8 ms·

The state I lived in developed one of those covid tracking apps. I asked for the source code and was told it wasn't available and would never be. I talked to pe

• jahewson 5y ago
  Define “belong”.
• EMIRELADERO 5y ago
  I don't know if it exists for where you live, but you might be able to make use of a public information law (FOIA-like)
  • datavirtue 5y ago
    I'm stunned that I had never thought to use a FOIA request for source code until seeing your comment. This is very tempting.
    • kingcharles 5y ago
      From a very experienced FOIA litigator, most of the time your FOIA request will be denied and then you'll have to sue to get the records. Typical time for these cases is 2-4 years of court appearances in trial court, then another 2 years in appellate court to get a favorable decision. A buddy of mine just won one that finally set the precedent that database schemas are not security: https://twitter.com/foiachap/status/1215388081378988039 https://twitter.com/foiachap/status/1215388081378988039
      • prepend 5y ago
        Also, once you finally get the zip file of source it will be a giant mess that doesn’t have build scripts, nor documentation, etc. So you’ll win, but won’t get want you want- a way to view, understand, improve, and share.
        • kingcharles 5y ago
          Or you'll find its just a mess of hundreds of off-the-shelf components glued together, none of which the government has the source code for :( So basically you're right - you'll get an unbuildable clusterfuck.
      • hyperdimension 5y ago
        You might be able to use this website. I've always wanted to use it, but haven't come up with something "interesting enough" to submit a request for: https://www.muckrock.com/foi/ https://www.muckrock.com/foi/ It helps you with the process of FOIA requests, and if/when granted, hosts the responses online publicly.
• hamandcheese 5y ago
  Open sourcing code safely also isn’t free. So unless something was developed in the open from the outset, I doubt it ever will become open source (unless mandated by law).
• machinerychorus 5y ago
  I was tangentially related to the covid app stuff so I can offer some insight there: most of those apps weren't built by the state. Google provided an open-source "base app" that could be customized by the states, but most states hired third-party contractors to build an app for them. I've worked in public sector and this is typical. the states can't open source it because they don't own it, they just pay a third-party to build+operate it for them. This is touted as "small govt", but it really just makes things less efficient. The total number of people involved stays the same.
  • ISL 5y ago
    Third parties can build/operate open-source software.
  • worik 5y ago
    > but most states hired third-party contractors to build an app for them. So the states paid the bills so can license the result any way they want. How can they pay for something and not own it? Sounds to me like there are deep corruption problems
    • bartvk 5y ago
      I don't see what corruption has to do with it. I'm a subcontractor and usually the contractual terms are dictated by my clients. If I get the chance however, I put forth my terms and these say that I'm the author of the code and thus the copyright holder.
      • HideousKojima 5y ago
        When I've done freelance work and have been able to write the contract, I include a clause that the client receives "a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the work and such derivative works, and to sublicense any or all of the foregoing rights to third parties," effectively giving them unlimited rights to use my code how they please while still retaining my own copyright.
• HideousKojima 5y ago
  My most recent job was for a local government, and even though I made a push for open sourcing our code, I never made much headway. Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file, so it could have been a bit disastrous if my efforts had actually made any headway
  • pooper 5y ago
    > Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?
    • HideousKojima 5y ago
      >Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere? Because most local governments are 10 to 20 years behind on anything remotely approaching best practices. It wasn't my choice to run things that way.
    • sonicggg 5y ago
      If it's hard enough for to tech companies to hire skilled developers, I can only imagine what the bar is for public work. They might even resort to hire some brain damaged people.
      • toomanybeersies 5y ago
        Here in Australia, only citizens can work for the Commonwealth (federal) government. The end result is that, due to a lack of competition from immigrants, the public sector is basically just a jobs program for those too incompetent to work in the private sector.
• ldoughty 5y ago
  This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway Also true, in an ideal world, the software should be free from such vulnerabilities. However security by obscurity is a layer of defense... And there might be other controls in place too to help.. e.g. a git repo behind SSO... If I accidentally check in a CSV of a data dump, or my access Keys, etc... It doesn't immediately become a data leak/issue.. I have at least some time to reconcile that.. but if the repo is publicly accessible, the moment it hits the wire someone can copy that data... One might follow up: "Well, they should not make the code if they are not competent enough to write it and host it" Would be nice as well! But sadly there is only so many developers that can do this kind of work with a very high level of security and competence... By requiring governments to make this code freely available, you could basically assume two outcomes: nothing the government has on you will be secret, including sealed records and private information. In addition, IT workers would be paid 7-figures with 5-10 years of experience, as every government project that touches software now needs 5+ highly trained workers to avoid gigantic lawsuits.. and no one could get an entry level job in government because one bad commit could cause an 8-figure lawsuit And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)
  • UncleEntity 5y ago
    > And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-) If they give you a tank they have one less tank to do stuff with but if they give you a copy of software they still have the ability to do stuff with the software. There’s a whole bunch of software out there that has been open sourced by government agencies like nasa and you don’t see satellites falling out of the sky on a regular basis.
    • gehwartzen 5y ago
      I'm not in software so maybe my viewpoint is just different but I also wouldn't expect NASA to give me the mechanical blueprints for a rocket, or even a concrete launch pad nor would I expect the local government to give me the the electrical schematics for the stop light systems, even though doing so would in no way prevent them from continuing to use these systems/items
• KarlKemp 5y ago
  The German version is at https://github.com/corona-warn-app https://github.com/corona-warn-app. It was expensive (18 million Euros I believe, but may be wrong). But other than that, it was excellent from start to finish. First release a few weeks after the API was available. The source was divided into logical components of more or less perfect size, it was straightforward, well commented, responsive to PRs, worked, and had no security issues as far as I remember.
  • LargoLasskhyfv 5y ago
    Hrm. Why tee eff shops downtown insisted on that Luca thing with Smudos blessing instead? PR? Federalism? Panic? Incompetence?
    • deknos 5y ago
      besides the three you named: lobbying and corruption i think
  • Semaphor 5y ago
    And there is even a fork on F-Droid that works without google framework only requiring microg, working on older devices, and having some minor additional features: https://f-droid.org/packages/de.corona.tracing/ https://f-droid.org/packages/de.corona.tracing/
  • mightyRodri 5y ago
    So much this. I am not one to be proud of the place i happened to be born but this effort gave me some hope for the gov software sector.
• mtalantikite 5y ago
  I've worked on some government projects (currently working on one), and we always try to open source everything we can. For instance, CMS has a lot of open source repos in their github org (https://github.com/CMSgov https://github.com/CMSgov). The mentality is changing in govtech and there are lots of orgs really trying to push for better software practices. It can be a slog though.
• jasonkester 5y ago
  I’m having trouble understanding why anybody would expect that to be the case. I have, for example, built things for government in the past. They paid for some code that I wrote and now they can use it as they like. But, (as with any client), they don’t have the right to turn around and give it to you. If you want that code, I’m happy to sell it to you. But, again, you’re not allowed to sell it on or give it away. Because that’s how software consulting works.
  • bryanrasmussen 5y ago
    I'm not understanding what you said, do you mean you had built the code before and you licensed it to the government, or in the contract you wrote to the government you specified that you owned the code that you were delivering, every time I've written code for people who've paid me on a project basis they can do what they want with the code afterwards, including give it away.
    • jasonkester 5y ago
      You could certainly ask for the right to redistribute the code when we were negotiating the contract. But that would get you a much larger quote since now you wouldn’t just be buying the software, you’d also have to be paying for every potential future sale of something similar. I can’t imagine that the government (or anybody really) would do that.
      • unnah 5y ago
        I suppose it depends on the market. I have been involved in a number of contracts to develop bespoke software for big private sector companies. Twenty years ago they were happy to just buy usage rights, but since then the customers have grown wiser to their leverage and keep insisting that if they pay for the development work, they get to keep the rights to the results. It's different if the vendor already has IP that can be licensed to the customer to substantially reduce the development cost of the bespoke solution.
• _trampeltier 5y ago
  Switzerland did make it public on Github https://github.com/admin-ch/CovidCertificate-App-Android https://github.com/admin-ch/CovidCertificate-App-Android There is even a section "Reproducible builds"
• prepend 5y ago
  I work in government (partially improving our use and creation of free and open source software) and I think there are a few different psychologies: 1) there are people who understand f/oss. Sometimes they are in power and choose it for the projects they oversee. This is small, but growing slowly. 2) there are people who don’t understand and the default is to do what their contractor says. This is huge and probably stable. 3) there are people who understand and don’t like it because of the lack of formal support and the chaos and perceived unpredictability. This is the “buy Microsoft/IBM and they will support you” group. This is large but shrinking a little. 4) there are contractors who don’t want the risk to their contracts being renewed from competitors seeing their code and being able to support. Obviously no feds in this group, but lots of feds are influenced by their contractor and take on their position. This irks me the most because its acting in the contractors benefit to the government’s detriment. I don’t understand how people in oversight positions take this position in good faith. 5) there are contractors who have IP and want to resell or reconfigure for multiple clients and would raise their bid price if they had to release under f/oss. Again, not feds, but this is a perceived fear of people with set budgets who want to get best value and their incumbent contractors are saying it’s more expensive if they have to do f/oss. I’m probably missing some of the tech workers. But I think the biggest blocker is contractors as probably 95% of actual hands on work is done by contractors. Some perpetual who have been in place for decades. Even when the companies change, the individuals stay the same.
• hackandtrip 5y ago
  The Italian version is fully public, and it was made by a third party which offered to do it free of charge. https://github.com/immuni-app https://github.com/immuni-app