3 ms·
Has anyone here worked on government websites or APIs? I'm curious what the experience was like.
by awb 5y ago
Has anyone here worked on government websites or APIs?
I'm curious what the experience was like.
- deleted 5y ago[deleted]
- atlgator 5y agoIt's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
- Jerrrry 5y agoThis is correct. The "FedRamp" contract overhaul pretty much locks in the requirements and specifications to these above implementations. I have designed an API that revolves around and side-steps this that currently serves 60 million US civilians...but in the end, the security assessment pretty much comes down to the Privacy Acts interpretations and the common sense security landscape.
- awb 5y agoHow is it different from working with a private company? Lots of stakeholders? More documented testing procedures?
- Spooky23 5y agoSomeone said it best upthread: the incentives are different. If you are a leader in the bureaucracy, your incentive is to not personally fail, which is not the same as to succeed. There is an army of auditors waiting to question every decision, so the obvious way to avoid that is to not make any. Balancing the need to do something without deciding anything is an art of sorts.
- wslack 5y agoAlso, to be clear, those incentives aren't coming from within the bureaucracy. For example, let's say that a program tries to do something and it totally doesn't work. A news story about this will be roughly the same if $10,000 is spent as if $100,000 is spent as if $1,000,000 is spent. That creates an incentive never to label anything a failure and just keep pumping good money after bad - that's how to avoid the negative article.
- sofixa 5y agoFrench Connect, the French government SSO is open source and on GitHub if you're interested: https://github.com/france-connect https://github.com/france-connect
- alexose 5y agoI spent a couple of years with the USDS (https://usds.gov/ https://usds.gov/). USDS, along with 18F, are largely responsible for login.gov, as well as a lot of other really great projects. Overall fantastic experience if you're open to an adventure! I could probably spend a week telling war stories, but the main takeaway is that you can't look at government as just another sector waiting to be brought up to speed. Government is an entire industry unto itself, with incentives that seem fully alien to anyone from the private sector. Money doesn't flow according to the laws of capitalist physics, but by byzantine congressional allocation. Understanding how things actually get done requires a ton of time, networking, study, and empathy. Career government techies are extremely risk adverse (for a lot of very good reasons). If you want to make an impact, it helps to be able to take on a lot of the risk that nobody else wants to. For me, that meant promoting open-source alternatives to various entrenched products (cough, MS Access, cough) and accepting all the blame if the higher-ups don't like it. For this reason, it helps not to look at this as a career. Going up against the entrenched interests can be frustratingly hard. It feels like everything is subtly working against you. Or, not so subtly- On more than one occasion I had teammates get singled out by the federal IT press. Somehow I managed to stay anonymous, but the threat was there. Fortunately, I felt a strong sense of support from my bosses, as well as a lot of righteous fury from seeing so many failed, hundred million dollar projects that could have just been a simple web app. Granted, it's been about five years since I was in government. I would be curious to know if things are different nowadays :)