Hacker News Reader

Comment by postalrat | Hacker News Reader

The state I lived in developed one of those covid tracking apps. I asked for the source code and was told it wasn't available and would never be. I talked to people working on other software developed for the state and they all think that software shouldn't be public.

It seems crazy to me that taxpayers pay for this software but it doesn't belong to them.

Knowing what I do know I gotta wonder if it's just about those developers being ashamed how bad their software is and don't want others to see it.

View on HN

I was tangentially related to the covid app stuff so I can offer some insight there: most of those apps weren't built by the state. Google provided an open-source "base app" that could be customized by the states, but most states hired third-party contractors to build an app for them.

I've worked in public sector and this is typical. the states can't open source it because they don't own it, they just pay a third-party to build+operate it for them. This is touted as "small govt", but it really just makes things less efficient. The total number of people involved stays the same.

> but most states hired third-party contractors to build an app for them.

So the states paid the bills so can license the result any way they want.

How can they pay for something and not own it?

Sounds to me like there are deep corruption problems

> So the states paid the bills so can license the result any way they want. > > How can they pay for something and not own it?

Try buying a copy of Adobe Software[1], and then hosting the *.isos on your website. You paid for it, you should get to do it!

The short answer is, it costs more to buy 100% of the rights, and governments rarely do so.

[1] It'd have to be older Adobe Software, as modern Adobe Software is all monthly licenses, etc.

If I commissioned Adobe Software to write a program, from scratch, that I specifically state I will own all rights to the program and source code itself, then I would fully expect to license it how I want.

We are not talking about a single consumer. We are talking about the state itself. They will get the license they want if they believe it is needed.

Ironically the state is a single consumer and they ever sell only one copy of the program, so business case for proprietary software doesn't exist at all.

> They will get the license they want if they believe it is needed.

They will also use more tax-payers money to do so. I agree that the code should be public, but I can see why that isn't the case.

> it costs more to buy 100% of the rights

of course. But this idea assumes that the contractors are selling the same software to multiple agents. Is that really the case?

Or are the agents already charging the maximum they could for the software, and yet, retain the rights themselves in the hopes of whiteboxing this software in the future for some other gov't agency?

> Sounds to me like there are deep corruption problems

I consider this to be a flavor of corruption, too, but it isn't, legally. It is the desired outcome for many, and for many more, maybe not the outcome they wanted, but the logical outcome of what they asked for.

There has been a decades-long process in the US of pressuring governments to do less, to outsource more, to privatize, to move to "public-private partnerships" or whatever new buzzword means socialize losses and privatize profits.

And this is what you get - government that doesn't have the capabilities it needs to do what people ask of it. Which makes it look bad, which encourages another cycle of privatization...

If you want functional government, stop electing people who promise to break it.

Yes.

Corruption can be legal.

Like election/campaign financing in the USA

> How can they pay for something and not own it?

They license it.

Renting everything seems to be the fad in business management, and governments often ape business.

I don't see what corruption has to do with it. I'm a subcontractor and usually the contractual terms are dictated by my clients. If I get the chance however, I put forth my terms and these say that I'm the author of the code and thus the copyright holder.

When I've done freelance work and have been able to write the contract, I include a clause that the client receives "a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the work and such derivative works, and to sublicense any or all of the foregoing rights to third parties," effectively giving them unlimited rights to use my code how they please while still retaining my own copyright.

It's a good idea so you don't need to worry about accidentally copying some code from one project to another. If you weren't the owner, they could theoretically come after you for copyright violation.

Would that let them GPL or even MIT the code? It would seem so.

Indeed it would, I borrowed the phrasing from Microsoft's contributor license agreement.

This. I always make sure both sides share in the full rights to the work. Regardless of whether I am the one doing the programming or the one paying for it.

Public sector usually makes up the rules for itself and then upholds them in the software. Very little public sector software could be resold in the private sector without significant investment into making it more general, usually to the detriment of the product. The "multiple clients => lower price" thus holds no water, because it's always just different branches of government and the usual way it ends up is that after 10 years or so the product is still used in one place only and the original programmers long left the company. And public still pays for a yearly license.

Of course. I have some experience(though old and long ago) with communal and governmental ICT operations. But also "the other side" :-) We have a saying here which goes like Government money is stupid money, meaning the government is stupid and pays anything. Then you close shop, and start another. For another round of stupid government money. And it doesn't even blink if it sees your name again, why should it? It's another business entity.

From what I hear it has changed just a little bit, not much, though. It also depends on state and town.

Speaking for .de and North-Rhine-Westfalia from 1994 to 2001 here.

> How can they pay for something and not own it?

Have you ever purchases software? Any media, recorded performance, or book?

I don't mean to be rude here, but this question shows a complete lack of awareness of the problem space.

There are a number of contributing factors to why most government software is not open source, but here are some of my direct observations as a consultant to government departments, an employee of government departments, a purchaser of products and services at multiple corporations, and a manager of contract software development as an employee of a corporation, and the owner of small business.

1. Stakeholders building software, using either directly employed, or contracted resources, have a desire to develop the software for the lowest cost possible. Generally this means preferring buying over building for many cases, and building on commercial (paid, free, or open source) stacks that promise easier development and efficiency. This often results the project being encumbered by licenses that complicate the potential release of software as open source.

2. Many government initiated software development projects are done directly in pursuit of supporting legislation that is tightly bound to the jurisdiction of the legislation; even if the legislation is meant to ratify state/provincial, federal, international or other standards, laws, and regulations, there will be regional variations that require at minimum configuration, and most likely real code changes to meet requirements. This often results in software that is tightly coupled to a particular jurisdiction in terms of both legislation and regulations, but also in terms of the ecosystem the software is developed in. The encumbrances created by these couplings often have dependencies on closed and proprietary systems which is a great deal of friction for releasing open source projects.

3. Despite the passage of many international rules related to economic development agreements like the former NAFTA and the newer USMCA which provide provisions to allow fair competition for government contracts within the regions affected (and I believe EU and other trade blocs have similar legislation), the opportunity to award software development contracts to local firms (at any level of locality across municipal, state, and federal jurisdictions) is a strong temptation for politicians to curry favor with voters and business communities. This is often pitched as economic benefits by creating jobs locally, while bolstering local businesses and making them more competitive; if these projects are subsequently released as open source projects, the perception from decision makers is that the value of the investment in the local community is lost. This is where a significant opportunity for what you bill as corruption is identified - I haven't seen a procurement process in government that can't be subverted by suitably motivated buyers and sellers.

4. Releasing open source software can be a public relations nightmare - bug reports, public review and criticism of design or implementation choices generally land on the desks of whatever passes for a service desk for that jurisdiction, who are usually ill equipped to deal with these technical issues, and also are generally understaffed for their core responsibilities. Eventually those reports and criticisms make their way up through different paths and land on the desk of high level bureaucrats and elected officials, who then have to deal with these issues as public relations items. Have to deal with HeartBleed2022? If it's internally developed and open source, the buck stops with the politicians and how they let it happen, time for a public inquiry! If it's an off the shelf product, "We are disabling the service until a patch becomes available." [1, specifically log4j] , and people can grumble about purchasing choices, but it's much harder to criticize the actual implementation.

Alot of folks in government (including me when I was there) wanted to release our stuff as OSS, but there is only so far you can go with opensourcing modules that depend on SAP code, IBM code, or systems that are supplied by the federal government.

[1] https://www.canada.ca/en/revenue-agency/services/e-services/...

I have read your long comment and I'm less than convinced by any of your arguments.

Specifically, I would say that number three is mostly false. The companies that receive those contracts are not, at least in my experience, small local shops (and there is an argument that they should be), but instead big consulting companies that know the correct people and procedures.

>>"Alot of folks in government (including me when I was there) wanted to release our stuff as OSS, but there is only so far you can go with opensourcing modules that depend on SAP code, IBM code, or systems that are supplied by the federal government"

The point of the endeavor is precisely to change that.

> Specifically, I would say that number three is mostly false. The companies that receive those contracts are not, at least in my experience, small local shops (and there is an argument that they should be), but instead big consulting companies that know the correct people and procedures.

Define small local shops? I have worked on procurement processes in the United States at the municipal, state, and federal level, but my experience is largely based in the Canadian market. These are companies that have 100-1000 employees, working on technologies tightly scoped to specific municipal, state/provincial programs, and in some cases Federal programs. Some industries include prisons, agricultural programs, energy programs (hydro-electric, oil, gas, nuclear), and a broad cross section of infrastructure projects.

You can disagree or be unconvinced, but even a basic google search highlights the significant issues with procurement, and the fact that we have old and current laws on the books to address these concerns is evidence enough that procurement practices and influence from politicians and industry need regulation.

Simply put, procurement is about finding the right proposition for governments, and demonstrating to taxpayers that they are getting best value, while rewarding the individuals and industries that supported the elected officials and beaurocrats. This isn't a personal opinion, it's well supported by documentation in the industry.

> The point of the endeavor is precisely to change that.

I 100% agree, and I avidly support these kinds of initiatives; my comment didn't discount that, it was an explanation of why public code, developed internally, or by contractors, isn't necessarily suitable for open source release. Not all of the reasons are technical or legal, some are due to organizational or social pressure.

> How can they pay for something and not own it?

Cloud SAAS e.g. Salesforce apps

There are lots of things you pay for that you don't own.

> How can they pay for something and not own it?

Actually, quite easily, and it's cheaper that way (especially if they pay to acquire it, and it wasn't exclusively developed for them.)

Which is also why they would do that.

> This is touted as "small govt"

Small government doesn’t have anything to do with outsourcing functions. Small government is about not doing those things to begin with.

There is definitely a case to be made for a government, big or small, tracking a pandemic. I’m not arguing it shouldn’t. Outsourcing that function to a contractor, however, does not “shrink” the role of government.

Right, that's what I'm trying to say. As another commenter put it,

> Govt doing the same things but having them done by contractors does not make it "smaller".

There's a crucial distinction between "privatization of govt" and "smaller govt" which usually gets lost in the public discourse.

Small government is absolutely the pretense.

The contracts go to software/it services companies that are connected at the state government level. WWT comes to mind.

Uhhh the Italian app wasn't developed by the state either, but the government acquired and open-sourced most (all?) of the code [1]. It's not that hard really.

[1] https://github.com/orgs/immuni-app

Contract software development is nearly always work-for-hire. To not own the result of what is in common practice work-for-hire is terrible contract management. Imagine a road paving company claiming the state doesn't own the road they just paved.

I think it's called a toll road. Around me they are owned by some French company.

Government outsourcing is the new patronage. And it has the advantage that you can focus the benefits directly to your powerful supporters and from the contractor's side, it gives them a line into government funding that doesn't get cut off as easily if their guy gets voted out as old-style patronage jobs did.

The problem is that most people confuse „small government“ with „small society“. I want the smallest government possible, but strong institutions outside of the governments direct controls and even stronger individuals. Open sourcing governmental software makes the government smaller compared to private institutions and individuals, because it puts them in the position to criticize the gov and compete with it in a meritocratic way.

Third parties can build/operate open-source software.

> This is touted as "small govt", but it really just makes things less efficient. The total number of people involved stays the same.

Maybe I'm reading this wrong, but are you suggesting big government is more efficient than small government? If so I wonder if there are some good examples of that, because previously I wasn't aware anyone would ever argue that could be the case.

In this case, yes the OPs argument is "small" gvt is less efficient. Except what the OP considers small government isn't actually small government. As far as efficiency goes. It depends. If you are a business you can do something in house or outsource it. Which is more efficient? If what needs to be done is a one of thing and neither party has the expertise then out sourcing is less efficient. As the amount of work that needs to be done is the same plus there is the additional overhead of the contract. The thing is, there was other variables that come into play, so it is difficult to say which way is better.

But small vs big government isn't really about the number of employees but rather what the government does.

The way I'm reading it, no, that's not what they're saying. Govt doing the same things but having them done by contractors does not make it "smaller".

right, this is what I meant. Running a covid tracing app requires a certain number of people. Splitting those people into "govt employees" and "contractors" doesn't reduce the number of people involved, it just adds an arbitrary boundary between them, which hinders their efficiency.

> Splitting those people into "govt employees" and "contractors" doesn't reduce the number of people involved.

It increases it, because (even optimally) you need the same number of people doing the main work, and as supervisors, HR support, etc., for the main workers, plus you have additional contracting and contract management overhead on both sides.

Small government has always been about business being able to make money doing outsourced big gov tasks. Look at who seeded that debate, it's big capital funded thinktanks.

> This is touted as "small govt", but it really just makes things less efficient.

You could say these exact words about the vast majority of PPP (public-private partnerships).

Private sector efficiency was the PPP sales pitch. Extracting rents is always the goal.

My most recent job was for a local government, and even though I made a push for open sourcing our code, I never made much headway. Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file, so it could have been a bit disastrous if my efforts had actually made any headway

> Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file

Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?

>Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?

Because most local governments are 10 to 20 years behind on anything remotely approaching best practices. It wasn't my choice to run things that way.

If it's hard enough for to tech companies to hire skilled developers, I can only imagine what the bar is for public work. They might even resort to hire some brain damaged people.

Here in Australia, only citizens can work for the Commonwealth (federal) government. The end result is that, due to a lack of competition from immigrants, the public sector is basically just a jobs program for those too incompetent to work in the private sector.

The same thing happens in the US with any jobs requiring security clearance.

I'm not surprised. Even great devs sometimes slip up and when you have enough people, someone is always slipping up. The only real solution IMO is to have safeguards in place like credential scanning (ideally both locally and on the server). It's not foolproof, but it can help avoid or minimize a lot of incidents.

The German version is at https://github.com/corona-warn-app.

It was expensive (18 million Euros I believe, but may be wrong). But other than that, it was excellent from start to finish. First release a few weeks after the API was available. The source was divided into logical components of more or less perfect size, it was straightforward, well commented, responsive to PRs, worked, and had no security issues as far as I remember.

And there is even a fork on F-Droid that works without google framework only requiring microg, working on older devices, and having some minor additional features: https://f-droid.org/packages/de.corona.tracing/

So much this. I am not one to be proud of the place i happened to be born but this effort gave me some hope for the gov software sector.

Hrm. Why tee eff shops downtown insisted on that Luca thing with Smudos blessing instead? PR? Federalism? Panic? Incompetence?

besides the three you named: lobbying and corruption i think

Switzerland did make it public on Github

https://github.com/admin-ch/CovidCertificate-App-Android

There is even a section "Reproducible builds"

I've worked on some government projects (currently working on one), and we always try to open source everything we can. For instance, CMS has a lot of open source repos in their github org (https://github.com/CMSgov).

The mentality is changing in govtech and there are lots of orgs really trying to push for better software practices. It can be a slog though.

I don't know if it exists for where you live, but you might be able to make use of a public information law (FOIA-like)

I'm stunned that I had never thought to use a FOIA request for source code until seeing your comment. This is very tempting.

From a very experienced FOIA litigator, most of the time your FOIA request will be denied and then you'll have to sue to get the records. Typical time for these cases is 2-4 years of court appearances in trial court, then another 2 years in appellate court to get a favorable decision.

A buddy of mine just won one that finally set the precedent that database schemas are not security:

https://twitter.com/foiachap/status/1215388081378988039

You might be able to use this website. I've always wanted to use it, but haven't come up with something "interesting enough" to submit a request for:

https://www.muckrock.com/foi/

It helps you with the process of FOIA requests, and if/when granted, hosts the responses online publicly.

Also, once you finally get the zip file of source it will be a giant mess that doesn’t have build scripts, nor documentation, etc.

So you’ll win, but won’t get want you want- a way to view, understand, improve, and share.

Or you'll find its just a mess of hundreds of off-the-shelf components glued together, none of which the government has the source code for :(

So basically you're right - you'll get an unbuildable clusterfuck.

I work in government (partially improving our use and creation of free and open source software) and I think there are a few different psychologies:

1) there are people who understand f/oss. Sometimes they are in power and choose it for the projects they oversee. This is small, but growing slowly. 2) there are people who don’t understand and the default is to do what their contractor says. This is huge and probably stable. 3) there are people who understand and don’t like it because of the lack of formal support and the chaos and perceived unpredictability. This is the “buy Microsoft/IBM and they will support you” group. This is large but shrinking a little. 4) there are contractors who don’t want the risk to their contracts being renewed from competitors seeing their code and being able to support. Obviously no feds in this group, but lots of feds are influenced by their contractor and take on their position. This irks me the most because its acting in the contractors benefit to the government’s detriment. I don’t understand how people in oversight positions take this position in good faith. 5) there are contractors who have IP and want to resell or reconfigure for multiple clients and would raise their bid price if they had to release under f/oss. Again, not feds, but this is a perceived fear of people with set budgets who want to get best value and their incumbent contractors are saying it’s more expensive if they have to do f/oss.

I’m probably missing some of the tech workers. But I think the biggest blocker is contractors as probably 95% of actual hands on work is done by contractors. Some perpetual who have been in place for decades. Even when the companies change, the individuals stay the same.

Open sourcing code safely also isn’t free. So unless something was developed in the open from the outset, I doubt it ever will become open source (unless mandated by law).

The Italian version is fully public, and it was made by a third party which offered to do it free of charge.

https://github.com/immuni-app

I’m having trouble understanding why anybody would expect that to be the case.

I have, for example, built things for government in the past. They paid for some code that I wrote and now they can use it as they like. But, (as with any client), they don’t have the right to turn around and give it to you.

If you want that code, I’m happy to sell it to you. But, again, you’re not allowed to sell it on or give it away.

Because that’s how software consulting works.

I'm not understanding what you said, do you mean you had built the code before and you licensed it to the government, or in the contract you wrote to the government you specified that you owned the code that you were delivering, every time I've written code for people who've paid me on a project basis they can do what they want with the code afterwards, including give it away.

You could certainly ask for the right to redistribute the code when we were negotiating the contract. But that would get you a much larger quote since now you wouldn’t just be buying the software, you’d also have to be paying for every potential future sale of something similar.

I can’t imagine that the government (or anybody really) would do that.

I suppose it depends on the market. I have been involved in a number of contracts to develop bespoke software for big private sector companies. Twenty years ago they were happy to just buy usage rights, but since then the customers have grown wiser to their leverage and keep insisting that if they pay for the development work, they get to keep the rights to the results. It's different if the vendor already has IP that can be licensed to the customer to substantially reduce the development cost of the bespoke solution.

Define “belong”.

This is the kind of issue that causes all that government bloat...

If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens.

One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway

Also true, in an ideal world, the software should be free from such vulnerabilities.

However security by obscurity is a layer of defense... And there might be other controls in place too to help.. e.g. a git repo behind SSO...

If I accidentally check in a CSV of a data dump, or my access Keys, etc... It doesn't immediately become a data leak/issue.. I have at least some time to reconcile that.. but if the repo is publicly accessible, the moment it hits the wire someone can copy that data...

One might follow up: "Well, they should not make the code if they are not competent enough to write it and host it"

Would be nice as well! But sadly there is only so many developers that can do this kind of work with a very high level of security and competence... By requiring governments to make this code freely available, you could basically assume two outcomes: nothing the government has on you will be secret, including sealed records and private information. In addition, IT workers would be paid 7-figures with 5-10 years of experience, as every government project that touches software now needs 5+ highly trained workers to avoid gigantic lawsuits.. and no one could get an entry level job in government because one bad commit could cause an 8-figure lawsuit

And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

> And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

If they give you a tank they have one less tank to do stuff with but if they give you a copy of software they still have the ability to do stuff with the software.

There’s a whole bunch of software out there that has been open sourced by government agencies like nasa and you don’t see satellites falling out of the sky on a regular basis.

I'm not in software so maybe my viewpoint is just different but I also wouldn't expect NASA to give me the mechanical blueprints for a rocket, or even a concrete launch pad nor would I expect the local government to give me the the electrical schematics for the stop light systems, even though doing so would in no way prevent them from continuing to use these systems/items

Honestly, why not? It's quite likely there has been a decent amount of information passing back and forth between NASA and various private space companies - there isn't a sane reason to require everyone to make the same mistakes that you've already learned from. Additionally while releasing rocket specifications probably won't result in any at-scale replicas it's a good way to feed the hobbiest community and possibly get some neat ideas back.

There are some components of rocketry that deserve careful consideration in sharing (i.e. rocket fuels) but a lot of those have mostly leaked at this point and the government has other reasons to limit their production and thus limits the supply of chemical components.

Much like with software there are going to be some secret components related to communication and the like - but those can be cherry picked from the information and deliberately hidden... similar to how most software teams don't check all their private SSH keys into public repos (usually).

I agree with you and would love more "real world" things to be open source. I do like the ethos within software/tech that things are open-sourced often. It doesn't exist to nearly the same degree in many other "physical world" type industries.

I think government/ bureaucracy moves slowly and most people working within them don't come from a software background so a lot of the older norms of not sharing things (outside of things like data/documents) is just the way things are done. I expect to a lot of these people sharing a source code is treated exactly the same as sharing any other mechanical designs which they just often don't do.

Hopefully both things will change.

I expect the rocket plans. Why the fuck wouldn't you expect the rocket plans? Unfortunately, letting companies own plans they were contracted to develop is actually a form of payment to those companies. GE's entire best-in-class commercial jet engine line was built from military blueprints they own and control but who's design was fully funded by the American people. This is bragged about openly within the company.

Elon had to go to Russia to get rocket plans. We have truly dropped the ball on this.

> However security by obscurity is a layer of defense...

In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense.

Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference?

I could write any government app or software but it would be a slow process, it would be hostile to further development and the security of it would be laughable. But from the GUI you wouldn't notice the difference. Mine might actually be nicer.

I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH?

I hoped by saying "a layer of defense" indicated that there was more layers

The developer is the attack vector. We give him some hand money, put a gun to his head and instruct him to make a backdoor.

The price increase required by the higher quality of software is roughly a fixed factor. The benefits that come from code reuse are exponential.

If a government can't afford to release the sources in public right away, a gradual transition is possible: vendors that offer open source software have their prices multiplied by 0.1 during bidding. And this factor of preference for open source can be increased or decreased state-wide depending on the budget.

> However security by obscurity is a layer of defense...

It's not: https://en.wikipedia.org/wiki/Security_through_obscurity#Cri....

> Security by obscurity alone is discouraged and not recommended by standards bodies

A layer, not the only layer.

> System security should not depend on the secrecy of the implementation or its components.

It is not depending on it. It is just an additional layer to delay or reduce impact.

This was the proposed scenario that the GP put forward:

> If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens.

Which doesn't seem to suggest any mitigation other than the lack of published source code.

My post was already very long, didn't want to tangent into possible defenses which depend heavily on what exactly is in the code base...

Using log4jail as a recent example, I had a code base vulnerable to this attack, but it would not be expected that the application used a vulnerable version (we forked the popular code base), and it only was vulnerable in a specific way (which, to this day, no one has attempted to explot, as I have an alarm set up if that kind of input comes in in logs, and previously had the block at the WAF when we were vulnerable for the 4 hours it took to fix the issue.

Security by obscurity is not I good defense, it's a single layer, which buys you time. You need to have multiple layers of defense, and closed source might buy your team time to fix issues.. or make it viable to release the application while a third party takes a year on a security audit.

I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens

So that's why no governments run Linux servers, right? After all, the Linux kernel is open source.

And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

And just to throw in some silly pedantry, the M109 is a self-propelled howitzer, not a tank. :)

I have spent a lot of time in public sector IT and I’ve rarely seen a management or information security team that didn't subscribe to this kind of security through obscurity thinking for internal code, including the management teams that were completely behind using open source code for cost, robustness, and avoiding vendor risk.

I find it bizarre that anyone familiar with software development would think this is a good idea.

I mean if gov't creates a useful API (eg. weather), or creates some reusable useful module (eg. something like hibernate), that would be nice. But, just generally publishing everything? REALLY BAD IDEA.

Sort of like too much information being "dangerous" and leading believers astray?

Reply on news.ycombinator.com