Hacker News Reader

Comment by ZeroGravitas | Hacker News Reader

Great advert for free and open source software.

As with dieselgate, this suggests you basically cannot trust anything containing software. Can't trust it to follow regulations. Can't trust it to do its job.

Can't trust the software. Can't trust the institutions that write the software.

All very "late stage capitalist software development".

View on HN

Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.

code escrow in general should be much more common.

An organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.

Compile the code yourself?

Right. Mandate that the software is delivered with CI pipeline running in the client's environment with 100% reproducible builds and verify checksums.

Implying that's an impossible obstacle. Reproducibility is a thing.

Make it so code needs to be reproducibly buildable. Only reproducibly buildable artifacts can be deployed on hardware. Document the whole process.

Doesn't mean it's not a step in the right direction. Any transparency is better than zero.

then you just need to bribe the code reviewer(s). open source is still the better answer, good luck bribing every member of the public who could potentially read public code.

That would work only on paper. The financial interests involved are huge.

All the more reason for governments to insist.

> can still require the manufacturers to privately submit to the government all code

I wonder if companies purchasing trains could put code disclosure in the purchase contract? I wonder if, in aggregate, train purchasers or car purchasers could fund an independent code storage vault and pay a small premium to fund that code vault organization?

In other words, if purchasers wanted this and valued this, they would demand it in purchase contracts and fund it.

I'm all for free and open source software, but what would you suggest here? That train operators will download code from the internet and install it on their trains?

Clearly not. A reasonable expectation might be though that if you want to sell your multi million pound products to a captive public sector, you have to publish all the source code and the means to build the binaries.

Yes. Once it's signed by somebody accredited to review it for safe train use.

Open source means just that - it doesn’t imply one sort of distribution mechanism over others.

The same way technical diagrams for roads, bridges and other public infrastructure are public.

In most OECD countries food needs to be labelled with a full list of ingredients.

Your GP can read scientific papers about the efficacy and risks of a new treatment.

(Yes, many papers are paywalled but that's irrelevant compared to secrecy)

It doesn't actually need to be open source. If they published binaries that would be enough to analyze.

Reply on news.ycombinator.com