11 ms·

US Air Force chief software officer quits

170 points by Ziggy_Zaggy 5y ago

jrochkind1 5y ago
> Among the USAF's sins-according-to-Chaillan? The service is still using "outdated water-agile-fall acquisition principles to procure services and talent", Wait, what?
- _bnmd 5y ago
  It's not explained, but I know exactly what he means. We mandate that development teams and integrated product teams have to use agile methods, but the procurement process itself is inherently not agile. Contracts come with fixed dollar amounts, milestone delivery dates, and requirements that need at least signoff from senior agency officials to change and possibly acts of Congress. Further, the way your "customer" is always an acquisition office rather than actual users of your system, developers can't receive, solicit, or respond to direct feedback from users, which is a pretty basic core tenet of agile development, without which it's hard to see how it can ever work.
  - ethbr0 5y ago
    This. If you want to read more into the precise ordering of the neologism, it's agile sandwiched in the middle of waterfall. Which is to say, the upstream and downstream didn't change how they do things at all, and somehow developers acting differently is supposed to convert everything to agile. Or to put it another way, this is what you get when you tell everyone they need to "do agile" without actually retraining people on what that means and update processes to enable it. Source: experience with healthcare "agile" and "sprints"
    - AnimalMuppet 5y ago
      Stronger: Somehow developers acting differently without the inputs that agile processes require is supposed to convert everything to agile. And somehow it never does...
      - panzagl 5y ago
        In practice most contractors end up hiring a bunch of former users to act as stand-ins for the real operators. These former users then get to engage in continual pissing matches with the acquisition office over how things really get done. Hilarity ensues.
    - tablespoon 5y ago
      > Which is to say, the upstream and downstream didn't change how they do things at all, and somehow developers acting differently is supposed to convert everything to agile. Sounds like my corner of the private sector.
    - Pokepokalypse 5y ago
      I know the solution! Hire a scrum-master! that will fix it.
- dragontamer 5y ago
  The full paragraph reads: > The DoD is still using outdated water-agile-fall acquisition principles to procure services and talent instead of leveraging “Capacity of work” agile contracts to staff teams. Improving acquisition ensures teams have the ability to groom their backlog and move at the pace of relevance. Only Platform One, and teams like Kessel Run, are truly end-to-end agile, from what I have seen to-date. I don't know what "water-agile-fall" is exactly, but he's probably talking about some terms in the Air Force. Maybe he means that the waterfall model still exists, and a bunch of people are trying (unsuccessfully) to convert to agile. But he's only seen Agile properly happen in a minority of projects.
  - jrochkind1 5y ago
    that is somewhat clarifying! Still trying to wrap my head around "to procure service and talent" with regard to agile/waterfall.
    - mpyne 5y ago
      He's talking about how you contract for additional staff to help with developing digital products. Typically the way government does this is by not contracting for staff at all, but instead contracting for a company to develop a software product that meets a long laundry list of requirements. Since 'agile' is in the DoD zeitgeist these contracts often throw in some agile buzzwords like "Story points" instead of "work breakdown structure", or split up the product into some kind of phased delivery scheme. Sometimes they'll throw in to do user-centered design. But invariably these contracts lay out the same thing: develop a product that meets X requirements. This means you have to know the requirements. You can't instead hire smart people to help explore a problem space, do interviews and experiments to determine whether you've achieved product-market fit (or what we'd call mission-market fit), and only then to start fielding a digital product in increments. This is considered a 'services contract' and these are frowned upon because they seem ripe for fraud ("you paid BigCo $40 million a year to do 'market research and product discovery'????? What did they discover? Why couldn't it have been $20M instead??"). TL;DR: The type of services you'd contract for are different for a modern digital product compared to a waterfall-style project. Even though DoD says we're doing agile, the reality is that the contracting system still pushes you hard to waterfall because no one seems to have the expertise to do 'agile acquisition'.
- markdjacobsen 5y ago
  HN has two threads on this now. I just replied on the other but will copy here: I can't speak for Chaillan, but as a military member who led an agile software development team similar to his during the same timeframe, I think he's referring to DoD's fondness for buzzwords. Because "agile" is the new hotness, every DoD office and vendor tries to slap the language of agile onto a waterfall model. See this wonderful report from the Defense Innovation Board on "Detecting Agile BS": https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB_DETECTING_AGILE_BS_2018.10.05.PDF https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB...
  - Ziggy_Zaggy 5y ago
    Do you might linking the other HN thread?
    - markdjacobsen 5y ago
      Other thread: https://news.ycombinator.com/item?id=28407219 https://news.ycombinator.com/item?id=28407219
      - Ziggy_Zaggy 5y ago
        Much appreciated.
- bink 5y ago
  I presume he means they're claiming to be agile while really continuing to use a waterfall process for deploying software. They create specs, hire a vendor, do regular reviews before testing, approvals, deployment, provide specs for changes, pay for those changes, test, approvals, deploy, and then repeat.
dragontamer 5y ago
https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-chaillan/ https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch... This linkedin post seems way more... balanced... than TheRegister.com implied.
- 2OEH8eoCRo0 5y ago
  > I realize more clearly than ever before that, in 20 years from now, our children, both in the United States’ and our Allies’, will have no chance competing in a world where China has the drastic advantage of population over the US. If the US can’t match the booming, hardworking population in China, then we have to win by being smarter, more efficient, and forward-leaning through agility, rapid prototyping and innovation. We have to be ahead and lead. We can’t afford to be behind. > While we wasted time in bureaucracy, our adversaries moved further ahead. Zoinks! This matches my experience working in defense and is one of my biggest fears. > I am becoming “technology stale”. > The DoD is still using outdated water-agile-fall acquisition principles to procure services and talent So glad that I left the industry. It's infuriating too because it's not a matter of if, but when. When the US faces a determined and modern adversary, the ones paying the price will be the men and women who serve in the military. It won't be the Pentagon brass or defense CEOs paying. This shit keeps me up at night. Worst of all the government has known it's a problem for decades if you read the Defense Innovation Board reports. https://media.defense.gov/2019/May/01/2002126691/-1/-1/0/SWAP%20FLYER.PDF https://media.defense.gov/2019/May/01/2002126691/-1/-1/0/SWA... > Nothing is changing: most of this has been said before and the 1987 DSB report on military software pretty much says it all. What is it going to take to actually do something?
  - trhway 5y ago
    >If the US can’t match the booming, hardworking population in China, then we have to win by being smarter, more efficient, and forward-leaning one of the most efficient way to balance the scales is by taking away that smartest and hardworking top of the population through immigration.
    - toomuchtodo 5y ago
chrisseaton 5y ago
> IT is a highly skilled and trained job; staff it as such I don't think it's highly trained at all! What kind of training do major tech companies do? I've never done any in my career, outside my degrees, and not everyone does that even! Is that unusual? Contrast that with the military, which is obsessive about training and invests a huge amount of time and effort into it throughout your entire career. So who are we taking lessons from here?
- mikewarot 5y ago
  It was a bad word choice, I'll agree. Our training is on the job, mostly. I'd bet most of us know many different layers of abstraction, and ways to just get stuff done, that would take years to teach formally, if it could be taught.
- Sevii 5y ago
  I've done a lot of paid training as an IT employee. Studying for a cassandra certification, getting the Kubernetes Admin certification, regular redundant OWASP security trainings. Export restriction trainings. There were a lot more that I didn't take. We basically had our own khan academy worth of trainings you could take at my last job.
  - chrisseaton 5y ago
    Imagine if when we promoted developers from juniors to seniors they were taken off their project and sent on a six-month residential retreat to focus exclusively on their own professional and personal development. That's the kind of approach to training the military has - beats some online course and corporate certs!
    - spaetzleesser 5y ago
      I always get jealous when managers at my company constantly go to trainings or are assigned to different roles to add skills. There really is a system for developing managers. That's opposed to developers who are basically asked to stagnate and stay where they are.
mikewarot 5y ago
>My office still has no billet and no funding, this year and the next. From his LinkedIn post... this really is the crux of the matter... they want to whitewash security, not actually implement it.
evilos 5y ago
Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like? It sounds like a terrible idea.
- markdjacobsen 5y ago
  See https://www.c4isrnet.com/air/2020/10/09/the-air-force-updated-the-software-on-one-of-its-oldest-aircraft-while-it-was-in-the-air/ https://www.c4isrnet.com/air/2020/10/09/the-air-force-update...
- ethbr0 5y ago
  U-2s are surveillance platforms. Hint: look at the letter. He means the initiative to provide in-air updating of the surveillance payload in response to tasking. Probably ELINT-related. Edit: He's probably talking about this https://mobile.twitter.com/WILLROP3R/status/1318161379304591363 https://mobile.twitter.com/WILLROP3R/status/1318161379304591... and this https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-taps-into-computers-on-the-ground-to-help-process-sensor-data-mid-mission https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-ta...
- chrisseaton 5y ago
  If you're watching a target, and it's going to be gone in a few hours, and the plane is already in the air, and you want to run a program to run the sensors in a certain way to get what you need, makes sense to me.
- _bnmd 5y ago
  Two notes on this: 1) If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain itself, but that is already an attack vector regardless of how the software gets loaded. 2) Part of the purpose of being able to do something like this is to push new software capabilities to platforms that can't be brought back to manually do it at all, like satellites in orbit. A software update that doesn't require you to launch a new rocket into space can save billions.
_bnmd 5y ago
I feel Nic's pain. Here is the original article about the talk he gave before leaving: https://www.airforcemag.com/air-force-leadership-chief-software-officer-devsecops/ https://www.airforcemag.com/air-force-leadership-chief-softw... > One of Chaillan’s main concerns is incorporating security into software development, a practice known among IT professionals as DevSecOps. With a lack of basic IT infrastructure, implementing DevSecOps has proven difficult, he said. What’s more, there has been some resistance among those used to the more traditional approach of considering security after development and operations. We're standing up basically everything ourselves from scratch. The mandate was basically "we have a critical need for a new capability. Here is an AWS account and five developers, so make it happen." That's it. So everything from standing up CI/CD pipelines, to building out a cluster, to configuring storage and networking, to writing and testing the application code, to maintaining environments and deployments, is falling on us, with no support. I'm not going to say what the product is for reasons of OPSEC, but it is inherently a product that has extremely high security needs. Yet in the rush to be able to tell some high-ranking people we have put an "MVP" in production, we've skimped in every which way it is possible to skimp. I am aware of so many holes in the system, but Air Force pen testers didn't find them, so our product manager is being pushed to go forward and we'll worry about security later. To my mind, this is absolutely unacceptable for a critical defense system, but nobody is asking my opinion. Supposedly, we keep being told we'll lose funding and get the plug pulled if we don't hit some important milestone at some exact date. By being "agile," we can deliver a broken, insecure "MVP" and "iterate" on it until we have a real product that actually meets its requirements. You can't do this crap with defense systems. This isn't Etsy. Deploying broken shit has far different implications than when all the exemplars from the DevOps Handbook do it in order to find all their bugs in prod and turn their users into beta testers.
- neilv 5y ago
  > has extremely high security needs ... I am aware of so many holes in the system, It sounds like you need to have a very serious talk with your management. I really hope that leads to a resolution of the problem. If not, lives and nations sometimes depend on these systems working, so you might be obligated to ensure that the right people understand the problem.
- 5y ago
AndrewKemendo 5y ago
I'm honestly surprised this is on HN, but it's good that it is. I worked with Nic on and off for almost his entire tenure while I was CTO for Kessel Run and I can state with full confidence that this is at best him mis-representing his importance and the problems with the DoD IT; and at worst this is his attempt to spin his being fired (or being asked to resign ala Nixon) by the incoming Secretary (timing here is not just a coincidence). A couple of core points, that are important to keep in mind that have nothing to do with Nic's character, integrity, communication style or technical capabilities (which is a separate and important topic but not suitable for this public forum IMO): - The CSO position was made up by him, it's not related to any GSA Schedule and it had about the kind of charter you would expect for the position: Namely ill-defined and loosely empowered. - There was no office of the CSO in the sense that it was not congressionally funded, had no budget, no personnel and no real authority for writing, implementing policy or actually doing engineering. - Nic never held a clearance, and as a result was never actually involved or aware of most of the programs that he intended to impact - His primary mission seemed to be to push any organization that was developing software for the USAF to immediately adopt microservices architectures, containers/kubernetes and a couple of very specific "DevSecOps" practices - and specifically to the specifications that he approved/suggested. Make of that what you will. That said, a lot of what he says is true and IT/network infrastructure, development and test etc... in the DoD is far from modern and in some places completely broken. Other places, where it matters a lot it's like nothing you've ever seen or will likely see in the commercial sector for decades. Bottom line, I suggest taking this tirade with an EXTREME amount of salt.
- ElijahLynn 5y ago
  I encourage you to leave this comment on the article itself on The Register since you already made it public here.
- phkahler 5y ago
  >> Other places, where it matters a lot it's like nothing you've ever seen or will likely see in the commercial sector for decades. That's something I'd really like to see. How does that kind of difference come about? My guess is that it requires a certain degree of funding and commitment that may be impossible in wallstreet companies. But what else does it take for an organization to get there?
GartzenDeHaes 5y ago
Fun fact about the USAF: pilots are selected based on personnel's assessment of a cadet's probability of making general officer. Aptitude for flying and piloting ability have nothing to do with the assessment, which occurs before pilot training. As a result, many Air Force pilots are awful pilots, but they are world class ass kisssers and social climbers.
- bodhiandphysics 5y ago
  Fun fact... this is completely false!
  - tablespoon 5y ago
    Yeah, it doesn't pass the smell test. I wouldn't be surprised if both piloting skill and advancement potential were requirements, though. It's sort of like people who are both awesome software developers and good managers. Those qualities often do not overlap, but they do sometimes. If you can afford to be selective enough (which is rare), you can check both boxes for everyone you hire.
    - bodhiandphysics 5y ago
      That is in fact what the air foce does. It uses a numerical rating based on a) an exam of pilot related skills. B) a general knowledge exam c) number of hours piloting you already have
- alarge 5y ago
  I'll take a slightly more nuanced position than a peer poster and say this is "mostly wrong" and somewhat backwards. (I've been out of this area for a few years, so my perspective might be a little dated, but I doubt it has changed that much) Pilots aren't simply "selected". You have to get through multiple gates to become a pilot in the USAF. Most of those gates involve demonstrating some degree of devotion and/or skill at flying (for example, having a private pilot's license before competing for a pilot slot is a really good idea). Having said this, pilots for the most part either end up in combat roles (e.g., fighters, etc.) or in leadership roles (as in, you have a whole crew you for which you are responsible). Furthermore, pilots are officers and all officers are expected to be effective leaders. So sure, leadership qualities are one of the things you look for - because you look for them in all your officer candidates. Now, you may not agree with the personality traits identified as leadership traits. In general, it is true that the military tends to favor personality traits over management skills (the argument being that management skills can be learned, but some innate personality traits cannot). They judge that things like "likeability" and "ability to get others to trust and follow you" matter. And here comes the backwards part. General officers are selected for their perceived ability to understand the mission of the USAF and move it forwards. This requires leadership skills and so is biased towards those with those skills. But there is also a general belief that the people who have most directly been involved in executing that mission are the people who are best positioned to lead that mission. In this case, being a "rated" officer (this used to be pilot/navigator/missile launch officer, but now seems to include a couple of other designations) actually dramatically improves your chances to make O6+ (Colonel -> 4-star General). So it isn't that you are selected to be a pilot because they think you'd be a good General - they think you'd be a good General because you've been a pilot. A final note - while all officer candidates are selected based on leadership skills, there are other factors that are also considered. For example, if you are competing for a technical slot, having a STEM degree is generally a requirement. But traditionally, the rated slots didn't have any particular educational requirements (other than a 4-year university degree). As a result, pilot candidates generally just have two things in common: * Those personality traits * A demonstrated commitment to become a pilot Given this, I can see why the original comment was made. But to actually become a pilot, you have to demonstrate the ability to fly. The training is both rigorous and very expensive, and I'd seriously doubt they'd keep the system as is if it routinely produced "awful" pilots.
RobRivera 5y ago
probably to make more money
- nchaillan 5y ago
  I made enough money selling 12 companies.
arwhatever 5y ago
> We would not put a pilot in the cockpit without extensive flight training; why would we expect someone with no IT experience to be close to successful? They do not know what to execute on or what to prioritize which leads to endless risk reduction efforts and diluted focus. IT is a highly skilled and trained job; staff it as such. Isn't this (general pattern) what led to the creation of the USAF as a separate military branch from the Army? Perhaps we need a use military branch - The U.S. Software Force!
- travisgriggs 5y ago
  Pitch that to Netflix. Space Force with Steve Carrell was decent, but done right, a Satirical Software Force could be a modern win. Especially since software has had such a transcendent arrival in our lives over the last 30 years.
pbpuckett3 5y ago
For those of you either contributing to PlatformOne or customers of PlatformOne struggling to get to prod, shoot me a message on LI and we will see if we can support you in cARMY/CReATE. I’m easy to find on LI or 365.

170 points by Ziggy_Zaggy 5y ago

> Among the USAF's sins-according-to-Chaillan? The service is still using "outdated water-agile-fall acquisition principles to procure services and talent", Wait, what?

_bnmd 5y ago
It's not explained, but I know exactly what he means. We mandate that development teams and integrated product teams have to use agile methods, but the procurement process itself is inherently not agile. Contracts come with fixed dollar amounts, milestone delivery dates, and requirements that need at least signoff from senior agency officials to change and possibly acts of Congress. Further, the way your "customer" is always an acquisition office rather than actual users of your system, developers can't receive, solicit, or respond to direct feedback from users, which is a pretty basic core tenet of agile development, without which it's hard to see how it can ever work.
- ethbr0 5y ago
  This. If you want to read more into the precise ordering of the neologism, it's agile sandwiched in the middle of waterfall. Which is to say, the upstream and downstream didn't change how they do things at all, and somehow developers acting differently is supposed to convert everything to agile. Or to put it another way, this is what you get when you tell everyone they need to "do agile" without actually retraining people on what that means and update processes to enable it. Source: experience with healthcare "agile" and "sprints"
  - AnimalMuppet 5y ago
    Stronger: Somehow developers acting differently without the inputs that agile processes require is supposed to convert everything to agile. And somehow it never does...
    - panzagl 5y ago
      In practice most contractors end up hiring a bunch of former users to act as stand-ins for the real operators. These former users then get to engage in continual pissing matches with the acquisition office over how things really get done. Hilarity ensues.
  - tablespoon 5y ago
    > Which is to say, the upstream and downstream didn't change how they do things at all, and somehow developers acting differently is supposed to convert everything to agile. Sounds like my corner of the private sector.
  - Pokepokalypse 5y ago
    I know the solution! Hire a scrum-master! that will fix it.
dragontamer 5y ago
The full paragraph reads: > The DoD is still using outdated water-agile-fall acquisition principles to procure services and talent instead of leveraging “Capacity of work” agile contracts to staff teams. Improving acquisition ensures teams have the ability to groom their backlog and move at the pace of relevance. Only Platform One, and teams like Kessel Run, are truly end-to-end agile, from what I have seen to-date. I don't know what "water-agile-fall" is exactly, but he's probably talking about some terms in the Air Force. Maybe he means that the waterfall model still exists, and a bunch of people are trying (unsuccessfully) to convert to agile. But he's only seen Agile properly happen in a minority of projects.
- jrochkind1 5y ago
  that is somewhat clarifying! Still trying to wrap my head around "to procure service and talent" with regard to agile/waterfall.
  - mpyne 5y ago
    He's talking about how you contract for additional staff to help with developing digital products. Typically the way government does this is by not contracting for staff at all, but instead contracting for a company to develop a software product that meets a long laundry list of requirements. Since 'agile' is in the DoD zeitgeist these contracts often throw in some agile buzzwords like "Story points" instead of "work breakdown structure", or split up the product into some kind of phased delivery scheme. Sometimes they'll throw in to do user-centered design. But invariably these contracts lay out the same thing: develop a product that meets X requirements. This means you have to know the requirements. You can't instead hire smart people to help explore a problem space, do interviews and experiments to determine whether you've achieved product-market fit (or what we'd call mission-market fit), and only then to start fielding a digital product in increments. This is considered a 'services contract' and these are frowned upon because they seem ripe for fraud ("you paid BigCo $40 million a year to do 'market research and product discovery'????? What did they discover? Why couldn't it have been $20M instead??"). TL;DR: The type of services you'd contract for are different for a modern digital product compared to a waterfall-style project. Even though DoD says we're doing agile, the reality is that the contracting system still pushes you hard to waterfall because no one seems to have the expertise to do 'agile acquisition'.
markdjacobsen 5y ago
HN has two threads on this now. I just replied on the other but will copy here: I can't speak for Chaillan, but as a military member who led an agile software development team similar to his during the same timeframe, I think he's referring to DoD's fondness for buzzwords. Because "agile" is the new hotness, every DoD office and vendor tries to slap the language of agile onto a waterfall model. See this wonderful report from the Defense Innovation Board on "Detecting Agile BS": https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB_DETECTING_AGILE_BS_2018.10.05.PDF https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB...
- Ziggy_Zaggy 5y ago
  Do you might linking the other HN thread?
  - markdjacobsen 5y ago
    Other thread: https://news.ycombinator.com/item?id=28407219 https://news.ycombinator.com/item?id=28407219
    - Ziggy_Zaggy 5y ago
      Much appreciated.
bink 5y ago
I presume he means they're claiming to be agile while really continuing to use a waterfall process for deploying software. They create specs, hire a vendor, do regular reviews before testing, approvals, deployment, provide specs for changes, pay for those changes, test, approvals, deploy, and then repeat.

dragontamer 5y ago

https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-chaillan/ https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch... This linkedin post seems way more... balanced... than TheRegister.com implied.

2OEH8eoCRo0 5y ago
> I realize more clearly than ever before that, in 20 years from now, our children, both in the United States’ and our Allies’, will have no chance competing in a world where China has the drastic advantage of population over the US. If the US can’t match the booming, hardworking population in China, then we have to win by being smarter, more efficient, and forward-leaning through agility, rapid prototyping and innovation. We have to be ahead and lead. We can’t afford to be behind. > While we wasted time in bureaucracy, our adversaries moved further ahead. Zoinks! This matches my experience working in defense and is one of my biggest fears. > I am becoming “technology stale”. > The DoD is still using outdated water-agile-fall acquisition principles to procure services and talent So glad that I left the industry. It's infuriating too because it's not a matter of if, but when. When the US faces a determined and modern adversary, the ones paying the price will be the men and women who serve in the military. It won't be the Pentagon brass or defense CEOs paying. This shit keeps me up at night. Worst of all the government has known it's a problem for decades if you read the Defense Innovation Board reports. https://media.defense.gov/2019/May/01/2002126691/-1/-1/0/SWAP%20FLYER.PDF https://media.defense.gov/2019/May/01/2002126691/-1/-1/0/SWA... > Nothing is changing: most of this has been said before and the 1987 DSB report on military software pretty much says it all. What is it going to take to actually do something?
- trhway 5y ago
  >If the US can’t match the booming, hardworking population in China, then we have to win by being smarter, more efficient, and forward-leaning one of the most efficient way to balance the scales is by taking away that smartest and hardworking top of the population through immigration.
  - toomuchtodo 5y ago

chrisseaton 5y ago

> IT is a highly skilled and trained job; staff it as such I don't think it's highly trained at all! What kind of training do major tech companies do? I've never done any in my career, outside my degrees, and not everyone does that even! Is that unusual? Contrast that with the military, which is obsessive about training and invests a huge amount of time and effort into it throughout your entire career. So who are we taking lessons from here?

mikewarot 5y ago
It was a bad word choice, I'll agree. Our training is on the job, mostly. I'd bet most of us know many different layers of abstraction, and ways to just get stuff done, that would take years to teach formally, if it could be taught.
Sevii 5y ago
I've done a lot of paid training as an IT employee. Studying for a cassandra certification, getting the Kubernetes Admin certification, regular redundant OWASP security trainings. Export restriction trainings. There were a lot more that I didn't take. We basically had our own khan academy worth of trainings you could take at my last job.
- chrisseaton 5y ago
  Imagine if when we promoted developers from juniors to seniors they were taken off their project and sent on a six-month residential retreat to focus exclusively on their own professional and personal development. That's the kind of approach to training the military has - beats some online course and corporate certs!
  - spaetzleesser 5y ago
    I always get jealous when managers at my company constantly go to trainings or are assigned to different roles to add skills. There really is a system for developing managers. That's opposed to developers who are basically asked to stagnate and stay where they are.

mikewarot 5y ago

>My office still has no billet and no funding, this year and the next. From his LinkedIn post... this really is the crux of the matter... they want to whitewash security, not actually implement it.

evilos 5y ago

Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like? It sounds like a terrible idea.

markdjacobsen 5y ago
See https://www.c4isrnet.com/air/2020/10/09/the-air-force-updated-the-software-on-one-of-its-oldest-aircraft-while-it-was-in-the-air/ https://www.c4isrnet.com/air/2020/10/09/the-air-force-update...
ethbr0 5y ago
U-2s are surveillance platforms. Hint: look at the letter. He means the initiative to provide in-air updating of the surveillance payload in response to tasking. Probably ELINT-related. Edit: He's probably talking about this https://mobile.twitter.com/WILLROP3R/status/1318161379304591363 https://mobile.twitter.com/WILLROP3R/status/1318161379304591... and this https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-taps-into-computers-on-the-ground-to-help-process-sensor-data-mid-mission https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-ta...
chrisseaton 5y ago
If you're watching a target, and it's going to be gone in a few hours, and the plane is already in the air, and you want to run a program to run the sensors in a certain way to get what you need, makes sense to me.
_bnmd 5y ago
Two notes on this: 1) If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain itself, but that is already an attack vector regardless of how the software gets loaded. 2) Part of the purpose of being able to do something like this is to push new software capabilities to platforms that can't be brought back to manually do it at all, like satellites in orbit. A software update that doesn't require you to launch a new rocket into space can save billions.

_bnmd 5y ago

I feel Nic's pain. Here is the original article about the talk he gave before leaving: https://www.airforcemag.com/air-force-leadership-chief-software-officer-devsecops/ https://www.airforcemag.com/air-force-leadership-chief-softw... > One of Chaillan’s main concerns is incorporating security into software development, a practice known among IT professionals as DevSecOps. With a lack of basic IT infrastructure, implementing DevSecOps has proven difficult, he said. What’s more, there has been some resistance among those used to the more traditional approach of considering security after development and operations. We're standing up basically everything ourselves from scratch. The mandate was basically "we have a critical need for a new capability. Here is an AWS account and five developers, so make it happen." That's it. So everything from standing up CI/CD pipelines, to building out a cluster, to configuring storage and networking, to writing and testing the application code, to maintaining environments and deployments, is falling on us, with no support. I'm not going to say what the product is for reasons of OPSEC, but it is inherently a product that has extremely high security needs. Yet in the rush to be able to tell some high-ranking people we have put an "MVP" in production, we've skimped in every which way it is possible to skimp. I am aware of so many holes in the system, but Air Force pen testers didn't find them, so our product manager is being pushed to go forward and we'll worry about security later. To my mind, this is absolutely unacceptable for a critical defense system, but nobody is asking my opinion. Supposedly, we keep being told we'll lose funding and get the plug pulled if we don't hit some important milestone at some exact date. By being "agile," we can deliver a broken, insecure "MVP" and "iterate" on it until we have a real product that actually meets its requirements. You can't do this crap with defense systems. This isn't Etsy. Deploying broken shit has far different implications than when all the exemplars from the DevOps Handbook do it in order to find all their bugs in prod and turn their users into beta testers.

neilv 5y ago
> has extremely high security needs ... I am aware of so many holes in the system, It sounds like you need to have a very serious talk with your management. I really hope that leads to a resolution of the problem. If not, lives and nations sometimes depend on these systems working, so you might be obligated to ensure that the right people understand the problem.
5y ago

AndrewKemendo 5y ago

I'm honestly surprised this is on HN, but it's good that it is. I worked with Nic on and off for almost his entire tenure while I was CTO for Kessel Run and I can state with full confidence that this is at best him mis-representing his importance and the problems with the DoD IT; and at worst this is his attempt to spin his being fired (or being asked to resign ala Nixon) by the incoming Secretary (timing here is not just a coincidence). A couple of core points, that are important to keep in mind that have nothing to do with Nic's character, integrity, communication style or technical capabilities (which is a separate and important topic but not suitable for this public forum IMO): - The CSO position was made up by him, it's not related to any GSA Schedule and it had about the kind of charter you would expect for the position: Namely ill-defined and loosely empowered. - There was no office of the CSO in the sense that it was not congressionally funded, had no budget, no personnel and no real authority for writing, implementing policy or actually doing engineering. - Nic never held a clearance, and as a result was never actually involved or aware of most of the programs that he intended to impact - His primary mission seemed to be to push any organization that was developing software for the USAF to immediately adopt microservices architectures, containers/kubernetes and a couple of very specific "DevSecOps" practices - and specifically to the specifications that he approved/suggested. Make of that what you will. That said, a lot of what he says is true and IT/network infrastructure, development and test etc... in the DoD is far from modern and in some places completely broken. Other places, where it matters a lot it's like nothing you've ever seen or will likely see in the commercial sector for decades. Bottom line, I suggest taking this tirade with an EXTREME amount of salt.

ElijahLynn 5y ago
I encourage you to leave this comment on the article itself on The Register since you already made it public here.
phkahler 5y ago
>> Other places, where it matters a lot it's like nothing you've ever seen or will likely see in the commercial sector for decades. That's something I'd really like to see. How does that kind of difference come about? My guess is that it requires a certain degree of funding and commitment that may be impossible in wallstreet companies. But what else does it take for an organization to get there?

GartzenDeHaes 5y ago

Fun fact about the USAF: pilots are selected based on personnel's assessment of a cadet's probability of making general officer. Aptitude for flying and piloting ability have nothing to do with the assessment, which occurs before pilot training. As a result, many Air Force pilots are awful pilots, but they are world class ass kisssers and social climbers.

bodhiandphysics 5y ago
Fun fact... this is completely false!
- tablespoon 5y ago
  Yeah, it doesn't pass the smell test. I wouldn't be surprised if both piloting skill and advancement potential were requirements, though. It's sort of like people who are both awesome software developers and good managers. Those qualities often do not overlap, but they do sometimes. If you can afford to be selective enough (which is rare), you can check both boxes for everyone you hire.
  - bodhiandphysics 5y ago
    That is in fact what the air foce does. It uses a numerical rating based on a) an exam of pilot related skills. B) a general knowledge exam c) number of hours piloting you already have
alarge 5y ago
I'll take a slightly more nuanced position than a peer poster and say this is "mostly wrong" and somewhat backwards. (I've been out of this area for a few years, so my perspective might be a little dated, but I doubt it has changed that much) Pilots aren't simply "selected". You have to get through multiple gates to become a pilot in the USAF. Most of those gates involve demonstrating some degree of devotion and/or skill at flying (for example, having a private pilot's license before competing for a pilot slot is a really good idea). Having said this, pilots for the most part either end up in combat roles (e.g., fighters, etc.) or in leadership roles (as in, you have a whole crew you for which you are responsible). Furthermore, pilots are officers and all officers are expected to be effective leaders. So sure, leadership qualities are one of the things you look for - because you look for them in all your officer candidates. Now, you may not agree with the personality traits identified as leadership traits. In general, it is true that the military tends to favor personality traits over management skills (the argument being that management skills can be learned, but some innate personality traits cannot). They judge that things like "likeability" and "ability to get others to trust and follow you" matter. And here comes the backwards part. General officers are selected for their perceived ability to understand the mission of the USAF and move it forwards. This requires leadership skills and so is biased towards those with those skills. But there is also a general belief that the people who have most directly been involved in executing that mission are the people who are best positioned to lead that mission. In this case, being a "rated" officer (this used to be pilot/navigator/missile launch officer, but now seems to include a couple of other designations) actually dramatically improves your chances to make O6+ (Colonel -> 4-star General). So it isn't that you are selected to be a pilot because they think you'd be a good General - they think you'd be a good General because you've been a pilot. A final note - while all officer candidates are selected based on leadership skills, there are other factors that are also considered. For example, if you are competing for a technical slot, having a STEM degree is generally a requirement. But traditionally, the rated slots didn't have any particular educational requirements (other than a 4-year university degree). As a result, pilot candidates generally just have two things in common: * Those personality traits * A demonstrated commitment to become a pilot Given this, I can see why the original comment was made. But to actually become a pilot, you have to demonstrate the ability to fly. The training is both rigorous and very expensive, and I'd seriously doubt they'd keep the system as is if it routinely produced "awful" pilots.

RobRivera 5y ago

probably to make more money

nchaillan 5y ago
I made enough money selling 12 companies.

arwhatever 5y ago

> We would not put a pilot in the cockpit without extensive flight training; why would we expect someone with no IT experience to be close to successful? They do not know what to execute on or what to prioritize which leads to endless risk reduction efforts and diluted focus. IT is a highly skilled and trained job; staff it as such. Isn't this (general pattern) what led to the creation of the USAF as a separate military branch from the Army? Perhaps we need a use military branch - The U.S. Software Force!

travisgriggs 5y ago
Pitch that to Netflix. Space Force with Steve Carrell was decent, but done right, a Satirical Software Force could be a modern win. Especially since software has had such a transcendent arrival in our lives over the last 30 years.

pbpuckett3 5y ago

For those of you either contributing to PlatformOne or customers of PlatformOne struggling to get to prod, shoot me a message on LI and we will see if we can support you in cARMY/CReATE. I’m easy to find on LI or 365.