Slashdot Mirror


Should All Government IT Systems Be Using Open Source Software? (linuxjournal.com)

Writing at Linux Journal, Glyn Moody reports that dozens of government IT systems are switching to open source software.

"The fact that this approach is not already the norm is something of a failure on the part of the Free Software community..." One factor driving this uptake by innovative government departments is the potential to cut costs by avoiding constant upgrade fees. But it's important not to overstate the "free as in beer" element here. All major software projects have associated costs of implementation and support. Departments choosing free software simply because they believe it will save lots of money in obvious ways are likely to be disappointed, and that will be bad for open source's reputation and future projects.

Arguably as important as any cost savings is the use of open standards. This ensures that there is no lock-in to a proprietary solution, and it makes the long-term access and preservation of files much easier. For governments with a broader responsibility to society than simply saving money, that should be a key consideration, even if it hasn't been in the past.... Another is transparency. Recently it emerged that Microsoft has been gathering personal information from 300,000 government users of Microsoft Office ProPlus in the Netherlands, without permission and without documentation.

He includes an inspiring quote from the Free Software Foundation Europe about code produced by the government: "If it is public money, it should be public code as well. But when it comes to the larger issue about the general usage of proprietary vs. non-proprietary software -- what do Slashdot's readers think?

Should all government IT systems be using open source software?

105 of 206 comments (clear)

  1. sometimes by Anonymous Coward · · Score: 1

    "Should All Government IT Systems Be Using Open Source Software? " where it makes sense sure. The primary thing I want government to do is spend intelligently, Open Source is definitely part of that, but don't use open source just because it is open source. I would rather them buy what is most efficient as the primary factor as those public servants are the costly inefficient piece and anything that makes there job slower is really bad for all of us.

    1. Re:sometimes by Anonymous Coward · · Score: 5, Insightful

      The problem is that government systems tend to handle all kinds of really important information, and proprietary vendors have shown over the years over and over again that they simply are not trustworthy, and that the people responsible are not up to par WRT keeping them safeguarded.

      Evidence? The massive hits by ransomware against various types of government agencies ranging from the NHS to the Alaskan administration, the latter I believe got hit so bad they were considering reverting to typewriters. And this is just the tip of the iceberg of the continual data leakage we never get to hear about.

      Making sure the systems run on verifiable code were you don't have to trust external parties should be the starting point for every state run system. That would be intelligent spending. The government has a lot of information on all of us, and by collecting it it also collects the responsibility to protect it. Something which just isn't possible with proprietary software, Microsoft's latest offerings in particular.

    2. Re:sometimes by mrvan · · Score: 5, Insightful

      I see the same in higher education. There's a number of things we all need (like an electronic learning environment) but we buy it from vendors like Canvas or Blackboard, which is expensive and inflexible. Same for grading systems, scheduling, course guides, human resource, etc.

      I think we should have moved to a cooperative structure for these things long ago and all pay into a group that develops the software and then releases it open source. Since this can be decided at the university system level there's less risk of freeriding, and since universities employ a lot of smart people who like tinkering there will be a lot of community contributions.

    3. Re:sometimes by Anonymous Coward · · Score: 2, Insightful

      You don't have to trust an open source project, especially not when you have the resources of a national state behind you. It's all out there in the open, you don't have to take anyone's word for anything. All it takes is the actual will to shore things up.

      Nobody said you should use any open source project for anything without vetting it. Remember, we're talking about governments here, different ballpark.

    4. Re:sometimes by Anonymous Coward · · Score: 1

      With the hundreds of billions of dollars available to the US government every year I'm rather surprised they haven't just developed their own OS from the ground up. Something that keeps everything locked down while having an easy to learn interface for the average worker.

      Hell, they don't even have to roll it out any time soon. But start WORKING on it with a healthy budget for R&D.

    5. Re: sometimes by Anonymous Coward · · Score: 1, Informative

      Canvas is open source under the AGPLv3 license and the source is on GitHub. They are nearly what you are asking for (a group we all pay into to manage updates and adding of new features). But the rest is a pipe dream. Who has time to tinker with their LMS? Iâ(TM)m a CS prof and I donâ(TM)t do it. Also, the software is necessarily web based, and I donâ(TM)t want somebody adding some patch to the system that brings it down. Better to let IT manage the thing.

    6. Re:sometimes by nine-times · · Score: 4, Interesting

      Honestly, I've come to think that's a bit of a cop-out. If the government can't use FOSS, then I think they should fund the software they need, which should then also be open source.

      That may sound excessive, but it's an investment. It accomplishes a bunch of stuff. First, over the long term, it does away with licensing costs. It also allows them to access the source code and verify its security, and then make modifications as needed. Also very importantly, it frees them from proprietary interests. They're not beholden to do things the way their vendor wants and serving their vendor's interests.

      Also, whatever improvements they make to the FOSS are likely to be needed somewhere else. Improving public software serves the public interest.

      The reality is, buying proprietary software may be "efficient" when looking at the short-term immediate cost, but it's much harder to say what will be efficient and cheap when viewed over the next several decades. I suspect that investing in public software now will pay off several times over in the next 50 years, and that's the sort of timeline the government should be considering.

    7. Re:sometimes by i.r.id10t · · Score: 5, Informative

      Except Canvas is AGPL licensed.

      https://github.com/instructure...

        Sure, you'll loose those nice integrations with Big Blue Button (conferences tool), some of the Speed Grader stuff, the equation editor, the "record from webcam" function in the HTML editor, etc. since those are licensed services or hosted via 3rd party contracts, but you can also replace them yourself.

      Strangely, what the college I work for pays for Canvas hosting and support (not a license fee) is about what we paid Angel/Blackboard for license and hosting, but the software is better and our support experience is better AND we get a LOT more resources.

      --
      Don't blame me, I voted for Kodos
    8. Re:sometimes by Anonymous Coward · · Score: 1, Insightful

      universities employ a lot of smart people who like tinkering

      There was a time that you had universities producing nice things like pine (now alpine/realpine, because the UW stopped development). Nowadays, the smart people have too much work on their hands. Professors have to profess, which means lots of articles and books need to be written. Tech support teams have a lot more on their hands in the era of BYOD and not much more in the way of resources. I used to be a tinkery sort of person, and now I'm busy writing instead, so I have no time to tinker. Tinkering won't get me tenure.

    9. Re:sometimes by Monoman · · Score: 1

      I tend to agree. I see too many schools struggle to keep up with tech when they should be banding together to find solutions and share resources. Those solutions don't necessarily have to be open source.

      --
      Keep the Classic Slashdot.
    10. Re: sometimes by ranton · · Score: 1

      The skills are not there, and cannot be hired, because in most cases the US government does not compete with private industry on salary. While this is theoretically a solvable problem, in practice it isn't. Even the vast majority of private companies cannot compete with large tech vendors for top talent.

      --
      -- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
    11. Re: sometimes by Anonymous Coward · · Score: 1, Insightful

      As a retired costly inefficient public service employee I totally agree. Use open source where it makes sense. In the case of the DOD, I think they should have their own OSs hardened and maintained by a single department. For most other agencies, they should be in the cloud as much as possible and have an agency making sure everything is configured properly. One thing about open source that I found over my years in IT is that it's great until you put it into production. Just because it's open source, you better make sure you have a support contract with a reliable company. Free is not always free.

    12. Re:sometimes by DCFusor · · Score: 2

      But government is all about the next election, like business is all about the next quarter. Wise investing is ancient history.

      --
      Why guess when you can know? Measure!
    13. Re: sometimes by Anonymous Coward · · Score: 1

      That's a bit of a fallacy you've got going there.

      1. Salary isn't necessarily everything that counts. There are plenty of competent people who aren't necessarily mercenaries who will sell themselves to the highest bidder.

      2. You're pretending that large tech vendors actually are interested in, and in fact do invest in top talent. A quick look at the reality, however, would indicate that opposite is true; experienced people (e.g 40+) regularly gets laid off, and are replaced by younger ones who are cheaper, less experienced and usually off-shored. Hardly a recipe that is hard to beat, both from a quality and a security POV.

    14. Re:sometimes by ElizabethGreene · · Score: 1

      You don't have to trust an open source project, especially not when you have the resources of a national state behind you.

      Pickett county Tennessee, population 5,100, does not have those resources. They are a very important government for the people that live there.

    15. Re: sometimes by ranton · · Score: 1

      1. Salary isn't necessarily everything that counts. There are plenty of competent people who aren't necessarily mercenaries who will sell themselves to the highest bidder.

      I must have hit a nerve there. While there are plenty of people who can command $250k in the marketplace but are perfectly happy making $125k, they are very rare. I haven't found any, but I'm only a couple decades into my career. I have found many people content with $125k who could make $150k elsewhere (one even works for me) because they like the company, team, location, etc. But the chasm between what the government tends to pay and what private industry does is far too great.

      The government is filled with big fish small pond types, like many small companies. That is far different than the big fish big pond types you will find at large tech vendors.

      2. You're pretending that large tech vendors actually are interested in, and in fact do invest in top talent. A quick look at the reality, however, would indicate that opposite is true; experienced people (e.g 40+) regularly gets laid off, and are replaced by younger ones who are cheaper, less experienced and usually off-shored. Hardly a recipe that is hard to beat, both from a quality and a security POV.

      Large tech vendors, and large consulting firms, are not made up of 100% top talent. Probably not even 20%. They are filled with younger "worker bees" who have very high turnover. But these companies still have the lion's share of the top people in the industry.

      And even the rest of that talent in the field is getting the rare technical architect, director of IT, etc. jobs at large private companies outside of the tech industry. They still aren't making their way into government for the most part.

      --
      -- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
    16. Re: sometimes by ranton · · Score: 1

      People will not accept lower wages but better job security and other less tangible benefits, because they could earn top talent wages were the top wages go to less than 20% of the workforce, and the rest is treated like crap with a huge turnover? Not to mention they might already have been kicked out of it once because they were "too old"? And these businesses have the lion's share of the top people? Gee, I wonder why since the alternative ATM is zero. I'm sorry, you make absolutely no sense, you're actively contradicting yourself.

      I'm not sure what is confusing you. If any worker in question cannot make top wages (because they aren't in the top 20% or whatever), sure they could be convinced to work in the public sector. But they couldn't command the top salaries because they weren't the top talent. The government can probably get plenty of ex-Google/Facebook/etc workers, but not their best and brightest. Those individuals are either still at the top tech companies, have started their own private companies, or are working for other well funded private companies.

      This is a small project will less specialized people than say, making an atomic bomb, and that got done.

      If the government treated any single project with the importance of the Manhattan project, I'm sure they could get the funding to gather the best and brightest and would accomplish as much as any private company could. Probably much more, since profits wouldn't be the primary motive. But that is not how the vast majority of public projects are run. In fact the Manhattan project and moon landing may be it. Today the government would most likely license private companies and contractors to do that work, since they can justify paying a private company $100 billion much easier than they can justify paying individual government employees $500k/yr.

      --
      -- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
    17. Re: sometimes by ranton · · Score: 1

      So it appears we aren't that far off on our opinions, and the difference is basically that I have less confidence in the government being able to access the personnel to ensure systems are trustworthy (regardless of open source or closed source). And I think the main reason we differ is you believe it doesn't take as significant level of expertise to do that as I do, which is basically just a judgement call. Nothing to really argue there except an agree to disagree.

      Finally I'd like to repeat that the reason we're having this discussion is that I pointed out that it's the only way to resolving conflicts of interest associated with commercial actors, re-asserting control over the information stored in the systems, and ensuring the system is trustworthy, something which is as essential as it is impossible with proprietary software. You might endorse that or not.

      I would like to add that private companies perform audits on other private companies of their IT systems all the time. I work at a financial services company and we go through multiple audits per month by our partners, investors, and regulators. There is nothing stopping government officials from being able to view proprietary code theoretically, although in practice it is unlikely in most cases. Just like it is unlikely for government (or private companies for that matter) to thoroughly review the code of any open source solutions they use.

      But it certainly isn't impossible to have a higher level of transparency with proprietary code than your average retail user. It just depends on what they work into their contract.

      --
      -- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
  2. Not "Open Source" but "Free Software" by Casandro · · Score: 1

    Just having the sourcecode of software doesn't mean much. Quite some governments have access to source code of proprietary software. What is more important is the freedom of software to be used and changed by anybody for their own purposes.

    1. Re:Not "Open Source" but "Free Software" by Anonymous Coward · · Score: 2, Insightful

      Open standards yes, since you avoid lock in. Open source maybe. Does it save money over the long term?

      "Millions for defense, but not one cent for tribute."

      This isn't a question of efficiency. It's a question being able to know 100% what the government is doing. There are proprietary breathalysers that sent people to prison and then turned out to be buggy. The manufacturers wouldn't let people see their source code so the defendants will often have never found out about this. If your town is not having it's road built because the Office356 regression function has a bug you will never be able to see that.

      For democratic control you need both open (so you can see inside) and free (so you can test it) software.

    2. Re:Not "Open Source" but "Free Software" by l0n3s0m3phr34k · · Score: 1

      If the risk assessment shows green, then this stuff would be in the federal enterprise more. When it's for federal purposes, support is one of the most important aspects. And I'm not talking about "jump on Stack Exchange and post a question", but the 3:00AM hyper-visor heartbeat failure that by 7:00AM has corrupted several critical VMs. I can pick up the phone, and have an expert team swarm down (virtually), and fix the problem, get the VMs back online, etc. Most government offices don't have large IT staffs with esoteric Docker knowledge and capabilities to troubleshoot the intricacies of such systems.

      How robust are industry-standard baseline configurations? For DoD-ish systems, do DISA STIGs exist for said software? Has it been thoroughly vetted under NIST's various 800 publications? More important, can the end user effectively use open-source desktop software without major training? Can the agency obtain support techs who can also pass background checks?

      For a smallish company, these aren't issues. For large enterprise critical federal systems, this is just the tip of the iceberg. Outside of systems like RHEL, very few open-source products have the required vendor support capabilities that are regulatory mandated. Fedramp, 800-53, 800-171...is a whole different ballgame.

  3. Considering how utterly Shiite Propietary software by Anonymous Coward · · Score: 1

    Has become, I’m surprised the switch hasn’t happened earlierly.

    It seems most proprietary software preempts the end-user or administrator in a myriad of ways, knowing “better” at best (I grew up luckily in an era where computers still took direction) or is just malware/spyware/adware at worst.

    Which is why I loathe smartphones so. Such great potential. So utterly wasted. It’s a shame what the net turned into as well though.

  4. Who develops it? by Skinkie · · Score: 4, Interesting

    Recently a Gartner report on open source in The Netherlands made an interesting case why with the current legislation the Dutch (and likely European) governments could not contribute to open source software. Governments may use it, but a software developer disguised as civil servant must never be provide patches or features back to the open source project, nor is the government allowed to publish their work in public, publication should be strictly limited to other governments. This would be prohibited due to unfair competition with software suppliers that build closed source software not having the advantage of government support. Now the case of no-vender-lockin still remains, but unless we first change these kind of laws, harnessing the true power of open source: collaboration, is legally not possible.

    --
    Support Eachother, Copy Dutch Property!
    1. Re:Who develops it? by stooo · · Score: 2

      >> unfair competition

      That's B.S.
      The thing about free Open source software, is everybody can use it under the exact same conditions.
      So it's fair, because that same company can just sell it also.

      --
      aaaaaaa
    2. Re:Who develops it? by Skinkie · · Score: 4, Interesting

      Considering the following real case. The City of Amsterdam created a new CAD plugin allowing to the export to contain all properties required for a government exchange. Everything they had seen on the market had issues, hence they developed something new. Other municipalities started to use this software, and one of the commercial suppliers of a competing plugin was not amused. Here the government puts in resources to compete with a market activity - even if they completely hate the product - the proper way to solve this is via a tender, which can obviously request all software assets to be available. The currently legislation prevents unfair competition by provision costs, hence the development costs (labor fees of the civil servant) should be balanced over all private users, unless legislation is made to prevent this. For open data this is for example the European Public Sector Information act.

      --
      Support Eachother, Copy Dutch Property!
    3. Re:Who develops it? by stooo · · Score: 2

      >> the proper way to solve this is via a tender
      Nope. That's the old way from the last millenium for governments to waste money. Welcome in 2019.
      Still, the field is level, the commercial companies can pick up the FOSS and sell it with good support. Everybody wins, it's good for fair competition.

      --
      aaaaaaa
    4. Re:Who develops it? by El_Muerte_TDS · · Score: 2

      That Gartner report is, obviously, quite pro-for-profit. According to the summary contributing to OSS is not allowed due to the requirement by law to be able to charge somebody for the made costs.
      The made costs are listed as (time spend on):

      1) Making code readable.
      They agree that readable code has it's benefits either way. But making code readable for temporary solution is not. They forget the principle that nothing is more permanent than temporary solutions.
      2) Performing security audits
      Security through obscurity reasons.
      3) Community support
      You need to build and support a community which you need to control with an iron fist. Otherwise the community might go into a different direction. (i.e. fork your project).
      No mention that if you contribute back to OSS you don't need to curate a community.
      4) Community support
      Basically the same reason. You need to spend time on processing community feedback (like bug reports/fixes).

      They also fear reputation damage for low quality code :) Reputation damage, for a government... They should hide that the government in run on terrible code.

      But what if the Government would pay a company to do all the above things? That's where the weird "unfair competition" comes to play. Requiring the work done to be made OSS is unfair to the companies which do not want to do that. (But now allowing small companies to bid on the tender isn't an issue)

    5. Re:Who develops it? by Skinkie · · Score: 3, Interesting

      Requiring the work done to be made OSS is unfair to the companies which do not want to do that. (But now allowing small companies to bid on the tender isn't an issue)

      The government is allowed to set requirements on what they want to receive, and how they want it be be delivered. So technically speaking they can request a can of developers for 10.000 hours, and want to have a fair price in a tender for that. Or you can ask for a software license to allow you to do this and that. Hence if a solution company does not want to deliver such, they will not participate in the tender, but they have been allowed to participate and with a lot of experience might have been able to do so under a reduced cost (much experience in the field, able to reuse previous work). Less money spend is good for the tax payer. But this would still only be able to be used inside the government. Because there is a limitation a public body could act as a private body by the legislation of competition. Imagine the government buying all ground, developing real estate, there couldn't be any competition. The article is about should government require open source software to be independent of suppliers. There are quite a lot of examples where government software development is not about the next "Office" software but in CAD, geospatial, photogrammetry, simulation, urban planning where this software might benefit others. If the government would build a new OS-kernel we would likely all agree this is stupid, what about a competitor to ArcGIS/QGis?

      --
      Support Eachother, Copy Dutch Property!
    6. Re:Who develops it? by Anonymous Coward · · Score: 1

      There are parallels in the construction industry. One of the difficulties of comparison is the way buildings are not copyrightable but the design documents are. Is the open source code considered a design document, or the end product? Still the documents are archived and the updated designs archived as the building evolves. The government regulates, inspects, controls, audits and buys design and construction services. But they don't design or construct new buildings in the normal conditions.

      So the government could run a static analyzer over the code, for example, and notify the detected issues to the developer but not fix them by themselves.

      Another issue is as the organizations become "digital", or are using software for organization and collaboration, a government using such software has to operate within the law as much as before. There has to be a way to verify that the code implements the processes as the law prescribes like in the "analog world" where there are documents related to private and public meetings, public announcements, legal texts and data. The processes implemented by the code has to be auditable by the relevant parties to enable the citizen to complain or legally challenge them. Governments change their processes all the time, like everybody else.

      There are either two separate cases here, or the golden age of end-user-programming is just coming around the corner.

    7. Re:Who develops it? by markdavis · · Score: 1

      >"Here the government puts in resources to compete with a market activity - even if they completely hate the product"

      Another way to solve that is for the government agencies to pay COMMERCIAL companies to develop the FOSS code that is needed. Then the tax money of the people is not used against the commercial sector. It supports it AND provides FOSS code that reduces later costs and provides options to other government entities AND the public, which lowers taxes and provides more services. It also prevents lock-in AND allows for more companies to provide support AND supports open standards AND supports transparency. To me this seems like a win-win-win-win-win situation.

    8. Re:Who develops it? by Skinkie · · Score: 1

      I totally agree. And that is why tenders with smart requirements are loving this.

      --
      Support Eachother, Copy Dutch Property!
    9. Re:Who develops it? by drinkypoo · · Score: 2

      Other municipalities started to use this software, and one of the commercial suppliers of a competing plugin was not amused.

      The city wasn't amused by the incompetence of the commercial supplier.

      The currently legislation prevents unfair competition by provision costs,

      There is no unfair competition because the commercial vendor is free to distribute the open source product as well.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    10. Re:Who develops it? by epine · · Score: 1

      One can choose to view small patches as extremely crisp bug reports. Governments don't charge the private sector for bug reports (governments generate bug reports by the thousand almost entirely at their own expense).

      And what about the case where government contracts out to the private sector to have a new module developed for a large, open-source framework, with the bidders informed in advance that the source code will be contributed back to open source so as to protect the government's future interests?

      That's not unfair competition. That's merely a diverse and effective ecosystem, in which the government is free to control public expense by any means available.

    11. Re:Who develops it? by hellopolly · · Score: 1

      Dutch governmental institutions are allowed to compete against commercial companies as long as they:
      - Account for all cost
      - Do not make misuse special governmental privileges. For example the government cannot use a loan that has better conditions then a private party could obtain.
      - Do not gain advantage out of data use. You cannot use data that a commercial party would have to buy or cannot access.
      - Individuals do the work should not have regulatory responsibility that may cause conflicts of interest.

      So as long as those requirements are met the people that are writing the software account for their hours, and the cost is administrated properly, there is no problem

  5. All IT systems should be using open source softwar by stooo · · Score: 4, Insightful

    >> Should all government IT systems be using open source software?
    All IT systems should be using open source software.

    --
    aaaaaaa
  6. Right solution for the problem, what's wrong here? by bogaboga · · Score: 1, Interesting

    ..."If it is public money, it should be public code as well..."

    No, dude...

    "If it is public money, it should be public code as well only if it works and does work well..."

    But I am almost embarrassed to say that in my little world, apart from the browser, open source desktop software sucks big-time. It just does not cut it.

    One has to "fight" with a situation where you have the same library named differently, installed in different locations, installed with older versions of the same depending on distribution...The arrogance in the open source world simply makes matters worse. Who has the time for all this nonsense?

  7. Yes. by MessageDrivenBean · · Score: 1

    Next question please.

    --
    Quisque verborum suorum optimus interpres...
  8. Not a failure of open source community, but greed. by Anonymous Coward · · Score: 1

    The software has been more than good enough for a decade, or more if you have actually competent admins.
    Not admins and users that are mentally stifled by having been treated like morons and unable to adapt their software to their actual needs for decades. Who had to settle for the dumbest common denominator, and eat whatever is put down their throat. (Yes, Windows 10 and macOS, I'm talking about you. Oh and don't think I forgot you, Gnome. You too.)

    E.g. writing a shell script that gets triggered by a shortcut or udev or cron etc, should come naturally at least to the admins (who should be able to do it in their sleep), if not to the users. IMHO, current GUIs (but not GUIs per se) are considered harmful.

    The failure has been, as always, in curbing the treason (aka "lobbyism") that drives deciders towards wasting money on for-profit imaginary "property" organizations instead of getting a fair deal for something made efficiently.

    Also, closed-source software is a huge security risk, as security is incalculable by definition. And the constant drive to keep adding things to half-assedly justify making further money only makes it worse. Especially when combined with the death spiral of dumbing down that happens, when companies always want to make it "simpler" for users, but the dumbest users are the most vocal that they listen to, and if it's made easier, will just slack off even more and become even dumber, demanding to be spoon-fed even more... until you end up with today's UIs that are so "simple" that they are horribly painfully cumbersome. (E.g. the lack of being able to script/automate some repetitive task away forever, which would actually save time.)

    The advantages of teamwork over a dog-eat-dog anarchy is the entire point of having a state and a government. That is also the key advantage of open-source over closed-source software. It's a human thing, dear lizard brains.

  9. PROTIP: We are part of "the market" too! by Anonymous Coward · · Score: 3, Interesting

    Yeah, the commercial offers sucked. And the market decided. For a better product and a better deal. Made by the "corporation" called "government", which is the "corporation" that we're all shareholders, employers and employees of.

    The commercial suppliers simply hated an actual free market (and especially it balancing itself out). Like apparently all corporations and businesses without exception always do. Because they prefer unfair competition, but only if it's them doing it, e.g. in the form of a monopoly (even imaginary ones on imaginary property).

    I think in the long run, FLOSS will win over all closed-source software. As an egoistical sole company simply cannot compete with everyone teaming up to make something free and libre. It's why social species succeed over everyone-for-himself species. And the imaginary property delusion won't last forever. People are gonna want to only pay for actual work, not for mere copies or mere profit, since they had to actually work for their money too. They only don't right now, because they have no choice, and because those who steal their money wrote laws and propaganda that became the cultural norm in some sad parts of this planet.

    1. Re:PROTIP: We are part of "the market" too! by Kjella · · Score: 1

      Yeah, the commercial offers sucked. And the market decided. For a better product and a better deal. Made by the "corporation" called "government", which is the "corporation" that we're all shareholders, employers and employees of. The commercial suppliers simply hated an actual free market (and especially it balancing itself out).

      That's like saying that if the voters voted for universal healthcare it's a free market solution. Heck, it would make communism a free market solution. It's totally okay to say that the free market doesn't always deliver and that you're sometimes better off funding it through taxes so you don't have to worry about revenue, margins and profits. It's called socialism, look it up.

      --
      Live today, because you never know what tomorrow brings
  10. Re:All IT systems should be using open source soft by Bite+The+Pillow · · Score: 1, Insightful

    Nope, Windows is not open source, but users and developers are cheaper. I'd rather not pay the taxes needed to support all OSS.

    In an ideal world where faries get you off daily? Sure. But in reality, no.

  11. Re:Right solution for the problem, what's wrong he by Bite+The+Pillow · · Score: 1

    I've not had this problem. But I have not used anything other than Windows for most of 26 years. Every attempt, no library issues.

    Of course I gave up each time so it was not long lived. So what are these libraries?

  12. Yes, anything else is insanity by gweihir · · Score: 1

    Sure, everyday insanity that is prevalent in software selection, but insanity nonetheless. The waste of money and the sheer dependency on a single or small number of companies is not acceptable.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  13. Re:unrealistic by gweihir · · Score: 3, Insightful

    That is nonsense. Nonsense often repeated, but still untrue.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  14. Unfair competition by Anonymous Coward · · Score: 2, Interesting

    And this "unfair competition" doctrine is the result of years (decennia!) of neoliberal lobbying. Why should be a government be prohibited to do what's best for its citizens and cater first to corporations which, in return try to avoid taxes as "cleverly" as they can?

    I mean: corporations /can/ be the government's allies in fostering the citizen's well-being, but they can be also its enemies. It should be up to the government to decide when and how.

    Lobbyists should be scrutinized much more closely. IMO half of them should be in jail, along with the politicians listening to them (the latter are worse).

    1. Re:Unfair competition by Anonymous Coward · · Score: 1

      'And this "unfair competition" doctrine is the result of years (decennia!) of neoliberal lobbying. Why should be a government be prohibited to do what's best for its citizens and cater first to corporations which, in return try to avoid taxes as "cleverly" as they can?'

      Prisons are washing thousands of tons of hotel bed-wares every day, thereby being unfair to those businesses too, but those don't have any lobbyists.

    2. Re:Unfair competition by Required+Snark · · Score: 1
      Exactly. It's not a level playing field, it's biased in favor of corporations. Because Politics!

      It's not about the best tool or what is most cost effective, it's about lobbyist and the revolving door. When managers don't even consider the open source option they know a job may be waiting for them when they leave government service. That's how the Military/Industrial complex works. As for lobbyists, if there is any talk about open source it's certain that the campaign contribution tap will open wide.

      As for all the whining "what about support!!!", that why it's call OPEN SOURCE. There's nothing stopping the government from either having in house support staff or paying a vendor to provide support. Does anyone think that paying Oracle or IBM rates for support is less expensive then going to the open market? Paying for bloated corporate costs is a form of hidden taxation that skips the middle man and put tax dollars directly in the pocket of Larry Ellison so he can buy his next generation billionaire yacht.

      --
      Why is Snark Required?
  15. One forgotten cost -- suppport by CaptQuark · · Score: 2

    One forgotten cost when using open source software is support. Every time an open source project adds or removes features it prompts a surge in support requests from users. Firefox is one example. When Firefox removed support for legacy add-ons everyone wanted to know how to replace their lost functionality. The removal of bookmark descriptions instead of just limiting their size caused another rash of questions. The removal of the Never Check for Updates means that every user is nagged to update to the newest version before it can be tested and rolled out in a controlled manner. Multiply these kind of problems to other OSS products for document processing, PDF, compression, graphic editing, multimedia playback, etc. and the support costs grow greatly.

    Another problem with OSS is who do you call for tech support. Most OSS products have limited support for enterprise level problems. Many software packages STILL require a user to run in administrator mode to work properly. Saving user preferences in the Program Files area still happens in some software. Every software package that displays the infamous UAC warning will cause support problems in a managed system. Software packages that use the Windows Temp folder for some intermediate file use will be blocked by some anti-malware software. Who does a company contact to fix these types of problems? To be fair, some of these problems are still present in proprietary software.

    Part of the appeal of OSS is the price; however, most people forget that part of the cost of retail software is the built-in cost of maintaining a support center, normally with a 1-800 number for question, or at least a knowledge base system to reduce the cost of support phone calls.

    --

    1. Re:One forgotten cost -- suppport by l0n3s0m3phr34k · · Score: 2

      Every new feature must also be evaluated if it makes baseline configuration changes. The software also needs to be able to have granular controls, and allow IT staff to BLOCK any upgrades that aren't vetted and authorized.

      At my work, we are having to implement AppLocker and other mitigation because one of our core "business critical" applications needs Admin to run. And this is a paid-for application that has been around for many years, with a very deep support structure; but getting them to be 800-171 compliant has been like pulling teeth. We may have to also VLAN off the users who need PUA for this application, and even then on our next audit we may have several "findings" because of this.

    2. Re:One forgotten cost -- suppport by serviscope_minor · · Score: 2

      most people forget that part of the cost of retail software is the built-in cost of maintaining a support center, normally with a 1-800 number for question,

      We're talking about large organisations though. I've never encountered a large organisation that wants you to call some vendor's support. They expect all IT support stuff to be handled through the organisations IT department.

      --
      SJW n. One who posts facts.
    3. Re:One forgotten cost -- suppport by jythie · · Score: 1

      Large and small though. The US government is huge, but it is made up of nearly uncountable groups, institutions, and offices, some of which are pretty tiny.

  16. Liability, integration etc. by mccalli · · Score: 1

    Who would deal with the inevitable liability suits? What about integration with vendor systems which are often proprietary or under NDA? What about vendor-derived systems full stop (not shrink-wrap, more thinking vendor has a core product which they then customise for each client)....

    It's too blanket a rule.

  17. if the reason for NOT by mapkinase · · Score: 4, Insightful

    is security, then that would be just an example of security hy obscurity.

    --
    I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
    1. Re:if the reason for NOT by david_bonn · · Score: 1

      is security, then that would be just an example of security hy obscurity.

      Three examples where I think open-sourcing software used by the government would be insane:

      (1) Offensive cyber weapons. If they are even allowed to exist at all, I don't want my government supplying script kiddies with scary dangerous zero-day exploits.

      (2) Software used in weapon systems. Why should we make it easier for adversaries to clone our tech? And why should we make it easier for them to come up with countermeasures for those systems?

      (3) Some software used in the criminal justice, law enforcement, and federal court system. This is a bit more ambiguous, but it is plausible to me that someone could use that software to either game the court system and make sure their cases only came before judges who would rule more favorably towards them, or could use them to make it more difficult for law enforcement to detect and combat criminal activities.

    2. Re:if the reason for NOT by drinkypoo · · Score: 2

      (1) Offensive cyber weapons. If they are even allowed to exist at all, I don't want my government supplying script kiddies with scary dangerous zero-day exploits.

      They shouldn't exist at all. The responsible thing for an agency tasked with securing the nation's communications (like the NSA) to do is to report vulnerabilities to vendors, so that holes can be patched, and the nation's communications can be made more secure. That's literally their first job.

      Software used in weapon systems. Why should we make it easier for adversaries to clone our tech? And why should we make it easier for them to come up with countermeasures for those systems?

      Agreed.

      Some software used in the criminal justice, law enforcement, and federal court system. This is a bit more ambiguous, but it is plausible to me that someone could use that software to either game the court system and make sure their cases only came before judges who would rule more favorably towards them, or could use them to make it more difficult for law enforcement to detect and combat criminal activities.

      It sounds like you're advocating security by obscurity...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:if the reason for NOT by urusan · · Score: 1

      Here's an interesting option for controlling cyber-weapons without taking them entirely off the table. Instead of banning them or allowing unlimited secrecy, instead the following rules have to be followed:
      1. The cyber-weapon has to be completely declassified within 1 year of becoming operational. (Perhaps a somewhat longer time could be mandated, such as 3 years or 5 years, but if the countdown becomes too long then the situation becomes more and more like unlimited secrecy)
      2. The cyber-weapon has to be declared when it becomes operational, so we know when to start the declassification countdown.
      3. The cyber-weapon cannot be used against the populace of the country operating the cyber-weapon. If this is the case, the exploits involved have to be reported to vendors immediately, and it has to be declassified more quickly as the vendors fix the issue. (What constitutes being usable against the populace is an interesting question, as stricter interpretations of this may rule out cyber-weapons usable against any public software, also note that private/secret forks of public software used by specific countries for country-specific purposes would almost certainly count as country-specific).

      The overall effect of this should be that cyber-weapons are short lived and limited in scope (mainly attacking the secret capabilities of other countries instead of public software/infrastructure). It incentivizes improvement of existing nationally-used public software by defence actors, as they can no longer exploit loopholes in the software used by their own nation. It also incentivizes other countries to use public software for their infrastructure, and increases the quality of said infrastructure dramatically as everyone would want said infrastructure to be of top notch quality. The relatively quick declassification time means that any scandalous abuse of the system can be detected quickly (such as if they ignored rule 3, or if they created a cyber-weapon that was brutal enough to cause war crimes). The cyber-weapons declarations also serve as a deterrent, indicating that such weapons exist without giving away details about who is targeted or what it's for (at least until it is declassified, at which point there should be new weapons in existence). If it ever got to the point where it'd be impossible to create a new weapon before the old ones expired, then there wouldn't be many vulnerabilities out there and so we'd live in a very safe cyber-environment, making cyber-warfare moot.

      If there were reasons to classify some cyber-weapons for longer periods, then I would recommend that they at least be required have an accurate summary of their purpose and reason for the classification extension declassified after the normal period, and they should be subject to substantial court scrutiny, with an ultimate declassification required at some later date. If this is allowed at all, it should be rare.

      As for your other two suggestions, I definitely agree that software used in weapon systems is important to keep classified. However, I strongly disagree that criminal justice software should be secret. The benefits of public review of criminal justice software outweigh the possibility that some genius could find an exploit that makes them harder to bring to justice. Also, such exploits are more likely to be detected in the first place.

      It should also be noted that the complete "source code" of the law itself is already out in the public view, yet we don't worry about someone finding an exploit in the law, even though it happens from time to time, allowing some people to exploit the system. Clearly, having a transparent code of law is much more important than catching every criminal.

  18. Yeah but in real life... by Casandro · · Score: 2

    ... you have a piece of software that doesn't work. You call in the highly expensive support from the vendor and they won't be able to do much more than shrug at it. It's something I have seen at large companies and very large vendors.

    "Free Software" means that you can change the software if you please. That implies that the software is simple enough for you to make meaningful changes to it. The simpler the software the more reliable and secure it usually becomes, that's why when hardening a system you throw out stuff you don't need. If you don't have your own staff understanding vital systems, you have done something severely wrong.

    1. Re:Yeah but in real life... by Anne+Thwacks · · Score: 5, Insightful
      That implies that the software is simple enough for you to make meaningful changes to it.

      I think you missed the point: governments can afford to pay for a team with the necessary skills to maintain the open source software in the manner that most benefits them. However, they only need pay once.

      With closed source, they need to pay through the nose possibly repeatedly for different departments, and still don't get what they want.

      However, this does require a degree of sanity in government, and I am not holding my breath on that account.

      --
      Sent from my ASR33 using ASCII
    2. Re:Yeah but in real life... by markdavis · · Score: 2, Informative

      >"... you have a piece of software that doesn't work. You call in the highly expensive support from the vendor and they won't be able to do much more than shrug at it. It's something I have seen at large companies and very large vendors.""

      THIS

      I can attest that "support" by major proprietary software companies is just as hit-or-miss as it is in the FOSS world. There is support that is great, and support that is expensive as hell and yet practically useless. So it is hard to generalize.

      One of the best models yet is the RedHat one- which is why they have been so successful. It is FOSS, so MORE THAN ONE ENTITY can actually support it- the main one, additional ones, freelance people, and your own staff. This is almost impossible with proprietary systems. It is like having the best of all worlds- multiple support options, free use options, good free support options, good paid support options, very little "lock-in", less forced upgrades, ability to see code, ability to extend, ability to share.

    3. Re:Yeah but in real life... by nine-times · · Score: 2

      Yeah, small businesses can't afford to support and maintain their own software, but an organization the size of the US government can. They could, at least theoretically, hire a team of programmers to develop and support the software they need. They can fix bugs and develop new features.

      And it's true that having software vendor support is overrated. For an awful lot of the problems you'll run into, when you contact support they'll tell you, "Oh, right, there's a bug. The thing you want to do can't be done and the data you've lost is gone forever. Sorry." Having support doesn't mean that everything will work or everything will be fixed. It just means you'll have a specific group to be mad at when things don't work.

    4. Re:Yeah but in real life... by eddeye · · Score: 2

      governments can afford to pay for a team with the necessary skills to maintain the open source software in the manner that most benefits them. However, they only need pay once.

      Spoken like someone who's never worked in govt. In reality most govt agencies can't do that, for a variety of reasons:

      • Agency budgets fluctuate year to year. Unpredictable funding can doom the project.
      • Agencies change leadership quite frequently. Look at the massive changes in policy and priorities at DOE, HHS, State, and other agencies when the Trump administration came in. As political priorities change, support and funding for other projects dries up.
      • Turnover. Many govt agencies have significant turnover, as people gain experience and contacts then jump to the private sector.
      • Hiring. Govt hiring practices are abysmal. They make it way tougher than necessary with arbitrary restrictions, greatly reducing the pool of candidates. Many good people never both applying for govt jobs, or never figure out the arcane tricks just to get past the HR gatekeepers.
      • Expertise. Project management is handled by mid-level bureaucrats with no experience in developing software. They're promoted based on skills at the agency's primary mission.
      • Changing requirements. Due to a rotating cast of leaders and managers with constantly changing priorities, projects tend to change requirements frequently and often. Hard for even a good software team to deliver successfully when the metrics for success swing wildly.

      In theory, there's no reason an agency can't recognize their own limitations and hire a skilled software manager to run the project. In practice there are tons of barriers to doing that successfully. Successes are rare.

      I'm not against open source in government. There should be more of it. But there are practical reasons why open source is difficult for govt agencies. You have to pick and choose the right use cases for it.

      --
      Democracy is two wolves and a sheep voting on lunch.
    5. Re:Yeah but in real life... by wisnoskij · · Score: 1

      It is not like this has not been tried. Governments have been spending billions developing their own software since software has existed. I have yet to see a single one that even worked and did the job it was designed to do. And I can assure you it was many times more expensive than leasing existing systems.

      Take for example my latest foray into the government system. First I had to sign up for a ONE-key account, to enable me to sign up for a service Ontario account on a second website, which allowed me to sign up for a ministry account on a third website. Strangely it did not even appear like it was possible to access any of these accounts without following them through the previous account. I was given a multi page guide on how to accomplish this, but strangely it appears most of the steps are just a little off; Most buttons, links, steps are worded exactly as specified or located exactly where they should be. Finally we get to the point of the whole exercise, renewing an exterminator licence. We start filling out the forms and oh, and error and we are booted out.

      Well try again, "Error: form not saved". Apparently this is common according to tech support. Any data you enter into any forms that does not get saved, any applications that do not get completed, any problems anywhere at any time makes the site display nothing but an error about how you have to save the data before continuing. And the kicker, all of these government sites only function if viewed through Chrome on Windows.

      --
      Troll is not a replacement for I disagree.
    6. Re:Yeah but in real life... by jezwel · · Score: 1

      ...these government sites only function if viewed through Chrome on Windows

      So they've finally ditched the IE6 requirement?!? Now that's progress.

      Sarcasm aside, government core business function almost everywhere is unrelated to OS development, and application development is usually business specific. I'm sure that certain security related agencies could be set as responsible for developing a secure core OS for use across all government sectors, but you're also running against corporate interests in regards to some pretty large US based companies out there. Considering this is a US centric site, supporting US centric companies is no-where near as big a deal as every other country also doing it.

      China has their Red-Flag (RH) linux, so it's certainly being done. I think there's little political capital around supporting that type of operation though, so it just won't happen.

    7. Re:Yeah but in real life... by l0n3s0m3phr34k · · Score: 1

      I'm sorry you've had such horrible support before, sounds like you should have vetted your vendors better. I've had pretty excellent results with real warranties from large companies, including Dell, VMWare, HPE, and so forth. I've had VMWare rebuild VMs pretty much by hand (we had VMware 6, not 6.5 with more advanced rebuild features), HPE support for blade servers, often they will open up support tickets FIRST when they see potential issues in various subsystems before we have time to go over the logs. Synology is pretty decent too; proactively helping with patching firmware across multiple SANS at multiple locations.

      We can't just "change stuff", we have baseline secure configurations, proper change control, and have to abide by both 800-171 and SOX. My coworkers have a VERY deep understanding of our systems. For us to use most open-source products we would need to test all the dependencies, hire more people to do low-level code reviews, and still it wouldn't be regulatory compliant due to lack of real vendor support. I'm guessing my "corporate world" is probably vastly different than yours; if we have a massive equipment failure...well, I can't say exactly but CENTCOM isn't a customer you want to fail an audit for.

    8. Re:Yeah but in real life... by l0n3s0m3phr34k · · Score: 1

      So, open source products never do any updates, change libraries, new dependencies...your install of Debian is forever set in stone and is never updated? You personally vet every new dependencies that comes up when you yum update, and go in to and review all 50+ package's code to make sure it's all complaint with the Application Security and Development Secure Technical Implementation Guide? You can verify that absolutely none of the code violates V-70363? This requirement here is why Open Course isn't widely used in Federal systems, outside of very specific products and applications. If you can't call a toll-free line, open up a real support ticket (NOT just posting to a forum), etc then it's "Remove or decommission all unsupported software products in the application". Any libraries that use cryptography need to be FIPS compliant, listing their module that can be verified.

      How do you specify a secure baseline for your open-source applications?

  19. Of Course by dohzer · · Score: 1

    How will I easily find exploitable flaws if they use closed source software?

    1. Re:Of Course by Anonymous Coward · · Score: 2, Insightful

      If you need the source code to find an exploit, just give up, kid. The black hat doesn't fit you.

  20. Open data standards and open APIs by kosmosik · · Score: 4, Insightful

    No.

    Public/government IT systems should use open data standards and open APIs so that data is not tied to one vendors system.

    Having that you can use whatever licensed software that does the job and is economically viable.

    1. Re:Open data standards and open APIs by Anne+Thwacks · · Score: 3, Informative
      In the "olden days" (when NASA was going to the moon) it was common for engineering procurement to require a "second source" - before aerospace would buy anything, there had to be an alternative source.

      If you had an invention, you had to licence it to a competitor, or it would not be bought Typically, government procurement would buy from multiple suppliers, quantities in inverse proportion to price, to ensure that multiple suppliers would always be available.

      I am not sure when this practice stopped - but it seems that things are no longer done this way - and as a result, we get Microsoft, Oracle, and Intel (or, to use the technical term: "totally shafted").

      If that is not the decline and fall of civilization as we know it, I don't know what is.

      --
      Sent from my ASR33 using ASCII
  21. They probably should by cyber-vandal · · Score: 1

    It's whether they're able to or not. There will be custom and proprietary software and hardware running on a variety of Unix, Windows and posiibly even mainframe systems. There will no doubt be plenty of OSS in there as well but until there's an easy and cheap migration path then the proprietary software isn't going anywhere.

  22. You actually believe that PR? by Anonymous Coward · · Score: 1

    I guess you haven't ever looked into it, and just swallowed it whole.

    No, for-profit is, by its very definition, never cheaper. Since it's the cost of doing the work, plus the profit, plus the training that you have to pay.
    And even non-profit closed-source is also not cheaper, since it's effectively still a (imaginary) monopoly combined with artificial scarcity. You know... those things that are major crimes in any non-imaginary-property industry.
    Finally, even training is easier for open-source software, as you can see every time your beloved Microsoft alters their damn UI for the sake of justifying paying money for a "new" version again.

    Also, listen here, lizard brain: Sure, you can refuse to chip in, and keep all your things for yourself. But how do you not realize that we won't share any of ours with you either? Even crows and squirrels realize that! Wasn't the whole point of the invention of commerce, that you can exchange things you don't need that much for things you need more? Isn't humanity so successful due to, among other things, using the advantages of teaming up?
    I think your chances in natural selection look pretty bad, compared to social humans.

    I do live is this ideal world. My OS has been the same for the last 15 years. The system is still clean as a whistle, yet I've got all the new features unless I didn't want them. Thanks to it being open source, I grew a host of little scripts and patches that make it fit me more snugly than a perfect glove. My computer does its actual job: Automate my work away, unless it really needs my input.
    While my girlfriend transitioned from Windows 7 and MS Office to Linux Mint and LibreOffice without any hassle whatsoever. ... What's so hard about it anyway? It’s all menus and bars of icons and property/settings widget blocks and input fields. You look for the word or image that's closest to what you need. Her old printer even works again under Linux, so she doesn't need to buy a new one. Thanks to some contributor.
    And we haven't paid a cent.

    I think the only ones who still argue like you, are the ones who have never actually used a computer, but only used software like a fixed-function appliance that happens to use a computer internally. And that still treat Linux, if they ever tried it, like Windows. (Hint: If you run across a repetitive task... like always placing a window a certain way, or always executing a certain task at a certain event... find the setting to do it, and if you can't, for the love of cod, at least learn to write yourself a small shell script. Even Windows can partially do that sort of thing nowadays.)
    It's not hard! If you can write a recipe, you can write a shell script.

  23. Re: Name them, then. by Anonymous Coward · · Score: 2, Informative

    OpenSSL.
    node.js last year
    PEAR this year

    Open Source also has some fairly substantial supply chain security problems. The delivery model, and update cadence can also be pretty terrible.

    The requirements of using something at home are vastly different than for the government, and scale becomes an issue. Your either paying a closed source vendor to manage this, or your bloating the size of your IT team and paying for it that way.

    Using open source to save money is a myth.

  24. Re:Right solution for the problem, what's wrong he by Freischutz · · Score: 1

    I've not had this problem. But I have not used anything other than Windows for most of 26 years. Every attempt, no library issues.

    Of course I gave up each time so it was not long lived. So what are these libraries?

    That kind of depends on the distribution you are using, some of them are crap when it comes to this but there are enterprise distributions that do some good and proper quality control. However, if you pick some thing like the Ubuntu or Fedora community distributions you are going to have this problem because those people have no issues with backwards compatibility, a lot of them just don't understand what all the fuss is about. The people running the enterprise distributions do understand it because they get angry phone calls and e-mails from customers every time, for example, the Python team decides to break backwards compatibility because they came up with a more elegant way to structure their API. You could also make the case that Windows is better because of QA and they do good QA these days but keep in mind that there you are limited to one distribution and no tech support worth mentioning unless you pay through the nose. I used to work for a telco that had a gold plated support agreement with Microsoft but apparently that didn't even include a provision for Microsoft to get off their ass and fix bugs. All the local MS dealer seemed to do was collect extra payments for marginally better support. For proper support from MS you needed a solid gold, platinum plated diamond encrusted support agreement that ships in an unobtanium case and that we could not afford. With FOSS you can at least either change distributions or hire a mercenary coder to fix your issue because you have the source.

  25. All? Stupid question. by Oligonicella · · Score: 1
    Apparently the submitter - and editors - fail to realize that many IT systems in the government are not PCs. How many open source projects are there for IBM mainframe, Tandem and other architectures? How many of those that *do* exist (show me they do first, of course) perform the specialized functions the feds need and use, like FedWire to name one.

    "If it is public money, it should be public code as well.

    In a number of cases no, no it should not. FedWire being one.

  26. Re:unrealistic by Oligonicella · · Score: 1

    Nonsense? Point me to the code in open source that can move wire transfers, both Fed and SWIFT.

  27. It makes more sense for Goverment by Anonymous Coward · · Score: 2, Interesting

    Yes, universities need student worker jobs for experience, research grant funding to try out new ideas in support software, longer term planning which requires investing instead of short term cloud fees.

    But governments which exist as a representation of the collective... is deeply aligned with the shared public work that open source is; with the biggest difference being it has an organized management with funding, power and the overhead of safe guards. That power and funding are what brings about most it's political problems... Sadly, the corruption and failing to fight against marketing/lobbying but in the USA, the increasingly anti-social culture is the main reason we do not collectively take on any new pubic works.

    Open source projects are so unorganized, volatile, unpredictable it deters adoption and isn't enough to counter the close-minded thinking it is wrong for collective works to replace privatized services.

    I do not think a national highway system could be built today. Obvious new public work projects that in the past would have easily been done have had trouble getting serious consideration. Such as, an information super highway... public health insurance, public healthcare, public car insurance, legalized co-operative insurance (illegal in some places...like public ISP are illegal too,) free college (high school wasn't free either until everybody needed it.) public recycling, trash, electricity.... or what everybody would lke: automatic TAX preparation by the IRS... which was proven cheaper but lobbyists killed that off.

    I've worked with local governments. They do have plenty of lazy workers. I've worked consulting too; they have just as many lazy workers but those are forced a bit more in my view. It comes down to management in each. The main difference is that the public employees care MORE than the private employee (especially now with the lack of loyalty to workers.) Public workers have at least tiny bit more loyalty to their community/country if not a lot more. Many of the poor ones I run into and explore out of curiosity actually cared too much and the dysfunction of the system crushed their spirit too much. This one is most easy to see in the ones who quit their careers as cops/teachers etc. and the ones who are still plugging along are in the middle ground. If we stopped hating on our public institutions (like Russia wants and has been doing since the cold war... you ignorant Americans haven't got a clue! ) these people would be far more productive and happy.

    1. Re:It makes more sense for Goverment by volcan0 · · Score: 1

      It is crazy, but I think you are right. I don't see how such a project would work today. Too much corruption and inflation. In Québec, we can't even build our own bridges anymore. We let private company do it, then charge tolls for like 20 years, they they give us the bridge back ( well maintained, I am sure....). All under the guise of we can't afford to build a new bridge. Well, you would if you were getting the tools ! I think the real problem is that we don't teach critical thinking in school anymore...

  28. Re: Name them, then. by Anonymous Coward · · Score: 1, Insightful

    Using open source to save money is a myth.

    OSS doesn't always save money, but may. Open standards may allow you to change supplier, though, and allows you to shop around the market better if others are using open standards. If the software you are using does not use open standards then you may have issues with integration, which can cost money.

  29. Re:All? Stupid question. by fluffernutter · · Score: 1

    Most of the IBM hardware supports Red Hat and SUSE, but you still have a good point because I couldn't see anyone buying a pseries machine and not putting AIX on it. You would be losing so many capabilities such as being able to dynamically resize partitions etc.

    --
    Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
  30. Meh by fluffernutter · · Score: 1

    Government has an obligation to make our data as safe as possible for as cheaply as possible and it ends there. If an open source solution fits those qualifications than use open source; but it's usually going to be a bad idea.

    --
    Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
  31. Theory vs practice by McLae · · Score: 1
    In theory, open source should be a no brainer to save money. Using open source can save tons of licence fees.

    IN practice, open source may not be compatible with legacy systems, or missing critical functionality. And support can be a nightmare, with no vendor to provide updates or respond to bug support.

    And before you say do it yourself, that adds more cost than the licences, for programmers, managers, testers, etc.

    1. Re:Theory vs practice by CRB9000 · · Score: 1

      Unfortunately, you are wrong. The U.S. Government requires all software purchases come with maintenance and support. When looking at software, the acquisition may be free, but we must purchase support licensing and the developer must be providing maintenance. This can be as costly as commercial closed source.

    2. Re:Theory vs practice by CRB9000 · · Score: 1

      Sorry, hit the wrong reply button, I'd say you amplified my other post.

  32. Government/Software Inside Baseball Stuff by CRB9000 · · Score: 1

    (Note: This applies to most U.S. Government agencies, but not all.)

    O.k., here is some "inside baseball" stuff. Every bit of software, from major applications, application helpers, plugins, drivers, etc. must be tested and accredited and supported. In a number of agencies, there are U.S. origin requirements.

    The large corporations, for example, Microsoft, host government employees, to include DOD civilian and uniformed, to be part of the testing process. A few years ago, Microsoft implemented changes to Windows 7 authentication directly as a result of the DOD move to smartcard (CAC/PIV).

    Support is another area of concern for the USG. All hardware and software must have continuing support, enterprise licensing, and continuing maintenance. The major corporations and some opensource do provide this, complete with published support and maintenance plans. They also participate in vulnerability assessment and reporting.

    If you want an open source project to be considered, you need invite the government in, and understand the software/hardware acquisition process and requirements. Simply tossing your source to the government saying, "Here, check it out for yourself" doesn't work.

  33. Direct experience: OSS is not a panacea by david.emery · · Score: 1

    I worked on a large program (that you probably heard about) with a lot of embedded and command & control software. We made extensive use of both COTS products and open source.

    Here are some of the impediments to using OSS we observed

    1. The plethora of licenses! We kept 2 lawyers (one government, one prime contractor) busy nearly full-time for several years evaluating open source licenses. Each project had a different license, that needed to be understood for its impacts on procurement, use, distribution and maintenance, and how the licenses work together in a deployed system.

    2. There was a big fight on the GPL. Many believed GPL would require the government to reveal all of its source code for this (weapon system) project. We never really did resolve this, and some GPL projects were disqualified from consideration due to license issues.

    3. Maintenance was a key concern. For a commercial product, you can negotiate maintenance with the vendor. For OSS, you -might- be able to negotiate a support contract with a vendor (e.g. RedHat). But the government also might need to assume the maintenance burden if it couldn't buy support.

    4. Related to #3: control of the evolution. With COTS products, there's a commercial entity that you can influence (including pay) to get the changes you need. With OSS, there's no guarantee the OSS product would migrate the direction you needed.

    5. Related to #4: Complexity of integration. If you have N products, you have N! ways those could fail to integrate :-)

    That being said, we used a lot of OSS in the project. We also took advantage of government site licenses on COTS, negotiated specific COTS contracts, and in some cases ended up writing our own code where we couldn't find an alternative. The project had a formal process for each significant component that required government and prime contractor concurrence. OSS tended to win in cases where there was a solid user community, some options for support (including training, by the way), and we understood the life-cycle risks. COTS won where there was an established product with clear maintenance costs (and things that the government already had site licenses for were obviously at a significant advantage.)

    And I still remember the one government group that showed up with a 1.2m line application written in Visual Basic, who were totally pissed when we told them "We have no provision for Microsoft Windows in our computing environment. If you want to use a Windows application, your group will be responsible for the life-cycle costs to buy WIndows licenses where you need them, install/provision Windows and the associated software such as Anti-Virus, pay for the support costs including software maintenance and the people costs to maintain a Windows environment, and the training for the users and administrators for Windows applications."

  34. Open Standards are the most important part. by biggaijin · · Score: 4, Insightful

    It seriously offends me when I download something from a government Web site and discover that I cannot read it without buying a copy of Microsoft Word or some other proprietary software. It is not my government's job to guarantee Microsoft a market for their products.

  35. Re:Direct experience: OSS is not a panacea by angel'o'sphere · · Score: 1

    4. Related to #3: control of the evolution. With COTS products, there's a commercial entity that you can influence (including pay) to get the changes you need. With OSS, there's no guarantee the OSS product would migrate the direction you needed.
    The idea of OSS is: you hire people to make the changes/evolution you want. So you actually have much more influence over an OSS project than over a closed source project. However you rather pay the $130/h to a company which might make some changes in time instead of the $100/h to a freelancer.

    Hint: if the software you want to be changed is Java, C++ or Python, you find hundreds of people here on /. who jump into it directly. Probably even a few dozen C# fans ...

    As I mostly live in Thailand no, I probably would even lower my price to $90 :P

    --
    Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
  36. Re:Direct experience: OSS is not a panacea by david.emery · · Score: 1

    That depends, of course, on finding competent workers and companies (even body shops) to contract with. For my project, that included all the overhead and pain of doing contract work for the US government. Usually, defense work requires be performed in the US by US citizens, so that rules you out :-(

  37. Re:Right solution for the problem, what's wrong he by drinkypoo · · Score: 1

    One has to "fight" with a situation where you have the same library named differently, installed in different locations, installed with older versions of the same depending on distribution...

    Unix supports that scenario just fine. It was only Windows where it was ever a problem (DLL hell) though even Microsoft has largely solved it now.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  38. Re:All IT systems should be using open source soft by drinkypoo · · Score: 4, Informative

    Windows is not open source, but users and developers are cheaper.

    You're ignoring the cost of running Windows. Not just the up front costs, but the maintenance costs, and the lost opportunity costs when closed source makes something difficult or impractical.

    I'd rather not pay the taxes needed to support all OSS.

    OSS supports YOU at the same time you support IT. It's not all outlay, you get the software back, and you get improvements from others.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  39. no, but by Tom · · Score: 1

    No, they should not exclusively use Free Software (sorry, "Open Source" guys, I never hopped on that bandwaggon) but they should have a strong preference for it.

    Sadly, there are many areas where no Free Software of adequate quality exists. Areas that are vital for government work, and a government should not restrict itself. However, if an adequate Free Software exists, the government should strongly prefer it.

    Security? Let's not forget two things: a) Free Software isn't bug-free, either, and especially tricky parts with security implications regularily don't get enough eyes on them. And b) we're talking about governments here. Unless you're the government of some tiny island, you can probably pressure big software vendors into giving you their source code for inspection. I mean, you seriously think the NSA (which is tasked with keeping the US government IT infrastructure secure) doesn't have access to the Windows, Office and whatever other source code they want? For large enough governments, every software is open source.

    --
    Assorted stuff I do sometimes: Lemuria.org
  40. Re:All? Stupid question. by drinkypoo · · Score: 1

    Apparently the submitter - and editors - fail to realize that many IT systems in the government are not PCs.

    The non-PC systems are waning, though. These days, the government is more likely to use cloud services, or otherwise employ a cluster of PCs.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  41. Re:Direct experience: OSS is not a panacea by angel'o'sphere · · Score: 1

    Perhaps I can masquerade as one :D

    Anyway, such jobs I would do remote, so it rules me out, as I don't plan to live in a mayour US city. Country side would probably be ok. But honestly I'm to old to do this green card shit and follow all the regulations, I would not even work for Apple or something like that. Oki, Space X ... that I probably could not resist.

    --
    Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
  42. Re:unrealistic by gweihir · · Score: 1

    An exotic example does not make a valid argument here. Incidentally, this will often be interbank agent owned software that they developed in-house and that is a trade secret. You only get the client side or the interface spec and that you may not even be able to buy.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  43. No, by WorBlux · · Score: 1

    It's not always feasable. However every government contract for non open source should include a provision for data export in an open format.

  44. I'd go further... by HiThere · · Score: 1

    They souldn't only be using Open Source, they should be using Free Software, preferably under some GPL or BSD license, with the weighing tilted towards GPL. And if they can't find it available, they should build it themselves (and publish it).

    There may be a very few small instances where they shouldn't publish it, but in those cases the software shouldn't be distributed in object form either.

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
    1. Re:I'd go further... by bloodhawk · · Score: 1

      FUCK that. government don't exactly have the best developers to start with. The last thing I want is them building it. It will mean $100,00 piece of commercial software will instead cost $10 million in development and then be ditched 2 years later for being unusable

  45. Re: Name them, then. by Anonymous Coward · · Score: 1, Informative

    >Using open source to save money is a myth.

    Whether or not FLOSS save money, depends upon what the comparison is with.

    License Fees: FLOSS is usually gratis. Non-FLOSS is usually non-gratis.

    Support:
    * Tier 0: Gratis for both FLOSS and non-FLOSS;
    * Tier 1: For non-FLOSS, when offered by the developer, it usually is gratis for a short period of time --- 90 days from date of purchase, or date of registration, is typical. When offered by a Third Party, as oft as not the cost of the first year or two is included in the price charged by the retailer, and the developer being completely out of the picture. Usually not available for FLOSS;
    * Tier 2: FLOSS is usually more expensive than non-FLOSS. FLOSS support packages tend to be per incident. Non-FLOSS support packages tend to be per seat, per year;
    * Tier 3: Non-FLOSS Tier 3 support generally requires a minimum number of seats per year. FLOSS Tier 3 generally looks at incidents per year.

    Training:
    * Non-FLOSS: First Party Training: Typically available, albeit at a high price;
    * Non-FLOSS: Third Party Training: Typically available, pricing is all over the map. Quality of training is also all over the map;
    * FLOSS: First Party Training: Typically not available;
    * FLOSS: Third Party Training: Can be difficult to find. When available, the cost is usually higher than the equivalent non-FLOSS Third Party Training;

    For Joe Sixpack, LibreOffice is going to be less expensive than Microsoft Office, simply because Joe Sixpack will purchase neither training nor support.

    For MySmallCompany, INC. Microsoft Office, with genuine Tier 2 or Tier 3 support, will save money, when compared to LibreOffice with Tier 2 or Tier 3 support. Unfortunately, most Third Party Tier 2 and Tier 3 non-FLOSS support is run by scam artists;

    For LargeEnterprise, INC. the cost for Tier 3 support is roughly the same, regardless of FLOSS or non-FLOSS status. The cost of training users for FLOSS is higher than training for non-FLOSS.

    For VeryLargeEnterprise, INC, FLOSS with Tier 3 support is cheaper than non-FLOSS with Tier 3 support. The additional cost involved in training for FLOSS may or may not equal the reduced costs of Tier 3 support.

    Remember, Sun purchased StarOffice, GMBH, because it was cheaper to do so, than purchase the same number of licenses for Microsoft Office.

    If you're a SOHO looking to migrate from Microsoft Office to LibreOffice, your best course of action is to retain a migration expert, to guide your organization in how to store and archive your existing data. Budget for per incident Tier 2 and Tier 3 support, for at least five years after migrating.

    If you're an SMB looking to migrate from Microsoft Office to LibreOffice, your best course of action is to retain the services of a company that has experience in migrations, for the migration period. Then retain an individual to do Tier 3 support. This individual can be either an independent contractor, or an in-house employee.

    Large organizations should have at least one individual, either an independent contractor, or in-house employee, whose sole function is to provide Tier 3 support for the FLOSS software that it uses.

  46. An example: Bioresearch by feranick · · Score: 1

    A possible example is in federally sponsored bioresearch. If money from the Feds are used, the data needs to be made public. Why not software? The fact that some is bad could be an opportunity to fund it to make it better. I don't really buy the idea that only FOSS software can be bad, while all paid one is worth. The former can be held accountable for its quality but not the latter...

  47. Re:YES! YES! YES! by uncoveror · · Score: 1

    I work in tech support at the IRS. Billions each year are thrown in fire for Microsoft software that is unreliable, and broken worse by every "fix" they send out. The Windows 10 Upgrade is a disaster. The ticketing system from HP is a waste of billions that gets in the way of doing our work. Adobe Acrobat is an unjustifiable expense now the PDF is no longer a patented technology. I could go on forever about the awful software billions have been wasted on, and how tech support is stretched way to thin trying to babysit all the junk. Instead of that, I will talk about something good. The VA's Vista system. It is the only electronic medical records system developed hand in hand with the doctors and nurses who had to use it, and the only one in the industry medical professionals don't hate. It was developed in house by the VA on the sly, as the bureaucrats never would have authorized its development. Government should stop wasting taxpayer dollars on commercial software, period.

    I feel your pain.

    --
    The Uncoveror: It's the real news.
  48. In many cases, they already do by whitroth · · Score: 1

    For example,Biowulf, 100th fastest supercomputer on the planet, at the NIH, mostly runs Linux. And many peopel use R, rather than paying the licensing for Matlab.

    Now, whether management wants to support Linux and OSS, or repeats in their sleep "THE WORLD BELONGS TO M$" is another story... but it's heavily used.

    Just for fun, slashdotters, look up https://www.spi.dod.mil/lipose... - a lightweight secure distro of Linux, can run from a flash drive.

    Put out by the US Air Force.

  49. Re:All IT systems should be using open source soft by Voyager529 · · Score: 1

    Windows is not open source, but users and developers are cheaper.

    You're ignoring the cost of running Windows. Not just the up front costs, but the maintenance costs, and the lost opportunity costs when closed source makes something difficult or impractical.

    These also apply for running OSS. I'm sure it's possible to ultimately replace Active Directory with some implementation of LDAP on CentOS, but a virtually any sysadmin with a pulse can go from bare metal to multiple domain controllers with checkbox-compliant GPOs, DHCP, DNS, shared folder permissions, and server clustering in an afternoon or two. I've yet to come across a drop-in replacement for that sort of core functionality in an OSS package. Additionally, a whole lot of closed source software only runs on Windows; moving to not-Windows yields lost opportunity costs on that end as well.

    I find myself as a software pragmatist. I would love nothing more than the Department of Developers (DoD?) whose job is to write OSS software that is compliant enough to replace closed source titles in use by the federal/state/local government. However, it would be a matter of principle, not a matter of cost savings...and it's been a very, very long time since we've had a political climate where such a department could be effectively founded and funded.

  50. Use the best tool for the job by Kryptonut · · Score: 1

    If one of those tools is Windows and one of those tools is Linux, who cares? As long as it's the right tool.

    1. Re:Use the best tool for the job by JustNiz · · Score: 1

      Except Windows isn't a good tool for anything on its own merit.

  51. Re:All IT systems should be using open source soft by Voyager529 · · Score: 1

    First off; In a world without Windows, why would you need AD?

    I'm not asking to be mean, but IMO this is one of the bigger problems with switching out proprietary software, specifically Microsoft's offerings. People are so indoctrinated, that they keep trying to solve Microsoft problems, the Microsoft way, which invariably leads to anything different being deemed "inferior". If you look at it that way, your question is the perfect example.

    Let's look at a handful of things AD does that would likely apply to Linux clients:
    1.) Centralized authentication. Users should be able to have their password apply to any computer in the environment. LDAP does this particular part pretty well.
    2.) Failover/Replication. LDAP supports this. LDAP does not support this in less than an hour from a bare metal install unless you have a bunch of scripts already written.
    3.) Group policies. How do you ensure different departments can only print to their own printers (Linux users print, right?)? How do you make sure profile folders are transparently redirected to the server (Linux users store data, right?)? How do you schedule patching intervals (Linux users want patches applied after hours, right?)? How do you specify proxy settings, especially when adding a trusted certificate for HTTPS filtering (Companies don't allow free-for-all internet access for Linux users, right)? Now, the answer may well be "shell scripts at logon", but do you have different scripts for different user/computer combinations? All of this is done via group policy.

    That's just off the top of my head.

    Secondly, your version of a DoD sounds like a good idea, but it wouldn't just be a matter of principle. It would be a matter of trust and control too. One can only ever have one master, and as long as we (as in we, the people of the state) rely on commercial actors, who ultimately have a completely different agenda and set of desires from what a state has, there will be conflicts of interests. It's crazy to have a state beholden to the whims and desires external entities!

    I'd love there to be a DoD, but I also fear that government developers would be hamstrung in some of the very worst ways. infinite scope creep, "why are we funding this finished project; we don't need no stinkin' patches?", "Your EMR connector needs to be able to understand data from $STATE_A and $STATE_B, each of whom use different systems built by direct competitors to be as incompatible as possible", constant subservience to the political and budget wind, standoffs regarding who gets to make the standard and who gets to conform to it (exacerbated if a state who has opted out of a new system still has to get their current one into compliance), incumbent systems dating back to the 80's, kowtowing to requests of different states if they're willing to directly fund projects, secondary effects from/to the private sector, and even the fundamentals - do they assume you're running GovSys from the BIOS up, do we assume Windows and GovLinux versions of everything, can they write a program with a depedency on Oracle? Could they do so if Oracle was compelled to release a version of their software that could be utilized to fill that requirement without expenditure, and if so, do we now reopen the can of worms that was the San Bernadino iPhone case?

    A new country starting today could probably make that one of their enumerated departments and require conformity from the very first computer purchased might have a fighting chance. China and DPRK who own the major software houses anyway could have one; it'd basically be a standards body at that point - one of the silver linings of an absolutist government. The USA...sadly...would be a super difficult place to make that happen.