4 ms·

Its almost like centralizing software to mayor clouds is not such a good idea after all ;) Governments should own their own datacenters and access should be hi

Its almost like centralizing software to mayor clouds is not such a good idea after all ;) Governments should own their own datacenters and access should be highly regulated. If you can spend billions on military projects that go nowhere, you should be able to spend a couple of million on people that create a networking structure for your that is based on RBAC, that is not owned by somebody else

DemiGuru 3y ago
I would go even further and say that governments should consider having their own OS. There is no reason why Windows 10 and 11, with their ever increasing number of ads and information sieve, would belong there.
- fsociety 3y ago
  If it doesn’t belong there then it doesn’t belong here.
lockhouse 3y ago
Sadly, the federal government doesn’t have a great track record here either… https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...
- toomuchtodo 3y ago
  It's duct tape and hope all the way down. (infosec/grc practitioner)
landemva 3y ago
> Governments should own their own datacenters Most government data should be on local in-country leased infrastructure. Government should not be building palaces and isolated from the people. It's my government and for the most part should be open.
_8j50 3y ago
A nation state compromises a cloud infra and that's your takeaway? Was your takeaway after solarwinds the opposite? To move it to the cloud? It's almost as if it is very easy to make reductionist statements without considering the nuances of the subject. While you're at it, stop using gmail and other webmail and selfhost. I am sure it will be more secure? Lol.
- jhoelzel 3y ago
  At least do some research my friend. Hackers compromised a digitally signed SolarWinds Orion network monitoring component, opening a backdoor into the networks of thousands of SolarWinds government and enterprise customers. Solarwinds was the exact same problem. the cloud service was centralized and thousands of server where hacked because of it. just because you install something yourself does not make it self hosted. Lastly this was a supply chain attack. which means too that if the government is able to roll their own stuff, or use open source products that can be reviewed properly, this would not have happened.
  - _8j50 3y ago
    Do some research? I do this for a living. "digitally signed SolarWinds Orion network monitoring component" Do you even know what that is? It's a .net dll. It was absolutley self hosted. Updating the self-hosted software meant that included the backdoored dll. There is no cloud involved. Do you even know what solarwinds does? > just because you install something yourself does not make it self hosted It does when you install it on your own server that you manage. > Lastly this was a supply chain attack. which means too that if the government is able to roll their own stuff, or use open source products that can be reviewed properly, this would not have happened. So now you moved to every company and government should write their own software? And you think opensource means it will get reviewed because unpaid people who are not responsible for review will review it no matter what? Opensource is an even bigger nightmare, I am sure you must have heard of the log4j mess. Perhaps you should look into what security professionals have to say about the subject instead of presuming things.
    - 3y ago
mrguyorama 3y ago
The federal government should absolutely have their own software development department that exists entirely to make software for governments. I'm so tired of us saying "nononono government can't do it efficiently" just so we can spend 10x as much on a "contractor" who works only ever for the government and spends all their R&D on circumventing government procurement contract clauses.

DemiGuru 3y ago

I would go even further and say that governments should consider having their own OS. There is no reason why Windows 10 and 11, with their ever increasing number of ads and information sieve, would belong there.

fsociety 3y ago
If it doesn’t belong there then it doesn’t belong here.

lockhouse 3y ago

Sadly, the federal government doesn’t have a great track record here either… https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...

toomuchtodo 3y ago
It's duct tape and hope all the way down. (infosec/grc practitioner)

landemva 3y ago

> Governments should own their own datacenters Most government data should be on local in-country leased infrastructure. Government should not be building palaces and isolated from the people. It's my government and for the most part should be open.

_8j50 3y ago

A nation state compromises a cloud infra and that's your takeaway? Was your takeaway after solarwinds the opposite? To move it to the cloud? It's almost as if it is very easy to make reductionist statements without considering the nuances of the subject. While you're at it, stop using gmail and other webmail and selfhost. I am sure it will be more secure? Lol.

jhoelzel 3y ago
At least do some research my friend. Hackers compromised a digitally signed SolarWinds Orion network monitoring component, opening a backdoor into the networks of thousands of SolarWinds government and enterprise customers. Solarwinds was the exact same problem. the cloud service was centralized and thousands of server where hacked because of it. just because you install something yourself does not make it self hosted. Lastly this was a supply chain attack. which means too that if the government is able to roll their own stuff, or use open source products that can be reviewed properly, this would not have happened.
- _8j50 3y ago
  Do some research? I do this for a living. "digitally signed SolarWinds Orion network monitoring component" Do you even know what that is? It's a .net dll. It was absolutley self hosted. Updating the self-hosted software meant that included the backdoored dll. There is no cloud involved. Do you even know what solarwinds does? > just because you install something yourself does not make it self hosted It does when you install it on your own server that you manage. > Lastly this was a supply chain attack. which means too that if the government is able to roll their own stuff, or use open source products that can be reviewed properly, this would not have happened. So now you moved to every company and government should write their own software? And you think opensource means it will get reviewed because unpaid people who are not responsible for review will review it no matter what? Opensource is an even bigger nightmare, I am sure you must have heard of the log4j mess. Perhaps you should look into what security professionals have to say about the subject instead of presuming things.
  - 3y ago

mrguyorama 3y ago

The federal government should absolutely have their own software development department that exists entirely to make software for governments. I'm so tired of us saying "nononono government can't do it efficiently" just so we can spend 10x as much on a "contractor" who works only ever for the government and spends all their R&D on circumventing government procurement contract clauses.