So you point to one instance of highly targeted sabotage aka sanctions. But Snowden and others exposed many instances of espionage dragnets.

It's funny, I was doing some budgeting stuff, and I ran into some corruption of payee-data in my bank's export files.

Good: I already wrote a script to fix the exact same issue.

Bad: It was in a pile of old stuff from 10+ years ago.

Good: It worked anyway.

Bad: The bank still has the same bug.

At a certain size (and government departments are absolutely large enough) it makes sense to manage software deployment centrally, from an internal package repository/cache.

Once that’s in place, the process for populating that repository can easily adopt locally modified versions of upstream software: defaults changed, bugs removed, features added, etc.

No one in a big business/government blinks at changing group policies for internal deployment. Changing the code is really very little different once the ability to do so is internalized.

The culture can only change when it actually becomes possible to make any changes to the systems.

If all the software one institution uses comes in the form of proprietary binaries, there is simply no need to even think about making policies about fixing those systems in-house.

I wonder if it is in fact easier in a German region than a bank though. A bank has massive compliance complications, where the state insists on rules being met, so their are teams of people trying to make sure no rules being broken, and therefore anti-change. Germany is a Federal system, and the region has law making powers, a bit like a US state. Therefore it can set the rules to make sure migration to a new system happens. If big fixes are not allowed, they have themselves to blame. At a bank it is the state causing the friction.

EU bureaucracy is where optimism goes to die

> How does anyone "control" an OSS project in the sense that you are talking about, so the ability to insert backdoors or activate kill-switches?

A government can control a piece of open source software the same way a big tech company does - with economies of scale. In other words, by throwing more money, resources, and warm bodies at their open source projects than anybody else.

The code itself might be under an open license, but project governance is free to remain self-interested and ignorant of the needs of the "community."

Any pull request accepted from outside isn't a mutual exchange of developer labor for the benefit of all, but the company successfully tricking an outside developer into doing free work for them.

Any pull request that runs counter to the interests of the company can and will be ignored or rejected, no matter how much effort was put into it or how much it would benefit other users.

Any hostile forks are going to be playing a catch-up game, as community efforts cannot outpace the resources of most large companies.

Linux is not a smart target. But OpenOffice, nextcloud, postfix, those are much easier targets for developer coercion to compromise widely installed software that is important for "linux on the desktop". Ah and ofcourse also the desktop environments, and perhaps systemD are all in a privileged position with much less eyes on.

The thought was that the government would effectively become the largest employer of OSS developers who would then be compelled to follow directions or be out of a job. Would there be enough independent developers to review millions of lines of code, patch out any back doors, or fork and maintain an entirely separate projects, since none of the government protects can be trusted?

Could the government also dictate the operating system and software people use to make sure it is the state sponsored one? If I’m not mistaken some similar actions have happened in N Korea and China.

I’m not saying this is an inevitable outcome, but just trying to think of worst case scenarios. A lot of terrible things have started with good intentions.

Haven't used Windows in almost a decade, has it gotten that bad?

I can't log on to a windows computer if the cloud account don't exist? What if there's no internet?

Not quite. Because that requires pushing an update and only hits those who have windows automatic updates enabled. A lot of companies run those updates on a slight delay, which means they have a decent enough window to block such an update. Microsoft is a big thing to worry about when it comes to independence from the emerging fascist government of the US. But not because 'they can shut off windows'.

The short-term fear should be in enterprise cloud (See ICC judges). The long-term pain lies in blocking security updates (As happened to Russia). One might worry about malicious updates being pushed, but the legal grounds for that are flimsy to non-existent, and Microsoft has very strong business reasons to push back. So even the trump administration would be smart enough to instead target the cloud solutions. Since the legal precedent is very clear and well lubricated "providing services to sanctioned entities", and the business impact is equally crippling.

Yup.

Microsoft pledged not to intervene like that again, reclassifying its legal interpretation of its own services, and added language to its contracts to guarantee that it would fight future US attempts to do so:

https://www.politico.eu/article/microsoft-did-not-cut-servic...

When the US manages to force Microsoft to do something, it responds by trying to protect itself from the same scenario in the future. Because it wants profits. The ICC leaving Microsoft is the last thing Microsoft wanted.

...and how did Microsoft respond?

https://news.ycombinator.com/item?id=46182023

Also, how about less snark about the "news in my jurisdiction"? Since the first amendment provides more press freedoms than many European countries have.

The employees don't care about software sovereignty. They just want to do their jobs and get their paychecks. Fail to win them over and the transition will fail as well.