Hacker News Reader

Brookings seems to be advocating funding open source IT projects that already exist, for example a big ($10m+) check to the Apache Foundation. Apache already has the compliance competency.

It may be more efficient to use existing grant writing for universities. The Apache Foundation can redistribute the money it can’t hire programmers competently the way a university research department can. However it would be bigger impact to write smaller checks for many tools.

The real problem is that single purpose / single feature IT software tends to be the best at what it does but is the hardest to fund this way.

The compromise will probably be funding people to write and evangelize standards. This is too bad, because people who apply for grants aren’t Google, they aren’t standardizing an existing, widely deployed real piece of successful engineering without any economics brakes. They’re people writing things like SOC 2 or ISO 27000xxx that arguably do not provide any meaningful value at all - standards that could vanish overnight and absolutely nothing about a single person’s daily life would change at all.

18F or whatever publishes a lot of stuff like this. Markdown policy documents. I think it’s profoundly wasteful, it is taking talented people’s intellectual energy and diverting it to something that not only hardly anyone will use, but perpetuates the worst aspects of government - the belief that text and bureaucracy and the way lawyers do things is intrinsically valuable, as opposed to something normal people routinely completely and utterly ignore.

I'm not sure who I would trust, but I don't generally trust university research departments to produce high quality, reusable software. Not that industry projects produce consistent quality software either, but fewer of those projects are open sourced.

Sure, but there is no reward for research departments to produce high quality code. Their job is to experiment and publish, maintainable bug free(unless it effects their code) doesn't get rewarded.

With that being said there are tons of high quality open source scientific computing projects e.g. lammps, abinit, dakota, Deal.II which are open source, ran by people at government research labs and universities and funded by e.g. NSF which work really nicely and are (I assume) quality software products. I will note that the Europeans seem to be better and producing these kinds of works than the Yankees.

One wants to get something that is worthwhile, of course. It would be fairly easy to vet existing projects and codebases for their quality at a high level. Mostly at a binary level, with the goal to weed out total junk.

Like a license, I think it would be nice if projects adopted a development guideline, code formatting, the commit, code review, merge process, etc. So that everyone can have a common set of known operating norms around how that project is developed. It would be a lot easier for a funding organization to review if that were in place. The Robert's Rules of Code Review. Bonus points if this were all encapsulated into an automatic process.

I think there is a ton of value in funding projects (Apache,Rust,Blender,etc) as well as individuals. It would be wonderful if someone could go on sabbatical, full or part time and get paid to work on OSS. Maybe you apply for a grant, show them the git repos (process above analyzes), one has a plan (fix bugs, new features, evangelism, tPM, etc) for the time and with time with the bare minimum of goals. Like an agent can watch your activity log and do a roll-up.

I think 50k a year would be a number that many technical folks making much much more would jump at the chance to just work on OSS.

> Sure, but there is no reward for research departments to produce high quality code. Their job is to experiment and publish, maintainable bug free(unless it effects their code) doesn't get rewarded.

This isn't completely true. I'm familiar with at least few projects which got grants specifically to build tools for other scientists and those were great for funding general software engineering jobs not tied to the usual academic publication/job cycle. That was good for supporting ongoing upgrades — nobody gets a publication for upgrading a dependency, which is how you end up with someone keeping a Windows 95 box on life support for years because they were focused on science – and also for supporting things like good documentation since that's a serious time commitment.

It'd be an idea to scale up things like that for identified high-impact projects, with the trick being finding someone capable of overseeing software engineering rather than the usual academic focus of existing grant panels. Seems like something which might be a fit under the Commerce department since there's a lot of stuff which American businesses benefit from but generally do not directly support.

You're a right, it isn't completely thankless. And it was suggested to me as a great way to increase citations was to write my algorithm to work in LAMMPs. Nevertheless, I looked at the risk-reward (and also considered the algorithm I was working on worthless and decided to punt).

Oh, I completely agree. The projects I saw were considered novel for actually getting funding for staff engineering positions which didn't follow the regular academic track. They had to do that to get the right people since the grad students were heavily incentivized to focus on things which would get noteworthy publications and you couldn't get experienced software engineers on the academic pay scale unless you hit the unicorn of someone who was really interested in the domain and didn't like money.

While I agree with your, let's call them reservations, about the quality of said software written by scientists who are not professional software engineers -- I still believe it would be a net benefit to the world if Congress tied all federally funded research dollars to an open source license, up to and including disclosure on hardware specifications and firmware source code.

I've got a friend on the data science/visibility team at CERN, and she has some fun stories. It's absurd to me that the reproducibility path for so much modern day research in nearly every field passes through proprietary closed source software, proprietary pre-compiled signed binaries, ditto for firmware, and then (sometimes) hardware where the entirety of the documentation consists of 'A service contract with the vendor'.

The reproducibility crisis in the sciences right now is essentially an excess of inputs and deficit of testing those inputs -- closed source hardware/software is not helping.

There is plausibly an easy enough solution for this, if the grant structure allows/encourages departments hiring developers to help with this. If your primary source of labor for this is short term grad students with no expertise in software development, and not training mechanism, the results are predictable.

Another thing that works against this is a lack of academic credit for doing,overseeing, or steering the work. This also could change.

Changing the incentives can easily change the results.

> Another thing that works against this is a lack of academic credit for doing,overseeing, or steering the work. This also could change.

> Changing the incentives can easily change the results.

Arguably, besides the PI (Principal Investigator) listed on a paper, you should also list a Principal Engineer.

Look up https://nlnet.nl/ they demux big EU grants to small projects that aren't well equipped to apply on their own.

It has been solving the problem you mention very well.

> 18F or whatever publishes a lot of stuff like this. Markdown policy documents. I think it’s profoundly wasteful

I think you’re under-estimating the value of publishing a good policy from a respectable source within the Federal government.

Many of the government’s technology problems are actually self-inflicted policy problems. Publishing a good policy gives internal reformers a place to start. When the lawyers and security people start telling you no, it’s much more effective to say “actually this language comes directly from GSA, who approved it for X, which has the same compliance requirement you’re concerned about” than to simply protest that it’s industry best practice.

I do agree that this lawyers-first way of doing things kinda sucks. It’s certainly not the way to maximize tech success. But it’s the system/culture we’ve got. I’d love to hear ideas for changing it, especially if you can figure out a way to accomplish the privacy, security, integrity, and fairness objectives that the current system prioritizes.

A government agency struggling to serve the public good because it’s hobbled by obsolete tech is better than an agency enabled by cutting edge tech unshackled from the public interest and democratic legitimacy.

> But it’s the system/culture we’ve got.

We wind up with a lot of political and business family dynasties despite the terrible incompetence of sons and daughters. Part of that is that families can operate totally without policies, that they are having horrible dynasty lawsuits because nothing is written on paper or litigated that way. Yet as long as they don’t sue each other, the lack of policy friction - a “liquidity” that may not show up as a dollar amount but as something else - makes the family dynasty surprisingly competitive.

Wouldn’t it be ironic that policies - specifically the hundred+ page markdown output kind of policies, not something succinct like I don’t know, the Ten Commandments or the Bill of Rights - make the corrupt family dynasty more competitive?

For what it's worth a large amount of the DOE work (where they have the super computers) is open source. You got ORNL (with Summit and soon Frontier)[0], ANL[1] (soon to have Aurora), and LLNL[2]. I think what needs to happen is that things could be better organized, for example ORNL has [3] which still open sourced but not grouped under the ORNL GH. Also if we got to code.gov and search "ORNL" and "C++" we only see DCA++ which isn't on the GH but here[4].

I think as long as code isn't sensitive to national security (LLNL...) it should be open source. But I think the big problem is that organization and discovery is very difficult. code.gov is an attempt to solve this, but it doesn't do it well.

[0] https://github.com/ORNL

[1] https://github.com/argonne-national-laboratory

[2] https://github.com/LLNL

[3] https://github.com/ornladios/ADIOS2

[4] https://github.com/CompFUSE/DCA

And I'll add Idaho National Lab [5] to that list - particularly the MOOSE multiphysics finite element code [6] is a largish project with significant momentum/funding:

[5] https://github.com/idaholab/

[6] https://github.com/idaholab/moose

I'll add Pacific Northwest National Lab (PNNL) [7]

[7]: https://github.com/pnnl

The funny part about a lot of the national security code at LLNL is that I bet there is approximately no one else on the planet with the computing resources to actually run it (HPC simulations of weapon effects) Except the few countries that possibility could are exactly the ones we wouldn't want to get their hands on it... funny how that works out.

Just remember, what was the actual reason ENIAC was created? It wasn't just for fun:

>its first program was a study of the feasibility of the thermonuclear weapon.

https://en.wikipedia.org/wiki/ENIAC

I work on a contract for the VA, which includes open-source repos [1] for VA.gov's frontend + backend systems. We work closely with USDS [2], who has been a huge ally in advocating for doing our work in the open, including our project management. It seems like GSA does a lot of similar advocacy work, though I haven't interfaced with them directly.

One interesting thing we've run across is that Public Domain source code is not considered "Open Source" in terms of OSI licensing [3]. This isn't usually relevant, but has blocked use cases like software services offering free use for OSI-licensed projects.

(To other readers: If you're interested in chatting about working on modern, open-source projects in the federal space, drop me a note! Email in profile).

[1] https://department-of-veterans-affairs.github.io/va.gov-team..., repository links at the bottom

[2] https://www.usds.gov/

[3] https://opensource.org/node/878

Hey, I just sent you a connection request on LinkedIn. Definitely interested in learning more about your open working experiences. I'm really surprised that they're also including project management with that.

> Public Domain source code is not considered "Open Source" in terms of OSI licensing https://opensource.org/node/878

The reasons look to more nuanced than that article (especially for government work) but the crux AFAIK is that public source is not a license, so there is no license that the OSI can approve. From https://opensource.org/faq#public-domain : There are certain circumstances, such as with U.S. government works as described above, where it is not easy to apply a license, and the software must be released into the public domain. In these cases, while it would be inaccurate to display the OSI logo or say that the license is OSI-approved (since there is no license), nevertheless we think it is accurate to say that such software is effectively open source, or open source for most practical purposes, even though it is not officially released under an open source license. (This is assuming, of course, that in the laws of releasing jurisdiction the meaning of "public domain" is compatible with the Open Source Definition.) After all, the freedoms guaranteed by open source licenses are still present, and it is possible for the familiar dynamics of open source collaboration to arise around the software.”

The next FAQ heading explains that the CC0 license was not OSI approved due to its patent clause.

Public source does have its issues with some jurisdictions, but surely jurisdiction problems are no worse than the specific problems each other license has.

Maybe publish under the user's choice of public domain, CC0, and MIT?

This is the VA we're talking about, so they can't do that unless congress changes the law. All works produced by direct employees of the federal government (ie not contractors) are in the public domain. (https://en.wikipedia.org/wiki/Copyright_status_of_works_by_t...)

One other issue with the public domain and the USA govt is that while US govt works are public domain in the USA, they can, at the same time, be copyrighted by the US govt outside of the USA. So public domain in the USA but proprietary outside of the USA.

> I think them funding projects directly with cash could cause a lot of problems though. The increase regulations that would need to be added would probably not be worth it for open source projects. People who get funding would likely need to submit a lot of documentation, there'd also probably be weird rules about non U.S. citizens etc... and laws would need to be passed.

I think 18F's modular contracting methodology is highly effective for this sort endeavor, if you can take the opinion that they're the sponsor and benevolent dictator driving that part of the codebase (and the code developed is open sourced upon confirmation acceptance criteria has been met).

Thank you for switching to an open development model. A rising tide lifts all boats.

https://18f.gsa.gov/2019/04/09/why-we-love-modular-contracti...

Nice link, I've followed 18F a little and I'm interested in everything they're doing.

I think whipping contractors into shape is the easiest path to increasing government participation in open source. It's easier than coming up with new regulations specifically around open source funding.

Billions of dollars are spent each year by the federal government on custom software development anyways. And on the whole, they end up spending about what big tech companies do for engineers (but not getting the same level of quality) Forcing the contractors to be more open will probably keep them more honest and make them write less shitty code.

I think the contracting model (which has it's place!) is really at the root of the problem. The time for contractors is when you need something that is very rare in the world or you need a large temporary expansion of capacity.

A lot of government contracts are the kind of work that will be consistently taking place over decades and can be done by any of hundreds of thousands of similarly competent people. Imagine if you didn't even need to write a contract, didn't need a bidding process, that could be substantial time and money saved on its own.

Then with FTEs minor initiatives like finding interesting internal libraries to open source can just happen. What I'm saying isn't a new idea (really it's an old idea) and I very much admire those who are actually taking the risk to make this kind of thing happen because the failures can be very visible and successes sometimes aren't.

Big +1.

I found a small bug in a GSA site (plainlanguage.gov) and was able to PR a fix that was merged almost immediately. It's a shame that we can't do the same with all of the bugs in other government websites.

The work we do for the VA is open source! I am a contractor working alongside the US Digital Service - there are a TON of projects out in the wild and lots of movement in the "Government should build open source software" direction.

https://github.com/department-of-veterans-affairs

Join us at https://oddball.io/jobs

It's definitely becoming more common. Many agencies have organizations up on GitHub where development of various products are done out in the open (for example, https://github.com/cmsgov).

Say, for the sake of argument, that you had $100m pa to invest in open source. What/how would you do?

yup, I'm working on a contract for HRSA and open source is a requirement