Hacker News Reader

I thought this went well with Germany’s Corona Warn App [0], which even resulted in a fork of the android app [1] that has a few more features, but most importantly supports more devices and works with microG instead of Google services.

Now, if the resulting service and maintenance fees in the millions are fair, is another question. But the open source work was great.

[0]: https://github.com/corona-warn-app

[1]: https://codeberg.org/corona-contact-tracing-germany/cwa-andr...

I would like to throw in the often used "Public Money = Public Code". I personally agree with your sentiment but would like to throw in that an open source, but not open contribution, similiar to SQLite may be a good addition for using OSS at this level.

Open contribution? What is that?

Any MR must pass automatic tests, independent project lead and dev review, have RFC/ADR/discussion etc. Why should it matter who did the code?

Lets take for example how PowerShell is governed on GitHub - what is wrong with that model?

> Open contribution? What is that?

For example SQLite is open source but not open contribution. It would not accept a pull request from someone outside the team.

> Why should it matter who did the code?

Largely licensing issues. For example, from SQLite's copyright page [1]:

> In order to keep SQLite in the public domain and ensure that the code does not become contaminated with proprietary or licensed content, the project does not accept patches from people who have not submitted an affidavit dedicating their contribution into the public domain.

[1]: https://sqlite.org/copyright.html#notopencontrib

That's not any different from the many open source projects that require a CLA.

Also, SQLite would have it easier if they had chosen, or written, an actual open source license rather than a public domain dedication considered invalid in many countries; they even sell "yes this was meant to be open source" warranties.

There is an interesting discussion here [ 1 ] although this particular project has since modified their stance

Summary from thread

1. Too many small contributions takes a toll on core developers

2. Issue of copyright assignment and knowing chain of ownership

3. Social cost when a PR is rejected and the submitter is mad.

1. https://news.ycombinator.com/item?id=25940195

While 1. may be meaningful on mainstream IT FOSS projects, this has probably next to 0 relevance to gov FOSS services. Issue 2 is solved already. Issue 3. also seem irrelevant - I doubt folks other from academia and specific nerds will try to PR on gov service given the extensive in domain hard to get knowledge that is needed for that in genral.

"Public Money = Public Code"

That's a deepity. It means nothing.

https://news.ycombinator.com/item?id=30733914

Big fan of the Foundation for Public Code!! They help coordinate FOSS efforts between governments. https://publiccode.net/

Thanks for the endorsement! (I'm a codebase steward at the Foundation for Public Code.)

It would also be a huge incentive for developers to turn to the public sector.

It is also VERY patriotic thing to do for your country - bring out your best brainz and make stuff better for your people, instead of promoting more insidious forms of it that we can witness today first hand.

I would very much like to see countries on GitHub the way we have organizations now (or GitLab as its core is FOSS).

> Anything custom made for the gov MUST BE FOSS as money is from the people, so people MUST own it.

This should also include the operating systems and associated tools used to run such software. Right now there are countries around the world shoveling loads of money to alternatives because they suddenly realized Kaspersky can't be trusted.

It seems that Bulgaria allows for usage of proprietary mainstream tools (such as Sql Server) but doesnt recommend it. Custom made software MUST be FOSS tho. which is IMO good middle ground. Also, that law was adopted 6 years ago. FOSS is stronger then ever IMO now, and there is really no reason nowdays to use propriatery stuff for majority of things.

There is a problem with this though. FOSS licenses (by OSI standards) demand that you should have the right as a user to redistribute that software and that the license should be non discriminatory. Now I'm going to go out on a limb and say that as a government licensing your custom built missile defence system control software as open source is not a good idea, because you probably want to restrict it's distribution for very good reasons. While this is an extreme example there are lots of other bits of software that you might not want to give away to your geopolitical rivals. So no, OSS has its place in government, but it shouldn't be universal.

Defense is always exception, even in non FOSS. This is very bad example.

No it's a very good example to your argument that "Anything custom made for the gov MUST BE FOSS" precisely because it is an exception, and an obvious and absurd one. That there is such an example makes a mockery of your position. See reductio ad absurdum.

I agree in principle but not everything is useful for the public, and making code FOSS is not just a matter of uploading it somewhere - this requires documentation, regular updates, clear assignation of responsibility, etc. You'd be surprised by how strapped for resources even powerful government bureaucracies can be - committing time to foss-ing is time not spent on operational needs.

So I would argue: open source anything that can be expected to have wider reuse or transparency benefits. But don't just spam any code produced to the public.

How about developing in public? See for example login.gov, the source code is on GitHub and you can see their commits and issue board in real time.

> Anything custom made for the gov MUST BE FOSS as money is from the people, so people MUST own it.

I tend to think the same way/hold the same ideologies, but is this really "true"? Something like, say, a tank is also produced by money from the people, but it's quite a stretch to demand that the people own it. Why is software different?

> Anything custom made for the gov MUST BE FOSS as money is from the people, so people MUST own it.

I like and agree on this, but just out of curiosity is it more reasonable to attribute the rights for the software to only taxpayers if the rationale is just about where the money come from?

This sounds good, however, the biggest problem is sustainability of FOSS if there are commercial alternatives. FOSS needs to be simply made competitive and agencies need to get their procurement processes straight. FOSS is already better and cheaper in the long run, but commercial companies will likely win most bids. FOSS is IMHO no value in itself, but it has value if used and supported by govs and it is just procurement that has gone all wrong.

Edit: to explain the value thing: just look at all the crappy FOSS build by many H2020 funded projects(there are exceptions) You can waste money also for building FOSS. Particularly if companies building it see no value in maintaining it and nobody has incentives to jump in.

Vendor sustainability is questionable at best. I hear this most of the time, that those companies will be there in 20 years when the world turns upside down and you can always hunt them for fixes, support etc.

In practice, however, at least in my country, it doesn't happen. Vendors of course gamed the system.