7 ms·

DoD's First Chief Software Officer Resigns in Frustration

56 points by xiaodai 5y ago

WarOnPrivacy 5y ago
Filed under: Things so true they're nearly physics. "Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 million users when they have no previous experience in that field—we are setting up critical infrastructure to fail." Past that, there are some other people who shouldn't ever get near cybersecurity management - legislators. Specifically the majority who are willfully clueless.
- Waterluvian 5y ago
  Like safety, security is a cost centre with catastrophic penalties for getting wrong. Absolutely any attempt to run it like we run other parts of an organization is a guaranteed way to create a disaster. P.S. “Things so true they’re nearly physics” might be my favourite line this year.
  - hulitu 5y ago
    > Like safety, security is a cost centre with catastrophic penalties for getting wrong. The main problem is that this cost center does generate any revenue. Try to explain this to a CFO.
- sushsjsuauahab 5y ago
  While I probably agree, why can't the Major just be the project manager and he or she consults daily with their trusted, deeply responsible technical advisor who is actually from the industry?
  - WarOnPrivacy 5y ago
    Because the major is unqualified to evaluate the guidance they receive. Same reason we don't randomly pick our battlefield generals from a pool of chimney sweeps.
  - ARandomerDude 5y ago
    Former USAF officer here. Part of the problem is that a Major or Lt Col does not have the rank or budget necessary to pull off a project of that scale. They are still too low on the chain, and too easy to override and then scapegoat when the project fails. Moreover, the officer system is "up or out" meaning that a field grade officer will always be incentivized to prioritize short-term paper gains over long-term strategic gains. This is a bad thing when designing critical infrastructure. A more senior officer with longer tenure and a bigger budget (i.e., a General or SES) needs to run a project intended for millions of users in a defense context.
    - sushsjsuauahab 5y ago
      Appreciate the perspective, I didn't realize that there was much higher up to go :) Makes sense!
  - obstacle1 5y ago
    Seems ripe for exploitation. What's stopping the PM-but-really-Major from invoking chain of command and making overriding decisions? In an org like the military I'm not sure you could just say "please act like a PM and don't make broader decisions" to someone with seniority and expect them to not exercise their authority, unless you actually revoke their authority. Or, what's stopping the Major from installing a friendly and symbolic tech advisor? Stranger things have happened than bureaucrats hiring and building departments designed to do nothing but legitimize and push forward their own agenda.
- smoldesu 5y ago
  My favorite is Sakurada, the cybersecurity expert who's allegedly never touched a computer. Can't hit what you can't see! https://www.bbc.com/news/technology-46222026 https://www.bbc.com/news/technology-46222026
  - AutumnCurtain 5y ago
    If everyone followed his lead, cybercrime would cease to exist. He's leading by example
  - hanniabu 5y ago
    Ironically a cybersecurity expert would know nothing is secure and not have a computer
counternotions 5y ago
Surprised that the DoD cannot contractually gag a high-level departure from sharing internal dirty laundry like this, as an issue of national security, when your typical corp would without a doubt suppress this kind of public lamentation. Does not look good for the US on the world stage.
- dylan604 5y ago
  Yeah, every corp out there would have a non-disclosure/non-disparge clause before receiving that shiny parachute being dangled in front of you on the way out the door. The problem is that with the military, that door might be 30k in the air so that 'chute might be pretty tempting! Guess the military hasn't had much need recruiting legal minds.
  - JohnJamesRambo 5y ago
    "The best minds are not in government. If any were, business would steal them away." -Ronald Reagan I've got a lot of issues with him, but this quote is spot on.
    - deleted 5y ago
      [deleted]
    - neilv 5y ago
      Government work still gets some top-capability people, who want to do something more worthwhile than is available in most of business.
      - deleted 5y ago
        [deleted]
      - dylan604 5y ago
        If you're into math/crypto, no better place if you're not also into fintech and you don't want to be babysitter in academia.
    - 5y ago
wildrhythms 5y ago
When our top lawmakers are bringing in tech CEOs to grill them on 'ending finsta' I think maybe we need a complete rethinking of how we address cybersecurity and tech in general.
- MeinBlutIstBlau 5y ago
  Personally it makes me want to get into it if things fall apart for me only because American technological incompetence has never been more apparent to me. I'd Target business analysts that love just grabbing python libraries but don't know anything about coding. Because that's what corporate America gets for letting people who don't know Jack about SWE touch a damn terminal. Business analysts are the scourge of tech. I have yet to meet one that actually is competent tech wise.
- jancsika 5y ago
  Craggy Senator to HN: Tell us how you would end finsta? HN: OMG LOL finsta's not a product GTFO vs. FAANG interviewer to HN Interviewee: Tell us how you would end finsta? HN Interviewee: Preventing users from signing up with secondary, pseudonymous accounts is of course a difficult problem. However, by using the following three sets of simple and anonymized data, I believe we can not only easily automate correlation of these accounts for the vast majority of cases, but if you'll hand me the marker I'll give you the pseudocode which can be abstracted to restrict any subset of users based on any underlying...
mat0 5y ago
Why not repost the original LinkedIn post? I don't see what value this piece aims to add
manpagereader 5y ago
Interesting how Chinese people have fixated upon this story.
itsdrewmiller 5y ago
Discussed two months ago: https://news.ycombinator.com/item?id=28408399 https://news.ycombinator.com/item?id=28408399
- remarkEon 5y ago
  That is one of the most interesting comment threads I've ever read on this website. It's like an in-house DoD drama played out in real time here on HN.
  - kevin_thibedeau 5y ago
    > I do have a clearance as well and yes sorry I didn't let us get locked into Pivotal like you did and cost taxpayer millions. Probably not cleared any more.
- babelfish 5y ago
  Title should be updated to include "[September]", my first thought was "Already?!" :) Link to CSOs resignation post the article is referencing https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-chaillan/ https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...
- Mandatum 5y ago
  He responded to comments in that thread here: https://news.ycombinator.com/context?id=28410812 https://news.ycombinator.com/context?id=28410812
jart 5y ago
> In only 3 years, we were able to bring Kubernetes on weapon systems, including jets and space systems, where we demonstrated that containerization was not only possible but game-changing on Real-Time OS and legacy hardware. Docker on fighter jets. Now all we need is NodeJS on nuclear submarines.
- numlock86 5y ago
  > Docker on fighter jets. Now all we need is NodeJS on nuclear submarines. We have electron/NodeJS on spacecrafts. Close enough.
HeyZuess 5y ago
> Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 million users when they have no previous experience in that field—we are setting up critical infrastructure to fail. We would not put a pilot in the cockpit without extensive flight training; why would we expect someone with no IT experience to be close to successful? This is very interesting. It is the 2 sides of the same coin. I have seem many IT projects deteriorate into a convoluted technical mess which solves none of the organizations or stakeholder requirements. However I have also seen top down management from business people destroy projects by their lack of knowledge, and understanding of IT. IT does not live in a bubble, it has a purpose and those whom manage it should also understand its attributes.

56 points by xiaodai 5y ago

Filed under: Things so true they're nearly physics. "Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 million users when they have no previous experience in that field—we are setting up critical infrastructure to fail." Past that, there are some other people who shouldn't ever get near cybersecurity management - legislators. Specifically the majority who are willfully clueless.

Waterluvian 5y ago
Like safety, security is a cost centre with catastrophic penalties for getting wrong. Absolutely any attempt to run it like we run other parts of an organization is a guaranteed way to create a disaster. P.S. “Things so true they’re nearly physics” might be my favourite line this year.
- hulitu 5y ago
  > Like safety, security is a cost centre with catastrophic penalties for getting wrong. The main problem is that this cost center does generate any revenue. Try to explain this to a CFO.
sushsjsuauahab 5y ago
While I probably agree, why can't the Major just be the project manager and he or she consults daily with their trusted, deeply responsible technical advisor who is actually from the industry?
- WarOnPrivacy 5y ago
  Because the major is unqualified to evaluate the guidance they receive. Same reason we don't randomly pick our battlefield generals from a pool of chimney sweeps.
- ARandomerDude 5y ago
  Former USAF officer here. Part of the problem is that a Major or Lt Col does not have the rank or budget necessary to pull off a project of that scale. They are still too low on the chain, and too easy to override and then scapegoat when the project fails. Moreover, the officer system is "up or out" meaning that a field grade officer will always be incentivized to prioritize short-term paper gains over long-term strategic gains. This is a bad thing when designing critical infrastructure. A more senior officer with longer tenure and a bigger budget (i.e., a General or SES) needs to run a project intended for millions of users in a defense context.
  - sushsjsuauahab 5y ago
    Appreciate the perspective, I didn't realize that there was much higher up to go :) Makes sense!
- obstacle1 5y ago
  Seems ripe for exploitation. What's stopping the PM-but-really-Major from invoking chain of command and making overriding decisions? In an org like the military I'm not sure you could just say "please act like a PM and don't make broader decisions" to someone with seniority and expect them to not exercise their authority, unless you actually revoke their authority. Or, what's stopping the Major from installing a friendly and symbolic tech advisor? Stranger things have happened than bureaucrats hiring and building departments designed to do nothing but legitimize and push forward their own agenda.
smoldesu 5y ago
My favorite is Sakurada, the cybersecurity expert who's allegedly never touched a computer. Can't hit what you can't see! https://www.bbc.com/news/technology-46222026 https://www.bbc.com/news/technology-46222026
- AutumnCurtain 5y ago
  If everyone followed his lead, cybercrime would cease to exist. He's leading by example
- hanniabu 5y ago
  Ironically a cybersecurity expert would know nothing is secure and not have a computer

counternotions 5y ago

Surprised that the DoD cannot contractually gag a high-level departure from sharing internal dirty laundry like this, as an issue of national security, when your typical corp would without a doubt suppress this kind of public lamentation. Does not look good for the US on the world stage.

dylan604 5y ago
Yeah, every corp out there would have a non-disclosure/non-disparge clause before receiving that shiny parachute being dangled in front of you on the way out the door. The problem is that with the military, that door might be 30k in the air so that 'chute might be pretty tempting! Guess the military hasn't had much need recruiting legal minds.
- JohnJamesRambo 5y ago
  "The best minds are not in government. If any were, business would steal them away." -Ronald Reagan I've got a lot of issues with him, but this quote is spot on.
  - deleted 5y ago
    [deleted]
  - neilv 5y ago
    Government work still gets some top-capability people, who want to do something more worthwhile than is available in most of business.
    - deleted 5y ago
      [deleted]
    - dylan604 5y ago
      If you're into math/crypto, no better place if you're not also into fintech and you don't want to be babysitter in academia.
  - 5y ago

wildrhythms 5y ago

When our top lawmakers are bringing in tech CEOs to grill them on 'ending finsta' I think maybe we need a complete rethinking of how we address cybersecurity and tech in general.

MeinBlutIstBlau 5y ago
Personally it makes me want to get into it if things fall apart for me only because American technological incompetence has never been more apparent to me. I'd Target business analysts that love just grabbing python libraries but don't know anything about coding. Because that's what corporate America gets for letting people who don't know Jack about SWE touch a damn terminal. Business analysts are the scourge of tech. I have yet to meet one that actually is competent tech wise.
jancsika 5y ago
Craggy Senator to HN: Tell us how you would end finsta? HN: OMG LOL finsta's not a product GTFO vs. FAANG interviewer to HN Interviewee: Tell us how you would end finsta? HN Interviewee: Preventing users from signing up with secondary, pseudonymous accounts is of course a difficult problem. However, by using the following three sets of simple and anonymized data, I believe we can not only easily automate correlation of these accounts for the vast majority of cases, but if you'll hand me the marker I'll give you the pseudocode which can be abstracted to restrict any subset of users based on any underlying...

mat0 5y ago

Why not repost the original LinkedIn post? I don't see what value this piece aims to add

manpagereader 5y ago

Interesting how Chinese people have fixated upon this story.

itsdrewmiller 5y ago

Discussed two months ago: https://news.ycombinator.com/item?id=28408399 https://news.ycombinator.com/item?id=28408399

remarkEon 5y ago
That is one of the most interesting comment threads I've ever read on this website. It's like an in-house DoD drama played out in real time here on HN.
- kevin_thibedeau 5y ago
  > I do have a clearance as well and yes sorry I didn't let us get locked into Pivotal like you did and cost taxpayer millions. Probably not cleared any more.
babelfish 5y ago
Title should be updated to include "[September]", my first thought was "Already?!" :) Link to CSOs resignation post the article is referencing https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-chaillan/ https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...
Mandatum 5y ago
He responded to comments in that thread here: https://news.ycombinator.com/context?id=28410812 https://news.ycombinator.com/context?id=28410812

jart 5y ago

> In only 3 years, we were able to bring Kubernetes on weapon systems, including jets and space systems, where we demonstrated that containerization was not only possible but game-changing on Real-Time OS and legacy hardware. Docker on fighter jets. Now all we need is NodeJS on nuclear submarines.

numlock86 5y ago
> Docker on fighter jets. Now all we need is NodeJS on nuclear submarines. We have electron/NodeJS on spacecrafts. Close enough.

HeyZuess 5y ago

> Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 million users when they have no previous experience in that field—we are setting up critical infrastructure to fail. We would not put a pilot in the cockpit without extensive flight training; why would we expect someone with no IT experience to be close to successful? This is very interesting. It is the 2 sides of the same coin. I have seem many IT projects deteriorate into a convoluted technical mess which solves none of the organizations or stakeholder requirements. However I have also seen top down management from business people destroy projects by their lack of knowledge, and understanding of IT. IT does not live in a bubble, it has a purpose and those whom manage it should also understand its attributes.