8 ms·

> Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main re

by mkl95 4y ago

> Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main reason to buy those domains is to spend as little money as possible. Someone at gov.uk is a cheapskate or works with a really limited budget.

IndigoIncognito 4y ago
Limited budget, the UK public sector funding right now is atrocious, even in IT
- robertlagrant 4y ago
  Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.
danw1979 4y ago
Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.
- mkl95 4y ago
  If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
  - logifail 4y ago
    > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.
    - mkl95 4y ago
      Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "shadow IT" will depend on who you ask. Personally I have never deployed something to prod that way (I did it for some lower envs), but it's something I've seen people do at every single place I've worked. And your last paragraph is 100% true in my experience.
selfhoster11 4y ago
This might sound a bit crazy, but... the UK government is in sole control of .gov.uk, right? They shouldn't have issues issuing themselves with as many subdomains as needed. For free, or for symbolic prices.
- ldjb 4y ago
  Sort of. The UK Government (specifically the Cabinet Office) manages various aspects of the *.gov.uk space, but .gov.uk domains can be registered not only by the UK Government, but also local governments and other public sector organisations. .gov.uk domains are registered through commercial registrars (who charge a fee), much like .co.uk domain names. The main difference being that you need to be an eligible organisation to register a .gov.uk domain name.
scrollaway 4y ago
Absolutely untrue. The main reason these domains get bought is because it’s simpler. There are likely procedures in place and security checks and people involved in gov.uk domain control, that are a non issue if the team owns the tld, which makes internal testing easier.

by mkl95 4y ago

IndigoIncognito 4y ago

Limited budget, the UK public sector funding right now is atrocious, even in IT

robertlagrant 4y ago
Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.

danw1979 4y ago

Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.

mkl95 4y ago
If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
- logifail 4y ago
  > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.
  - mkl95 4y ago
    Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "shadow IT" will depend on who you ask. Personally I have never deployed something to prod that way (I did it for some lower envs), but it's something I've seen people do at every single place I've worked. And your last paragraph is 100% true in my experience.

selfhoster11 4y ago

This might sound a bit crazy, but... the UK government is in sole control of .gov.uk, right? They shouldn't have issues issuing themselves with as many subdomains as needed. For free, or for symbolic prices.

ldjb 4y ago
Sort of. The UK Government (specifically the Cabinet Office) manages various aspects of the *.gov.uk space, but .gov.uk domains can be registered not only by the UK Government, but also local governments and other public sector organisations. .gov.uk domains are registered through commercial registrars (who charge a fee), much like .co.uk domain names. The main difference being that you need to be an eligible organisation to register a .gov.uk domain name.

scrollaway 4y ago

Absolutely untrue. The main reason these domains get bought is because it’s simpler. There are likely procedures in place and security checks and people involved in gov.uk domain control, that are a non issue if the team owns the tld, which makes internal testing easier.