6 ms·

Neat. Curious: What's your stance on open-sourcing all civic infrastructure, like Healthcare.gov?

paulsmith 6y ago
I think it's a good idea (not a magic silver bullet, but considering tradeoffs, on balance better than proprietary platforms), but it's entirely up to the government folks in charge of particular projects.
- gpm 6y ago
  I'm curious what you think the greatest downsides would be? It seems the typical ones (you can't sell open source stuff) don't really apply.
gunsch 6y ago
VA has attempted a lot of open-sourcing as well, including most of VA.gov [1], including the project management of it, mostly as an ideological stance from the VA product owners we work with. Open-sourcing hasn't cultivated much in the way of public engagement with the projects, but it's done a lot in terms of making development easier for the range of contractors + VA employees we have, and (IMO) nudged toward better decision-making with the underlying knowledge that everything we do is publicly viewable. Other federal agencies routinely come to VA asking to learn from their digital modernization efforts, and I suspect the open-source stance has been a big part of that. (I also work at Ad Hoc. It's great!) [1] https://department-of-veterans-affairs.github.io/va.gov-team/ https://department-of-veterans-affairs.github.io/va.gov-team..., repository links at the bottom
- ElijahLynn 6y ago
  Nicely stated gunsch: > Open-sourcing hasn't cultivated much in the way of public engagement with the projects, but it's done a lot in terms of making development easier for the range of contractors + VA employees we have, and (IMO) nudged toward better decision-making with the underlying knowledge that everything we do is publicly viewable.
  - TOGoS 6y ago
    Care to define "gunsch"? Other than the expected gross definitions from Urban Dictionary I'm coming up empty-handed.
    - jonchang 6y ago
      That is the handle of the person who wrote the comment.
      - dboreham 6y ago
        But now it's a word, meaning: to mistake someone's username for an unfamiliar natural language word. To gunsch v.
    - lazyasciiart 6y ago
      The name of the commenter they replied to.
- trimbo 6y ago
  It's worth noting that the VA's most critical software -- its EHR system, VistA -- is public domain with the source code available. However, despite being a critical, successful piece of open source software that had massive investment over decades, it's being abandoned for a commercial system, Cerner, in a $16bn project. https://ehrintelligence.com/news/va-cerner-implementation-contract-balloons-to-16-billion https://ehrintelligence.com/news/va-cerner-implementation-co...
  - rattray 6y ago
    Why is that happening? How successful was the open source software?
    - trimbo 6y ago
      As far as software success goes, all healthcare providers at the VA have used VistA daily for a couple of decades (actually CPRS -- it's like an MFC app or something on top of VistA). A relative who works at the VA likes it, and is not excited about moving to Cerner. Why Cerner? I don't know.
      - pnut 6y ago
        https://projects.propublica.org/represent/lobbying/300928017 https://projects.propublica.org/represent/lobbying/300928017
    - dmm10 6y ago
      VistA has been a very successful open source project and is being continued in OpenVistA [1]. Originating as a software project in the Veterans Administration (named VA MUMPS) in 1977 it only took on the name VistA in 1994[2]. Internationally it has been used freely in hospitals in the U.S., Mexico, India, various countries in Africa, ...[3]. It was a truly open source project within the VA with programmers customizing this national patient record software in cooperation with doctors (to meet their needs) locally and sharing the modifications nationally. Perhaps its greatest technical challenge (besides complexity arising from decades of evolution) was finding programmers to work with the MUMPS language that it was written in. FYI MUMPS is a language with an integral db -a concept which was out of vogue for some time. Political challenges are another story[4]. [1] https://sourceforge.net/projects/worldvista/ https://sourceforge.net/projects/worldvista/ [2] https://www.hardhats.org/history/hardhats.html https://www.hardhats.org/history/hardhats.html [3] https://worldvista.org/AboutVistA https://worldvista.org/AboutVistA [4] https://www.politico.com/agenda/story/2017/03/vista-computer-history-va-conspiracy-000367/ https://www.politico.com/agenda/story/2017/03/vista-computer...
ElijahLynn 6y ago
There is a start on VA.gov already happening in this direction. The front-end codebase and backend (Drupal 8) CMS are both fully opensource for VA.gov. * Frontend - https://github.com/department-of-veterans-affairs/vets-website/ https://github.com/department-of-veterans-affairs/vets-websi... * Backend - https://github.com/department-of-veterans-affairs/va.gov-cms/ https://github.com/department-of-veterans-affairs/va.gov-cms... Paul's company is working on this project too (whom I work alongside with but with a different company)! The U.S. Digital Service is really a big factor in this, see the playbook, specifically play 13: > If the codebase has not been released under an open source license, explain why. source: https://playbook.cio.gov/#play13 https://playbook.cio.gov/#play13. So, see how this is now flipped. It is now "hey, you need to open source this by default, and if not, you need to explain why you didn't." and not the other way around! Update: See Andrew Gunsch's comment in this thread too!
dheera 6y ago
It would only make sense to open source something like that if people would actually go work on it. There may be lots of security flaws in the system but it's not guaranteed that open sourcing it will result in a fast fix from the community. This isn't OpenSSL. A better approach might be to just budget for and pay a team of good developers a market wage to make it better.
- randmeerkat 6y ago
  To be fair OpenSSL was mostly ignored by industry and the community until heartbleed. “At the time of the Heartbleed attack, the OpenSSL website listed just 15 active developers, most of whom contributed to the project on a volunteer basis. But not all changes to the OpenSSL software are written by these 15 people. Rather, these developers help to filter and organize suggested changes from a larger community of people who make occasional contributions.” https://www.vox.com/2014/6/19/18076318/heartbleed https://www.vox.com/2014/6/19/18076318/heartbleed If you want the government to have more competitive Federal salaries for developers then write your Senators. As a note, I’ve seen some truly awful software written by highly paid devs, so, just paying more won’t necessarily fix the problem.
  - WesolyKubeczek 6y ago
    > As a note, I’ve seen some truly awful software written by highly paid devs, so, just paying more won’t necessarily fix the problem. High pay is necessary, but not sufficient. With high pay, you MAY get a good product — if you attract competent people on all levels. With low pay, the mind-numbing godawfulness of the end result, if it's ever delivered, is practically guaranteed.
  - Chris2048 6y ago
    Sometimes, the high pay is to offset the terrible nature of the work, not to attract better developers, e.g. having to work on the terrible ad-hoc, micro-managed code of many previous devs.
- mrmonkeyman 6y ago
  Why not work out in the open? Nothing innovative or secretive going on, right? Bridges being build are not walled off with armed military around them right?

I think it's a good idea (not a magic silver bullet, but considering tradeoffs, on balance better than proprietary platforms), but it's entirely up to the government folks in charge of particular projects.

gpm 6y ago
I'm curious what you think the greatest downsides would be? It seems the typical ones (you can't sell open source stuff) don't really apply.

gunsch 6y ago

VA has attempted a lot of open-sourcing as well, including most of VA.gov [1], including the project management of it, mostly as an ideological stance from the VA product owners we work with. Open-sourcing hasn't cultivated much in the way of public engagement with the projects, but it's done a lot in terms of making development easier for the range of contractors + VA employees we have, and (IMO) nudged toward better decision-making with the underlying knowledge that everything we do is publicly viewable. Other federal agencies routinely come to VA asking to learn from their digital modernization efforts, and I suspect the open-source stance has been a big part of that. (I also work at Ad Hoc. It's great!) [1] https://department-of-veterans-affairs.github.io/va.gov-team/ https://department-of-veterans-affairs.github.io/va.gov-team..., repository links at the bottom

ElijahLynn 6y ago
Nicely stated gunsch: > Open-sourcing hasn't cultivated much in the way of public engagement with the projects, but it's done a lot in terms of making development easier for the range of contractors + VA employees we have, and (IMO) nudged toward better decision-making with the underlying knowledge that everything we do is publicly viewable.
- TOGoS 6y ago
  Care to define "gunsch"? Other than the expected gross definitions from Urban Dictionary I'm coming up empty-handed.
  - jonchang 6y ago
    That is the handle of the person who wrote the comment.
    - dboreham 6y ago
      But now it's a word, meaning: to mistake someone's username for an unfamiliar natural language word. To gunsch v.
  - lazyasciiart 6y ago
    The name of the commenter they replied to.
trimbo 6y ago
It's worth noting that the VA's most critical software -- its EHR system, VistA -- is public domain with the source code available. However, despite being a critical, successful piece of open source software that had massive investment over decades, it's being abandoned for a commercial system, Cerner, in a $16bn project. https://ehrintelligence.com/news/va-cerner-implementation-contract-balloons-to-16-billion https://ehrintelligence.com/news/va-cerner-implementation-co...
- rattray 6y ago
  Why is that happening? How successful was the open source software?
  - trimbo 6y ago
    As far as software success goes, all healthcare providers at the VA have used VistA daily for a couple of decades (actually CPRS -- it's like an MFC app or something on top of VistA). A relative who works at the VA likes it, and is not excited about moving to Cerner. Why Cerner? I don't know.
    - pnut 6y ago
      https://projects.propublica.org/represent/lobbying/300928017 https://projects.propublica.org/represent/lobbying/300928017
  - dmm10 6y ago
    VistA has been a very successful open source project and is being continued in OpenVistA [1]. Originating as a software project in the Veterans Administration (named VA MUMPS) in 1977 it only took on the name VistA in 1994[2]. Internationally it has been used freely in hospitals in the U.S., Mexico, India, various countries in Africa, ...[3]. It was a truly open source project within the VA with programmers customizing this national patient record software in cooperation with doctors (to meet their needs) locally and sharing the modifications nationally. Perhaps its greatest technical challenge (besides complexity arising from decades of evolution) was finding programmers to work with the MUMPS language that it was written in. FYI MUMPS is a language with an integral db -a concept which was out of vogue for some time. Political challenges are another story[4]. [1] https://sourceforge.net/projects/worldvista/ https://sourceforge.net/projects/worldvista/ [2] https://www.hardhats.org/history/hardhats.html https://www.hardhats.org/history/hardhats.html [3] https://worldvista.org/AboutVistA https://worldvista.org/AboutVistA [4] https://www.politico.com/agenda/story/2017/03/vista-computer-history-va-conspiracy-000367/ https://www.politico.com/agenda/story/2017/03/vista-computer...

ElijahLynn 6y ago

There is a start on VA.gov already happening in this direction. The front-end codebase and backend (Drupal 8) CMS are both fully opensource for VA.gov. * Frontend - https://github.com/department-of-veterans-affairs/vets-website/ https://github.com/department-of-veterans-affairs/vets-websi... * Backend - https://github.com/department-of-veterans-affairs/va.gov-cms/ https://github.com/department-of-veterans-affairs/va.gov-cms... Paul's company is working on this project too (whom I work alongside with but with a different company)! The U.S. Digital Service is really a big factor in this, see the playbook, specifically play 13: > If the codebase has not been released under an open source license, explain why. source: https://playbook.cio.gov/#play13 https://playbook.cio.gov/#play13. So, see how this is now flipped. It is now "hey, you need to open source this by default, and if not, you need to explain why you didn't." and not the other way around! Update: See Andrew Gunsch's comment in this thread too!

dheera 6y ago

It would only make sense to open source something like that if people would actually go work on it. There may be lots of security flaws in the system but it's not guaranteed that open sourcing it will result in a fast fix from the community. This isn't OpenSSL. A better approach might be to just budget for and pay a team of good developers a market wage to make it better.

randmeerkat 6y ago
To be fair OpenSSL was mostly ignored by industry and the community until heartbleed. “At the time of the Heartbleed attack, the OpenSSL website listed just 15 active developers, most of whom contributed to the project on a volunteer basis. But not all changes to the OpenSSL software are written by these 15 people. Rather, these developers help to filter and organize suggested changes from a larger community of people who make occasional contributions.” https://www.vox.com/2014/6/19/18076318/heartbleed https://www.vox.com/2014/6/19/18076318/heartbleed If you want the government to have more competitive Federal salaries for developers then write your Senators. As a note, I’ve seen some truly awful software written by highly paid devs, so, just paying more won’t necessarily fix the problem.
- WesolyKubeczek 6y ago
  > As a note, I’ve seen some truly awful software written by highly paid devs, so, just paying more won’t necessarily fix the problem. High pay is necessary, but not sufficient. With high pay, you MAY get a good product — if you attract competent people on all levels. With low pay, the mind-numbing godawfulness of the end result, if it's ever delivered, is practically guaranteed.
- Chris2048 6y ago
  Sometimes, the high pay is to offset the terrible nature of the work, not to attract better developers, e.g. having to work on the terrible ad-hoc, micro-managed code of many previous devs.
mrmonkeyman 6y ago
Why not work out in the open? Nothing innovative or secretive going on, right? Bridges being build are not walled off with armed military around them right?