Open Source and Governments

While one can argue for greater efficiency, it’s still a double-edged sword:

  • more eyes on the code empowers white-hat developers to highlight problems (like the xz success story where hacking was detected before it could be used)
  • but public source code would let state actors reverse engineer even more easily, giving an order-of-magnitude leg up, and maybe making North Koreans or Hamas capable of major disruptions.

What do you all think?

5 Likes

Definitely go open source. Where features are missing, government can sponsor open source development instead of purchasing closed products. Government can also sponsor in-depth security audits–that would benefit many. Almost all open source projects offer paid support, one way or another.

FWIW, I think it parallels my opinion on government-funded research at universities–publicly paid ==> publicly owned. (After a suitable delay for secret research on national defense.)

5 Likes

The Obama administration Office of Management and Budget (OMB) issued OMB Memorandum M-16-21, directing federal agencies to make custom-developed code available for reuse across the federal government and, where appropriate, to the public.

Agencies are required to share their custom-developed code with other agencies to promote efficiency and reduce duplicative spending. Agencies are also encouraged to release at least 20% of their new custom-developed code as open source software for public access.

source

6 Likes

Open source may make it easier for adversaries to reverse engineer opaque systems, but that’s the wrong metric. The important metric is the first derivative of the number of vulnerabilities the adversary can exploit, or said another way, how fast they can find new vulnerabilities. This metric is a function of how many unknown vulnerabilities exist, how many known vulnerabilities are not defended, and how difficult the vulnerabilities are to find and exploit. Without thinking about it too deeply, my gut feeling is that open source would move the needle on the parameters, but the final metric doesn’t change much because changes in one get balanced out by changes in the others.

7 Likes

Thinking about this, not even deeply, suggests to me that all three of those metrics improve with open source. :man_shrugging:

6 Likes

Do university patents belong to the government or public?

Since taxpayers funded the research they should own the patents

3 Likes

Not giving the inventors and universities an incentive, nobody will care. It’s already bureaucratic enough with inventors paid peanuts.

4 Likes

I am not sure how it works for an invention from a university. How does it compare to a typical corporation where the inventor gets the patent, but the corporation gets all the financial benefits a patent may afford? Does the university get the financial benefit? Does the researcher get royalties? Can the researcher start their own company based on the patent developed while being funded by the public?

I know, at least many years ago, for a patent from say the US Navy, a corporation could acquire that patent by paying the Navy. I believe the patent would have individuals names on it, but the Navy received the benefit. I would assume it would be the same for a patent from research as a university employee.

3 Likes

I worked with a fellow who was credited for at least 10 patents while working for Xerox Parc. I asked him if he owns the patents. He said no, they all belong to Xerox Parc.
We had this conversation over 20 years ago.

2 Likes

You get paid far more at an industry R&D facility than in academia. And yes, universities rev-share with inventors. The tech transfer offices fund themselves with patent royalties, but the cost of this is substantial, so the inventors get a relatively small share.

3 Likes