6 ms·

> The IRS' IT "upgrade" is just a huge money grab. Nobody has the slightest interest or desire to do anything properly - they simply want in on that lucrative I

> The IRS' IT "upgrade" is just a huge money grab. Nobody has the slightest interest or desire to do anything properly - they simply want in on that lucrative IRS money. This is factually wrong (at least for the most current effort): https://federalnewsradio.com/tom-temin-commentary/2018/01/irs-clutches-its-modernization-holy-grail/ https://federalnewsradio.com/tom-temin-commentary/2018/01/ir... An eight person IRS development team nearly finished building a replacement, but the main developers were hired on a special program to pay them at above-GSA rates, and that program expired before they could put it into production.

rbanffy 8y ago
Open-source it and we'll help with the fixes.
- rhizome 8y ago
  And then we'll see how vicious the incumbent companies get. There's no FUD greater than government contractor FUD.
  - rbanffy 8y ago
    I say bring them out into the light. It's an excellent disinfectant.
- DrScump 8y ago
  That would be a huge exploit/privacy risk.
  - heartbreak 8y ago
    Right because that's what we say about the Linux kernel too, right? If IRS is the maintainer, they still review changes. And so do all of us. If someone slips in an exploit, we'll catch it the same way every other open source project does.
    - DrScump 8y ago
      Unless it's an exploit-able weakness that is discovered only because the source is open to be both read and tested against, like Heartbleed.
      - rbanffy 8y ago
        I sincerely hope that machine is not accessible from the open internet.
    - occams_chainsaw 8y ago
      The kernel is an entirely different beast. The systems in question have been around three times longer, and have been closed from the start. A hardware caching issue bringing the whole thing down probably means it's closely tied into the hardware, and difficult to contribute to. Obscurity isn't security, but it may not be the best idea to pop the lid off everything at once in such a case.
  - danso 8y ago
    How would it be a privacy risk, unless, the data files were included/embedded in the source code repo?
    - DrScump 8y ago
      Heartbleed[0] is a perfect demonstration of such a real-world exploit risk. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
  - fjsolwmv 8y ago
    Is that why Google's and Amazon's linux kernels are constantly being exploited?
    - DrScump 8y ago
      Heartbleed[0], it fact, was exploitable in the wild well before Neel Mehta of Google discovered and diagnosed it. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed

rbanffy 8y ago

Open-source it and we'll help with the fixes.

rhizome 8y ago
And then we'll see how vicious the incumbent companies get. There's no FUD greater than government contractor FUD.
- rbanffy 8y ago
  I say bring them out into the light. It's an excellent disinfectant.
DrScump 8y ago
That would be a huge exploit/privacy risk.
- heartbreak 8y ago
  Right because that's what we say about the Linux kernel too, right? If IRS is the maintainer, they still review changes. And so do all of us. If someone slips in an exploit, we'll catch it the same way every other open source project does.
  - DrScump 8y ago
    Unless it's an exploit-able weakness that is discovered only because the source is open to be both read and tested against, like Heartbleed.
    - rbanffy 8y ago
      I sincerely hope that machine is not accessible from the open internet.
  - occams_chainsaw 8y ago
    The kernel is an entirely different beast. The systems in question have been around three times longer, and have been closed from the start. A hardware caching issue bringing the whole thing down probably means it's closely tied into the hardware, and difficult to contribute to. Obscurity isn't security, but it may not be the best idea to pop the lid off everything at once in such a case.
- danso 8y ago
  How would it be a privacy risk, unless, the data files were included/embedded in the source code repo?
  - DrScump 8y ago
    Heartbleed[0] is a perfect demonstration of such a real-world exploit risk. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
- fjsolwmv 8y ago
  Is that why Google's and Amazon's linux kernels are constantly being exploited?
  - DrScump 8y ago
    Heartbleed[0], it fact, was exploitable in the wild well before Neel Mehta of Google discovered and diagnosed it. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed