4 ms·

Except the USDS, 18F, PIFs, and OCSIT are all attracting really great people. Now, HTTPS everywhere is a dubious project, sorry Konklone, but its difficult to d

by vippy 11y ago

Except the USDS, 18F, PIFs, and OCSIT are all attracting really great people. Now, HTTPS everywhere is a dubious project, sorry Konklone, but its difficult to deny that the problem of talent in government has always been one of the hiring process being controlled by contractors and the perverse economic incentives of the traditional bodies-in-chairs contracting model.

konklone 11y ago
> Now, HTTPS everywhere is a dubious project, sorry Konklone Well, I like it. =)
- vippy 11y ago
  OH NOES! Hey Eric! :P The problem we have with our project is that we're dealing with a ton of subdomains and not a lot of data I would consider "sensitive" enough to really necessitate encryption. While I appreciate the sentiment of the project, and value your commitment to privacy, for our use case it's definitely a bit of a pain in the butt. That, and I know getting IT departments to move to install certs on their old infrastructure for things that might not require encryption is definitely painful. And the errors generated by expired certificates and "insecure content warnings" are confusing, and don't add value to projects that don't benefit from encrypted connections. We've been hearing all about it.
  - djcapelis 11y ago
    Honestly, now that I read down the thread, it kinda sounds like you don't have your shit together and you want to blame someone else who created something awesome for it. It's not important whether you consider the data sensitive enough to bother doing your job. It's actually your users, which, if they've installed HTTPS Everywhere, they do. So get your shit together! :)
    - konklone 11y ago
      FWIW, vippy's not referring to the browser extension, but to the federal policy: https://www.whitehouse.gov/blog/2015/06/08/https-everywhere-government https://www.whitehouse.gov/blog/2015/06/08/https-everywhere-...
      - djcapelis 11y ago
        Ah ha! Thanks!
      - vippy 11y ago
        Yes, thank you konklone. My primary complaint with the policy, and I'm hesitant to complain because, let me be clear, it is a good policy, is that we're now held accountable to a metric that adds engineering complexity and additional costs to our small team, and has created some confusion amongst our hundreds of customers who, arguably, don't serve content that, in my professional opinion, requires an encrypted connection to meet the needs of their millions of users.
djcapelis 11y ago
I mean. They are attracting people who are better than the quality of the people the government usually gets. By a lot. But that's a pretty low bar. I have no idea why you're commenting to me about HTTPS Everywhere. So unfortunately I've missed whatever point you were trying to make there. Want to enlighten me?

by vippy 11y ago

konklone 11y ago

> Now, HTTPS everywhere is a dubious project, sorry Konklone Well, I like it. =)

vippy 11y ago
OH NOES! Hey Eric! :P The problem we have with our project is that we're dealing with a ton of subdomains and not a lot of data I would consider "sensitive" enough to really necessitate encryption. While I appreciate the sentiment of the project, and value your commitment to privacy, for our use case it's definitely a bit of a pain in the butt. That, and I know getting IT departments to move to install certs on their old infrastructure for things that might not require encryption is definitely painful. And the errors generated by expired certificates and "insecure content warnings" are confusing, and don't add value to projects that don't benefit from encrypted connections. We've been hearing all about it.
- djcapelis 11y ago
  Honestly, now that I read down the thread, it kinda sounds like you don't have your shit together and you want to blame someone else who created something awesome for it. It's not important whether you consider the data sensitive enough to bother doing your job. It's actually your users, which, if they've installed HTTPS Everywhere, they do. So get your shit together! :)
  - konklone 11y ago
    FWIW, vippy's not referring to the browser extension, but to the federal policy: https://www.whitehouse.gov/blog/2015/06/08/https-everywhere-government https://www.whitehouse.gov/blog/2015/06/08/https-everywhere-...
    - djcapelis 11y ago
      Ah ha! Thanks!
    - vippy 11y ago
      Yes, thank you konklone. My primary complaint with the policy, and I'm hesitant to complain because, let me be clear, it is a good policy, is that we're now held accountable to a metric that adds engineering complexity and additional costs to our small team, and has created some confusion amongst our hundreds of customers who, arguably, don't serve content that, in my professional opinion, requires an encrypted connection to meet the needs of their millions of users.

djcapelis 11y ago

I mean. They are attracting people who are better than the quality of the people the government usually gets. By a lot. But that's a pretty low bar. I have no idea why you're commenting to me about HTTPS Everywhere. So unfortunately I've missed whatever point you were trying to make there. Want to enlighten me?