Peters and Hawley Introduce Bipartisan Bill to Help Secure Open Source Software

There is mandamus language that directs the DHS Director to "bolster the security of open source software", "support Federal efforts to strengthen the security of open source software", etc. but it's up to the director to determine the methods of doing so.

Forgive me if my bar is too low, but just to see bipartisan efforts at all toward this is a refreshing bright spot in American politics. Let's not make the perfect the enemy of the good.

I'd much rather they spent money hiring people to contribute to securing open source and doing outreach, rather than just some mandatory "software scanning" which generate noisy alerts no one does anything about.

Or neither. Just make a fund to hire talent to work all day hardening OSS projects. Rather than all the new mandatory meetings and oversight.

Today I learned that we have an Agency for Cybersecurity and Infrastructure Security: https://www.cisa.gov/

How about just looking at tax law to really juice that average...

From the perspective of politicians, bugs in the legal code are actually features. The incumbent power structure expends resources paying lawyers to find and exploit them, while the little people are mostly stuck following the law at face value. Most people don't even get to run the interpreter, but get forced into plea bargains and settlements instead! The imbalance helps perpetuate the status quo which lines the politicians' pockets.

Whereas bugs in computer software are problematic because they allow a new type of analyst to gain an outsized advantage, which upsets the status quo. Although the sharp contrast is slowly vanishing as full compromise bugs get rarer and the incumbent power structure employs more and more computer code analysts. For example, look at all of the security vulns in modern browsers and web protocols themselves that leak information to surveillance companies, but get downplayed as mere "privacy" problems that would be nice to fix some day perhaps.

There was at least one federal agency directly breached using it, so that’s probably part of it:

https://www.bleepingcomputer.com/news/security/us-govt-irani...

Agreed. Wyden is my senator so I may be a bit biased, but I'd want to see his involvement in something like this because he's pretty much the only senator that gets this stuff. Reading that blurb it seems kind of ambiguous - it could potentially lead to some bad places if people who don't understand the issues are writing the bill.

Right. Would be more helpful to view this as fraternizing with confederates, not bipartisanship. Anything Hawley touches is tainted by his role as an insurrectionist.