A content analysis of the submitted responses to the US Government’s Request for Information on Open Source Software – Part I: Results
In August, the United States Government issued a Request for Information (RFI) regarding open source software. The objective was to gather input from the private and public sectors and begin formulating a long-term strategy and action plan for the federal government to strengthen the open source ecosystem.
You can read more about the RFI through the following link:
Request for Information on Open-Source Software Security: Areas of Long-Term Focus and Prioritization
In response to this call, we (under the Dalewind Software name) submitted the “National Public Fund to Finance Open Source Ecosystem” proposal, which suggests establishing a federal-level fund modeled after Germany’s Sovereign Technology Fund. In our proposal, we specifically emphasized that the fund should account for the fast-paced nature of the software ecosystem and that the funding structure should be designed accordingly. You can read more about our proposal in the previous article.
***
When the RFI was completed in November, it received 107 responses totaling 786 pages from organizations and individuals with varied views on open source software, including large technology companies, foundations, research centers, and security firms.
Conveniently, public access to these diverse responses, capped at 10 pages, made the output of this consultation a valuable resource for researching how open source software is perceived in the industry and the types of solutions proposed to address the challenges.
When we started reviewing these responses, our goal was to identify those that were similar to our proposal. However, our work soon evolved into a more systematic analysis, and we decided to document our findings.
Results
You can access the following document, which lists all responses, the keywords we searched for, and our notes, via the link: ONCD-2023-0002 – Content Analysis.
Steps
Here are the steps we took to prepare the results:
- List several keywords to search for. For example, “Volunteer”, “Public good”, “Procurement”.
- Run a text search with these keywords within all the responses.
- If the response has the keyword, mark that response in the sheet.
- Read the full text of the marked responses.
- Determine true (✅) and false (✖) positives; for example, does the “volunteer” keyword appear when describing open source software or in another context?
- Take note of important sections and newly revealed keywords during the review (e.g., “Volunteer” leads to “Hobbyist”).
- Iterate through the steps with the new keywords.
If you wish, you can visit this online folder to access all the responses submitted to the RFI.
Categories & Keywords
Below is the list of categories, associated keywords, and the number of different responses they appear in. In the document, please check the “Notes” of each column to see the details and alternative keywords in the document.
Definitions: Which keywords does the response refer to when describing OSS?
- Volunteer: 22 responses
- Public good: 14 responses
Solutions: Which solutions does the response recommend?
- Government funding: 37 responses
- Procurement: 8 responses
- Tax credits: 7 responses
- Government OSPO: 4 responses
Systemic issues: Which systemic issues does the response mention?
- Underfunded: 12 responses
- Free rider: 6 responses
- Bureaucracy: 4 responses
- Cyber Resilience Act: 11 responses
Organizations: Which organizations does the response mention?
- OpenSSF: 23 responses
- OWASP: 12 responses
- Sovereign Tech Fund: 10 responses
- Open Technology Fund: 7 responses
- Open Source Initiative: 6 responses
Quick Remarks
Here are our brief remarks about the results.
Growing demand for public funding
Compared to previous conversations on financing open technologies, it is promising to see public funding promoted as a viable solution by numerous organizations. Degrees and conditions vary, but of 107 responses, 37 suggest government funding as a way to strengthen the open source ecosystem, including big tech companies like Amazon, Google, and Microsoft.
In line with this general consensus in the responses, it would not be surprising if the United States Government were to take a step towards creating a dedicated public fund to support the open source ecosystem. Such a move by the US, which could set an example for other countries, would be a significant milestone for the open source ecosystem.
Charity or business?
On the flip side, open source software is still primarily framed as volunteer work rather than a business activity with substantial economic value. While terms like “volunteer” appear in 22 responses, only a few mention the significant social and economic benefits open technologies can deliver.
Looking at this table, our view that the open technology ecosystem should be, or become, more business-oriented differs significantly from this general “charity” perspective.
Successful organizations
Under the Organizations category, the Open Source Security Foundation (OpenSSF), established under the Linux Foundation only three years ago, stands out prominently. Undoubtedly, the RFI is well within its scope. Still, it is impressive that it was mentioned in 23 responses, making it the most referenced organization.
Similarly, despite being just one year old, the Sovereign Tech Fund has been cited as a model in almost every instance in which dedicated public funding has been proposed.
Taking a closer look at the ingredients of these organizations could be a good practice, providing valuable insights.
Highlights
While reviewing the submitted responses, we noted numerous sections that stood out. You can continue by exploring the second article in the series, which features forty excerpts that we wanted to highlight from those notes.