3 ms·

Why isn’t all software created for the government required to be open-source? Would that really drive the costs up, if the providers don’t have the choice?

• openthc 5y ago
  The vendor claimed that if the code was out it would be a security risk. The agency claims the vendor needs to protect their intellectual property rights. We have (some) visibility into other things our taxes pay for -- the software should absolutely be one -- expecially the regulatory compliance ones that drive enforcement action. Edit: also, they were breached anyway shortly after launch (2018) and then an email went around offerting to sell the code and data from their entire system.
  • laurent92 5y ago
    And it is true: If their code were out, it would be painfully obvious that it is full of vulnerabilities. Security by obscurity! I know that because I’m myself afraid of making my old app open-source… I wish I had done a bug bounty from day #1. Bug bounties are a killer tool. I wish some lawyers had made a license like “Not open-source but here’s the source for vulnerability research.”
    • Kinrany 5y ago
      The government could also require a bug bounty, with a centralized agency investigating reports.