Hacker News Reader

Comment by ecshafer | Hacker News Reader

I am an open source advocate, but I don't really agree here. Should the IRS, NSA, CIA, and FBI code all be open source? Here are some cases where closed source software, with some security by obscurity could be helpful. Another example would be some software around designing nuclear systems.

But as an example maybe a software funded by the national weather service to run simulations, that aught to be open source (perhaps something like that exists and is open source, that's not my area).

But a counter argument to mine could be that some software that is security focused might be more secure if it was open source. I think this is an area with a lot of nuance, and absolute statements are hard to make.

View on HN

> Should the IRS, NSA, CIA, and FBI code all be open source?

Yes. Open source, but secret/classified (as necessary, IRS software should be open-source, period). This way the software will be a useful learning/historical resource when it's declassified in the future.

Also, electronic voting. Not that electronic voting booths will ever be a good idea, but forcing them to open source their stuff will hopefully deter people from even trying (and if not it will make it even more blatantly visible that these things are terrible).

It's just like the biggest argument for open source in science: it is required for proper accountability.

Most of the code in electronic voting is owned by the vendors though so by the same standard would we have to open source any 3rd party software the govt aquires?

I think it would have to be a requirement of any money the government spends on code. Otherwise, they will easily defeat the requirement to make it public by passing it through a private company.

I don't quite follow your line of thinking here:

- currently most electronic voting software is owned by the vendors

- electronic voting should really not be trusted, period, but definitely not be allowed to be closed source

- therefore, we should ban any electronic voting software not made on open source software (arguably even hardware)

- therefore, I am implying vendors of electronic voting software should only be allowed to use a fully open source software stack in their final product

I do not see the jump from this reasoning to any software used by the government must be open source (if I understand you correctly).

That's a lot more involved and domain-specific than the question of whether or not government-owned code should be open source.

The person you're responding to is just making the positive observation that, since electronic voting software is licensed - not produced - by the government, you can't mandate it be open sourced via e.g. a FOIA request.

You are making a normative declaration that it should be open sourced because it's important and intrinsically untrusted software, and as a consequence it either will be or electronic voting won't be possible. These are separate things. You're talking about what ought to be, the other commenter is talking about what (currently) is.

Right, I see where GP and I were talking past each other now now. Thank you for clarifying!

Having said that, I think there is a more general point to be made from bringing up electronic voting in the discussion of open source + government funded software development.

Licensed products are an inevitable loophole to be exploited unless we stipulate rules for use-cases like this. Inevitable because some products will always be licensed, and mandating that everything the government uses must be open source is... well, actually, that sounds great, but even if such a policy were implemented that would be a slow, tough transition to make.

> Not that electronic voting booths will ever be a good idea

Why not?

Yes, open source IRS software. Tax breaks for bug fixes!

What do I get for sending in a malformed e-file that breaks the mainframe? There's some REALLY old code in the IRS processing systems and it would surprise me if any of it stood up to modern security designs. Also, you don't want to reveal how you determine who to audit.

> who to audit.

Doesn't have to be complicated, pull 10% of the "simple" forms, 90% of complicated.

Simple forms would be the 1040EZ, 1040s w/ std deductions & no other "business" forms.

I highly doubt that the real code is random in that way. I'm sure there's some random aspect, but not all. If you're committing tax fraud, it's very valuable to know how to avoid tripping up the "audit this account" triggers.

This is assuming "who to audit" is even a software process or completely a software process, but fine, don't open source that if necessary. I really just want the IRS software that I personally use to be open source.

There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited. Releasing that risks big bad actors working around the limitations of whatever algorithms it contains.

> There are some things the IRS shouldn't release like their fraud detection or anything related to deciding who should get audited

That's perhaps a good reason for that part of the software to not be published and/or FOIA disclosable, but that's orthogonal to how it is licensed. If it's an original government work now it would be public domain (which is more open than open source), but still potentially confidential and nondisclosable.

While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable? It may as well not exist as far as open-source or public domain is concerned.

> While I appreciate the distinction between license and classification, does it really matter if a piece of software is "in the public domain" if its very existence and content is classified and non-disclosable?

If the entire work is, less so than if it was disclosable (although there are laws governing the government use of copyright protected work, and arguably there is a benefit to the public interest if the vendor has provided and open source license even if the work is not publicly disclosable.)

But practically, classification and, perhaps even moreso, the other exceptions to FOIA would often apply to limited portions of software systems rather than whole systems, as is often the case with other materials covered by FOIA.

I see. Well a redacted code base is certainly better than none at all, so I guess I agree

> Should the IRS, NSA, CIA, and FBI code all be open source?

No, works made by or under hire for the federal government should be public domain, from a copyright standpoint, not exclusively owned but licensed under an open source license.

But on the other hand, I think your real question has nothing to do with ownership or licensing, but whether or not they should be publicly disclosed. In many cases the answer is “no”, but lots of government work that is in the public domain from a copyright perspective is also not subject to unrestricted publicly disclosure (and may also be classified.)

But arguably the licensing can work the same way as disclosure; presumptively, all government software should be open source, just as presumptively all government records are publicly disclosable; there may be limited defined exceptions for the former as there are for the latter, and decisions to treat software as within an exception should be reviewable by courts just as witholding material from FOIA disclosure is.

And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software? Should the government have to pay tens of millions and years of waiting to re-create said software?

> And private software that only needs a 3-5% modification for government usage? Should that be required to open-source the entire software?

I think there is a good argument for anything where the government is acquiring software rather than paying for service that the acquired software (even if it zero percent modified) should be under a permissive open source license (or even acquired into the public domain), and the source code should be a disclosable public record except to the extent it would be covered by privacy, security, or other existing exceptions to public records laws.

So, you'd rather spend millions and years of time extra than to use closed source software?

> So, you'd rather spend millions and years of time extra than to use closed source software?

No, I'd rather save millions and years of time than use closed source software (if it's zero modification COTS, the extra cost comes in organizing operations around software limitations rather than business driving tools, if it's 3-5% modification at acquisition MOTS, then the additional cost is the continued modifications necessary as government needs evolve differently than private needs with the original vendor able to charge want amounts to monopoly rents because there are no substitute providers because the vendor owns the code, or you fail back to business organized around software rather than vice versa again.)

I've actually spent quite a while working in public sector IT in a unit which manages COTS, MOTS, and we-own-the-code solutions.

(Now there are some exceptions, just as FOIA has exceptions as to which government records are disclosable, but by far I'd prefer the baseline would be code acquired by government must belong to or be freely usable by the public, either PD or permissively-licensed.)

I agree that there may be edge cases where it doesn't make sense to make software open source (although I also think that the majority of software used at IRS, NSA, CIA, and FBI could be open source). However, I strongly believe that if the code is not published, it should at least be available to the government itself, s.t. if a vendor goes out of business or the government wants to change vendors they can do so without issues.

> Should the IRS, NSA, CIA, and FBI code all be open source?

I'm leaning toward "yes", but that doesn't mean the data (including encryption/decryption keys) should be publicly available.

They will definitely want to consider extraordinary projects, materials, and infrastructure as munitions.

But they also have existing, good relationships with academics in other engineering fields where those regulated materials can still be accessed.

Maybe Wide-Open Source isn't the right answer for all projects because of the understood risks, but because they already have a good set of SOP for a similar program, perhaps it's time to ask them if they could expand that program's scope and loosen their grip on those things a little.

What do they have to hide? Nobody is asking for their list of passwords/private keys. Even if they do have secret projects, nobody sane is asking them to open source every line of code they write.

Look at NASA’s open mct on github - that’s awesome and we should push govt orgs to release more projects like this.

The federal source code policy [0] gives an exemption for national security or mission requirement. So in the US there are valid reasons why CIA and FBI shouldn’t be totally open. But for everything else the directive is to default to open.

[0] sourcecode.cio.gov

Isn't security by obscurity only giving a false sense of security? So it's actually making things worse.

Security through "obscurity" is not security at all.

Reply on news.ycombinator.com