Hacker News Reader

Comment by mch82 | Hacker News Reader

Stumbled upon this today and found it quite interesting that DoD now considers Open Source Software to be a subcategory of Commercial Software.

> As explained in detail below, nearly all OSS is “commercial computer software” as defined in US law and the Defense Federal Acquisition Regulation Supplement, and if it used unchanged (or with only minor changes), it is almost always COTS.

This should have the effect of making it easier to consider Open Source Software in make/buy trade studies.

View on HN

> This should have the effect of making it easier

the CIO's office of the DOD is saying that if you didn't consider open source alternatives you would be in violation of the FARs.

Wow! They are basically saying you must do so if you are the federal govt. or contractor.

In my experience as a contractor, most federal agencies are now preferring products that are built with open source software, and I think a big reason why is because realistically there’s only a handful of contracting firms big enough to fulfill a lot of these $100M+ IT contracts, and the systems need to be supported for many years, so it makes it much easier if the contractor that builds a system does so in a way that one of their competitors can come in and maintain it when the first company cuts corners to boost profits after a few years.

Open source also creates a better pathway to "organic" sustainment or emergency (I forget the term they actually use) sustainment.

In organic sustainment the system is maintained by government employees. In the emergency context, it's the ability of the government to sustain a system without needing to defer to contractors in extreme circumstances. Imagine an actual total war for the US, contract negotiations take months or years even for stupidly simple work (I'm pretty sure some systems spend more in contract negotiations than the entire rest of the system costs). Open source is an effective way to ensure the government has access to all or most of the data needed to assume responsibility for the work later on. Technically the government also purchases data rights, but that part of contracts is almost always fouled up in some subtle way that makes it near useless.

There are so many big government IT contracts that are saddled with products like MS-SQL or worse Oracle instead of postgresql or mariadb. Big multicore M$ hyper-V with per-core pricing and so on.

It's just terrible to see the $$$$$ wasted on "enterprise" stuff that isn't needed 99% of the time.

This has been the case since 2016 at least, I think.

It's been that way for a very long time, because it's based on the US definition of "commercial item".

I know that the 2009 DoD policy on OSS attachment 2 part 2 spwcifically states this. It said, “In almost all cases, OSS meets the definition of ‘commercial computer software’ and shall be given appropriate statutory preference in accordance with 10 USC 2377 (reference (b)) (see also FAR 2.101(b), 12.000, 12.101 (reference (c)); and DFARS 212.212, and 252.227-7014(a)(1) (reference (d))).” The most recent version of this policy says the same thing.

What software is not commercial?

Government software, public domain software

Isn't all public-domain software automatically open source though?

It is. But very rarely do people publish software under the public domain. Most are under conditional licenses like MIT/BSD/GPL.

I don't think that's a full subset. Can't a developer release a binary of their software or make it available as public domain SaaS, without it being any kind of open source?

You are right. I wasn't considering binaries released to the public domain. In that case the source is not available.

As for SaaS, what is in public domain? The output of the public server? There is no public domain software runnable or compilable by a third party.

True, but there is one major prominent exception: SQLite. The author of such programs as djbdns and qmail also eventually released those under the public domain, but SQLite is under that status while still being actively developed and widely used.

Not necessarily, it's possible that somebody could release a software binary as public domain, while keeping the code private.

It seems CC0 may have simplified this now. The issue used to be that software enters the public domain after copyright expires & different countries interpret that different ways, which can become complicated without an explicit license document.

“Using CC0 for Public Domain Software” https://creativecommons.org/2011/04/15/using-cc0-for-public-...

“CC0 FAQ” https://wiki.creativecommons.org/wiki/CC0_FAQ#May_I_apply_CC...

Public domain software would be considered “commercial” under the DoD’s definition.

It's not the DoD definition. It's the US definition. The DoD simply tries to make that clear, because thinking "open source is not commercial" is a common misunderstanding.

Commercial in this context is referring to "Commercial Off The Shelf" (COTS). Something that is available on the public market, rather than being produced specially for the government. Budgets, bids, etc. often specify whether something is or should be COTS.

> Obviously, software that does not meet the U.S. government’s definition of “commercial computer software” is not considered commercial software by the U.S. government’s acquisition processes. For example, software that is released to the public as OSS is not considered commercial if it is a type of software that is only used for governmental purposes. In contracts where this issue is important, you should examine the contract to find the specific definitions that are being used. But in practice, publicly-released OSS nearly always meets the various government definitions for “commercial computer software” – and thus is nearly always considered commercial software.

Reply on news.ycombinator.com