Comment on The IRS Tax Filing Software TurboTax Is Trying to Kill Just Got Open Sourced
bitofarambler@crazypeople.online 3 weeks ago
really good article with a couple surprises in there.
"some people speculated that, because of the political pressure against it, its release must have been an act of resistance by someone within the IRS. But the open sourcing of the program was always part of the plan, and was required by a law called the SHARE IT Act. It happened “fully above board, which is honestly more of a feat!,” Given told 404 Media. “This has been in the works since last year.” "
Vinton told 404 Media in a phone call that the open sourcing of Direct File “is just good government.”
“All code paid for by taxpayer dollars should be open source, available for comment, for feedback, for people to build on and for people in other agencies to replicate. It saves everyone money and it is our [taxpayers’] IP,” she said. “This is just good government and should absolutely be the standard that government technologists are held to.”
“All code paid for by taxpayer dollars should be open source, available for comment, for feedback, for people to build on and for people in other agencies to replicate. It saves everyone money and it is our [taxpayers’] IP,” she said. “This is just good government and should absolutely be the standard that government technologists are held to.”"
Nice sentiment, but bad take. Open-sourcing the software that runs our military equipment would be a fantastic gift to the bad actors of the world.
security through obscurity is not security
Security can mean security against hackers, but it can also mean security against revealing classified information. Classified information about weapons systems (e.g. performance characteristics) is inherently embedded into the code running on those systems, and therefore shouldn’t be open sourced.
Source: used to write classified code
then the code maintainers are doing it wrong.
Any information that shouldn’t be public knowledge such as specs, account credentials, access tokens etc should be in a configurable/dynamic format such as an ENV variable or a config file, that way confidential info isn’t part of the working tree.
This should not be an issue in a properly maintained codebase.
A lot of functionality can be decoupled from anything that needs to be classified. A HUD is a HUD and no one should be hard coding in performance characteristics of the F-35 into it for example. I’ve also worked on government projects and holy crap does the code quality vary wildly, even before you get into “it’s still working so deal with the problems, it doesn’t have the budget for updates”.
Using ‘off the shelf’ parts/code can save significant time and money. There’s a reason subs use xbox controllers. Government websites and data interfaces at the very least should have the audit-ability that open source provides.
It seems to be working out fine in Ukraine…
Uh, clearly you haven’t seen the quarterly earnings reports.
Our entire Internet, the backbone of all encryption, all runs on open source software.
It is more secure because people can see and audit the code.
Let me flip what you wrote:
Our military equipment already is vulnerable. We just don’t know how badly because it’s not open source.
Prove it’s secure by releasing the code.
Our military equipment already is vulnerable. We just don’t know how badly because it’s not open source.
I’m gonna be honest, I’m sure China has many copies of the source code already
The GitHub page has a section for this:
Exempted Code
Not all source code, documentation and metadata used in the development of Direct File is included in this repository. Specifically, any code or data that is considered Personally Identifiable Information (PII), Federal Tax Information (FTI), Sensitive But Unclassified (SBU), or source code developed for National Security Systems (NSS), as defined in 40 U.S.C. § 11103, is exempt. Due to these restrictions, certain pieces of functionality have been removed or rewritten.
But does it build?!
Maybe it’s the military that’s incompatible with our values, not open source
The problem you’re describing (open sourcing critical software) could both increase the capabilities of adversaries and also make it easier for adversaries to search for exploits. Open sourcing defeats security by obscurity.
Leaving security by obscurity aside could be seen as a loss, but it’s important to note what is gained in the process. Most security researchers today advocate against relying on security by obscurity, and instead focus on security by design and open security. Why?
Security by obscurity in the digital world is very easily defeated. It’s easy to copy and paste supposedly secure codes. It’s easy to smuggle supposedly secret code. “Today’s NSA secrets become tomorrow’s PhD theses and the next day’s hacker tools.”
So what’s the alternative? If you can’t secure some and hack others, you’ve got to choose between insecurity for all or security for all. If you rely on security by design and open security for military equipment, it’s possible that adversaries will get a hold of the software, but the attack surface will be smaller than if relying on security by obscurity.
So, insecurity for all or security for all? I’d go for security for all every time. I want my critical infrastructure without ransomware. I want tyrannical governments out of my private life. I want reliable software. If someone is waging a war, they’re going to have to use methods that can actually create a technical asymmetry of power, and insecure software is not the way to gain the upper hand.
I’m sure there are exceptions for classified systems. Personally, I do believe all things developed by tax payer money should be released to the public including classified systems, given enough time has passed that the release of such information wouldn’t put anything or anyone at risk.
For the most part they are. You can find enormous troves of classified documents that have been made public, and a huge amount of once top secret technology and engineering eventually makes its way into the public space.
Yeah, they get open sourced by publishing them over the usual channels during disputes on the War Thunder discord server.
I am fairly confident that theNSA is aware of this kind of concern and they have an pretty cool repo.
Idk, they didn’t appreciate Snowden open sourcing a lot of their documents.
So open sourcing Tor, which protects our foreign operatives, was a bad idea? Implementing secure sockets for the web (TLS) was a bad idea? Publishing security vulnerabilities publicly (CVE system) was a bad idea?
All of those help our adversaries, but our adversaries also have an incentive to improve the code so everyone benefits.
Sure, there are probably some things that shouldn’t be released (i.e. something w/ a legitimate national security concern), but by and large, most things should. Tax software absolutely should, because there’s zero reason for the software you use to file your taxes (which is a legal requirement) to not be publicly auditable, because you’re on the hook for any mistakes it makes.
Watch this thread from here on in carefully separate the idealists from those who know what defence is like.
Anything I missed?
Yes, Virginia, it’s better to open all the things right now, but there are risks you haven’t taken into account because you’re not aware of them. The pros are; it’s their job and their work, so listen to their expertise no matter what the oppositional/defient disorder suggests otherwise.
Defense code can absolutely be open source, even the very sensitive code that goes into guidance systems on rockets and whatnot. Open source != publicly available, it means those who receive the code get certain rights to use and modify the code. This is imperative for the US government to provide timely updates to their equipment if the vendor is doing a poor job at it.
Yes, it’s ideal to open source everything, but not ideal to release it to the public. Once the code is no longer sensitive (i.e. the equipment is obsolete), it should be released publicly.
Depends on the application.
In some cases, it would be fantastic. But it’s clearly not a one size fits all, yeah.
Good thing no bad actors have root access. Agreed though; open source software is so notoriously insecure.
You know open-source doesn’t mean publicly available. It means the person, or in this case the US government, that brought the software should have free access to the source code to edit and distribute it as they like.
So yes, the military should use something functional equivalent to open source to prevent vender lock in and to allow for external audits. They probably shouldn’t give it to Russia or make it freely available online though.
At least not while it presents a national security risk. Once it’s largely obsolete, everything should be made public.
I’m sure a lot of military software, in contrast, is acquired from private companies that retain IP rights. Likely legal exceptions aside.
Ideally, any software the government buys or any firmware that ships on hardware the government buys should be FOSS, but not necessarily released to the public right away (i.e. if there’s a legitimate national security risk). That gives the government the option to fix issues they run into instead of being forced to wait for the vendor to fix them (if they ever do).
Don’t worry, that’s all written by defense contractors anyways, so they’ll sell it to the US, and to others the US allows, all closed source. The source won’t even be open to the US government, either, as that’d harm the bottom line of the contractor (support & maintenance contracts for that closed-source software).
I really don’t get why the government does this. The US government is a massive client, and they could probably force their suppliers to provide them an open source license so they can maintain it themselves. What else are military contractors going to do, not sell their guns? It’s not like the US gov is going to let them sell to countries we don’t like anyway, so it’s in their interest to play ball.
All code paid for by taxpayer dollars should be open source, available for comment, for feedback, for people to build on and for people in other agencies to replicate.
as long as its not military stuff, I don’t want to be able to download a simulator for nuclear bombs or something on my PC
outhouseperilous@lemmy.dbzer0.com 3 weeks ago
Dunno, sounds like some fucking commie shit to be. And not the kind i can someyimes get on board with when it comes time to do secret police shebanigans, but the bad scary kind where they dont even have a use for police.
Wouldn’t it be better to just give the code for free to a good corporate citizen who can be entrusted with its stewardship?
bitofarambler@crazypeople.online 3 weeks ago
only if the corporate citizen promise really hard we can trust them. like a super promise.
outhouseperilous@lemmy.dbzer0.com 3 weeks ago
Also we have to pay them whenever we want to use the code. Yes.
bitofarambler@crazypeople.online 3 weeks ago
you bought it, why shouldn’t you also rent it?
refurbishedrefurbisher@lemmy.sdf.org 3 weeks ago
We need better than that. We need a pinky promise.
sugar_in_your_tea@sh.itjust.works 3 weeks ago
That’s impractical, because for a pinky promise, you need to actually lock pinkies. We need a surrogate, like maybe the Commander in Chief?
czl@lemmy.dbzer0.com 3 weeks ago
Bro why are people downvoting this when it is so clearly a joke
fiddledeedee@sopuli.xyz 3 weeks ago
because its the internet in 2025 and we simply cannot tell anymore
outhouseperilous@lemmy.dbzer0.com 3 weeks ago
I can think of two reasons and both of them are hilarious.
sugar_in_your_tea@sh.itjust.works 3 weeks ago
A lot of people are completely incapable of reading obvious sarcasm, which is too bad.
Gladaed@feddit.org 3 weeks ago
/s dude, this is the Internet and you are not a person with a widely known stance.
outhouseperilous@lemmy.dbzer0.com 3 weeks ago
The candle that burns half as bright burns twice as long, and you, my child, will burn so very long.
Gladaed@feddit.org 3 weeks ago
Sick “burn”, but still a bit uncalled for, don’t you think?
sugar_in_your_tea@sh.itjust.works 3 weeks ago
To be fair, since it’s public domain, anyone can take it, modify it (and not release modifications), and try to screw you over w/ it.
outhouseperilous@lemmy.dbzer0.com 3 weeks ago
No but im saying it shouldn’t be public, it should be given to a good corporate citizen to maintain so we can rent it back when we need it.
sugar_in_your_tea@sh.itjust.works 3 weeks ago
Well, public domain gets you halfway there. You can still rent it later, provided the original is user-unfriendly enough that you’d be interested in alternatives.