{"action":"created","issue":{"url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/26","repository_url":"https://api.github.com/repos/WhiteHouse/source-code-policy","labels_url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/26/comments","events_url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/26/events","html_url":"https://github.com/WhiteHouse/source-code-policy/issues/26","id":140258986,"number":26,"title":"Peer review of source-code policy","user":{"login":"mikeBeviBevi","id":5783280,"avatar_url":"https://avatars.githubusercontent.com/u/5783280?v=3","gravatar_id":"","url":"https://api.github.com/users/mikeBeviBevi","html_url":"https://github.com/mikeBeviBevi","followers_url":"https://api.github.com/users/mikeBeviBevi/followers","following_url":"https://api.github.com/users/mikeBeviBevi/following{/other_user}","gists_url":"https://api.github.com/users/mikeBeviBevi/gists{/gist_id}","starred_url":"https://api.github.com/users/mikeBeviBevi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikeBeviBevi/subscriptions","organizations_url":"https://api.github.com/users/mikeBeviBevi/orgs","repos_url":"https://api.github.com/users/mikeBeviBevi/repos","events_url":"https://api.github.com/users/mikeBeviBevi/events{/privacy}","received_events_url":"https://api.github.com/users/mikeBeviBevi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-03-11T18:40:06Z","updated_at":"2016-04-10T17:50:05Z","closed_at":null,"body":"Thank you for the opportunity to take part in the review of this policy.  The following is my review:\r\n\r\n_**General observations**_\r\n\r\n- There  should probably be a preference for abstraction and not implementation in this document for certain sections of this policy.\r\n\r\n- Does the federal government agency need to report when they are using OSS?  If this policy is seeking transparency than I think there needs to be record of not just when an agency is \"pulling down\" the source code, but also when they are actively using it.  I also wonder how this information would drive the OSS community.  I'm not entirely convinced that this would not somehow hinder the diversity of work that has made the OSS community what it is today.\r\n\r\n- There is some re-stating and frivolous re-wording through out this policy that should be removed.  Try to keep descriptions of unrealized benefits to a minimum or at least segregated from sub sections describing specific devices.   \r\n\r\n- Must there be a clear distinction between when a federal employee has made a contribution to source code and when a non-fed has?  At what times are contributions by fed employees considered to be work done by the federal government?  Can federal employees charge for this time?  Can non-feds charge for this time?  What work can be charged and what cannot in refernce to work done to fulfill this policy? \r\n\r\n**_Specific critique_**\r\n\r\n**Line 20** Possible rewording, because there is no process defined, nor a federal platform for agencies to share source code even if they wanted to.  The current wording seems to say that it is currently the individual agencies short comings which are costing tax payers dollars.\r\n\r\n**Line 77** - I also think that certain operational systems should be considered for exception.  I think some other criteria for exception might be\r\n\r\n-  systems which provide access/manipulation to sensitive personnel information that is not necessarily classified or part of military operations.\r\n\r\n- certain safety critical systems such as air traffic control\r\n\r\nIn general I think the same methodology for determining security classification could used when we replace the words \"national interest\"  with \"human lives\" or \"national economic impact\".  I'm not certain as to what the criteria should be.\r\n\r\nI do think that  systems that are to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications). Might be considered for exception.\r\n\r\nNote: I realize that the rules for filing for an exception are later stated however, the reference used here has wording that I think might conflict.\r\n\r\n**Line 86**  - could be tricky because the federal government has many times taken on software that was originally developed by contractors.  I think that when the federal government makes any change to these products or has been deemed to be the sole maintainer of the product than that source code should be made available under the terms of this policy.\r\n\r\n** Lines 98-103** - I believe there should be a general preference for existing Federal open source solutions than COTS products when not taking into consideration total costs to agency.  In reality,   short term/long term costs and scheduling are the factors that weigh most heavily into this decision.\r\n\r\n**Line 103** -  Not just custom code form scratch or proprietary solution but, build off of open source solution.\r\n\r\n**Line 113-114** -  What OMB policy is the use of cloud based technology consistent with?  This is not specified in \"Raines Rules\". What is the reasoning that cloud based deployment solutions are preferable?  Also does this mean a federal government owned cloud service or the cloud of some third party business?  I would think that the federal government should maintain its own “community cloud” for deployment which could be configured by each system making use of the deployment service.  This would be a shared service across federal government.  We can still keep data and source code hosted publicly. Also cloud computing is a  \"buzz word\".  Since NIST is mentioned later in this document I offer their definition:  \"Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction\".  This definition seems vague at best.  I do not believe stating the preference for cloud computing is appropriate for this policy.\r\n\r\n**Line 119** - What does it mean to demonstrate a preference?\r\n\r\n**Line 124 - 129** - COTS products are different than open source.  I believe there should be a preference for open source before COTS product with consideration for my comments made on **Lines 98-103**.\r\n\r\n**Lines 136 - 141** There should be a preference for developing a solution based off of any existing open source code before developing solution from scratch or customizing existing federal or COTS product.  With the understanding that the customization of the COTS product source code would be under open source licensing described in this policy.\r\n\r\n**Lines 145-149**  There should also be consideration made for not only copyright, but also trademarking.  I believe that there is currently or could be code developed with federal funds that have been part of a system that has been trademarked by companies contracted by federal government.  software created on behalf of the government should not be subject to trademark protection.  Also  often the copyright of source code is largely predicated on the process or algorithms that are unique to that source code.  In some cases, it is the federal government entity that is creating this design and the third party is contracted to implement it.  In these cases, I believe that the source code should not be subject to copyright protection.  There must be a mechanism to accurately track these track these cases, either by mandating that a design be uploaded to some federal repository or some other mechanism.\r\n\r\n**157 - 160**  I'm not sure that this policy should dictate the deliverable.  That should be in the terms of the individual contracts.  If the federal government desires to be that specific than I think build instructions, user guides, test suites etc. should be defined here or in a supplement to this policy. I also think that it would be useful to have a supplement to that might attempt to recommend deliverable artifacts based on some classification of software development contracts that we have yet to define.  Perhaps something related to scope of complexity, cost, type of system, or specific agency.\r\n\r\n**Line 162-164** - These terms should be dictated by some specific open source licence that has yet to be or already been established as acceptable by the federal government.  Perhaps one of the licences defined by NIST? \r\n\r\n**Line 167** - define unlimited data rights\r\n\r\n**Lines 177-179** - I propose the creation of a new \"Open government licence\" which would be used for \"government -wide reuse of custom-developed code\"\r\n\r\n**187-188** -  Please define peer review and security testing or make reference to some existing material.  These processes can vary greatly depending on the project.  I think the federal government should have some definition of minimum criteria for peer review and security testing.\r\n\r\n**Section 5.0** -  Possibly move the text of this section to an earlier part of this document.  This is a more general discussion of the purpose of this policy.  This section should be labeled something like \"Road map\" or \"Implementation\" to group the remaining subsections.\r\n\r\n**Section 5.1** - Rather than each covered agency releasing 20%, why not choose agencies with operations that have been deemed to have low risk to human lives/sensitive information/security etc.  and have those agencies take part in the pilot program to determine proof of concept.  After the impact assessment, another group of agencies should take part in this program.  The order would be based on the amount of risk each agencies operations have to the areas described above.  There also be an allowance for any CIO of an agency to request  admittance to the program earlier than scheduled if they should choose.  Also the code contributed as part of the 20% should not be incomplete.  If code released as part of the 20% requires some dependency that can be described as \"newly-developed custom code\" than those dependencies must also be released as well.  This is to prevent unusable/incoherent/un-compilable code from being released to meet the 20% criteria.  Again I would not that many times federal employees are designing the software or in some cases are dictating the source code to contract personnel.  I question whether or not that code would be considered as developed by third part vendors.  This needs to have a clear distinction.\r\n\r\n**Lines 245 -246** - Please define criteria that will be used to evaluate the success of this pilot program in a supplement to this policy.  (lines of code contributed, labor months saved, etc.).\r\n\r\n**Line 268-269** - Frivolous statement \"Open development practices....\"\r\n\r\n**Lines 270-273** - Define engaging the public.  What is the minimum level of engagement?  What if there simply is not an interested community for the source code? Define alpha and beta phase.  This varies wildly between projects.  Also refrain from using \"1.0\"  To my knowledge and my experience there is no standard software versioning  that is used across software projects.  There are many schemes accepted to be part of best practice and many custom schemes that are actively used today.  instead describe the state which the software must be in before official release.  Although again I think this is getting into to deep into implementation of this policy.\r\n\r\n**Lines 274-279** - Define incremental release schedule.  I also think this is to deep into implementation.  What is considered incremental for one team could be much different than another.\r\n\r\n**Line 280** - define \"User\".  Who is the federal government engaging?\r\n\r\n**Lines 285 - 291** - What are the criteria for consideration?  I  think there should be some minimum standards either described generally here or this policy should enforce each project to define their own minimum standards.\r\n\r\n**Section 5.2** - Who's job is it to enforce these policies and provide oversight on this community?\r\n\r\n**Lines 292 - 304** -  Who is responsible for this documentation?  This this change depending on whether the original author or designated \"owner/manager\" of the project is a federal employee or not?\r\n\r\n**Line 318** -  Are \"web manager\" and \"digital strategist\" positions defined by the federal government?  Does every agency have this position slotted?\r\n\r\n**Lines 324-332** -  Who will be developing/managing the content of Project open source?  Will the federal government also accept public input for this effort?  Will there be access levels created to separate federally accessible information from publicly available information?  Who woudl control those access levels?\r\n\r\n**Lines 336 - 340** -  Who will be held responsible for funding efforts associated with transferring source code from current repositories (or lack there of) to these public ones?  Who will fund training for federal personnel and current contractors who must now use these repositories?\r\n\r\n**Lines 344 - 354** -  How are individual artifacts in this inventory defined?  Where is this inventory maintained and how is it made available?  Who is it made available to?  \r\n\r\n**Lines 356 - 362** - Can agencies request updates to this schema?  How do they accomplish that?  Who will be defining this schema? \r\n\r\n**Lines 383 - 385** - What is the quarterly Integrated data collection?  Who performs this collection? How is the data used? Is that data available to the public?  Same for PortfolioStat, IT dash etc.\r\n\r\n**Lines 404 - 412** -  I think these exemptions and general reasons should be captured in meta data found in the enterprise code inventory.  I know this is stated later but I wanted to make it clear that it was part of the schema.\r\n\r\n**Lines 409-410** -  I would even go so far as to say that there should be some automated process to scan code before it would be uploaded to the national open source repository so that we could prevent such information from being uploaded.  We could also require that the uploader confirm that they understand they are held responsible for the information that is uploaded.\r\n\r\n**Line 412** - Please give examples to clarify.\r\n\r\n**Line 431**  Please define source code. \r\n\r\n**Line 431 - 435**  What about code that has neither been funded by nor used by the federal government but has been uploaded to the publicly accessible federal code repository?\r\n\r\n**Line 452** - remove frivolous use of \"agile\".  Agile is a formal set of principles that dictate a certain engineering development life cycle model.  This policy should not dictate the development model used for a particular system.  This needs to be left up to the managers of the system so that they can pick the model which meets their needs.  There is no development lifecycle model that can meet the needs of all systems.  This document needs to refrain from using such language.\r\n\r\n**Line 461** - Regarding the mention of opensource.org. What is the approving process for determining licences and other definitions?  What influence does sponsorship have on the standards that this site recommends?  I think the definition of open license and which open licenses are accepted should follow the same model as the source code that falls under these licenses.  I mean to say that the decision making process should be transparent and input should be accepted from the general public.  I think the federal government should list the specific open source licenses that are considered acceptable for this open source code policy or it should have representation on any board that has been tasked to do so.  There are possibly many other groups whose aims are similar to but conflict with opensource.org.  I think it is important that the federal government does not appear to give preferential treatment in this case.  What is the relationship between opensource.org and project-open-source.cio.gov (if any)?\r\n\r\n**Line 489 - 494** - I believe the definitions of software, computer databases and computer software documentation need to be updated in 48 CFR 2.101.  Part ii. of software definition and the definition of software documentation have overlap which should not exist when trying to draw a distinction.   Specifically, Design details, algorithms, processes, flow charts, formulas, that allow programs to be produced or created could also be defined by computer software documentation.  By definition of software, I am not convinced that a computer database should not be considered software.  That is dictated by house the specific data in the computer database is used.\r\n\r\n**489 - 500** - These two definitions should have a direct relation by using common language in their definitions.\r\n\r\n\r\n**496 - 497** -  What does it mean to be readable by people?  A picture is not “readable” however it could be used as source code.  Are we referring to any person or the general human population? I think this needs a more specific description. A possible definition of source code could be any information that could be represented by binary data and/or cause some machine function.  I believe that a broad definition, such as this, could easily be abused.  I think we should ensure that we cover any Esoteric languages in our definition.  Here are some examples: https://en.wikipedia.org/wiki/Esoteric_programming_language\r\n\r\n**497 - 498** - Is this to say that only the precompiled/interpreted data is considered source code?  It might be beneficial to define compiled and or interpreted.\r\n\r\n**498 - 500** - This is not part of source code definition and should be stated else where.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/comments/208030433","html_url":"https://github.com/WhiteHouse/source-code-policy/issues/26#issuecomment-208030433","issue_url":"https://api.github.com/repos/WhiteHouse/source-code-policy/issues/26","id":208030433,"user":{"login":"benbalter","id":282759,"avatar_url":"https://avatars.githubusercontent.com/u/282759?v=3","gravatar_id":"","url":"https://api.github.com/users/benbalter","html_url":"https://github.com/benbalter","followers_url":"https://api.github.com/users/benbalter/followers","following_url":"https://api.github.com/users/benbalter/following{/other_user}","gists_url":"https://api.github.com/users/benbalter/gists{/gist_id}","starred_url":"https://api.github.com/users/benbalter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benbalter/subscriptions","organizations_url":"https://api.github.com/users/benbalter/orgs","repos_url":"https://api.github.com/users/benbalter/repos","events_url":"https://api.github.com/users/benbalter/events{/privacy}","received_events_url":"https://api.github.com/users/benbalter/received_events","type":"User","site_admin":true},"created_at":"2016-04-10T17:50:05Z","updated_at":"2016-04-10T17:50:05Z","body":">  The government is no stranger to managing huge complex safety critical, and secure systems.\r\n\r\nI agree. And if you can further stipulate that most open source developers *are* strangers to the legal complexity of those systems, then the license should be optimized for the developer's use, not the government's as the government will be able to navigate the complexity of the process, whether that complexity is in the license, or around it, whereas the developer will not.\r\n\r\n> I think this is a complex issue that might not be satisfactorily covered by current open source licenses.\r\n\r\nCan you provide some examples of those edge cases? How are they not already covered by federal law (e.g., logo use, impersonation, implying endorsement)? How is the complexity of this large, bureaucratic and highly regulated organization sufficiently different than other highly regulated bureaucratic organizations (e.g. financial services, healthcare) that are able to participate within the open source community under existing licenses? Is that difference so sufficient as to justify creating a new license that would shift all that complexity on to developers?\r\n"}}