'Securing Open Source Software Act' introduced to US Senate

Re:'Securing Open Source Software Act' introduced to US Senate by kube-system on Saturday September 24, 2022 @02:13AM (#32960099)

I said the issues are different and you disagreed, so I detailed what I meant.

It’s also not reasonable to require the government to just get 10,000 support contracts just to implement a single application.

What makes the most sense is what they’re doing here:

1. come up with a strategy for managing these risks

2. Collectively work with OSS developers instead of treating every one of the governments 10 bazillion projects like it needs a separate support contract for a component that is shared

[ Parent | on HN ]

Re:'Securing Open Source Software Act' introduced to US Senate by dllthomas on Monday September 26, 2022 @12:35PM (#32985204)

> I said the issues are different and you disagreed

I disagreed that things are all that different "if you have a support contract."

> It’s also not reasonable to require the government to just get 10,000 support contracts just to implement a single application.

I agree, but I'm not sure that's relevant? If a single support contract is sufficient for proprietary software - making them responsible for addressing (incl. possibly working around) issues in any dependency - why is that not also viable for FOSS software?

I don't disagree that what they're doing here seems likely to be a good idea, I just think you were initially selling "pay for support for the software you rely on as a big organization" a little short in its general applicability; indeed, this probably be viewed as providing that service internally.

[ Parent | on HN ]