6 ms·

"when you requested the confirmation code [it] was generated client-side, then sent to you via a POST Request" That is shocking. What must the internal culture

"when you requested the confirmation code [it] was generated client-side, then sent to you via a POST Request" That is shocking. What must the internal culture be like for such an idea to even be a possibility?

coldcode 5y ago
There are a lot of highly terrible government contracting agencies out there who charge enormous fees and who knows who actually does the work given the likelihood no one even validates any of the work. Suck our taxpayer money out of the system and leave trash in the wake. You'd think an agency as important as the FBI would verify who is working on their systems, but probably no one did.
- topspin 5y ago
  > You'd think an agency as important as the FBI would verify who is working on their systems Why? The upper echelons of these federal law enforcement and intelligence agencies are universally political animals with names suffixed by III and IV that instinctually perceive anything as even vaguely technical as far beneath them. The only time something like the security of a network becomes a priority for these people is when it causes them embarrassment. At all other times the operation of these systems is a budget item that gets farmed out according to the prevailing political prerogatives of the day; actual competence being well down on the list of priorities.
- neartheplain 5y ago
  This wouldn't be the first time the FBI mismanaged software contractors: https://www.centreforpublicimpact.org/case-study/fbi-virtual-case-file-system/ https://www.centreforpublicimpact.org/case-study/fbi-virtual... Or the second: https://www.newsweek.com/fbis-expensive-sentinel-computer-system-still-isnt-working-despite-report-272855 https://www.newsweek.com/fbis-expensive-sentinel-computer-sy...
christophilus 5y ago
I spent two weeks or so working at a government contractor. I put my two week notice in almost as soon as I’d started, and I permanently swore off the industry. There were some genuinely good, smart people working there, but the culture was such that I’d be very surprised if they shipped a working product in 5 years time. If they did ship it, it would be an awful thing to behold. I don’t know how to fix this issue. But from what I’ve seen and heard, the best minds (other than the rare altruist) stay in the private sector. It pays better, and there’s just so much less BS to deal with.
- orangepurple 5y ago
  I know another government contractor whose idea of client responsiveness is to download the entire server database to the client browser on initial load
  - couchand 5y ago
    That's completely the right strategy for the scale most web apps operate at.
    - foota 5y ago
      This works great until you have something that doesn't fit, and it can block new features as a result of that. I worked on an application a number of years ago where it was trying to load all the comments and details about an internal bug tracker into memory. It must have worked fine at first, but after time it was a POS.
      - altfredd 5y ago
        There is no "one size fits all" solution. If the database fits onto client hard drive and the modifications are rare, preloading everything is almost always better. If you have a dynamically changing system such as bug tracker, it is still possible to go fully local, but that would require considerable cooperation from server side. When the back-end does not have a fast, efficient API for sending diffs, you may get stuck waiting for it to be implemented. But that's a purely organizational problem. Of course, all of above applies to actually saving data to permanent storage. Storing everything in memory is a sin by itself.
deleted 5y ago
[deleted]
rglover 5y ago
It's the government.
- tamaharbor 5y ago
  Lowest bidder.
  - hellbannedguy 5y ago
    That has changed a tiny bit. They are suppose to have some experience too, but I imagine that is faked too. I heard things changed a bit when those two guys from Miami got in trouble forging papers. (I have nothing wrong with the lowest price on most contracts. Guys with no trail of experience should be able to compete with the big guys. Contracts like software development should be vetted more than price though.)
  - silexia 5y ago
    Not low bidder, most politically connected. I have been trying to get US government contracts for years through my company, including offering $0, $1 and other guaranteed low price bids to try to get the work. We exceed every requirement in the RFPs. We are recognized as the best in the nation in our service area and have 200+ full time employees. Crickets.
ma2rten 5y ago
What does this actually mean? Why does it need to be sent to you (presumably referring to the client) when it's generated client side.
- navels 5y ago
  Agree this wording is confusing, but from the article I think we can infer that the client makes s POST request to the backend which sends the email.
L-four 5y ago
From the government work I've done. The most important thing is the paperwork and paper-trail, everything else is secondary.
technion 5y ago
A comment elsewhere is that the site was made with the 'IBM Form Experience', and that this issue is possibly just a part of how that product works. In which case I could totally see how it's part of the culture, having worked in orgs like this: - A person brings up this concern - "Uh sweetie, I think IBM wouldn't make a mistake like that"
- lotsofpulp 5y ago
  Being able to scapegoat IBM of all companies would just show how far people in the org are out of the loop.
noduerme 5y ago
How incredibly stupid. A twelve year old who spent two seconds thinking about what confirmation codes are for would realize the error of generating them in the browser. What do they think conf codes do? Just be there for show? Don't programmers have to pass some kind of minimal literacy test to work for the government?
- slavboj 5y ago
  "Just be there for show?" Yes. In the same way that many law enforcement organizations (not so much the FBI, but definitely US Marshals Service) will carry around badges and take extreme umbrage at anyone actually attempting to confirm their identity.
ocdtrekkie 5y ago
An important highlight in this article is the Internet Explorer requirement: The site is old. The security focused mindset we have today in web development just wasn't developed to that level whenever this thing was written. It's kinda a case in point for replacing websites entirely from time to time.

coldcode 5y ago

There are a lot of highly terrible government contracting agencies out there who charge enormous fees and who knows who actually does the work given the likelihood no one even validates any of the work. Suck our taxpayer money out of the system and leave trash in the wake. You'd think an agency as important as the FBI would verify who is working on their systems, but probably no one did.

topspin 5y ago
> You'd think an agency as important as the FBI would verify who is working on their systems Why? The upper echelons of these federal law enforcement and intelligence agencies are universally political animals with names suffixed by III and IV that instinctually perceive anything as even vaguely technical as far beneath them. The only time something like the security of a network becomes a priority for these people is when it causes them embarrassment. At all other times the operation of these systems is a budget item that gets farmed out according to the prevailing political prerogatives of the day; actual competence being well down on the list of priorities.
neartheplain 5y ago
This wouldn't be the first time the FBI mismanaged software contractors: https://www.centreforpublicimpact.org/case-study/fbi-virtual-case-file-system/ https://www.centreforpublicimpact.org/case-study/fbi-virtual... Or the second: https://www.newsweek.com/fbis-expensive-sentinel-computer-system-still-isnt-working-despite-report-272855 https://www.newsweek.com/fbis-expensive-sentinel-computer-sy...

christophilus 5y ago

I spent two weeks or so working at a government contractor. I put my two week notice in almost as soon as I’d started, and I permanently swore off the industry. There were some genuinely good, smart people working there, but the culture was such that I’d be very surprised if they shipped a working product in 5 years time. If they did ship it, it would be an awful thing to behold. I don’t know how to fix this issue. But from what I’ve seen and heard, the best minds (other than the rare altruist) stay in the private sector. It pays better, and there’s just so much less BS to deal with.

orangepurple 5y ago
I know another government contractor whose idea of client responsiveness is to download the entire server database to the client browser on initial load
- couchand 5y ago
  That's completely the right strategy for the scale most web apps operate at.
  - foota 5y ago
    This works great until you have something that doesn't fit, and it can block new features as a result of that. I worked on an application a number of years ago where it was trying to load all the comments and details about an internal bug tracker into memory. It must have worked fine at first, but after time it was a POS.
    - altfredd 5y ago
      There is no "one size fits all" solution. If the database fits onto client hard drive and the modifications are rare, preloading everything is almost always better. If you have a dynamically changing system such as bug tracker, it is still possible to go fully local, but that would require considerable cooperation from server side. When the back-end does not have a fast, efficient API for sending diffs, you may get stuck waiting for it to be implemented. But that's a purely organizational problem. Of course, all of above applies to actually saving data to permanent storage. Storing everything in memory is a sin by itself.

deleted 5y ago

[deleted]

rglover 5y ago

It's the government.

tamaharbor 5y ago
Lowest bidder.
- hellbannedguy 5y ago
  That has changed a tiny bit. They are suppose to have some experience too, but I imagine that is faked too. I heard things changed a bit when those two guys from Miami got in trouble forging papers. (I have nothing wrong with the lowest price on most contracts. Guys with no trail of experience should be able to compete with the big guys. Contracts like software development should be vetted more than price though.)
- silexia 5y ago
  Not low bidder, most politically connected. I have been trying to get US government contracts for years through my company, including offering $0, $1 and other guaranteed low price bids to try to get the work. We exceed every requirement in the RFPs. We are recognized as the best in the nation in our service area and have 200+ full time employees. Crickets.

ma2rten 5y ago

What does this actually mean? Why does it need to be sent to you (presumably referring to the client) when it's generated client side.

navels 5y ago
Agree this wording is confusing, but from the article I think we can infer that the client makes s POST request to the backend which sends the email.

L-four 5y ago

From the government work I've done. The most important thing is the paperwork and paper-trail, everything else is secondary.

technion 5y ago

A comment elsewhere is that the site was made with the 'IBM Form Experience', and that this issue is possibly just a part of how that product works. In which case I could totally see how it's part of the culture, having worked in orgs like this: - A person brings up this concern - "Uh sweetie, I think IBM wouldn't make a mistake like that"

lotsofpulp 5y ago
Being able to scapegoat IBM of all companies would just show how far people in the org are out of the loop.

noduerme 5y ago

How incredibly stupid. A twelve year old who spent two seconds thinking about what confirmation codes are for would realize the error of generating them in the browser. What do they think conf codes do? Just be there for show? Don't programmers have to pass some kind of minimal literacy test to work for the government?

slavboj 5y ago
"Just be there for show?" Yes. In the same way that many law enforcement organizations (not so much the FBI, but definitely US Marshals Service) will carry around badges and take extreme umbrage at anyone actually attempting to confirm their identity.

ocdtrekkie 5y ago

An important highlight in this article is the Internet Explorer requirement: The site is old. The security focused mindset we have today in web development just wasn't developed to that level whenever this thing was written. It's kinda a case in point for replacing websites entirely from time to time.