5 ms·

I am an open source advocate, but I don't really agree here. Should the IRS, NSA, CIA, and FBI code all be open source? Here are some cases where closed source

I am an open source advocate, but I don't really agree here. Should the IRS, NSA, CIA, and FBI code all be open source? Here are some cases where closed source software, with some security by obscurity could be helpful. Another example would be some software around designing nuclear systems. But as an example maybe a software funded by the national weather service to run simulations, that aught to be open source (perhaps something like that exists and is open source, that's not my area). But a counter argument to mine could be that some software that is security focused might be more secure if it was open source. I think this is an area with a lot of nuance, and absolute statements are hard to make.

AlexandrB 8y ago
> Should the IRS, NSA, CIA, and FBI code all be open source? Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.
- vanderZwan 8y ago
  Also, electronic voting. Not that electronic voting booths will ever be a good idea, but forcing them to open source their stuff will hopefully deter people from even trying (and if not it will make it even more blatantly visible that these things are terrible). It's just like the biggest argument for open source in science: it is required for proper accountability.
  - ganoushoreilly 8y ago
    Most of the code in electronic voting is owned by the vendors though so by the same standard would we have to open source any 3rd party software the govt aquires?
    - PurpleBoxDragon 8y ago
      I think it would have to be a requirement of any money the government spends on code. Otherwise, they will easily defeat the requirement to make it public by passing it through a private company.
    - vanderZwan 8y ago
      I don't quite follow your line of thinking here: - currently most electronic voting software is owned by the vendors - electronic voting should really not be trusted, period, but definitely not be allowed to be closed source - therefore, we should ban any electronic voting software not made on open source software (arguably even hardware) - therefore, I am implying vendors of electronic voting software should only be allowed to use a fully open source software stack in their final product I do not see the jump from this reasoning to any software used by the government must be open source (if I understand you correctly).
      - throwawaymath 8y ago
        That's a lot more involved and domain-specific than the question of whether or not government-owned code should be open source. The person you're responding to is just making the positive observation that, since electronic voting software is licensed - not produced - by the government, you can't mandate it be open sourced via e.g. a FOIA request. You are making a normative declaration that it should be open sourced because it's important and intrinsically untrusted software, and as a consequence it either will be or electronic voting won't be possible. These are separate things. You're talking about what ought to be, the other commenter is talking about what (currently) is.
        vanderZwan 8y ago
        Right, I see where GP and I were talking past each other now now. Thank you for clarifying!
        vanderZwan 8y ago
        Having said that, I think there is a more general point to be made from bringing up electronic voting in the discussion of open source + government funded software development. Licensed products are an inevitable loophole to be exploited unless we stipulate rules for use-cases like this. Inevitable because some products will always be licensed, and mandating that everything the government uses must be open source is... well, actually, that sounds great, but even if such a policy were implemented that would be a slow, tough transition to make.
  - MadWombat 8y ago
    > Not that electronic voting booths will ever be a good idea Why not?
- ianwalter 8y ago
  Yes, open source IRS software. Tax breaks for bug fixes!
  - Consultant32452 8y ago
    What do I get for sending in a malformed e-file that breaks the mainframe? There's some REALLY old code in the IRS processing systems and it would surprise me if any of it stood up to modern security designs. Also, you don't want to reveal how you determine who to audit.
    - jsymolon 8y ago
      > who to audit. Doesn't have to be complicated, pull 10% of the "simple" forms, 90% of complicated. Simple forms would be the 1040EZ, 1040s w/ std deductions & no other "business" forms.
      - Consultant32452 8y ago
        I highly doubt that the real code is random in that way. I'm sure there's some random aspect, but not all. If you're committing tax fraud, it's very valuable to know how to avoid tripping up the "audit this account" triggers.
        ianwalter 8y ago
        This is assuming "who to audit" is even a software process or completely a software process, but fine, don't open source that if necessary. I really just want the IRS software that I personally use to be open source.
- rtkwe 8y ago
  There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited. Releasing that risks big bad actors working around the limitations of whatever algorithms it contains.
  - dragonwriter 8y ago
    > There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited That's perhaps a good reason for that part of the software to not be published and/or FOIA disclosable, but that's orthogonal to how it is licensed. If it's an original government work now it would be public domain (which is more open than open source), but still potentially confidential and nondisclosable.
    - creatornator 8y ago
      While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable? It may as well not exist as far as open-source or public domain is concerned.
      - dragonwriter 8y ago
        > While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable? If the entire work is, less so than if it was disclosable (although there are laws governing the government use of copyright protected work, and arguably there is a benefit to the public interest if the vendor has provided and open source license even if the work is not publicly disclosable.) But practically, classification and, perhaps even moreso, the other exceptions to FOIA would often apply to limited portions of software systems rather than whole systems, as is often the case with other materials covered by FOIA.
        8y ago
OxO4 8y ago
I agree that there may be edge cases where it doesn't make sense to make software open source (although I also think that the majority of software used at IRS, NSA, CIA, and FBI could be open source). However, I strongly believe that if the code is not published, it should at least be available to the government itself, s.t. if a vendor goes out of business or the government wants to change vendors they can do so without issues.
stronglikedan 8y ago
> Should the IRS, NSA, CIA, and FBI code all be open source? I'm leaning toward "yes", but that doesn't mean the data (including encryption/decryption keys) should be publicly available.
cosinetau 8y ago
They will definitely want to consider extraordinary projects, materials, and infrastructure as munitions. But they also have existing, good relationships with academics in other engineering fields where those regulated materials can still be accessed. Maybe Wide-Open Source isn't the right answer for all projects because of the understood risks, but because they already have a good set of SOP for a similar program, perhaps it's time to ask them if they could expand that program's scope and loosen their grip on those things a little.
rplst8 8y ago
Security through "obscurity" is not security at all.
dragonwriter 8y ago
> Should the IRS, NSA, CIA, and FBI code all be open source? No, works made by or under hire for the federal government should be public domain, from a copyright standpoint, not exclusively owned but licensed under an open source license. But on the other hand, I think your real question has nothing to do with ownership or licensing, but whether or not they should be publicly disclosed. In many cases the answer is “no”, but lots of government work that is in the public domain from a copyright perspective is also not subject to unrestricted publicly disclosure (and may also be classified.) But arguably the licensing can work the same way as disclosure; presumptively, all government software should be open source, just as presumptively all government records are publicly disclosable; there may be limited defined exceptions for the former as there are for the latter, and decisions to treat software as within an exception should be reviewable by courts just as witholding material from FOIA disclosure is.
- tracker1 8y ago
  And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? Should the government have to pay tens of millions and years of waiting to re-create said software?
  - dragonwriter 8y ago
    > And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? I think there is a good argument for anything where the government is acquiring software rather than paying for service that the acquired software (even if it zero percent modified) should be under a permissive open source license (or even acquired into the public domain), and the source code should be a disclosable public record except to the extent it would be covered by privacy, security, or other existing exceptions to public records laws.
    - tracker1 8y ago
      So, you'd rather spend millions and years of time extra than to use closed source software?
mirekrusin 8y ago
What do they have to hide? Nobody is asking for their list of passwords/private keys. Even if they do have secret projects, nobody sane is asking them to open source every line of code they write. Look at NASA’s open mct on github - that’s awesome and we should push govt orgs to release more projects like this.
prepend 8y ago
The federal source code policy [0] gives an exemption for national security or mission requirement. So in the US there are valid reasons why CIA and FBI shouldn’t be totally open. But for everything else the directive is to default to open. [0] sourcecode.cio.gov
shmerl 8y ago
Isn't security by obscurity only giving a false sense of security? So it's actually making things worse.

AlexandrB 8y ago

> Should the IRS, NSA, CIA, and FBI code all be open source? Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.

vanderZwan 8y ago
Also, electronic voting. Not that electronic voting booths will ever be a good idea, but forcing them to open source their stuff will hopefully deter people from even trying (and if not it will make it even more blatantly visible that these things are terrible). It's just like the biggest argument for open source in science: it is required for proper accountability.
- ganoushoreilly 8y ago
  Most of the code in electronic voting is owned by the vendors though so by the same standard would we have to open source any 3rd party software the govt aquires?
  - PurpleBoxDragon 8y ago
    I think it would have to be a requirement of any money the government spends on code. Otherwise, they will easily defeat the requirement to make it public by passing it through a private company.
  - vanderZwan 8y ago
    I don't quite follow your line of thinking here: - currently most electronic voting software is owned by the vendors - electronic voting should really not be trusted, period, but definitely not be allowed to be closed source - therefore, we should ban any electronic voting software not made on open source software (arguably even hardware) - therefore, I am implying vendors of electronic voting software should only be allowed to use a fully open source software stack in their final product I do not see the jump from this reasoning to any software used by the government must be open source (if I understand you correctly).
    - throwawaymath 8y ago
      That's a lot more involved and domain-specific than the question of whether or not government-owned code should be open source. The person you're responding to is just making the positive observation that, since electronic voting software is licensed - not produced - by the government, you can't mandate it be open sourced via e.g. a FOIA request. You are making a normative declaration that it should be open sourced because it's important and intrinsically untrusted software, and as a consequence it either will be or electronic voting won't be possible. These are separate things. You're talking about what ought to be, the other commenter is talking about what (currently) is.
      - vanderZwan 8y ago
        Right, I see where GP and I were talking past each other now now. Thank you for clarifying!
      - vanderZwan 8y ago
        Having said that, I think there is a more general point to be made from bringing up electronic voting in the discussion of open source + government funded software development. Licensed products are an inevitable loophole to be exploited unless we stipulate rules for use-cases like this. Inevitable because some products will always be licensed, and mandating that everything the government uses must be open source is... well, actually, that sounds great, but even if such a policy were implemented that would be a slow, tough transition to make.
- MadWombat 8y ago
  > Not that electronic voting booths will ever be a good idea Why not?
ianwalter 8y ago
Yes, open source IRS software. Tax breaks for bug fixes!
- Consultant32452 8y ago
  What do I get for sending in a malformed e-file that breaks the mainframe? There's some REALLY old code in the IRS processing systems and it would surprise me if any of it stood up to modern security designs. Also, you don't want to reveal how you determine who to audit.
  - jsymolon 8y ago
    > who to audit. Doesn't have to be complicated, pull 10% of the "simple" forms, 90% of complicated. Simple forms would be the 1040EZ, 1040s w/ std deductions & no other "business" forms.
    - Consultant32452 8y ago
      I highly doubt that the real code is random in that way. I'm sure there's some random aspect, but not all. If you're committing tax fraud, it's very valuable to know how to avoid tripping up the "audit this account" triggers.
      - ianwalter 8y ago
        This is assuming "who to audit" is even a software process or completely a software process, but fine, don't open source that if necessary. I really just want the IRS software that I personally use to be open source.
rtkwe 8y ago
There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited. Releasing that risks big bad actors working around the limitations of whatever algorithms it contains.
- dragonwriter 8y ago
  > There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited That's perhaps a good reason for that part of the software to not be published and/or FOIA disclosable, but that's orthogonal to how it is licensed. If it's an original government work now it would be public domain (which is more open than open source), but still potentially confidential and nondisclosable.
  - creatornator 8y ago
    While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable? It may as well not exist as far as open-source or public domain is concerned.
    - dragonwriter 8y ago
      > While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable? If the entire work is, less so than if it was disclosable (although there are laws governing the government use of copyright protected work, and arguably there is a benefit to the public interest if the vendor has provided and open source license even if the work is not publicly disclosable.) But practically, classification and, perhaps even moreso, the other exceptions to FOIA would often apply to limited portions of software systems rather than whole systems, as is often the case with other materials covered by FOIA.
      - 8y ago

OxO4 8y ago

I agree that there may be edge cases where it doesn't make sense to make software open source (although I also think that the majority of software used at IRS, NSA, CIA, and FBI could be open source). However, I strongly believe that if the code is not published, it should at least be available to the government itself, s.t. if a vendor goes out of business or the government wants to change vendors they can do so without issues.

stronglikedan 8y ago

> Should the IRS, NSA, CIA, and FBI code all be open source? I'm leaning toward "yes", but that doesn't mean the data (including encryption/decryption keys) should be publicly available.

cosinetau 8y ago

They will definitely want to consider extraordinary projects, materials, and infrastructure as munitions. But they also have existing, good relationships with academics in other engineering fields where those regulated materials can still be accessed. Maybe Wide-Open Source isn't the right answer for all projects because of the understood risks, but because they already have a good set of SOP for a similar program, perhaps it's time to ask them if they could expand that program's scope and loosen their grip on those things a little.

rplst8 8y ago

Security through "obscurity" is not security at all.

dragonwriter 8y ago

> Should the IRS, NSA, CIA, and FBI code all be open source? No, works made by or under hire for the federal government should be public domain, from a copyright standpoint, not exclusively owned but licensed under an open source license. But on the other hand, I think your real question has nothing to do with ownership or licensing, but whether or not they should be publicly disclosed. In many cases the answer is “no”, but lots of government work that is in the public domain from a copyright perspective is also not subject to unrestricted publicly disclosure (and may also be classified.) But arguably the licensing can work the same way as disclosure; presumptively, all government software should be open source, just as presumptively all government records are publicly disclosable; there may be limited defined exceptions for the former as there are for the latter, and decisions to treat software as within an exception should be reviewable by courts just as witholding material from FOIA disclosure is.

tracker1 8y ago
And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? Should the government have to pay tens of millions and years of waiting to re-create said software?
- dragonwriter 8y ago
  > And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? I think there is a good argument for anything where the government is acquiring software rather than paying for service that the acquired software (even if it zero percent modified) should be under a permissive open source license (or even acquired into the public domain), and the source code should be a disclosable public record except to the extent it would be covered by privacy, security, or other existing exceptions to public records laws.
  - tracker1 8y ago
    So, you'd rather spend millions and years of time extra than to use closed source software?

mirekrusin 8y ago

What do they have to hide? Nobody is asking for their list of passwords/private keys. Even if they do have secret projects, nobody sane is asking them to open source every line of code they write. Look at NASA’s open mct on github - that’s awesome and we should push govt orgs to release more projects like this.

prepend 8y ago

The federal source code policy [0] gives an exemption for national security or mission requirement. So in the US there are valid reasons why CIA and FBI shouldn’t be totally open. But for everything else the directive is to default to open. [0] sourcecode.cio.gov

shmerl 8y ago

Isn't security by obscurity only giving a false sense of security? So it's actually making things worse.