7 ms·

Most posts on this thread are focusing on exceptional cases where there are obvious reasons not to open the source, such as defense, but huge amounts of publicl

• zbruhnke 8y ago
  Man it would be pretty amazing to be able to submit a Pull Request to the IRS. Matt Cutts if you're reading this please help! On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that
  • deleted 8y ago
    [deleted]
  • dragontamer 8y ago
    > On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that Any more nefarious things that can be done with your Linux OS server talking to your Open Source Chromium / Firefox web browser? Open Source doesn't necessarily mean less secure.
    • zbruhnke 8y ago
      Agreed that it does not necessarily mean less secure ... see my comment below
    • keithnz 8y ago
      I'm not sure these things are equivalent, many people use a browser and Linux, not many people need to use electrical grid software. However, I would imagine it would still be beneficial for open analysis though. I'm not sure security through obscurity is a good option when there are motivated nefarious actors involved. But that's more of a "gut feel" than based on any evidence
  • tracker1 8y ago
    Agreed, safety and essential infrastructure should probably not be open source. That said, the main points of infrastructure access and configuration are probably larger issues at hand over the actual systems source itself. As to TFA, I have mixed feelings. I'm actually more concerned about research and related patents and data surrounding publicly funded study. I do feel that Open-Source should be given some level of preference, but not that all publicly funded software should be open source itself. It's a blurry line imho.
    • jacquesm 8y ago
      Disagreed, safety and essential infrastructure should definitely be open source. Right now your typical infrastructure project is about as leaky as they come compared to a typical web app. Exposing that stuff to broad daylight will certainly help to harden it.
      • zbruhnke 8y ago
        I wish I had as much faith in the government as you ... then again as a resident of the netherlands I suppose you might have reason to have more faith than I do in the US? In principle I completely agree that things being in the open should help to harden them, but especially in the US where funding is often used as a bargaining chip and bureaucracy is rampant I get a bit nervous
        • jacquesm 8y ago
          Then you're essentially ceding the ground to the bad guys.
      • tracker1 8y ago
        And how much of that is already using open-source and it's the configuration that's leaky, and not the software itself? How many poorly maintained/updated/configured Linux hosts are out there? Same for Windows, etc... in the end, the software can be the greatest, but if the host's configuration is poorly setup/managed, what does it matter.
      • 8y ago
  • PurpleBoxDragon 8y ago
    By hiding the code, it makes security through obscurity far more possible. If you force the code to be public, very poor security will be discovered far faster and be more of an issue to the public. While this will also make abusing security flaws easier, I think there is also a real benefit to forcing it to be public that could potentially outweigh the risks of doing such.
    • zbruhnke 8y ago
      I agree with this in principle (in fact I had a long argument with the former CTO of Citi about this during the heartbleed fiasco) but I also worry that if noone is willing to put in the effort to fix flaws or they are not reported properly then fixing them could go un-funded while flaws were easier to discover. Maybe the answer is very good logging of anyone who has cloned the repos etc. but right now when we have a government that uses whether or not they're going to fund important parts of our infrastructure (like Air Traffic Controllers) as a bargaining chip I have some skepticism around them being willing to fund ongoing maintenance of some of these products. Despite the fact that things being in the open SHOULD curb this from happening I've read enough legislation (yes, I actually do like to read legislation) to know that that probably is not true when it comes to the government
    • rhacker 8y ago
      An alternative would be to rebuild these from scratch, not using any existing code, but start (and always continue) in the open.
  • container 8y ago
    Could you be more specific about what you can imagine? People looking at the code and finding exploits that way?
  • natechols 8y ago
    Or at the very least our entire national tax code should be downloadable in machine-readable form.
    • analog31 8y ago
      It should just be a giant function: def foo(**kwargs): <insert code here> return how_much_you_owe
      • m0zg 8y ago
        It really should be a provably unambiguous ruleset that would take in the person's circumstances and numbers and spit out a number, yes. I understand that your post is a joke, but that'd be an _awesome_ thing to have for everyone, especially if coupled with some adversarial tech to find and close loopholes. Which is, ironically, why this isn't going to happen.
        • natechols 8y ago
          I've always assumed that Intuit lobbying alone will be sufficient to kill this idea.
          • m0zg 8y ago
            I think Intuit is just a scapegoat in this case. Incomprehensible tax code is a rich environment for corruption.
            • natechols 8y ago
              Totally true, but I've certainly seen claims that Intuit actually lobbies against simplifying the tax code.
        • logfromblammo 8y ago
          This might work: x = gross_income / median_income; if( x <= 1 ) { return 0; } if( x <= 50 ) { y = ( x * Math.ln( x ) - x + 1 ) / Math.ln( 2500 ); } else { y = x - 0.5 * Math.ln( 50 ) * Math.li( x ) + 4.862; } return y * median_income; Math.ln() is the log function for base e, and Math.li() is the logarithmic integral function. The constants are based on the income at 50 times the median income having a marginal tax rate of 50%, and the median income having a marginal tax rate of 0%. Marginal tax rates above 50% asymptotically approach 100%. There are no loopholes or exemptions. If the median income is $32k, and you earned $31k, your tax is zero. Your only obligation is to report your gross income honestly, so that the median income is calculated accurately for next year. If your income is $96k, your x = 3.0, your y = 0.1656, so your tax is $15.9k . If your income is $1.6M, your x = 50, your y = 18.74, so your tax is $600k . If your income is $32M, your x = 1000, your y = 657.5, and your tax = $21M. The only effective ways to reduce your tax would be to reduce your income (as reported) or raise the nationwide median income, such as by paying your lowest-paid workers more in the previous year. Seems fair to me.
  • sametmax 8y ago
    The french equivalent of the IRS did open up their software: https://github.com/GouvernementFR/calculette-impots-m-source-code https://github.com/GouvernementFR/calculette-impots-m-source... Everybody got very enthousiastic at the begining, then realized: - it was written in a niche proprietary language: M - it was provided with almost zero doc or comments - the process of getting the code was tedious, and the law changes every year - taxes are complicated And so nobody did anything with it ever since.
    • Sniffnoy 8y ago
      Huh, usually I've seen "M" used to refer to MUMPS. But this appears to be something else -- I guess something proprietary, like you said. I have to wonder where one would look it up, as I imagine searching for information on the M programming language would mostly turn up information about MUMPS...
      • dragonwriter 8y ago
        > Huh, usually I've seen "M" used to refer to MUMPS M is also the name of the built in language in Microsoft Power Query.
  • maxxxxx 8y ago
    I am always told that if security is done right you can release the code. Makes sense to me. If you don’t release code it’s much more tempting to do some quick hacks that rely on not releasing the code but aren’t really secure.
• dragontamer 8y ago
  1. https://www.healthcare.gov/developers/ https://www.healthcare.gov/developers/ 2, 3, and 4 are made by private companies. Not government. 5. Probably a good idea.
  • rtkwe 8y ago
    > 5. Probably a good idea. You probably wouldn't want their fraud detection/audit selection software published. No matter how good it is releasing it gives people a chance to better avoid detection.
    • dragontamer 8y ago
      I guess that's true. I'm mostly thinking of it from a law-abiding citizen perspective. Maybe make some basic tests available to more easily show that I'm not making the stupid mistakes (an extra "0" somewhere or missing a digit somewhere else). Also, anything that would more easily interface with the IRS's online submission system would be great.
    • swish_bob 8y ago
      That kind of depends. The software could easily be published without publishing the rules/models that are being run. While knowing what sort of parameters are available to the rules/models might make it easier to identify attacks that aren't going to be found, that's not a given.
  • capdeck 8y ago
    > 2, 3, and 4 are made by private companies. Not government. But government pays them to develop the code. For many such companies government is the only customer (whom else are you going to sell the traffic light software to?).
    • dragontamer 8y ago
      Another government. The traffic lights in Chicago are likely made by a different company than the traffic lights in New York City (I dunno for sure... but it'd be a separate arrangement nonetheless). Those are two grossly different customers. USA has a federal society: that means we have mini-governments across the country with their own laws and regulations. In an extreme case, an Home-owners association can own traffic lights and operate roads. (My own HOA for example owns the traffic lights in my area, and hires cops from the county to patrol our roads. They're county-cops contracted out to the Homeowner's Association for security in the neighborhood) --------- Same thing with voting booths, and other services. They're made by private companies in the USA, to serve the many different local governments that exist. And local governments interact with local neighborhoods / homeowners associations, depending on local regulations of course.
• AdrianB1 8y ago
  There is more than one country in the world. Let's say country A is paying for some software and open source it, the rest of the world can get it. That may be fair if everyone is doing the same and contributing fairly (hard to assess that), but if countries A,B,C are the only ones contributing (paying) and everyone else just use, then it is not fair or sensible. More than that, there is no "public paid", just "tax paid". That makes the tax payers entitled to some of that code, not someone else. With taxes paid on so many layers (federation, state, county, city) the ownership and entitlement is also layered: if a small town pays for some software, should the entire country get it? Why?
  • Sean-Der 8y ago
    Country A isn't losing anything by allowing others to use it. Even if no one contributes back developers can spend that time doing other valuable work, rather then re-invent the wheel in every country around the world.
    • de_watcher 8y ago
      Country A has to pay more for development because the company won't be payed again for this software by countries B and C. So to start the FOSS process there is a need to somehow have for each niche a GPL software base that cuts costs by a lot.
  • O1111OOO 8y ago
    > if countries A,B,C are the only ones contributing (paying) and everyone else just use, then it is not fair or sensible. There's Open Source and then there's the Licensing of Open Source. Just because the source is available does not automatically mean it's free to use under any circumstance. Licensing is a separate and complicated issue.
  • phiresky 8y ago
    Wealth is not a zero sum game.
    • AdrianB1 8y ago
• pathseeker 8y ago
  >2. Stoplights/traffic control cameras. If you think this should be open source, do you then carry that logic to demand that all government vehicles run on open source software as well? In my local community, the government does not own the traffic control cameras. They contract out agreements to maintain cameras at intersections that meet constraints. I'm not necessarily against the idea of the government being restricted to using 100% open source hardware, but that's super radically different than "software the government owns should be open source".
• joshvm 8y ago
  Are all of these publicly funded? There are companies (including Siemens, for example) which build traffic lights and sell the control software and algorithms for eg car and pedestrian detection. See https://www.speedcamerasuk.com/speed-camera-types.htm https://www.speedcamerasuk.com/speed-camera-types.htm In a lot of places, the government decides that a service is required and companies bid for the construction rights. Just because public money was used to buy a service doesn't make the IP the property of the public. And in response to a sibling comment, no, the government does not always pay for code development. The company decides they have some niche IP (eg car detection) and start selling speed cameras. They then bid for government contracts. You could argue that there is an onus on government to use open hardware and software where possible. It often costs them less money, for a start. I suspect its easier to run an open source focused company and aim to be a major government contractor than it is to persuade the government to buy open source.
  • kazagistar 8y ago
    > Just because public money was used to buy a service doesn't make the IP the property of the public. No, but it could. Might raise costs initially, but the idea is that enforcing such a spending policy would lower costs and reduce duplication long term. Not to mention that having law and beurocracy enforced by closed source systems is a major threat to freedom and democracy, of course.
    • corbee 8y ago
      No, because no company in their right mind will give up its IP like this. You will have to purchase the company, or minimally, purchase an exclusive license to that technology at 10x or even 20x the price.