3 ms·

How could they not have https, is that by decision, or by incompetence, or...?

HenryKissinger 6y ago
Every change has to go through months, or years, of review, and be approved by 50 different people. I take it you've never worked for the government, have you?
- hirundo 6y ago
  Only until around April 16th. https://en.wikipedia.org/wiki/Tax_Freedom_Day https://en.wikipedia.org/wiki/Tax_Freedom_Day
  - cosmojg 6y ago
    Huh! TIL! Is that why US federal taxes are typically due on April 15th? Or is it a coincidence?
    - 0xffff2 6y ago
      Seems unrelated since the exact date has bounced around both before and after the 15th over the last 60 years.
- pbhjpbhj 6y ago
  So the site devs fixed it 5 years ago and we've been waiting for management to sign off "should we implement basic site security"? Heads should roll, really.
kache_ 6y ago
Not everything needs https. You can read more about this here: http://n-gate.com/software/2017/ http://n-gate.com/software/2017/ (Discourse on https)
- kobalsky 6y ago
  >>> If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks. Such a pointless read.
  - KeepFlying 6y ago
    I regret reading this article. Damn, its just constantly "But by site doesn't need HTTPS". So many of the responses to criticism don't address the response at all and just parrot "but I don't need it". Make a valid argument and I'll listen to you, but parroting "but I don't need it" does nothing to add to the conversation at all. Is adding HTTPS a 100% required critical sev0 ship-blocking bug on every site in the world? No. Is it a valuable improvement to add HTTPS? I'd argue that it is.
onlyrealcuzzo 6y ago
Isn't congress actively working to limit encryption for everyone else at the same time?
- KeepFlying 6y ago
  If I understand things like EARNIT correctly, they want to limit end-to-end encryption. I don't think they have a problem with HTTPS or any of the other transport encryption schemes. I know its a bit of a nitpick, but its important that they know we understand the laws they want to push through and STILL disagree with them.
bargl 6y ago
The US government probably has more software than any non-tech company out there. Non-tech being very important here. The US government is not a technology company. So think of the worst enterprise software you've seen and the US government has it beat somewhere on some system they are still using. How does this happen? Contracts, they write contracts to the lowest bidder to build them software and then they pick the greenest/cheapest software engineers to do work in a mix of waterfall, agile, what's older than waterfall? On top of that they've got mission critical software that runs on this stuff. A silly little change like upgrading paper Notices to Airmen (NOTAMs) requires YEARS of planning, safety analysis, and buy in from a representative every airport/airline/airtraffic controller across the US. Multiple unions etc. At it's worst the us government is slower than the slowest enterprise company you've seen. On top of all that, there is a review board for EVERY (mostly open source library you want to import, so there aren't bad actors on it. This review process is slow and pushes back on innovation. The worst thing you can do as a contractor is not hit your deadline. So many of them use tried and true technologies to get the job done, but don't innovate. Is it by decision? Yes the decision to pick the cheapest contractors, yes by the decision to include security in a way that actually slows things down, yes by a myriad of decisions that make innovating government software really hard. Is it by incompetence? Meh, yes and no. You have people even at these contracts who are railing and screaming against this. There is competence in all these places. But the pressure to slow down and do things a specific way push back so hard it's really difficult to accept new risk. And this was just my experience on one contract. Another government contract was super innovative and fun.
- bumby 6y ago
  What’s the discriminator between the two vastly different contract experiences? Is it contact size, bureaucracy, visibility, mission-criticality...?
  - bargl 6y ago
    Everything you mentioned as well as agency and the contracting firm. Also the innovative nature of what we were building at the new contract vs. just redoing a crud app. I suspect part of it was me too. My first job, vs my ability to discern better contracts etc in for future ones.
gpvos 6y ago
Inertia, forgetfulness, lack of decision. Which can be construed as incompetence if it goes on for too long. If it's for a website that started within the last three years, it's direct incompetence.
thephyber 6y ago
Government policies. Legacy code. Cascade of updating vendor contracts and waiting for them to update their product/service. The Webmaster frequently doesn't have the autonomy to be able to prioritize the project they think is most critical. The switch from HTTP to HTTPS is almost never as simple as "call LetsEncrypt and switch the port number". If you have an existing HTTP site that includes Images, Script, Styles, Frames from other HTTP resources, switching the top of the page to HTTPS may break functionality on the page if the browser's security settings deny HTTP resources from being loaded on the newly HTTPS page. That said, there's really no reason any government shouldn't prioritize these fixes... except we are in the middle of a COVID-pocalypse where budgets are likely to get slashed. Sometimes it's "incompetence" of management (not seeing the risk after it's described to them or their underlings not communicating the risk), but mostly

Every change has to go through months, or years, of review, and be approved by 50 different people. I take it you've never worked for the government, have you?

hirundo 6y ago
Only until around April 16th. https://en.wikipedia.org/wiki/Tax_Freedom_Day https://en.wikipedia.org/wiki/Tax_Freedom_Day
- cosmojg 6y ago
  Huh! TIL! Is that why US federal taxes are typically due on April 15th? Or is it a coincidence?
  - 0xffff2 6y ago
    Seems unrelated since the exact date has bounced around both before and after the 15th over the last 60 years.
pbhjpbhj 6y ago
So the site devs fixed it 5 years ago and we've been waiting for management to sign off "should we implement basic site security"? Heads should roll, really.

kache_ 6y ago

Not everything needs https. You can read more about this here: http://n-gate.com/software/2017/ http://n-gate.com/software/2017/ (Discourse on https)

kobalsky 6y ago
>>> If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks. Such a pointless read.
- KeepFlying 6y ago
  I regret reading this article. Damn, its just constantly "But by site doesn't need HTTPS". So many of the responses to criticism don't address the response at all and just parrot "but I don't need it". Make a valid argument and I'll listen to you, but parroting "but I don't need it" does nothing to add to the conversation at all. Is adding HTTPS a 100% required critical sev0 ship-blocking bug on every site in the world? No. Is it a valuable improvement to add HTTPS? I'd argue that it is.

onlyrealcuzzo 6y ago

Isn't congress actively working to limit encryption for everyone else at the same time?

KeepFlying 6y ago
If I understand things like EARNIT correctly, they want to limit end-to-end encryption. I don't think they have a problem with HTTPS or any of the other transport encryption schemes. I know its a bit of a nitpick, but its important that they know we understand the laws they want to push through and STILL disagree with them.

bargl 6y ago

The US government probably has more software than any non-tech company out there. Non-tech being very important here. The US government is not a technology company. So think of the worst enterprise software you've seen and the US government has it beat somewhere on some system they are still using. How does this happen? Contracts, they write contracts to the lowest bidder to build them software and then they pick the greenest/cheapest software engineers to do work in a mix of waterfall, agile, what's older than waterfall? On top of that they've got mission critical software that runs on this stuff. A silly little change like upgrading paper Notices to Airmen (NOTAMs) requires YEARS of planning, safety analysis, and buy in from a representative every airport/airline/airtraffic controller across the US. Multiple unions etc. At it's worst the us government is slower than the slowest enterprise company you've seen. On top of all that, there is a review board for EVERY (mostly open source library you want to import, so there aren't bad actors on it. This review process is slow and pushes back on innovation. The worst thing you can do as a contractor is not hit your deadline. So many of them use tried and true technologies to get the job done, but don't innovate. Is it by decision? Yes the decision to pick the cheapest contractors, yes by the decision to include security in a way that actually slows things down, yes by a myriad of decisions that make innovating government software really hard. Is it by incompetence? Meh, yes and no. You have people even at these contracts who are railing and screaming against this. There is competence in all these places. But the pressure to slow down and do things a specific way push back so hard it's really difficult to accept new risk. And this was just my experience on one contract. Another government contract was super innovative and fun.

bumby 6y ago
What’s the discriminator between the two vastly different contract experiences? Is it contact size, bureaucracy, visibility, mission-criticality...?
- bargl 6y ago
  Everything you mentioned as well as agency and the contracting firm. Also the innovative nature of what we were building at the new contract vs. just redoing a crud app. I suspect part of it was me too. My first job, vs my ability to discern better contracts etc in for future ones.

gpvos 6y ago

Inertia, forgetfulness, lack of decision. Which can be construed as incompetence if it goes on for too long. If it's for a website that started within the last three years, it's direct incompetence.

thephyber 6y ago

Government policies. Legacy code. Cascade of updating vendor contracts and waiting for them to update their product/service. The Webmaster frequently doesn't have the autonomy to be able to prioritize the project they think is most critical. The switch from HTTP to HTTPS is almost never as simple as "call LetsEncrypt and switch the port number". If you have an existing HTTP site that includes Images, Script, Styles, Frames from other HTTP resources, switching the top of the page to HTTPS may break functionality on the page if the browser's security settings deny HTTP resources from being loaded on the newly HTTPS page. That said, there's really no reason any government shouldn't prioritize these fixes... except we are in the middle of a COVID-pocalypse where budgets are likely to get slashed. Sometimes it's "incompetence" of management (not seeing the risk after it's described to them or their underlings not communicating the risk), but mostly