Switzerland mandates all software developed for the government be open sourced
Switzerland mandates software source code disclosure for public sector: A legal milestone
Open Source code for Science/Mathematics/Medicinal related fields 👍
Open Source code for Security/Social Media/Psychological related fields 👎
Security shouldn’t be based on ofuscation but on a good cryptographic algorithm concept.
Remember when Apple was demanded to give their cryptographic key to the government to unlock “”“terrorists’ phones”“”
Cryptography is in state of quantum uncertainty here
Now there is some common sense.
This makes me curious in the US on whether or not government app source code would be provided via a FOIA request.
You’d think so, but the answer is no. They’ve employed companies like Microsoft, Oracle, etc. to write up the security handbooks that says proprietary software is more secure. Heck, even electronic voting systems in the US is closed-source.
Security by obscurity the 100% least effective security measure! Wait what? MS left the government knowingly vulnerable for years for the shareholders?! That’s some good security right there!
I don’t agree with the generalization here. Sure, it is generally advisable not to rely on security through obscurity, but depending on the use-cases and purpose it can be effective.
I dislike DRM systems with a passion, but they, especially those for video games like denuvo, can be quite effective, if the purpose is to protect against copying something for a short time until it gets cracked.
Otherwise I agree that software developed in the open is intrinsically more secure, because it can be verified by everyone.
However, many business and governments like to have support contracts so want to be able to sue and blame someone else than themselves if something goes wrong. This is in most cases easier with closed source products with a specific legal entity behind it, not a vague and loose developer community or even just a single developer.
However, many business and governments like to have support contracts
What i don’t get is that governments can have their own in-house IT and can moderately large companies and up, so why the blame-shifting game?
If i’m a customer and your software blows up in my face i will not care that It’s not our fault, it’s our contractors.
They don’t care about what their customers think. It’s about criminal and civil liability.
Heck, even electronic voting systems in the US is closed-source.
How can elections even be trusted to be fair in that case?
Simply, you can’t. I’m personally all for an open source alternative for electronic voting. I can bank online, but not vote online. I’d trust an open source online voting platform more than I’d trust poll workers to not skew some votes. I’d also like to be able to track my vote and ensure it was cast for the person I voted for.
Banking is completely different from voting from a security point of view. None of the parties in a bank transaction are anonymous, and there are numerous ways to retry or roll back a transaction. Computerized voting is more like crypto currency. 😝
Computerized voting is more like crypto currency. 😝
Like it, but worse
Biggest vulnreability for online voting stands behind voter
you can’t have secret ballot and have a secure, auditible online vote. One of the problems of social media is it has created enemy lists for authoritarian states.
You kind of can. Depends how fully auditable you want, but you can have cryptographically anonymized entries, that (I believe?) could even allow the original voter to track their vote, without enabling anyone else to track the vote back to the voter.
It’s a different project, but GNU Taler have some interesting work on anonymized but not forgeable money transactions.
The issue with online voting, no matter what you do, is that someone can force you under threat of violence to vote for a specific candidate, and watch to make sure you do it. Complete privacy in the voting booth is paramount to ensuring that everyone can vote freely.
I think we’re well past the open/closed discussion when hackers have repeatedly shown how easy it is to compromise the voting machines.
We know they’re trash, it’s not theory.
By claiming that everyone who do not trust is
communisttrumpist
Short version: no
Long version: I’m pretty sure; no. I believe that; tools used like apps would not be subject to FOIA.
I deal with public records requests at work… email, documents etc. sure thing, but I’m pretty sure that the AG would laugh at you requesting the source code for apps we use.
—- I could only wish that we were mandated to use only open source software
Generally, works of the US government are public domain.
However, most apps are produced on contract with development companies, and I expect the contract specifies that the rights remain with the developer.
They explicitly do not, at least with every US federal contract I’ve ever seen. The govt owns the code that is written full stop.
As someone who works with and knows several military contractors, I’ve never heard of the US taking ownership of any code written. In fact, most of what they’re paying for is for companies to extend software they’ve already written to better fit the governments use case, such that even if the government owned the new improvements, that code wouldn’t function without the base application that pre-dates a government contract.
It depends on the software and situation of course, but if you are paying a contractor to develop/write a solution for you aka “government built” then the contractor that writes the code owns 0 of that code. It’s as if it was written by Uncle Sam himself.
Now, if the government buys software (licenses), the companies will retain ownership of their code. So if Uncle Sam bought Service Now licenses, the US doesn’t “own” service now. If service now extended capability to support the govt, the US still doesn’t own the license or that code in most cases.
Sometimes the government will even pay for a company to extend its software and that company can then sell that feature elsewhere. The government doesn’t get any benefit beyond the capability they paid for–ie they don’t own that code. That can work to the governments benefit though, because it can be used as a price negotiation point. “we know you can sell this feature to 50 different agencies if you develop it for us, so we only want to pay 25% of what you priced it at”.
But like it said, if it’s a development contract and the contractors build an app for the government, all of the contracts I’ve ever seen, have Uncle Sam owning it all. The govt could open source it if they wanted and the contractor would have no say.
That’s what we call GOTS products https://en.m.wikipedia.org/wiki/Government_off-the-shelf#:~:text=Government off-the-shelf (,for%20which%20it%20is%20created.
Vs COTS:
https://en.m.wikipedia.org/wiki/Commercial_off-the-shelf
With COTS, that’s where you’d see the ownership (depending on the contract/license agreement of course) remain with the vendor.
Open source will always be the best option, especially with a government supporting it! Imagine what government funding could do to accelerate improvements to Linux
Russia does some of it, probably most countries in EU and China do it.
If only other non-podunk countries would follow suit.
Is Switzerland podunk now?
Is their Microsoft deal about to expire?
This is the way it should be. Governments around the world have spent decades enriching big tech with public money, when they could have pooled their resources and built FOSS software that benefited everyone.
Same goes for science and everything else funded by tax payers.
That’s fucking amazing
Public money, public code!
IMO this should be the case for everything developed using public money, looking at you, pharmaceutical companies…
The issue becomes when things are developed with a mix of public and private money. I’m not saying we shouldn’t tackle the issue, only that it can’t be as simple as public money = public resource. If that were true, nearly all of us would be required to work for free, since we got the majority of our education through public funding.
Edit: It seems everyone ignored the generalization I was replying to. Yes, in terms of code it’s actually relatively easy to require that a publicity funded project be open source and leave it at that. The business can decide if they want to write everything from scratch to protect their IP or if they want to open up existing code as a part of fulfilling/winning the contact.
In terms of other partially government funded projects, like the pharmaceutical example given, it’s much more difficult to say how much of the process and result are thanks to public funding. That’s really the only point I was trying to make, that it can get very hard to draw the line. With code, it can be relatively easy.
You can still pay people to write public code, though. Just because you can use it for free doesn’t mean it always has to be written for free. In some cases, sure, it can make more sense to have it for free if it’s a fully non-profit volunteer-run project, but that is not the only way to write open-source software. Talented developers are still talented, open-source or not.
govts print infinite money. All of us are working for free. Their fiat is credits for the company store.
If you think funding projects is bad then the response is to support lobbying project owners to put in malware until FOSS is publically funded.
All we have to do is verbally support it. And cheerlead when it occurs. We don’t actually have to actively do it. It’s a threat which is done in politics all the time.
If governments could print infinite money they would just pay themselves an infinite salary.
Your fundamentals of economics is broken.
There’s the difference between individual knowledge (company training) and code licenses though.
Maybe this lazy private money should get a real job if it wants to pay for things to profit off of.
I don’t think anyone intends public funds to be quite that sticky; public education is itself a public good, and having once attended a public school really has nothing to do with developing a product 20 years down the road.
Also, writing open source code can support a viable business. Not every example has been successful, and some have been sold to hypercapitalist owners who wanted to extract more profit, others have failed to keep up, but Canonical is doing alright with it, Red Hat did for a long time, among others. Plenty of bigger tech companies also employ people to write open source software, despite it not being the company’s main business, React, PyTorch, TensorFlow, and so many other projects. Those engineers definitely aren’t working for free.
This almost pleases RMS
But it will be written in Schwiizerdütch, so no one outside of Switzerland will understand it. I think it’s a dialect of Perl.
They’ll do with Swiss dialect of Lisp with grüezi instead of define.
Your joke aside, which I thought was funny did remind me that as it happens, the Swiss do an amazing job in making things internationally accessible.
Take for example their spectrum management system that not only allows you to search for categories of users, handles kHz to MHz data entry, gives access to the legal provisions and then the legislation itself, does so in four languages.
This doesn’t seem like a big deal?
The fact the code is open sourced is much less significant than the fact now the Swiss government will need to negotiate complete ownership of any software they commission.
That’s going to make things more expensive for them, and limit the vendors prepared to work with them.
Their systems, their call 🤷♂️
At least for ASTRA, for software developed in their projects that’s already the case. Frameworks etc. used are not covered, but all source code for PLC and SCADA are theirs and you’re required to hand over all code as part of documentation at the end. As a zip on a USB key, never to be looked at again.
Wtf is even “ASTRA”
https://www.astra.admin.ch/astra/de/home.html
The English abbreviation is in fact FEDRO.
the fact now the Swiss government will need to negotiate complete ownership of any software they commission.
I can’t find it
No, that is counter intuitive. It may appear more expensive at first, but on the long run it is a lot more cheaper. It avoid vendor lock-in, recurring increase of dev costs and licensing and lots of other plagues of closed proprietary development like blackbox development and justification of hidden complexity as a driving factor on costs. I worked with legacy closed proprietary sw development and lock-in combined with legacy complexity made man-hour costs exorbitant. These are partially solved by open-sourcing, as kicking out a team and putting a new one is easier, but most importantly transparency as a driving factor on quality of development.
Hopefully more governments will follow this. At the very least, the taxpayer should have the right for whatever software’s source code that it funds development.
Wwwaiiiiiittt… So does this mean OS too? Is an entire country switching to the dark side? Linux, I mean Linux
“Windows wasn’t developed for the Swiss government, it was developed for the general public and we adopted it off the shelf.”
Found the Swiss, can’t even take a joke¡
the right side
Together monkey strong!!
“unless precluded by third-party rights or security concerns”, so this bill does nothing
-
I imagine that the company would have the burden of proof that any of these criteria are fulfilled.
-
Third-party rights most likely refers to the use of third-party libraries, where the source code for those isn’t open source, and therefore can’t be disclosed, since they aren’t part of the government contract. Security concerns are probably things along the line of “Making this code open source would disclose classified information about our military capabilities” and such.
Switzerland are very good bureaucracy and I trust that they know how to make policies that actually stick.
It is written like that, so that MS 365 still can be used. Some worker here go literally crazy, if they have to work with alternatives to MS 365…
While there might be some truth to that, I don’t think MS 365 would qualify as “developed for the government.”
Ah, i see… The „Security“ is used for the digital ID that is coming. Sadly, the part about Security of the ID is closed source to be “secure”. Someone has to teach them that security through # obscurity is no security…
This is not what the law is about. They can use closed sourced software just fine.
This is a law about software developed for the Schweiz government. If they needed a new CRM system or database system for medical records, it would be open source.
And they can use Outlook to inform everyone about it without problem.
-
It does one thing: make every contract have a clause specifically to combat this…
I still think a good chunk of the code will be visible. You can have all the code up to the point where you call the proprietary function. Obviously you won’t get to see what’s inside that function but you can guess. Also, a lot of proprietary libraries have that functionality really well documented.
