5 ms·

I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. On

I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. On a somewhat-related note: you wouldn't happen to be / know who is responsible for the BC CDC Covid results service, would you? I was disappointed to see this page, which asks for personal information including your PHN, served over HTTP. Not only that but there is actually a disclaimer saying it's fine to ignore the big red padlock because the iframe uses HTTPS (which is also technically not true as far as I can tell - the iframe _redirects_ to HTTPS though).

tempestn 6y ago
I also noticed the BC CDC use of http and reported that to them a couple months ago. Nice to see I'm not the only one.
burke 6y ago
Nope, sorry, no insight or connections there.
danudey 6y ago
> I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. Canada is kind of... weird, in this regard. I knew about the CDS, and was on their mailing list (they talk about pretty neat stuff and it sounds like a neat place to work), so this didn't surprise me, but... So a while ago, we (the company I worked for at the time) had some servers hosted at a hosting company based here in Vancouver, though the servers were in Seattle. Well, we got an e-mail from our host, forwarding some automated e-mails that they had received from the Canadian government (possibly the CDS, but I don't think so) notifying us that we had open memcached ports (11211) on some of our servers. I went and checked the configuration, and sure enough we'd had a configuration error, where memcached would only accept one IP address to bind to, but our script had provided two (because the servers had an internal and external), creating an invalid config which was never deployed, so memcached was just listening on [::]:11211, and since it wasn't supposed to be open we didn't have any ACLs on the access routers. We fixed the configuration issue and switched to a default-deny policy and all was fixed, but it was surreal that an e-mail from the government was what tipped us off.
- bonestamp2 6y ago
  That's funny, and it reminds me of something we discovered too. We use bugsnag on many of our client web apps to catch javascript runtime errors and with one of our apps we frequently come across problems that reference javascript functions and variables that aren't ours. Sometimes it turns out to be a benign plugin, but in many of these cases it is a known virus or dangerous browser plugin that is trying to log keystrokes, mine crypto, extract banking info, etc. We have gotten to the point where we can often tell them which virus they have, how we know, and include removal instructions. Our app is very expensive so most customers are people who need our tools and use the app everyday, which means we can often tell them when they got the virus too. It's way out of scope for our role in their life, so it's a little bizarre for everyone involved, but the customers seem to appreciate it at least.
momackay 6y ago
Pretty much every gov site 8n Canada is served over non secure HTTP.
- bregma 6y ago
  That's funny, I just checked and I couldn't find a single one. Not that I even know of all of them, but the obvious ones (CRA, PM's office, EI, e-services's 'My Account', main site, etc) all use HTTPS.
cbsmith 6y ago
Jeez. This should be HTTPS with HSTS.

tempestn 6y ago

I also noticed the BC CDC use of http and reported that to them a couple months ago. Nice to see I'm not the only one.

burke 6y ago

Nope, sorry, no insight or connections there.

danudey 6y ago

> I had no idea there was a Canadian Digital Service - I'm glad to hear that it not only exists but that it's a relatively efficient government organization. Canada is kind of... weird, in this regard. I knew about the CDS, and was on their mailing list (they talk about pretty neat stuff and it sounds like a neat place to work), so this didn't surprise me, but... So a while ago, we (the company I worked for at the time) had some servers hosted at a hosting company based here in Vancouver, though the servers were in Seattle. Well, we got an e-mail from our host, forwarding some automated e-mails that they had received from the Canadian government (possibly the CDS, but I don't think so) notifying us that we had open memcached ports (11211) on some of our servers. I went and checked the configuration, and sure enough we'd had a configuration error, where memcached would only accept one IP address to bind to, but our script had provided two (because the servers had an internal and external), creating an invalid config which was never deployed, so memcached was just listening on [::]:11211, and since it wasn't supposed to be open we didn't have any ACLs on the access routers. We fixed the configuration issue and switched to a default-deny policy and all was fixed, but it was surreal that an e-mail from the government was what tipped us off.

bonestamp2 6y ago
That's funny, and it reminds me of something we discovered too. We use bugsnag on many of our client web apps to catch javascript runtime errors and with one of our apps we frequently come across problems that reference javascript functions and variables that aren't ours. Sometimes it turns out to be a benign plugin, but in many of these cases it is a known virus or dangerous browser plugin that is trying to log keystrokes, mine crypto, extract banking info, etc. We have gotten to the point where we can often tell them which virus they have, how we know, and include removal instructions. Our app is very expensive so most customers are people who need our tools and use the app everyday, which means we can often tell them when they got the virus too. It's way out of scope for our role in their life, so it's a little bizarre for everyone involved, but the customers seem to appreciate it at least.

momackay 6y ago

Pretty much every gov site 8n Canada is served over non secure HTTP.

bregma 6y ago
That's funny, I just checked and I couldn't find a single one. Not that I even know of all of them, but the obvious ones (CRA, PM's office, EI, e-services's 'My Account', main site, etc) all use HTTPS.

cbsmith 6y ago

Jeez. This should be HTTPS with HSTS.