3 ms·
The US government, especially the military, is largely allergic to software. This is slowly starting to change, but only in small pockets. I am aware of three
by austin-cheney 2y ago
The US government, especially the military, is largely allergic to software. This is slowly starting to change, but only in small pockets. I am aware of three software teams in the military but they are highly specialized with small dedicated customers.
I have tried several times to get Node.js into the military on approved software lists for internal development and its a huge struggle. I suspect the main culprits are due to valid security concerns regarding package managers like NPM and old ignorant thinking about open source being either immature or open software being a wide open exploitation vector. That is really tough because there aren't official binaries of Node without NPM and ignorant thinking about open source is really persistent.
- SV_BubbleTime 2y agoI mean… open source IS suffering insecurity issues. A lot of the supply chain failures I can think of, were open source projects. I’m not saying node or OSS has no place, but there is more than something to do t being a security issue. How many years was heartbleed exploitable despite “all the eyes on it”? The good part about OSS is all the people that can review it, the bad part is all the people that can review it. Now… which one is more incentivized today ignoring a future military use? It only works when assets are put into hardening existing code.
- recursivedoubts 2y agoi can think of no act more deviously effective in bringing down the american empire than introducing the NPM ecosystem into its vital bloodstream, well played comrade!
- rawgabbit 2y agoIf you had to select a single programming language, for US government agencies to use, which one would you pick?
- recursivedoubts 2y agogo or java, in that order
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- rawgabbit 2y agoThank you for your reply. If you were asked develop a web application using Go, how would you go about doing it?
- jazoom 2y agoI would assume he would use HTMX, being the creator of it.
- rawgabbit 2y agoThank you
- recursivedoubts 2y agoYeah, go w/ htmx + vanillajs (or possibly alpine.js or https://github.com/gnat/surreal https://github.com/gnat/surreal) would be a reasonable option for many government projects. You can audit the htmx codebase and it is dependency free (same w/ alpine & surreal) and self-host everything, go compiles to a single binary for deployment.
- lawn 2y agoTo be honest, not having node.js on the approved software list seems like a pretty good idea.
- _xivi 2y ago> I have tried several times to get Node.js into the military on approved software lists for internal development and its a huge struggle What's on the approved stack? I imagine .Net and Java/spring are the standard, right? anything else like php, python, go etc?
- ffsm8 2y agoBut is node worth it without the npm packages? I feel like it's pretty much one of the worst runtimes/scripting languages if you can't utilize it's ecosystem.
- austin-cheney 2y agoYes, absolutely. I can manually import the 2-3 packages I regularly use. TypeScript, for example, has no dependencies. The only thing I would miss is ESLint which has a billion dependencies that I wouldn't bother with.
- kjkjadksj 2y agoConsidering the military has an offensive cybersecurity arm, maybe they know more about node js and why not to use it than you might assume.
- deleted 2y ago[deleted]
- thaithrowawayy 2y agoThis is actually really scary that you want NPM in the military... Thank god that I trust - this was denied - smart move.
- austin-cheney 2y agoI don't. I want Node available to write systems automation without dependency on OS specific code. I don't need NPM to make effective use of Node.
- segmondy 2y agoSorry, but I'm glad they are not open to node. Why would you want node within the militaries network?
- austin-cheney 2y agoTo quickly spin up OS-agnostic systems automation.
- rbc 2y agoIf you can piggyback on an existing system, you may only need to pursue using the RMF assess only process with the gaining system owner. Once the assess only process is approved, the hardware, software and PPSM in the gaining system would be updated to reflect the new components. Those approved software lists don’t get updated very quickly. Using an assess only process may move things ahead more quickly.
- Already__Taken 2y agoWell NPM isn't really your problem there, the registry its targeting is and that's a firewall & config change, no need to block npm.exe.