5 ms·
Great advert for free and open source software. As with dieselgate, this suggests you basically cannot trust anything containing software. Can't trust it to fo
by ZeroGravitas 3y ago
Great advert for free and open source software.
As with dieselgate, this suggests you basically cannot trust anything containing software. Can't trust it to follow regulations. Can't trust it to do its job.
Can't trust the software. Can't trust the institutions that write the software.
All very "late stage capitalist software development".
- kibwen 3y agoHell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.
- nielsole 3y agocode escrow in general should be much more common.
- deleted 3y ago[deleted]
- rlpb 3y agoAn organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.
- bmacho 3y agoCompile the code yourself?
- mordae 3y agoRight. Mandate that the software is delivered with CI pipeline running in the client's environment with 100% reproducible builds and verify checksums.
- Ygg2 3y agoImplying that's an impossible obstacle. Reproducibility is a thing. Make it so code needs to be reproducibly buildable. Only reproducibly buildable artifacts can be deployed on hardware. Document the whole process.
- redman25 3y agoDoesn't mean it's not a step in the right direction. Any transparency is better than zero.
- gryn 3y agothen you just need to bribe the code reviewer(s). open source is still the better answer, good luck bribing every member of the public who could potentially read public code.
- goodpoint 3y agoThat would work only on paper. The financial interests involved are huge.
- tremon 3y agoAll the more reason for governments to insist.
- landemva 3y ago> can still require the manufacturers to privately submit to the government all code I wonder if companies purchasing trains could put code disclosure in the purchase contract? I wonder if, in aggregate, train purchasers or car purchasers could fund an independent code storage vault and pay a small premium to fund that code vault organization? In other words, if purchasers wanted this and valued this, they would demand it in purchase contracts and fund it.
- deleted 3y ago[deleted]
- 2rsf 3y agoI'm all for free and open source software, but what would you suggest here? That train operators will download code from the internet and install it on their trains?
- hgomersall 3y agoClearly not. A reasonable expectation might be though that if you want to sell your multi million pound products to a captive public sector, you have to publish all the source code and the means to build the binaries.
- mordae 3y agoYes. Once it's signed by somebody accredited to review it for safe train use.
- achileas 3y agoOpen source means just that - it doesn’t imply one sort of distribution mechanism over others.
- goodpoint 3y agoThe same way technical diagrams for roads, bridges and other public infrastructure are public. In most OECD countries food needs to be labelled with a full list of ingredients. Your GP can read scientific papers about the efficacy and risks of a new treatment. (Yes, many papers are paywalled but that's irrelevant compared to secrecy)
- shpx 3y agoIt doesn't actually need to be open source. If they published binaries that would be enough to analyze.