NYC Councilman (and Open Source Developer) Submits Bill Establishing Open Source

NewYorkCountryLawyer (912032) writes "New York City Council Member Ben Kallos (KallosEsq), who also happens to be a Free and Open Source Software (FOSS) developer, just introduced legislation to mandate a government preference for FOSS and creating a Civic Commons website to facilitate collaborative purchasing of software. He argues that NYC could save millions of dollars with the Free and Open Source Software Preferences Act 2014, pointing out that the city currently has a $67 million Microsoft ELA. Kallos said: 'It is time for government to modernize and start appreciating the same cost savings as everyone else.'"

Comments

Well,

[NoNonAlphaCharsHere]

I guess we should be glad there are no Visual Basic programmers on the City Council.

I'd be satisfied with...

[YrWrstNtmr]

I'd be satisfied with a preference for whatever actually works for the given requirement, for the least amount of money. FOSS, proprietary, whatever.

Re:I'd be satisfied with...

[Ichijo]

Evaluate software not just on purchasing/licensing costs but also on the cost of installing the software, migrating old documents, and training users, and the time required to complete day-to-day tasks. Because sometimes FOSS is only free if your time is worth nothing.

And require open standards.

Re:I'd be satisfied with...

[oodaloop]

Sure. As long as the same is done with Windows. We went from XP to 7 and every edition of Office with no training. In those cases, we all taught ourselves and each other informally. I taught myself Ubuntu at home, so it can be done. Let's just compare apples to apples.

Re:I'd be satisfied with...

[Em Adespoton]

Also require that anything developed by the city staff itself be released as FOSS if at all possible. Evaluate all competing bits to ensure that they allow derivative works to be released as FOSS.

Because it's one thing to pay public money to a private org to get work done; it's quite another to pay public money to public servants and have the resulting product not be available to the public.

Re:I'd be satisfied with...

[swv3752]

About the only way to get open standards is to use FOSS. There are also benefits that will spur the local economy as proven with the recent story on Munich. Plenty of FOSS projects are best of class. It is not just about up front costs or installation and configuration. What are the ongoing support costs? For a given number of servers, it usually means more Windows admins that Unix/Linux admins. Unix/Linux can do more on given hardware than Windows. When Microsoft transitioned Hotmail from BSD to Windows Server, they had to more than double the amount of servers to achieve the same performance.

Plenty of Government uses FOSS- http://leeunderwood.org/linux/...
There are even more undocumented cases, but I am not at liberty to divulge that information.

Some Reasonable Arguments

[NotSanguine]

From the proposed amendment:

It is necessary for the functioning of the city that computer data owned by the city be permanently available to the city throughout its useful life. To guarantee the succession and permanence of public data, it is necessary that the city's accessibility to that data be independent of the goodwill of the city's computer system suppliers and the conditions imposed by these suppliers. It is in the public interest to ensure interoperability of computer systems through the use of software and products that promote open, platform-neutral standards. It is also in the public interest that the city be free, to the greatest extent possible, of conditions imposed by parties outside the city's control on how, and for how long, the city may use the software it has acquired. Finally, it is not in the public interest and it is a violation of the fundamental right to privacy for the city to use software that, in addition to its stated function, also transmits data to, or allows control and modification of its systems by, parties outside of the city's control.

I agree that we should use the right tool for the right job, but why should that exclude FOSS?

Re:Some Reasonable Arguments

[bmajik]

There are some great points in there

1) access to data without vendor approval/involvement.

2) interop

3) no "remote killswitch" on software

4) no strange privacy leaks

I think these are all fine requirements.

But it's not clear to me why closed software couldn't meet them.

For instance, how does Windows + Office not meet these requirements?

1) the Office XML formats are documented, open, and have reader/writer libraries on non-Microsoft platforms

2) As a result of the consent decree, and much subsequent engineering and doc work, its quite easy to interop with windows and office.

3) So far as I know, there are editions of Windows and Office that require no internet connection at all, and certainly have no provision for remote-kill.

4) Microsoft is actually pretty good about shutting off telemetry, either on a per user basis, or with centralized management tools -- because enterprise customers want this capability too.

Re:Some Reasonable Arguments

[garyebickford]

From my own experience, today, I would say that one way Office fails is that a document written in Open Document Format, which is a standard that MS has signed on to, could not be opened by my boss. I don't know the details in this particular case, but several times with my own work I've experienced a failure where the new MS "security features" prevent opening anything not produced by MS Office, or even by an earlier version of MS Office. I forget what it's called, but it required my to get an upgraded version of MS Office on a machine that was only used to work on one Excel file, one or two days per year.

And then there's Office Open XML, which is Microsoft's successful standardization ploy to prevent ODF to take hold. To my knowledge nobody has ever built a complete OOXML implementation, including Microsoft. And some of the rules in the "standard" are in the form, "do it like Excel 2007 does it." What the H___ does that mean? OOXML was nothing but a scam from the beginning, intended to defend MS against the thrust toward standardization. The classic methodology used in procurement is to define the desired product specification in such a way that only one vendor can meet it, and OOXML is a successful tool for that.

The councilman is right - all government documents _must_ be in a form that can be correctly opened, read, and if necessary edited, by future tools that may have no historical relation to Microsoft or any other present software vendor. Imagine if the land, birth, and death records of Britain from the 1200s were written in a script that nobody understood any more. That is what governments _must_ prevent.

Re:This is bullshit.

[Githaron]

I would argue that having any government move to open source is good for everyone. I don't know if it will be cheaper but I do think it will like give the people more bang for their buck. Instead of those dollars going into one person's pockets, they can not only still be used to solve the government's software problems but also provide software libraries and frameworks for other to bulid off of.

Re:This is bullshit.

[Jmc23]

So, you couldn't be bothered to read the one page and started on a rant that has nothing to do with what is trying to be accomplished eh?

Slashdotters shouldn't be paying with their time for you to push your agenda.

How About We Make it Mature?

[mx b]

Open standards is extremely important. I'd hate for all that data to be locked into Microsoft Excel format, or what have you.

While I agree that sometimes the FOSS is buggy or missing features, I do not think in this situation we should let that stop us. In fact, I would love to see NYC (and other cities across the country) agree to sponsor/contract a couple of developers each to work on whatever we need: data formatting and conversion, word processing, accounting, voting software, etc. In this way, while the FOSS is maybe not up to spec today, we can all work together on making it up to spec soon. In this way, we all pool resources, get it done correctly ONCE*, and enjoy the savings and philosophical warm and fuzzies.

(* yes I understand that long term we would probably need to continually hire developers on a contract basis to fix problems that come up, or add new features or support for new operating systems, etc., but generally speaking it would be much less impact on the budget long term -- though I also understand the political pressure currently to cut budgets rather than spend a little extra for a perk down the road.).

Re:How About We Make it Mature?

[mx b]

So instead of Microsoft (a dedicated software company), we would have a network of cities with a couple of developers in each working on an office suite? That's a horrible waste of resources, especially when we already have Microsoft Office which works fine for the most part. Look, I share the concern about open standards, but we have to also consider what is practical.

You are correct, if everyone made their own office suite, but that was not what I was proposing.

I instead would like a few local/state governments to COLLABORATE on the SAME FOSS office suite (and maybe not even a totally new one -- perhaps jump on board LibreOffice, Calligra, etc.) and make it up-to-par to the needs of government, rather than paying Microsoft for continually bloated office suites that push you more and more to their OneDrive and proprietary formats. Yes, there would be some up-front costs, but then everyone -- local governments, small business, whatever -- could benefit from a nice FOSS suite. It's a much more practical use of resources, as well as philosophically good (since government is keeping data in open and documented formats and software, supporting small business by hiring people to work on it, letting small business use the FOSS for free, etc.)

Consider incidentals

[l2718]

Taxpayers should not be paying for someone's pet cause ... Proper action would be to mandate the government to use the best software for the task at hand ... Let the technical merits decide.

I'm sorry, but while technical merits should be paramount, they are not the only consideration. Public contracting is not an exact science, and it is entirely appropriate to have non-technical considerations tip the scales in close cases. So while Free Software should not be mandatory, legislating a preference for it makes perfect sense.

Furthermore, there are considerations beyond the needs of a specific project and tender. Free Software has an externality: when the government (as a customer) requests modifications and improvements (and pays for them to be created), everyone benefits. For example, when my university has Blackboard Inc fix a bug (or improve the software) only Blackboard captures the value (when they sell their software to the next customre). If we were using Moodle, every other Moodle user would automatically benefit. Had we opted for Moodle, we'd also benefit from fixes made by other universities.

Re:Call it the hartbleed act

[rogoshen1]

dude. your argument is basically this : "hEartbleed was a serious bug in FOSS. therefore FOSS is bad". So periodically FOSS has a serious bug. okay.

I'm not even going to bother trying to reference all the recent events involving Adobe, MS, or Apple having quite serious bugs in their proprietary code.
A similar bug could have just as easily have happened to a closed source shop. As long as humans are writing the code, it's a possibility.

The thing is, companies with licensing revenue have every incentive in the world to machinate lock-in. And with lock-in comes higher prices, both for support and the software itself.

By all means use the best tool for the job, but retaining some optionality for the future is a valuable thing.

I'd rather keep the risk of another bug like heartbleed than deal with vendor lock-in, ever increasing licensing costs, compliance costs, potential BSA raids, and frequent zero day exploits. =/

QA

[jones_supa]

No, just no. The quality of OSS is too bad. Well, let's not say bad per se, but it varies a lot. What you win in software licensing costs, you lose in fighting all the bugs. Too many of your support calls will be wasting your time with silly glitches.

Re:QA

[dens]

This is certainly true for some software (GUI/UX-heavy sort of applications, in my experience). Linux kernel, Apache (and the whole LAPP/LAMP stack), FireFox/Chromium, etc. are all OSS (to some extent). Yes, I think Open/LibreOffice is FAR from competitive with Word -- so I guess I'm agreeing with you, it varies a lot; but I take issue with "the quality of OSS is too bad."

You're citing the same handful of great (yes, they are) OSS apps that most proponents of OSS do, but these, in my experience, are the exception, not the rule.

Re:This is bullshit.

[jc42]

Open source != free beer. In fact, being "gratis" is not a requirement for being open source. Open source is, amongst more familiar aspects, about stuff like accountability.

Indeed, and this is also an excellent example of where we can use the canonical /. automotive simile: There is a long tradition of government agencies (and some corporations) requiring that all purchased vehicles come with complete shop manuals. This is a direct parallel to requiring the source code for software. In both cases, such a requirement makes it possible for the purchasing organization to set up their own repair shop to fix the products when something fails. It also allows the purchaser to make their own mods to handle their special needs.

Many US states (and a good number of other countries) require that shop manuals be available for all vehicles sold in their jurisdiction, not just to the government. This is done to guarantee that independent auto shops can exist, and the vendor can't have a monopoly on repairs and spare parts. The same argument applies to software. With open source, you can hire local independent software contractors to debug (and/or extend) purchased software. Without this, both government agencies and private purchasers are at the mercy of the vendor when problems or special needs arise.

Of course, we can expect to hear from the usual corporate shills (paid or ideologically motivated ;-), pushing their usual misleading claims. But note that nobody much ever claims that open-source software is bug-free. The argument is that, when bugs are discovered, people not working for the vendor can study the code and fix the code. And they can also publicize bugs and fixes, unlike what happens all too often when dealing with secret, proprietary software. This also applies to both software and vehicles.

Re:Call it the hartbleed act

[DickBreath]

That argument works both ways. Microsoft has had some very serious security bugs. Therefore, using your logic, all Microsoft software should not now or ever again be trusted. Think Code Red and others. In 1999 on a fully patched NT box you could compromise it with regular HTTP requests to IIS by just using pathnames with dot-dot-backslash and then working your way down the WINDOWS System CMD.EXE and then using it to run TFTP.EXE which was a standard part of the install. You could make the server TFTP down a bad exe from your own server, and then a second carefully crafted Http request to CMD.EXE could execute it for you. Game over.

Microsoft then fixed this by not allowing IIS to accept the dot-dot-backslash business. But you could use percent-sign-hex characters to represent the dot-dot-backslash. Microsoft then fixed that in IIS, but the filesystem would still accept the percent-hex-code characters. So you could double-escape them to get the filesystem to walk you to the CMD.EXE. Eventually they got this right and it was fixed. But there were many other holes. And who's stupid idea was it to run a server process, basically with root privileges?

I could go on. Even recently there was a major IE vulnerability that affected current and past versions.

Heartbleed was one instance of a lapse in security.

Re:This is bullshit.

[TapeCutter]

Unless there's some shadowy "Open Source Developer" organization that I've never heard about.

Turn out the lights, I think he's on to us...