5 ms·

> I'll be honest: I barely knew anything about the CDS and I expected some runaround from a government agency like this, and I was pleasantly surprised I'm one

by burke 6y ago

> I'll be honest: I barely knew anything about the CDS and I expected some runaround from a government agency like this, and I was pleasantly surprised I'm one of the team that did the initial implementation of the server and iOS app before handing it off to the CDS for the latter part of implementation, and I've been really, really impressed with the CDS. They're a great model for what tech in government should look like.

OJFord 6y ago
I haven't worked with either of them, but I'm British and similarly impressed with our GDS (G for Gov.) - this is interesting: https://www.publicsectorblogs.org.uk/2018/07/gds-across-the-globe-where-our-alumni-are-now-government-digital-service/ https://www.publicsectorblogs.org.uk/2018/07/gds-across-the-...
scoates 6y ago
Yeah, my interactions with them were all great. Really refreshing.
ghostpepper 6y ago
I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. On a somewhat-related note: you wouldn't happen to be / know who is responsible for the BC CDC Covid results service, would you? I was disappointed to see this page, which asks for personal information including your PHN, served over HTTP. Not only that but there is actually a disclaimer saying it's fine to ignore the big red padlock because the iframe uses HTTPS (which is also technically not true as far as I can tell - the iframe _redirects_ to HTTPS though).
- tempestn 6y ago
  I also noticed the BC CDC use of http and reported that to them a couple months ago. Nice to see I'm not the only one.
- burke 6y ago
  Nope, sorry, no insight or connections there.
- danudey 6y ago
  > I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. Canada is kind of... weird, in this regard. I knew about the CDS, and was on their mailing list (they talk about pretty neat stuff and it sounds like a neat place to work), so this didn't surprise me, but... So a while ago, we (the company I worked for at the time) had some servers hosted at a hosting company based here in Vancouver, though the servers were in Seattle. Well, we got an e-mail from our host, forwarding some automated e-mails that they had received from the Canadian government (possibly the CDS, but I don't think so) notifying us that we had open memcached ports (11211) on some of our servers. I went and checked the configuration, and sure enough we'd had a configuration error, where memcached would only accept one IP address to bind to, but our script had provided two (because the servers had an internal and external), creating an invalid config which was never deployed, so memcached was just listening on [::]:11211, and since it wasn't supposed to be open we didn't have any ACLs on the access routers. We fixed the configuration issue and switched to a default-deny policy and all was fixed, but it was surreal that an e-mail from the government was what tipped us off.
  - bonestamp2 6y ago
    That's funny, and it reminds me of something we discovered too. We use bugsnag on many of our client web apps to catch javascript runtime errors and with one of our apps we frequently come across problems that reference javascript functions and variables that aren't ours. Sometimes it turns out to be a benign plugin, but in many of these cases it is a known virus or dangerous browser plugin that is trying to log keystrokes, mine crypto, extract banking info, etc. We have gotten to the point where we can often tell them which virus they have, how we know, and include removal instructions. Our app is very expensive so most customers are people who need our tools and use the app everyday, which means we can often tell them when they got the virus too. It's way out of scope for our role in their life, so it's a little bizarre for everyone involved, but the customers seem to appreciate it at least.
- momackay 6y ago
  Pretty much every gov site 8n Canada is served over non secure HTTP.
  - bregma 6y ago
    That's funny, I just checked and I couldn't find a single one. Not that I even know of all of them, but the obvious ones (CRA, PM's office, EI, e-services's 'My Account', main site, etc) all use HTTPS.
- cbsmith 6y ago
  Jeez. This should be HTTPS with HSTS.
Kluny 6y ago
I don't know a ton about the CDS, but at least one of their employees is a former coworker of mine from the VIP team at Automattic. He was team leader for a group that had EXTREMELY high customer satisfaction goals as its mandate. I see his influence here - or maybe they just hire people like him.
lwansbrough 6y ago
Actually the CDS was based on the Obama era model created in the US Digital Service. It’s a great idea and I was pleasantly surprised to learn that the Canada COVID app (which is very well designed!) was created by them (well, and Shopify :) )
shahsyed 6y ago
out of curiosity, how were you approached to tackle this problem for the gov't? can you introduce me to someone? i'm working on this currently: https://www.youtube.com/watch?v=t9xFQFkvoLg& https://www.youtube.com/watch?v=t9xFQFkvoLg&
purephase 6y ago
I'm happy to hear that the experience w/CDS is improving. I worked on a project with them about 4 years ago, and it was a less than ideal experience. CDS was not entirely at fault, as there were other departments involved, but they were willing to bend on specific details that we (as an outside service provider) specifically recommended against. It put us at odds contractually in terms of project timelines, but we were pushed between delivering securely or timely, and the stress from all sides for the latter caused a number of people to not only leave our company, but also take leaves of absense on the government side. I strongly support them as a Canadian citizen, and sincerly hope that they've reached the zenith in that their stated position holds, because the alternative was a downright awful experience.

by burke 6y ago

OJFord 6y ago

I haven't worked with either of them, but I'm British and similarly impressed with our GDS (G for Gov.) - this is interesting: https://www.publicsectorblogs.org.uk/2018/07/gds-across-the-globe-where-our-alumni-are-now-government-digital-service/ https://www.publicsectorblogs.org.uk/2018/07/gds-across-the-...

scoates 6y ago

Yeah, my interactions with them were all great. Really refreshing.

ghostpepper 6y ago

I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. On a somewhat-related note: you wouldn't happen to be / know who is responsible for the BC CDC Covid results service, would you? I was disappointed to see this page, which asks for personal information including your PHN, served over HTTP. Not only that but there is actually a disclaimer saying it's fine to ignore the big red padlock because the iframe uses HTTPS (which is also technically not true as far as I can tell - the iframe _redirects_ to HTTPS though).

tempestn 6y ago
I also noticed the BC CDC use of http and reported that to them a couple months ago. Nice to see I'm not the only one.
burke 6y ago
Nope, sorry, no insight or connections there.
danudey 6y ago
> I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. Canada is kind of... weird, in this regard. I knew about the CDS, and was on their mailing list (they talk about pretty neat stuff and it sounds like a neat place to work), so this didn't surprise me, but... So a while ago, we (the company I worked for at the time) had some servers hosted at a hosting company based here in Vancouver, though the servers were in Seattle. Well, we got an e-mail from our host, forwarding some automated e-mails that they had received from the Canadian government (possibly the CDS, but I don't think so) notifying us that we had open memcached ports (11211) on some of our servers. I went and checked the configuration, and sure enough we'd had a configuration error, where memcached would only accept one IP address to bind to, but our script had provided two (because the servers had an internal and external), creating an invalid config which was never deployed, so memcached was just listening on [::]:11211, and since it wasn't supposed to be open we didn't have any ACLs on the access routers. We fixed the configuration issue and switched to a default-deny policy and all was fixed, but it was surreal that an e-mail from the government was what tipped us off.
- bonestamp2 6y ago
  That's funny, and it reminds me of something we discovered too. We use bugsnag on many of our client web apps to catch javascript runtime errors and with one of our apps we frequently come across problems that reference javascript functions and variables that aren't ours. Sometimes it turns out to be a benign plugin, but in many of these cases it is a known virus or dangerous browser plugin that is trying to log keystrokes, mine crypto, extract banking info, etc. We have gotten to the point where we can often tell them which virus they have, how we know, and include removal instructions. Our app is very expensive so most customers are people who need our tools and use the app everyday, which means we can often tell them when they got the virus too. It's way out of scope for our role in their life, so it's a little bizarre for everyone involved, but the customers seem to appreciate it at least.
momackay 6y ago
Pretty much every gov site 8n Canada is served over non secure HTTP.
- bregma 6y ago
  That's funny, I just checked and I couldn't find a single one. Not that I even know of all of them, but the obvious ones (CRA, PM's office, EI, e-services's 'My Account', main site, etc) all use HTTPS.
cbsmith 6y ago
Jeez. This should be HTTPS with HSTS.

Kluny 6y ago

I don't know a ton about the CDS, but at least one of their employees is a former coworker of mine from the VIP team at Automattic. He was team leader for a group that had EXTREMELY high customer satisfaction goals as its mandate. I see his influence here - or maybe they just hire people like him.

lwansbrough 6y ago

Actually the CDS was based on the Obama era model created in the US Digital Service. It’s a great idea and I was pleasantly surprised to learn that the Canada COVID app (which is very well designed!) was created by them (well, and Shopify :) )

shahsyed 6y ago

out of curiosity, how were you approached to tackle this problem for the gov't? can you introduce me to someone? i'm working on this currently: https://www.youtube.com/watch?v=t9xFQFkvoLg& https://www.youtube.com/watch?v=t9xFQFkvoLg&

purephase 6y ago

I'm happy to hear that the experience w/CDS is improving. I worked on a project with them about 4 years ago, and it was a less than ideal experience. CDS was not entirely at fault, as there were other departments involved, but they were willing to bend on specific details that we (as an outside service provider) specifically recommended against. It put us at odds contractually in terms of project timelines, but we were pushed between delivering securely or timely, and the stress from all sides for the latter caused a number of people to not only leave our company, but also take leaves of absense on the government side. I strongly support them as a Canadian citizen, and sincerly hope that they've reached the zenith in that their stated position holds, because the alternative was a downright awful experience.