14 ms·

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-fac

Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help" senators write OSS bills. Do you honestly think Rob fucking Portman woke up one day with strong opinions about FOSS? Make no mistake: this is a thinly veiled late-stage attempt to displace the growing dominance of OSS-based solutions to the sorts of problems that the government and military used to pay 8 and 9 figures a year to EDS to solve. An actual, good-faith bill that seeks to address these issues would attempt to incentivize/punish orgs that use FOSS without making meaningful contributions to it.

kube-system 4y ago
They're trying to destroy FOSS ...by hiring FOSS developers? I don't buy it. More like, log4j was an actual real big issue for government agencies because they use rely on tons of open source projects and haven't previously done much to make sure that that supply chain is robust. This would help to change that. Federal contractors don't need to sell proprietary software to make money -- they make more money selling FOSS software.
- throwbigdata 4y ago
  More or less of a big issue than the revolving door of Microsoft bugs?
  - kube-system 4y ago
    Different types of issues with different solutions. When you have a support contract with the original developer of a piece of code, you can demand the original developer fix the code.
    - dllthomas 4y ago
      That same solution still works for FOSS, you just actually need to pay for it. The situation for FOSS is even better because you also have the option of paying any other person to fix the code. Hopefully that's kinda what this bill does, though?
      - kube-system 4y ago
        It’s “the same” in a really broad hand-wavy sort of way. It’s not the same practically speaking. FOSS usually does not have warrantees, SLAs, or developers in particular locations with particular credentials. The government has processes that they must follow for paying contractors, so “just pay them” is not something that can easily be done last minute, (and sometimes, not at all without a literal act of Congress.) Also the financial and obligatory relationship between them and the developer is much different, and must be managed differently. Really, it is very important for people doing technology projects at the government to understand the difference between calling up the developer of Windows and calling up the developer of Git. Those are two very different relationships.
        dllthomas 4y ago
        You seem to be reading me as implying any use of FOSS is equivalent to having a support contract; it's not. I was claiming that having a support contract for FOSS is equivalent to having a support contract for proprietary software. If you need "support contract" level support you should probably be paying for a support contract. At least with FOSS that can be competitive for the same piece of software (although that probably also means that some of the services on offer are quite a bit worse, having not had to organizationally have passed the hurdle of "actually making the software" at any point). Finding out that you have a problem when you don't have a support contract and then looking around for someone to work on the thing is not the same thing as having a support contract, although in some cases it can be a sufficient substitute and it's certainly cheaper in the best case (like any other form of skipping insurance). Depending on context, providing the "support contract" internally is also an option.
- wnevets 4y ago
  > Federal contractors don't need to sell proprietary software to make money -- they make more money selling FOSS software. tech companies in general are making billions using FOSS.
  - kube-system 4y ago
    Of course, which is why I think viewing this as a push for proprietary software is not a fair assessment. Increasing your company's development costs is not a way to make more profit. The point of this is that you can't treat proprietary software dependencies the same way you treat FOSS. Community FOSS projects just don't have the same development process and governance model that proprietary software does. And so, the assessment of these projects is necessarily different.
    - peteforde 4y ago
      Respectfully, you have a too-reasonable hunch of how decisions are made at the executive level, and because of that, you're reaching an incorrect conclusion. The primary factor driving the decision making process is not cost but risk. Many fail to remember the lengths to which companies like Microsoft, Oracle, Sun and others went to create FUD around the adoption of OSS in the public sector. It involved lobbyists, marketing campaigns and a whole certifications industry. When a CIO selects a technology, they aren't just weighing its merits and price tag; they are actively looking to leave a glowing legacy while actively doing everything they can to avoid being humiliated if the technology fails. See, the CIO knows that, as far as their board of directors is concerns, it's not the software that failed but the executive. That's why enterprise support packages exist; it's an insurance policy and a promise that if something goes terribly wrong at 2am, someone is going to pick up the phone when you call. Companies with expensive tools have an obvious interest in convincing their best customers that the competition in inherently risky.
      - deleted 4y ago
        [deleted]
      - Forgeties79 4y ago
- thayne 4y ago
  > haven't previously done much to make sure that that supply chain is robust I'm doubtful that anything short of requiring thorough security/pen testing on everything in the dependency tree would have prevented log4shell. And if that is the goal here, who is going to pay for that? Most open source projects don't have that kind of funding.
  - dllthomas 4y ago
    > everything in the dependency tree With reasonable prioritization, we can probably do a lot to reduce the threat long before we get near everything. > who is going to pay for that? Well, this bill does seem to involve hiring FOSS devs, maybe that's partly what they'd do?
- drc500free 4y ago
  Seriously, the government would rather burn $50k on the manpower that makes the decision to not pay $10k in software licenses. The beltway contracting space is about selling a lot of butts in a lot of seats, and a bit of hardware that goes boom. FOSS is AMAZING for govt contractors, they can bill $250m building something using FOSS that's available as a commercial-off-the-shelf (COTS) product. They put a lot of work into ensuring the govt requirements are rigid enough that the COTS alternative is deemed unacceptable during the AoA process.
buscoquadnary 4y ago
Ehh, I don't disagree with where you start but I do with where you end. If it is a money thing then it probably has more to do setting up "standards" and "compliance" requirements that you must me to use FOSS software in the government. Then federal contractors and other big FOSS organizations repackage their existing solution as "Government ISO-MITRE, PCI, Whatever-BS-Acronym-we-can-come-up-with" compliant and charge a premium over something they already sale. I don't think this will hurt FOSS, at the end of the day FOSS is nothing more than someone saying "here's something I wrote or whatever." and sharing it, anything that tries to make more than that isn't talking about FOSS anymore.
- yesbut 4y ago
  These corporate sponsored legislators are really good at writing policy that sounds good to the public but really helps their corporate sponsor's bottom lines in practice. This bill wouldn't exist if it wasn't designed by large corporate software firms looking to taint, or profit from, FOSS in some way.
  - themitigating 4y ago
    100% sure? Why not find out if that's true because I'm sure there are exceptions.
    - yesbut 4y ago
      100% sure.
  - staticassertion 4y ago
    Isn't it very obvious that the US government has a vested interested in software security? I see no reason whatsoever to believe that this is some sly attempt to make FOSS more expensive as opposed to the US trying to solve a very real problem.
    - Xelynega 4y ago
      If it were truly about software security it wouldn't be limited to open source. Whatever standards make a piece of software secure doesn't change when it's developed by a company or a community, so what's the reason they're making the distinction in law? For that reason I agree with the conclusion of the person above, things don't happen in capitalist societies without someone getting paid for it.
ZainRiz 4y ago
If they were really trying to secure the code, shouldn't the bill be called the "Securing Software Act"? It's not like closed source software is magically immune to vulnerabilities
- yesbut 4y ago
  They'll change the name as soon as FOSS developers spend millions to hire lobbyists.
- kube-system 4y ago
  This isn't about fixing anyone's code, it's about securing the software stack that the government is running. They already have well developed processes for addressing closed source software.
  - yakak 4y ago
    Can you provide a reference to the processes you are referring to? I'm only familiar with EAL and FIPS which require theories that there is maintenance where they apply in the lower part of the stack. They are applied to open source like OpenSSL and SeLinux, probably with better quality than a lot of niche closed source government procures.
  - Xelynega 4y ago
    Why can't those same processes be used for open source code then? If we assume those processes can't(or don't) apply to open source software then am I to believe that OpenSSL has been running the internet without any scrutiny for the last decade?
    - kube-system 4y ago
      This is about risk management process, not computer science process. The businesses processes are different. For example, if your proprietary software has a bug, you call the developer and demand they come into your office and fix it under warranty. Doesn’t work that way for some dependency downloaded from GitHub.
themitigating 4y ago
While skepticism is fair that should be motivation to do research to possibly find evidence of an ulterior motive. However just saying that all legislation is some scam without evidence doesn't make sense. For example, and I don't know the exact name, but the health care transparency act where pricing for treatments or whatever must be published. Who is that helping if you follow the money? Edit: I should have been more clear but ulterior motive to benefit large companies who sell software, or something that harms OSS.
- senorrib 4y ago
  Maybe increased popularity to the legislator in question? Surely no bill comes without some ulterior motive.
  - themitigating 4y ago
    Of course one or more people benefit from every piece of legislation. If a legislator does it to get elected then that's the best case scenario for democracy, right?
  - lolinder 4y ago
    Increased popularity isn't an ulterior (meaning hidden) motive, it's explicitly the foundation for democracy. The whole premise is that we exploit human selfishness for net good by setting up a system that (in theory) rewards making the largest number of people happy. There's nothing ulterior about that motive, it's the point. Where things go wrong is when money becomes involved, because then the system rewards making the wealthiest people happy, not the largest number. That's an ulterior motive.
    - deleted 4y ago
      [deleted]
    - senorrib 4y ago
      Why is buying votes by using government power/money good, and buying congress votes through lobbying bad?
pGuitar 4y ago
> and definitely >100% secure proprietary offerings how is that even possible
- ncallaway 4y ago
  You can manage it if you plant your tongue firmly in your cheek
thayne 4y ago
> definitely >100% secure Did you mean <100%?
- lioeters 4y ago
  > perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount That part confused me too - I believe it's meant to be sarcastic. There's a kind of humor that I often don't get until further reflection, which is a way of saying things that are so overboard and absurd that the speaker cannot possibly believe what they're saying. Or rather, the speaker is saying the opposite of what they mean, in order to make their point. Might be a cultural thing. This kind of humor is even harder to recognize these days, when people honestly do believe the absurd things that they're saying.
kortilla 4y ago
> An actual, good-faith bill that seeks to address these issues would attempt to incentivize/punish orgs that use FOSS without making meaningful contributions to it. Holy shit this is a terrible idea. I can’t think of a better way to discourage people from using open source than to punish organizations for “not making meaningful contributions” to it. As a heavy open source user, contributor, and author, I’m begging you to stay the fuck away from regulating users. That’s the fastest way to destroy open source.
nonameiguess 4y ago
You're actually dead wrong and this is spoken like someone with no experience in this space. What actually happened was not only log4j, but then multiple pre-auth CVEs in Atlassian suite products, effectively brought down DI2E, a collaboration and developer tooling platform that was open to the Internet and used by huge numbers of unclassified DoD and IC development projects. Since it was already sunsetting and had reduced staff, most programs still haven't gotten back data that was lost when the web fronts went offline suddenly to mitigate ongoing attacks. This wasn't catastrophic, but months of work were lost The reality is, the greatest vulnerability here isn't in government-procured software that uses OSS libraries directly. The DoD's own critical custom applications are largely as secure as secure gets. The much bigger problem is in proprietary software, like the Atlassian suite, that uses OSS libraries in its own supply chain. In fact, the DoD has had mandates from the highest level for years to use FOSS everywhere it is available, and to require all new contractors to open source anything they create for government use that isn't classified. The only reason something like the Atlassian suite is still used is a combination of institutional inertia and the lack of comparably feature-complete FOSS alternatives (the vast majority of this kind of space going to SaaS companies that don't allow you to self-host).
gastroturf 4y ago
Paraphrasing your closing paragraph: “you may not use this software if you have not already contributed to it” (because enforcing a future is hard). Seems a bit contradictory to the license terms. Gonna be a trick to get legislation to enforce something that isn’t in established contractual language. Edit: on the positive incentive approach, getting double-funded with discretionary budget for every FOSS developer they hire might be a viable strategy.

kube-system 4y ago

They're trying to destroy FOSS ...by hiring FOSS developers? I don't buy it. More like, log4j was an actual real big issue for government agencies because they use rely on tons of open source projects and haven't previously done much to make sure that that supply chain is robust. This would help to change that. Federal contractors don't need to sell proprietary software to make money -- they make more money selling FOSS software.

throwbigdata 4y ago
More or less of a big issue than the revolving door of Microsoft bugs?
- kube-system 4y ago
  Different types of issues with different solutions. When you have a support contract with the original developer of a piece of code, you can demand the original developer fix the code.
  - dllthomas 4y ago
    That same solution still works for FOSS, you just actually need to pay for it. The situation for FOSS is even better because you also have the option of paying any other person to fix the code. Hopefully that's kinda what this bill does, though?
    - kube-system 4y ago
      It’s “the same” in a really broad hand-wavy sort of way. It’s not the same practically speaking. FOSS usually does not have warrantees, SLAs, or developers in particular locations with particular credentials. The government has processes that they must follow for paying contractors, so “just pay them” is not something that can easily be done last minute, (and sometimes, not at all without a literal act of Congress.) Also the financial and obligatory relationship between them and the developer is much different, and must be managed differently. Really, it is very important for people doing technology projects at the government to understand the difference between calling up the developer of Windows and calling up the developer of Git. Those are two very different relationships.
      - dllthomas 4y ago
        You seem to be reading me as implying any use of FOSS is equivalent to having a support contract; it's not. I was claiming that having a support contract for FOSS is equivalent to having a support contract for proprietary software. If you need "support contract" level support you should probably be paying for a support contract. At least with FOSS that can be competitive for the same piece of software (although that probably also means that some of the services on offer are quite a bit worse, having not had to organizationally have passed the hurdle of "actually making the software" at any point). Finding out that you have a problem when you don't have a support contract and then looking around for someone to work on the thing is not the same thing as having a support contract, although in some cases it can be a sufficient substitute and it's certainly cheaper in the best case (like any other form of skipping insurance). Depending on context, providing the "support contract" internally is also an option.
wnevets 4y ago
> Federal contractors don't need to sell proprietary software to make money -- they make more money selling FOSS software. tech companies in general are making billions using FOSS.
- kube-system 4y ago
  Of course, which is why I think viewing this as a push for proprietary software is not a fair assessment. Increasing your company's development costs is not a way to make more profit. The point of this is that you can't treat proprietary software dependencies the same way you treat FOSS. Community FOSS projects just don't have the same development process and governance model that proprietary software does. And so, the assessment of these projects is necessarily different.
  - peteforde 4y ago
    Respectfully, you have a too-reasonable hunch of how decisions are made at the executive level, and because of that, you're reaching an incorrect conclusion. The primary factor driving the decision making process is not cost but risk. Many fail to remember the lengths to which companies like Microsoft, Oracle, Sun and others went to create FUD around the adoption of OSS in the public sector. It involved lobbyists, marketing campaigns and a whole certifications industry. When a CIO selects a technology, they aren't just weighing its merits and price tag; they are actively looking to leave a glowing legacy while actively doing everything they can to avoid being humiliated if the technology fails. See, the CIO knows that, as far as their board of directors is concerns, it's not the software that failed but the executive. That's why enterprise support packages exist; it's an insurance policy and a promise that if something goes terribly wrong at 2am, someone is going to pick up the phone when you call. Companies with expensive tools have an obvious interest in convincing their best customers that the competition in inherently risky.
    - deleted 4y ago
      [deleted]
    - Forgeties79 4y ago
thayne 4y ago
> haven't previously done much to make sure that that supply chain is robust I'm doubtful that anything short of requiring thorough security/pen testing on everything in the dependency tree would have prevented log4shell. And if that is the goal here, who is going to pay for that? Most open source projects don't have that kind of funding.
- dllthomas 4y ago
  > everything in the dependency tree With reasonable prioritization, we can probably do a lot to reduce the threat long before we get near everything. > who is going to pay for that? Well, this bill does seem to involve hiring FOSS devs, maybe that's partly what they'd do?
drc500free 4y ago
Seriously, the government would rather burn $50k on the manpower that makes the decision to not pay $10k in software licenses. The beltway contracting space is about selling a lot of butts in a lot of seats, and a bit of hardware that goes boom. FOSS is AMAZING for govt contractors, they can bill $250m building something using FOSS that's available as a commercial-off-the-shelf (COTS) product. They put a lot of work into ensuring the govt requirements are rigid enough that the COTS alternative is deemed unacceptable during the AoA process.

buscoquadnary 4y ago

Ehh, I don't disagree with where you start but I do with where you end. If it is a money thing then it probably has more to do setting up "standards" and "compliance" requirements that you must me to use FOSS software in the government. Then federal contractors and other big FOSS organizations repackage their existing solution as "Government ISO-MITRE, PCI, Whatever-BS-Acronym-we-can-come-up-with" compliant and charge a premium over something they already sale. I don't think this will hurt FOSS, at the end of the day FOSS is nothing more than someone saying "here's something I wrote or whatever." and sharing it, anything that tries to make more than that isn't talking about FOSS anymore.

yesbut 4y ago
These corporate sponsored legislators are really good at writing policy that sounds good to the public but really helps their corporate sponsor's bottom lines in practice. This bill wouldn't exist if it wasn't designed by large corporate software firms looking to taint, or profit from, FOSS in some way.
- themitigating 4y ago
  100% sure? Why not find out if that's true because I'm sure there are exceptions.
  - yesbut 4y ago
    100% sure.
- staticassertion 4y ago
  Isn't it very obvious that the US government has a vested interested in software security? I see no reason whatsoever to believe that this is some sly attempt to make FOSS more expensive as opposed to the US trying to solve a very real problem.
  - Xelynega 4y ago
    If it were truly about software security it wouldn't be limited to open source. Whatever standards make a piece of software secure doesn't change when it's developed by a company or a community, so what's the reason they're making the distinction in law? For that reason I agree with the conclusion of the person above, things don't happen in capitalist societies without someone getting paid for it.

ZainRiz 4y ago

If they were really trying to secure the code, shouldn't the bill be called the "Securing Software Act"? It's not like closed source software is magically immune to vulnerabilities

yesbut 4y ago
They'll change the name as soon as FOSS developers spend millions to hire lobbyists.
kube-system 4y ago
This isn't about fixing anyone's code, it's about securing the software stack that the government is running. They already have well developed processes for addressing closed source software.
- yakak 4y ago
  Can you provide a reference to the processes you are referring to? I'm only familiar with EAL and FIPS which require theories that there is maintenance where they apply in the lower part of the stack. They are applied to open source like OpenSSL and SeLinux, probably with better quality than a lot of niche closed source government procures.
- Xelynega 4y ago
  Why can't those same processes be used for open source code then? If we assume those processes can't(or don't) apply to open source software then am I to believe that OpenSSL has been running the internet without any scrutiny for the last decade?
  - kube-system 4y ago
    This is about risk management process, not computer science process. The businesses processes are different. For example, if your proprietary software has a bug, you call the developer and demand they come into your office and fix it under warranty. Doesn’t work that way for some dependency downloaded from GitHub.

themitigating 4y ago

While skepticism is fair that should be motivation to do research to possibly find evidence of an ulterior motive. However just saying that all legislation is some scam without evidence doesn't make sense. For example, and I don't know the exact name, but the health care transparency act where pricing for treatments or whatever must be published. Who is that helping if you follow the money? Edit: I should have been more clear but ulterior motive to benefit large companies who sell software, or something that harms OSS.

senorrib 4y ago
Maybe increased popularity to the legislator in question? Surely no bill comes without some ulterior motive.
- themitigating 4y ago
  Of course one or more people benefit from every piece of legislation. If a legislator does it to get elected then that's the best case scenario for democracy, right?
- lolinder 4y ago
  Increased popularity isn't an ulterior (meaning hidden) motive, it's explicitly the foundation for democracy. The whole premise is that we exploit human selfishness for net good by setting up a system that (in theory) rewards making the largest number of people happy. There's nothing ulterior about that motive, it's the point. Where things go wrong is when money becomes involved, because then the system rewards making the wealthiest people happy, not the largest number. That's an ulterior motive.
  - deleted 4y ago
    [deleted]
  - senorrib 4y ago
    Why is buying votes by using government power/money good, and buying congress votes through lobbying bad?

pGuitar 4y ago

> and definitely >100% secure proprietary offerings how is that even possible

ncallaway 4y ago
You can manage it if you plant your tongue firmly in your cheek

thayne 4y ago

> definitely >100% secure Did you mean <100%?

lioeters 4y ago
> perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount That part confused me too - I believe it's meant to be sarcastic. There's a kind of humor that I often don't get until further reflection, which is a way of saying things that are so overboard and absurd that the speaker cannot possibly believe what they're saying. Or rather, the speaker is saying the opposite of what they mean, in order to make their point. Might be a cultural thing. This kind of humor is even harder to recognize these days, when people honestly do believe the absurd things that they're saying.

kortilla 4y ago

> An actual, good-faith bill that seeks to address these issues would attempt to incentivize/punish orgs that use FOSS without making meaningful contributions to it. Holy shit this is a terrible idea. I can’t think of a better way to discourage people from using open source than to punish organizations for “not making meaningful contributions” to it. As a heavy open source user, contributor, and author, I’m begging you to stay the fuck away from regulating users. That’s the fastest way to destroy open source.

nonameiguess 4y ago

You're actually dead wrong and this is spoken like someone with no experience in this space. What actually happened was not only log4j, but then multiple pre-auth CVEs in Atlassian suite products, effectively brought down DI2E, a collaboration and developer tooling platform that was open to the Internet and used by huge numbers of unclassified DoD and IC development projects. Since it was already sunsetting and had reduced staff, most programs still haven't gotten back data that was lost when the web fronts went offline suddenly to mitigate ongoing attacks. This wasn't catastrophic, but months of work were lost The reality is, the greatest vulnerability here isn't in government-procured software that uses OSS libraries directly. The DoD's own critical custom applications are largely as secure as secure gets. The much bigger problem is in proprietary software, like the Atlassian suite, that uses OSS libraries in its own supply chain. In fact, the DoD has had mandates from the highest level for years to use FOSS everywhere it is available, and to require all new contractors to open source anything they create for government use that isn't classified. The only reason something like the Atlassian suite is still used is a combination of institutional inertia and the lack of comparably feature-complete FOSS alternatives (the vast majority of this kind of space going to SaaS companies that don't allow you to self-host).

gastroturf 4y ago

Paraphrasing your closing paragraph: “you may not use this software if you have not already contributed to it” (because enforcing a future is hard). Seems a bit contradictory to the license terms. Gonna be a trick to get legislation to enforce something that isn’t in established contractual language. Edit: on the positive incentive approach, getting double-funded with discretionary budget for every FOSS developer they hire might be a viable strategy.