Hacker News Reader

Comment by yazzku | Hacker News Reader

So will they help fund the projects now, or will they just express their opinions on how your unpaid work should be done?

View on HN

There is this little nugget:

“The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.”

Unless it specifies who this just means they'll throw a few billion to Teksystems, CGI or whoever and then say that it was a failure like HealthCare.gov

That spawned a lot of good things. Check out 18F and USDS.

There are special exceptions, but definitely not the norm.

Except for the change in acquisition and contracting behind the scenes that was driven by that colossal failure.

Have you noticed that the IRS website is accessible and searchable? That SBA is functional? Conpare that to, say, Department of Commerce, where things are a mess (currently).

The US realized it needed to pick things up a bit and, while it's still a hard space to work in, started to shift to a better playbook.

https://playbook.cio.gov/

Without the text of the bill should show up here eventually: https://www.congress.gov/bill/117th-congress/senate-bill/491...

There's no way to actually know. Everything not based on the text of the bill is pure speculation.

That’s really the question, isn’t it? The article makes it sound like hiring “open source devs” may be part of the strategy, which essentially amounts to anyone with a public GitHub repo.

No the people hired will be IBM consultants and such with long lists of meaningless qualifications and no GitHub profile.

No the people hired will be IBM consultants and such with long lists of meaningless qualifications and no MicroSoft profile.

Oh no, they’ll have all the Microsoft certifications too.

Do licenses like the GPL even apply to TLA like the NSA and CIA? Or could they just make patches for themselves and not release them?

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

where it gets really goofy is the US gov work doesn't have copyright itself, so wouldn't any work done by them be PD, regardless of the underlying license?

If they extend an existing GPL work, the work as a whole is GPL, even if their added code is PD.

My gut feeling is no, because the work is still a derivative work of a privately-owned copyrighted work, and private copyright does not dissolve when the government touches it. If you could separate the governments' code from the GPL code, then it would be automatically public domain, but the combination is still GPL.

However I'm not aware of any case law proving this.

My first instinct is that sovereign immunity applies. GPL is a license designed to protect the copyrights of the creator or copyright owner, but copyright itself is a privilege granted by the Federal government and protected by law. So if you sued them for violating the GPL, I’m fairly certain they could just claim sovereign immunity in court.

There is a comment about that up-thread:

https://news.ycombinator.com/item?id=32957861

When government agencies behave within the law, it is by coincidence, if not an accident which will soon be rectified.

GPL only requires you to provide source code when you provide an executable program. If their internal software isn't released outside the organization, then source code does not need to be either.

google famously used this clause and that was near twenty years ago.. things have evolved in GPL land

https://en.wikipedia.org/wiki/GNU_General_Public_License

Might depend on whether copyright applies to the agencies, since the GPL depends on copyright itself.

Yes. The US federal government has voluntarily relinquished their sovereign immunity and they can and often do get sued for copyright violations. Of course, given that the NSA/CIA have the luxury of classification, the resulting lawsuit will be even more complicated than a normal copyright lawsuit (which is already one of the most expensive and frustrating parts of law to litigate).

States are where you need to worry. Occasionally a state decides to pass a law[0] saying they can't be sued for certain copyright violations. Because of how the US constitution is set up, states (and nothing smaller than them) are allowed to just say they can't be sued, which lets them crime with impunity.

[0] https://www.npr.org/2020/03/24/820381016/in-blackbeard-pirat...

Don't worry about it. It's just code for 'government departments only get to use software from giant corps with well known and unpatched bugs now'.

Reply on news.ycombinator.com