problems, they create new ones.

onestone 10y ago

I remember the CEO of Information Services JSC (the de-facto Bulgarian monopolist in governement software procurement), prof. Mihail Konstantinov, making the ridiculous claim on TV that "We can't release the source code of the elections counting software. Anyone who has the source can hack into the system, even children know that. If you don't understand that, you should tear your diploma". Glad to see that morons such as him will no longer have the final say.

bozho 10y ago
Actually, we made sure that the e-voting provisions in the new electoral code explicitly require the whole software to be open source. Especially for voting this is mandatory, otherwise there is no trust.
- onestone 10y ago
  That's awesome to hear. Many thanks for your efforts :)
- bluetomcat 10y ago
  And how do you ensure that the actual deployed code doesn't differ from the one posted on GitHub?
  - bozho 10y ago
    From the electoral code, rough translation: "Independent observers are allowed to verify whether the digital fingerprint of the system in the data centers matches the publicly announced one"
    - vladimirralev 10y ago
      The more people insist such verification is possible, the less you should trust them, they don't understand the issues[1]. It might be possible to come up with some provably verifiable scheme but they are very sophisticated and revised often because people still come up with ways to skew them[2]. [1] https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI [2] https://evoting.bismark.se/verifiable-electronic-voting/ https://evoting.bismark.se/verifiable-electronic-voting/

leandot 10y ago

That is great news, hope it works out well.

donkeyd 10y ago

I've personally seen the Dutch government spend millions implementing open source software. This was something that could've been fixed for a fraction using a closed source solution. After a couple of years, the project was canceled and the closed source solution was implemented anyway. I'm not saying that using OSS is a bad thing. I don't, however, think that 'OSS only' is the solution to the problem at hand.

lucb1e 10y ago
More background please? Because unless they were cutting corners in a huge way (probably security-wise), I don't see how open source would be so much more expensive than closed source. The statement that "[it] could've been fixed for a fraction using closed source" seems very weird since there are no fundamental differences in how one writes open or closed source code.
- donkeyd 10y ago
  They were implementing an ESB. There wasn't any internal knowledge on it, so they had started a joint venture with a business that provided consultants. For some reason (not exactly sure why), the project went past its deadline by about 2 years. My own employer at the time also provided an ESB, though it was closed source. We had a lot of experience with the product, and therefore could've implemented it quickly and for a fraction of the price (like we'd done before). Unfortunately, no information on this is available online, for reasons I understand. When they canceled the project, apparently they ended up hiring my employer anyway.
bluehazed 10y ago
All this means is that new implementations of software created by contractors will required to be licensed differently than before (with an OSS license), so that contracted work is able to be audited by the public.
- donkeyd 10y ago
  To me, it seems like this is not just about software created by contractors: > develop, upgrade or implementation of information systems and e-services Implementation infers that also OOTB software should be open source. To me this could lead to forced use of inferior OSS, or to costly implementations of OSS where there are only few experts.

anaolykarpov 10y ago

If facebook, google, twitter and others are able to run their world scale software on OSS solutions without being hacked, I am sure that OSS can power some national scale software as well.

kowdermeister 10y ago
They ARE being hacked from time to time :) But they also know that and they run bug-bounty programs.