3 ms·

Disclaimer: I work in politics professionally, as a digital consultant. ActBlue is better at security (and just in general product) than NGP, but neither suppo

Disclaimer: I work in politics professionally, as a digital consultant. ActBlue is better at security (and just in general product) than NGP, but neither supports physical 2fa keys. I don't want to speak too publicly about NGP VAN but I think this area is very ripe for disruption, but it would be hard to get the finance side 100% correct, automated FEC & compliance and all. This built up moat I personally believe lets them stagnate on technology. I think their API is proof they know the weakness or are afraid of easily better tools built on top (no important data in and out). One attack vector I dont see mentioned is locking down domains and websites. Campaigns are incredibly cheap, it only took a few consultants selling shitty pre-built wordpress themes and now it's tough to get a Congressional to pay much or anything. We now build static websites for clients who pay, but I'm still worried about some actor uploading a google-verification.txt, or updating DNS to send better phishing emails. Emailing passwords in plain text and shared twitter passwords for candidate accounts which are 'victory!2020' are VERY common and we've been trying to correct this behavior. Though this isn't perfect we have been sending one time links with no authentication info in email plaintext. If anyone has a better solution? (remember non-technical (no PGP) campaign staff and not in same geo a lot of time). In writing up some campaign plans this cycle I made some security notes, especially for a top 5 race target client we have (if win primary) I suggested separate senior staff office in a more secure location which no volunteers know about. This wont work at Congressional level, where anyone can get access to call time room or CMs office if they try.. Yes because I'm overly paranoid but also sadly because security in politics now means protecting from some random nut bag with a gun. Which is really scary to me. But mostly I'm surprised at Maciej's willingness to spend money (and valuable time) doing this. Sadly I think the willingness to help anyone including 'Green Party candidate in a district the Republicans carried by 60 points' combined that with the general (and I can understand and am not judging) attitude that 'the system' is broke, is probably a factor to why he was not taken as serious as I think he would have liked. Sorry this got really long.. I could go on and on (if @Maciej or is it @idlewords ? sees this would be happy to chat on DM). love seeing politics on HN a topic I have specialized knowledge in for once ;0

idlewords 7y ago
Thanks for these comments, and I'm happy to talk; you can find me on Signal at 415 610 0231.
jonathanwallace 7y ago
How can I best connect with you? I did a quick stint in politics and would love to chat.
- dillondoyle 7y ago
  dillon @ 4degre.es or send me a message on fb dillondoyle or ig dillonjdoyle sometimes email doesn't get filtered so i see it from cold contacts.
n69NGNxu 7y ago
Making a throwaway because I too work in politics and have worked with your firm before. Also I might disagree with lots of your points but if you actually want to build something better than what currently exists there are tons of resources, Higher Ground Labs is probably a good place to start [0] ActBlue is better at security... than NGP By what metric? They're vastly different products serving completely different end users. That's like saying that Uber is better at security than Oracle. I don't want to speak too publicly about NGP VAN but I think this area is very ripe for disruption Your comments show that you have some understanding of the ecosystem but I'm not sure what you're getting at here. First, NGP VAN serves two different purposes - NGP does FEC compliance while VAN handles voter files and direct volunteer contact. Automated compliance is really hard, a lot of companies do this but none are as good at NGP. More than 40 companies are register with the FEC to provide this service [1] with some of the larger ones being Aristotle, Blue Utopia, and Trail Blazer (this does not include R only companies like CMDI). Managing voter data is also really hard [2] ots of other companies do that too though. Off the top of my head I can think of NationBuilder, PDI, L2, Crowdskout, and VoterHub. There's also a whole group of start ups working on new voter files, including one backed by Reid Hoffman [3] and one with Howard Dean [4]. Note for non political folks: VAN does not provide data, it's the software platform used to slice and dice data that the DNC + others collect. I'm getting off track but while VAN is far from perfect (and could be better!) it's a pretty great solution when all is said and done [5]. I think their API is proof they know the weakness or are afraid of easily better tools built on top (no important data in and out). Well that's just false. VAN has both import [6] and export [7] functionality via API. The older NGPs don't have all these feature but the newest version does too. Campaigns are incredibly cheap Yes lol so much yes. I'm still worried about some actor uploading a google-verification.txt, or updating DNS to send better phishing emails. I also agree that this is a risk. If I were you I'd start by updating DMARC, DNS, and SMTP records on your firms website minimize the chance of your clients being phished. Though this isn't perfect we have been sending one time links with no authentication info in email plaintext. If anyone has a better solution? Use Signal. Everyone involved with a campaign should have Signal on their phone. [0] https://www.highergroundlabs.com/ https://www.highergroundlabs.com/ [1] https://www.fec.gov/help-candidates-and-committees/filing-reports/other-filing-software/ https://www.fec.gov/help-candidates-and-committees/filing-re... [2] https://medium.com/@heywillconway/why-the-ngp-van-model-is-hurting-democracy-d9893d3d28f7 https://medium.com/@heywillconway/why-the-ngp-van-model-is-h... [3] https://www.wsj.com/articles/fight-over-voter-data-roils-democrats-ahead-of-election-11544899956 https://www.wsj.com/articles/fight-over-voter-data-roils-dem... [4] https://www.apnews.com/9a47a0def9234e338bc72053e86f221f https://www.apnews.com/9a47a0def9234e338bc72053e86f221f [5] https://medium.com/@danancona/why-the-ngp-van-model-has-been-awesome-for-democracy-and-how-it-could-be-more-awesome-43e96ce0fdc6 https://medium.com/@danancona/why-the-ngp-van-model-has-been... [6] https://developers.ngpvan.com/van-api#file-loading-jobs https://developers.ngpvan.com/van-api#file-loading-jobs [7] https://developers.ngpvan.com/van-api#export-jobs https://developers.ngpvan.com/van-api#export-jobs

idlewords 7y ago

Thanks for these comments, and I'm happy to talk; you can find me on Signal at 415 610 0231.

jonathanwallace 7y ago

How can I best connect with you? I did a quick stint in politics and would love to chat.

dillondoyle 7y ago
dillon @ 4degre.es or send me a message on fb dillondoyle or ig dillonjdoyle sometimes email doesn't get filtered so i see it from cold contacts.

n69NGNxu 7y ago

Making a throwaway because I too work in politics and have worked with your firm before. Also I might disagree with lots of your points but if you actually want to build something better than what currently exists there are tons of resources, Higher Ground Labs is probably a good place to start [0] ActBlue is better at security... than NGP By what metric? They're vastly different products serving completely different end users. That's like saying that Uber is better at security than Oracle. I don't want to speak too publicly about NGP VAN but I think this area is very ripe for disruption Your comments show that you have some understanding of the ecosystem but I'm not sure what you're getting at here. First, NGP VAN serves two different purposes - NGP does FEC compliance while VAN handles voter files and direct volunteer contact. Automated compliance is really hard, a lot of companies do this but none are as good at NGP. More than 40 companies are register with the FEC to provide this service [1] with some of the larger ones being Aristotle, Blue Utopia, and Trail Blazer (this does not include R only companies like CMDI). Managing voter data is also really hard [2] ots of other companies do that too though. Off the top of my head I can think of NationBuilder, PDI, L2, Crowdskout, and VoterHub. There's also a whole group of start ups working on new voter files, including one backed by Reid Hoffman [3] and one with Howard Dean [4]. Note for non political folks: VAN does not provide data, it's the software platform used to slice and dice data that the DNC + others collect. I'm getting off track but while VAN is far from perfect (and could be better!) it's a pretty great solution when all is said and done [5]. I think their API is proof they know the weakness or are afraid of easily better tools built on top (no important data in and out). Well that's just false. VAN has both import [6] and export [7] functionality via API. The older NGPs don't have all these feature but the newest version does too. Campaigns are incredibly cheap Yes lol so much yes. I'm still worried about some actor uploading a google-verification.txt, or updating DNS to send better phishing emails. I also agree that this is a risk. If I were you I'd start by updating DMARC, DNS, and SMTP records on your firms website minimize the chance of your clients being phished. Though this isn't perfect we have been sending one time links with no authentication info in email plaintext. If anyone has a better solution? Use Signal. Everyone involved with a campaign should have Signal on their phone. [0] https://www.highergroundlabs.com/ https://www.highergroundlabs.com/ [1] https://www.fec.gov/help-candidates-and-committees/filing-reports/other-filing-software/ https://www.fec.gov/help-candidates-and-committees/filing-re... [2] https://medium.com/@heywillconway/why-the-ngp-van-model-is-hurting-democracy-d9893d3d28f7 https://medium.com/@heywillconway/why-the-ngp-van-model-is-h... [3] https://www.wsj.com/articles/fight-over-voter-data-roils-democrats-ahead-of-election-11544899956 https://www.wsj.com/articles/fight-over-voter-data-roils-dem... [4] https://www.apnews.com/9a47a0def9234e338bc72053e86f221f https://www.apnews.com/9a47a0def9234e338bc72053e86f221f [5] https://medium.com/@danancona/why-the-ngp-van-model-has-been-awesome-for-democracy-and-how-it-could-be-more-awesome-43e96ce0fdc6 https://medium.com/@danancona/why-the-ngp-van-model-has-been... [6] https://developers.ngpvan.com/van-api#file-loading-jobs https://developers.ngpvan.com/van-api#file-loading-jobs [7] https://developers.ngpvan.com/van-api#export-jobs https://developers.ngpvan.com/van-api#export-jobs