7 ms·

Man it would be pretty amazing to be able to submit a Pull Request to the IRS. Matt Cutts if you're reading this please help! On another note, I'm not sure I

Man it would be pretty amazing to be able to submit a Pull Request to the IRS. Matt Cutts if you're reading this please help! On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that

deleted 8y ago
[deleted]
dragontamer 8y ago
> On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that Any more nefarious things that can be done with your Linux OS server talking to your Open Source Chromium / Firefox web browser? Open Source doesn't necessarily mean less secure.
- zbruhnke 8y ago
  Agreed that it does not necessarily mean less secure ... see my comment below
- keithnz 8y ago
  I'm not sure these things are equivalent, many people use a browser and Linux, not many people need to use electrical grid software. However, I would imagine it would still be beneficial for open analysis though. I'm not sure security through obscurity is a good option when there are motivated nefarious actors involved. But that's more of a "gut feel" than based on any evidence
tracker1 8y ago
Agreed, safety and essential infrastructure should probably not be open source. That said, the main points of infrastructure access and configuration are probably larger issues at hand over the actual systems source itself. As to TFA, I have mixed feelings. I'm actually more concerned about research and related patents and data surrounding publicly funded study. I do feel that Open-Source should be given some level of preference, but not that all publicly funded software should be open source itself. It's a blurry line imho.
- jacquesm 8y ago
  Disagreed, safety and essential infrastructure should definitely be open source. Right now your typical infrastructure project is about as leaky as they come compared to a typical web app. Exposing that stuff to broad daylight will certainly help to harden it.
  - zbruhnke 8y ago
    I wish I had as much faith in the government as you ... then again as a resident of the netherlands I suppose you might have reason to have more faith than I do in the US? In principle I completely agree that things being in the open should help to harden them, but especially in the US where funding is often used as a bargaining chip and bureaucracy is rampant I get a bit nervous
    - jacquesm 8y ago
      Then you're essentially ceding the ground to the bad guys.
  - tracker1 8y ago
    And how much of that is already using open-source and it's the configuration that's leaky, and not the software itself? How many poorly maintained/updated/configured Linux hosts are out there? Same for Windows, etc... in the end, the software can be the greatest, but if the host's configuration is poorly setup/managed, what does it matter.
  - briandear 8y ago
    Except how long does it take to fix a vulnerability in government? If an exploit is discovered, consequences are immediate and the patch to fix it might not be.
PurpleBoxDragon 8y ago
By hiding the code, it makes security through obscurity far more possible. If you force the code to be public, very poor security will be discovered far faster and be more of an issue to the public. While this will also make abusing security flaws easier, I think there is also a real benefit to forcing it to be public that could potentially outweigh the risks of doing such.
- zbruhnke 8y ago
  I agree with this in principle (in fact I had a long argument with the former CTO of Citi about this during the heartbleed fiasco) but I also worry that if noone is willing to put in the effort to fix flaws or they are not reported properly then fixing them could go un-funded while flaws were easier to discover. Maybe the answer is very good logging of anyone who has cloned the repos etc. but right now when we have a government that uses whether or not they're going to fund important parts of our infrastructure (like Air Traffic Controllers) as a bargaining chip I have some skepticism around them being willing to fund ongoing maintenance of some of these products. Despite the fact that things being in the open SHOULD curb this from happening I've read enough legislation (yes, I actually do like to read legislation) to know that that probably is not true when it comes to the government
- rhacker 8y ago
  An alternative would be to rebuild these from scratch, not using any existing code, but start (and always continue) in the open.
container 8y ago
Could you be more specific about what you can imagine? People looking at the code and finding exploits that way?
natechols 8y ago
Or at the very least our entire national tax code should be downloadable in machine-readable form.
- analog31 8y ago
  It should just be a giant function: def foo(**kwargs): <insert code here> return how_much_you_owe
  - m0zg 8y ago
    It really should be a provably unambiguous ruleset that would take in the person's circumstances and numbers and spit out a number, yes. I understand that your post is a joke, but that'd be an _awesome_ thing to have for everyone, especially if coupled with some adversarial tech to find and close loopholes. Which is, ironically, why this isn't going to happen.
    - natechols 8y ago
      I've always assumed that Intuit lobbying alone will be sufficient to kill this idea.
      - m0zg 8y ago
        I think Intuit is just a scapegoat in this case. Incomprehensible tax code is a rich environment for corruption.
        natechols 8y ago
        Totally true, but I've certainly seen claims that Intuit actually lobbies against simplifying the tax code.
    - logfromblammo 8y ago
      This might work: x = gross_income / median_income; if( x <= 1 ) { return 0; } if( x <= 50 ) { y = ( x * Math.ln( x ) - x + 1 ) / Math.ln( 2500 ); } else { y = x - 0.5 * Math.ln( 50 ) * Math.li( x ) + 4.862; } return y * median_income; Math.ln() is the log function for base e, and Math.li() is the logarithmic integral function. The constants are based on the income at 50 times the median income having a marginal tax rate of 50%, and the median income having a marginal tax rate of 0%. Marginal tax rates above 50% asymptotically approach 100%. There are no loopholes or exemptions. If the median income is $32k, and you earned $31k, your tax is zero. Your only obligation is to report your gross income honestly, so that the median income is calculated accurately for next year. If your income is $96k, your x = 3.0, your y = 0.1656, so your tax is $15.9k . If your income is $1.6M, your x = 50, your y = 18.74, so your tax is $600k . If your income is $32M, your x = 1000, your y = 657.5, and your tax = $21M. The only effective ways to reduce your tax would be to reduce your income (as reported) or raise the nationwide median income, such as by paying your lowest-paid workers more in the previous year. Seems fair to me.
sametmax 8y ago
The french equivalent of the IRS did open up their software: https://github.com/GouvernementFR/calculette-impots-m-source-code https://github.com/GouvernementFR/calculette-impots-m-source... Everybody got very enthousiastic at the begining, then realized: - it was written in a niche proprietary language: M - it was provided with almost zero doc or comments - the process of getting the code was tedious, and the law changes every year - taxes are complicated And so nobody did anything with it ever since.
- Sniffnoy 8y ago
  Huh, usually I've seen "M" used to refer to MUMPS. But this appears to be something else -- I guess something proprietary, like you said. I have to wonder where one would look it up, as I imagine searching for information on the M programming language would mostly turn up information about MUMPS...
  - dragonwriter 8y ago
    > Huh, usually I've seen "M" used to refer to MUMPS M is also the name of the built in language in Microsoft Power Query.
maxxxxx 8y ago
I am always told that if security is done right you can release the code. Makes sense to me. If you don’t release code it’s much more tempting to do some quick hacks that rely on not releasing the code but aren’t really secure.

deleted 8y ago

[deleted]

dragontamer 8y ago

> On another note, I'm not sure I agree on the electrical grid or traffic controls being open sourced ... could imagine some nefarious things happening as a result of that Any more nefarious things that can be done with your Linux OS server talking to your Open Source Chromium / Firefox web browser? Open Source doesn't necessarily mean less secure.

zbruhnke 8y ago
Agreed that it does not necessarily mean less secure ... see my comment below
keithnz 8y ago
I'm not sure these things are equivalent, many people use a browser and Linux, not many people need to use electrical grid software. However, I would imagine it would still be beneficial for open analysis though. I'm not sure security through obscurity is a good option when there are motivated nefarious actors involved. But that's more of a "gut feel" than based on any evidence

tracker1 8y ago

Agreed, safety and essential infrastructure should probably not be open source. That said, the main points of infrastructure access and configuration are probably larger issues at hand over the actual systems source itself. As to TFA, I have mixed feelings. I'm actually more concerned about research and related patents and data surrounding publicly funded study. I do feel that Open-Source should be given some level of preference, but not that all publicly funded software should be open source itself. It's a blurry line imho.

jacquesm 8y ago
Disagreed, safety and essential infrastructure should definitely be open source. Right now your typical infrastructure project is about as leaky as they come compared to a typical web app. Exposing that stuff to broad daylight will certainly help to harden it.
- zbruhnke 8y ago
  I wish I had as much faith in the government as you ... then again as a resident of the netherlands I suppose you might have reason to have more faith than I do in the US? In principle I completely agree that things being in the open should help to harden them, but especially in the US where funding is often used as a bargaining chip and bureaucracy is rampant I get a bit nervous
  - jacquesm 8y ago
    Then you're essentially ceding the ground to the bad guys.
- tracker1 8y ago
  And how much of that is already using open-source and it's the configuration that's leaky, and not the software itself? How many poorly maintained/updated/configured Linux hosts are out there? Same for Windows, etc... in the end, the software can be the greatest, but if the host's configuration is poorly setup/managed, what does it matter.
- briandear 8y ago
  Except how long does it take to fix a vulnerability in government? If an exploit is discovered, consequences are immediate and the patch to fix it might not be.

PurpleBoxDragon 8y ago

By hiding the code, it makes security through obscurity far more possible. If you force the code to be public, very poor security will be discovered far faster and be more of an issue to the public. While this will also make abusing security flaws easier, I think there is also a real benefit to forcing it to be public that could potentially outweigh the risks of doing such.

zbruhnke 8y ago
I agree with this in principle (in fact I had a long argument with the former CTO of Citi about this during the heartbleed fiasco) but I also worry that if noone is willing to put in the effort to fix flaws or they are not reported properly then fixing them could go un-funded while flaws were easier to discover. Maybe the answer is very good logging of anyone who has cloned the repos etc. but right now when we have a government that uses whether or not they're going to fund important parts of our infrastructure (like Air Traffic Controllers) as a bargaining chip I have some skepticism around them being willing to fund ongoing maintenance of some of these products. Despite the fact that things being in the open SHOULD curb this from happening I've read enough legislation (yes, I actually do like to read legislation) to know that that probably is not true when it comes to the government
rhacker 8y ago
An alternative would be to rebuild these from scratch, not using any existing code, but start (and always continue) in the open.

container 8y ago

Could you be more specific about what you can imagine? People looking at the code and finding exploits that way?

natechols 8y ago

Or at the very least our entire national tax code should be downloadable in machine-readable form.

analog31 8y ago
It should just be a giant function: def foo(**kwargs): <insert code here> return how_much_you_owe
- m0zg 8y ago
  It really should be a provably unambiguous ruleset that would take in the person's circumstances and numbers and spit out a number, yes. I understand that your post is a joke, but that'd be an _awesome_ thing to have for everyone, especially if coupled with some adversarial tech to find and close loopholes. Which is, ironically, why this isn't going to happen.
  - natechols 8y ago
    I've always assumed that Intuit lobbying alone will be sufficient to kill this idea.
    - m0zg 8y ago
      I think Intuit is just a scapegoat in this case. Incomprehensible tax code is a rich environment for corruption.
      - natechols 8y ago
        Totally true, but I've certainly seen claims that Intuit actually lobbies against simplifying the tax code.
  - logfromblammo 8y ago
    This might work: x = gross_income / median_income; if( x <= 1 ) { return 0; } if( x <= 50 ) { y = ( x * Math.ln( x ) - x + 1 ) / Math.ln( 2500 ); } else { y = x - 0.5 * Math.ln( 50 ) * Math.li( x ) + 4.862; } return y * median_income; Math.ln() is the log function for base e, and Math.li() is the logarithmic integral function. The constants are based on the income at 50 times the median income having a marginal tax rate of 50%, and the median income having a marginal tax rate of 0%. Marginal tax rates above 50% asymptotically approach 100%. There are no loopholes or exemptions. If the median income is $32k, and you earned $31k, your tax is zero. Your only obligation is to report your gross income honestly, so that the median income is calculated accurately for next year. If your income is $96k, your x = 3.0, your y = 0.1656, so your tax is $15.9k . If your income is $1.6M, your x = 50, your y = 18.74, so your tax is $600k . If your income is $32M, your x = 1000, your y = 657.5, and your tax = $21M. The only effective ways to reduce your tax would be to reduce your income (as reported) or raise the nationwide median income, such as by paying your lowest-paid workers more in the previous year. Seems fair to me.

sametmax 8y ago

The french equivalent of the IRS did open up their software: https://github.com/GouvernementFR/calculette-impots-m-source-code https://github.com/GouvernementFR/calculette-impots-m-source... Everybody got very enthousiastic at the begining, then realized: - it was written in a niche proprietary language: M - it was provided with almost zero doc or comments - the process of getting the code was tedious, and the law changes every year - taxes are complicated And so nobody did anything with it ever since.

Sniffnoy 8y ago
Huh, usually I've seen "M" used to refer to MUMPS. But this appears to be something else -- I guess something proprietary, like you said. I have to wonder where one would look it up, as I imagine searching for information on the M programming language would mostly turn up information about MUMPS...
- dragonwriter 8y ago
  > Huh, usually I've seen "M" used to refer to MUMPS M is also the name of the built in language in Microsoft Power Query.

maxxxxx 8y ago

I am always told that if security is done right you can release the code. Makes sense to me. If you don’t release code it’s much more tempting to do some quick hacks that rely on not releasing the code but aren’t really secure.