Someone should make the point to these agencies [LWN.net]

Someone should make the point to these agencies

Posted Aug 9, 2026 16:07 UTC (Sun) by koverstreet (subscriber, #4296)
Parent article: Changes in shadow-utils password-expiration features

"Working with upstream and the community" is something that ought to apply to them, too :)

A lot of the security recommendations that get audited for compliance are of pretty dubious value, often outdated and counterproductive; the underlying issues tend to get fixed over time.

The regulatory agencies may not (don't) have engineering staff to be involved with fixing the issues, but I think there's a strong case to be made that if they're making broad policy recommendations on how to configure system X there needs to be open lines of communication between them and the system X maintainers. Productive development tends to come from good communication with users, and we've got tools they can use; bug trackers for tracking bugs, mailing lists, et cetera.

And as a maintainer, if someone out there is making wonky recommendations on how to use my code, I certainly want to be in the loop! Cuts down on the "you're holding it wrong" bug reports :)

It might be useful for projects like shadowutils to make up a public list of regulatory policies that apply to shadowutils with comments on "does this still make sense, or is it out of date with the promulgators AWOL" - it sounds like you're making that list anyways, just throw it up on the website where users can find it.

Sort of a reverse "auditing the auditors". And if there's something semi official up from the experts, it might give the actual users leverage to push back on nuttier policy.

We're probably going to be seeing the intersection of open source maintainers and regulatory policy only increase - c.f. all the age verification laws popping up. We the experts on the technology should probably be making our positions known and explaining the reasoning in language they can understand, rather than just adding whatever crap the regulators dream up.

to post comments

Someone should make the point to these agencies

Posted Aug 9, 2026 16:45 UTC (Sun) by kleptog (subscriber, #1183) [Link] (3 responses)

> The regulatory agencies may not (don't) have engineering staff to be involved with fixing the issues, but I think there's a strong case to be made that if they're making broad policy recommendations on how to configure system X there needs to be open lines of communication between them and the system X maintainers.

Well sure. Regulatory agencies have many mechanisms for providing input: working groups, requests for comment, etc. They however are not going to proactively approach developers. If you think an agency is doing something that affects your project it's up to you to lobby, or find someone to do it for you.

In the specific case of the Spanish CNI, they're apparently an intelligence agency so by their nature not very open, so they're not a good example here. But at EU level you have ENISA which is much more open. Someone should probably send CNI a note that ENISA moved on from password expiry and they should follow suit.

You're not going to get into ENISA as an individual developer though, but organisations like OpenSSF and Apache/Eclipse foundation as well as businesses like RedHat/Canonical have an interest in representing open source projects. I think open-source as a whole does a decent job of lobbying (see the efforts around the CRA) but we're still on the reacting side. We're not yet at the point were the initial drafts of things take OSS into account.

> We're probably going to be seeing the intersection of open source maintainers and regulatory policy only increase - c.f. all the age verification laws popping up. We the experts on the technology should probably be making our positions known and explaining the reasoning in language they can understand, rather than just adding whatever crap the regulators dream up.

ISTM that were doing an ok job. Sure, it might be nice if F/OSS was a bit more organised rather than relying on the goodwill of various tech groups/businesses/etc to represent them. But I think we're doing as well as can be expected given the type of people that that do F/OSS.

Someone should make the point to these agencies

Posted Aug 9, 2026 17:08 UTC (Sun) by koverstreet (subscriber, #4296) [Link] (2 responses)

> Well sure. Regulatory agencies have many mechanisms for providing input: working groups, requests for comment, etc. They however are not going to proactively approach developers. If you think an agency is doing something that affects your project it's up to you to lobby, or find someone to do it for you.

Are you sure they never do?

If they don't, then they're being lazy idiots. No matter what your job is, you can't expect everything to come to you, you have to seek things out sometimes, and if you're promulgating regulations on specific software packages without ever reaching out to say "hey, this is us at X, this is what we're doing and why, this is how to contact us", then that's sheer lazyness.

> ISTM that were doing an ok job. Sure, it might be nice if F/OSS was a bit more organised rather than relying on the goodwill of various tech groups/businesses/etc to represent them. But I think we're doing as well as can be expected given the type of people that that do F/OSS.

That sounds like a cop out :)

If you're the expert at something, part of your job is education so that knowledge doesn't die with you. F/OSS isn't a hobby underground thing anymore, we build and maintain the infrastructure the world runs on, so part of our job description is now education - if not ourselves personally, getting organized enough so that it happens.

And I personally avoid the word organization, because that calls to mind meetings and committees - i.e. places where work doesn't get done. It's more about recognizing good ideas and getting the ball rolling so it becomes something we as the OSS community culturally recognize as something worth doing.

You can do a lot with just the right sort of encouraging conversations here and there, and making stuff visible that you were doing already by making your notes presentable and public.

A big part of my job right now is just the documentation and test infrastructure version of this. I'm not spending a ton of time writing new bcachefs code right now, a lot of it has been documentation and test infrastructure and working with people in those areas so that hopefully someday it can just be the default expectation that those parts of the project, and people will pitch in and help out because they see me doing it instead of seeing it as shit work that no one else wants to do. And it seems to be working pretty well; point is, this job isn't just about writing code, and leaving stuff to the organizations you mentioned often results in stuff not getting done or getting done badly. There's just a lot that goes into having a functioning ecosystem.

Someone should make the point to these agencies

Posted Aug 9, 2026 19:01 UTC (Sun) by pizza (subscriber, #46) [Link] (1 responses)

> If they don't, then they're being lazy idiots. No matter what your job is, you can't expect everything to come to you,

If "reaching out" is not part of an an agency's charter, then yes, by definition stuff is expected to come to you instead.

> F/OSS isn't a hobby underground thing anymore, we build and maintain the infrastructure the world runs on, so part of our job description is now education - if not ourselves personally, getting organized enough so that it happens.

...I'm sorry, but if you're not being paid, then by definition it is a hobby, and there is no "job" to have a "description". Much less placing any obligations on you whatsoever.

You know, the whole "This software is provided as-is, with no warranty whatsoever" shtick.

Someone should make the point to these agencies

Posted Aug 9, 2026 22:32 UTC (Sun) by alx.manpages (subscriber, #145117) [Link]

> ...I'm sorry, but if you're not being paid, then by definition it is a hobby, and there is no "job" to have a "description". Much less placing any obligations on you whatsoever.
>
> You know, the whole "This software is provided as-is, with no warranty whatsoever" shtick.

I'm certainly not going to do any boring work without being paid. If any user (actually, companies) are affected by policies and want me to teach them about those, and possibly centralize knowledge about known regulations of our software, I'm certainly open to consulting work, and of course, to being well paid for it.

And if intelligence agencies are affected by our software releases and they don't voluntarily come to us, they'll have to do more work, so it's in their interest to come to us and talk. If they don't, I don't give a ****. I'll keep having fun of having broken the (bad) scripts of an intelligence agency with a release.