{"thread":{"id":"63802","subject":"Security Questionnaires for Software Installation – Hillsborough County Public Libraries","startedAt":"2025-07-16T16:58:04Z","lastAt":"2025-07-17T22:45:05Z","messageCount":2,"participants":["Harrison, Latasha","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"522122","messageId":"DM8PR09MB65497709DE3054423B2FFDFFD556A@DM8PR09MB6549.namprd09.prod.outlook.com","threadId":"63802","inReplyTo":null,"subject":"Security Questionnaires for Software Installation – Hillsborough County Public Libraries","fromName":"Harrison, Latasha","fromEmail":"harrisonl@hcfl.gov","sentAt":"2025-07-16T16:57:59Z","receivedAt":"2025-07-16T16:58:04Z","isPatch":false,"sender":{"key":"harrisonl@hcfl.gov","avatar":null},"body":"Hello,\nI hope this message finds you well. My name is Latasha Harrison, and I’m a Project Manager with Hillsborough County Public Libraries.\nWe are planning to install your software on select staff computers, and as part of our standard procedure, our IT department requires completion of two brief documents: a Cybersecurity Questionnaire and software questions. I can attach both forms for your review. If there's a specific team member who handles these requests, please let me know, or feel free to forward this directly to them. We appreciate your help in supporting our security compliance process and look forward to moving ahead with the installation. Let me know if you have any questions. \nThank you, \nLatasha Harrison\nProject Manager\nLibrary Services\n \nE: HarrisonL@HCFL.gov\nP: (813) 276-2160 | M: (813)\n  352-1273\n \n102 E. 7th Ave., Tampa, FL 33602\nHCFL.gov\n \nFacebook  | \n X  | \n YouTube  | \n LinkedIn  | \n Instagram \n |  HCFL Stay Safe\n \nHillsborough County Florida\n\n\n  Please note: All correspondence to or from this office is subject to\n  Florida’s Public Records law.\n \n \n "},{"id":"522255","messageId":"aHl87-stEOn_AxIy@fruit.crustytoothpaste.net","threadId":"63802","inReplyTo":"DM8PR09MB65497709DE3054423B2FFDFFD556A@DM8PR09MB6549.namprd09.prod.outlook.com","subject":"Re: Security Questionnaires for Software Installation – Hillsborough County Public Libraries","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-07-17T22:45:03Z","receivedAt":"2025-07-17T22:45:05Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-07-16 at 16:57:59, Harrison, Latasha wrote:\n> Hello,\n\nHi,\n\n> I hope this message finds you well. My name is Latasha Harrison, and I’m a Project Manager with Hillsborough County Public Libraries.\n> We are planning to install your software on select staff computers, and as part of our standard procedure, our IT department requires completion of two brief documents: a Cybersecurity Questionnaire and software questions. I can attach both forms for your review. If there's a specific team member who handles these requests, please let me know, or feel free to forward this directly to them. We appreciate your help in supporting our security compliance process and look forward to moving ahead with the installation. Let me know if you have any questions. \n\nI'm certainly glad to hear that you'd like to use Git, especially for a\npublic library[0].  However, we are an open source project and many of\nour contributors are volunteers. The Git project is legally part of the\nSoftware Freedom Conservancy, a nonprofit that provides a legal\nframework for our project, but no paid staff to respond to inquiries on\nbehalf of the project.\n\nIt's generally considered impolite to ask contributors to open source\nprojects to fill out paperwork, since this paperwork is different for\nevery company, it doesn't really benefit us or the project in any way to\ndo so, and it would take so much time that we wouldn't have any time to\ndo anything else like write code or maintain the project.  Instead, we\nask that you take on that responsibility since it's your organization\nthat has this policy.  As I mentioned above, there are no team members\nor other people that the project pays to work on it or answer inquiries,\nalthough some companies do employ paid staff to contribute to Git (but\nnot to address paperwork matters).\n\nNote that the Git project doesn't ship anything but source code.  If\nyou're installing a compiled version, that probably comes from somewhere\nelse.  On Windows, that's usually the Git for Windows project; on macOS,\nit's Apple or something like Homebrew; and on Linux, it's usually the\nLinux distro itself.  If you have a contract with Apple or a Linux\ndistro (such as Ubuntu), they might be willing to fill out that\npaperwork, but in general, the other distributors, like most other open\nsource projects, will not want to do so.  I am very certain that the Git\nfor Windows maintainer in particular will not appreciate such a request,\nsince they are very busy and have lots of pieces to maintain as part of\nGit for Windows[0].  However, if your version of Git is distributed by\nyour OS vendor, you may not need this paperwork at all since it comes\ndirectly from them, depending on your policies.\n\nHopefully your IT department will understand that we can't fill out\nthese documents, since it applies to almost all open source software\n(which is something that IT staff should be familiar with in this day\nand age).  I will note that we've had other government organizations\nthat have asked for similar things and we've given them a similar\nresponse, so hopefully that's helpful.  I'll note that Git is in use in\na variety of governmental agencies across the world[1], all without the\nneed for us to fill out any questionnaires.\n\nBest of luck in your rollout of Git.\n\n[0] I'm a huge fan of libraries and started programming at six years old\nbased on books from the local library.\n[1] Including, among others:\n\n18F, a (former) U.S. government agency (https://github.com/18F/18f.gsa.gov)\nThe Government of Canada (https://github.com/canada-ca)\nVarious agencies of the European Union (such as https://github.com/eea\nand https://github.com/eurostat)\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"}]}