I don't think it's everything, but the UK gov has a github account where you can do just that https://github.com/alphagov

alphagov is GOV.UK and shared services which are part of the "Government as a Platform" service line. Things like GOV.UK Notify (Twilio), GOV.UK Design System (Bootstrap), GOV.UK Service Manual (Ops manual), GOV.UK PaaS (Heroku, now defunct), and so on.

Every major UK government department has their own GitHub orgs:

- Healthcare, NHS: https://github.com/nhsuk/

- Education, DFE: https://github.com/DFE-Digital

- Justice, MOJ: https://github.com/ministryofjustice

- Taxes, HMRC: https://github.com/hmrc

And on and on the list goes.

Many things are private, but the 10th UK Government Design Principle is "make things open: it makes things better" https://www.gov.uk/guidance/government-design-principles#mak...

Imagine getting 10,000 pull requests and 7 originate from KGB hackers that solve a real problem but contain a vulnerability.

Wow, even using "Russians under the bed" to attack FOSS now.

even worse, we know for a fact all the shit the NSA did to our software, but muh spoopy russians instead

* * *

that's true, but, to be fair, it might be easier to order an anti-hacker CIA background check for a contracted company of 100+ employees, than for a 10,000 pseudo-anonymous github users.

Yeah, but how often do you perfom that check? In the end it is all about the code and whether it can be checked.

And I have to say my personal confidence in the quality of governmental code is higher if it is open source than if it wasn't — because I know some pretty paranoid people who would for sure check that could better than any contractor ever would.

Why bother when KGB hackers can already find a dozen of vulnerabilities just by looking sideways at a closed source project built by the most well-meaning team?

So I guess the solution is to not use open source, and force the KGB to have their agents hired as regular employees instead?

Valid risk [0], but that shouldn't keep the gov from making the code public. Open source / free software has its unique challenges, but it's a more fair model to people, and also it doesn't have challenges that arise from the code being "secret".

[0] example with the Linux kernel: https://www.theverge.com/2021/4/22/22398156/university-minne...

It's risk management. close 10,000 quick wins and hypothetically introduce 7?

many bug fixes open new bugs anyway due to poor architecture, this is what we should focus on

the prc is a greater threat than Russia anyway

The Labor and Welfare Administration (NAV) of the Norwegian government is doing exactly that, we have been opening up our code since 2018 and are accepting pull requests across our 2000 public repositories from those who want to improve government services https://github.com/navikt this has also enabled a much more close collaboration between new and existing partners that was previously unheard of!

This seems so obvious, it's crazy this isn't being done everywhere.

I think the main reason why this is not done actively in Germany, is missing people with expertise. Lots of old guys from the pre-internet era taking care of the technical systems. Unfortunately, the gov is not doing much to make at least official positions attractive to young programmers. And of course, if it's done by a contractor, they do not wat to share any code with the public.

Only somewhat positive example from the recent past is the Corona warning app: https://github.com/corona-warn-app

This might be because the government is a really unattractive employer both in terms of culture and remuneration.

However I have met some truly brilliant people working for the city of Berlin. They're just limited by red tape and diffusion of responsibilities, not to mention the amount of work that needs doing.

Opening the code up to pull requests could give the city IT a free boost from motivated citizens, I think.