4 ms·

https://www.notifications.service.gov.uk/features/who-can-use-notify https://www.notifications.service.gov.uk/features/who-can-us... * central government de

https://www.notifications.service.gov.uk/features/who-can-use-notify https://www.notifications.service.gov.uk/features/who-can-us... * central government departments * local authorities * the armed forces * the NHS * the emergency services * GP surgeries * state-funded schools looks quite critical to me

BartjeD 2y ago
Yes, personally I don't think it's a good idea to host these things with the US companies. As a citizen I prefer it's in my own country, unless it's really not critical or interesting information / services. The UK made a different choice.
- patrakov 2y ago
  Is the gov.uk website infrastructure compliant with their own Cyber Essentials requirements? I very much doubt it, as the anti-malware requirements applicable to cloud providers that are not using Windows or MacOS ([1], section 5, subsection "Requirements", option "Application allow listing" on page numbered 14 in the corner) are not implementable as worded. Using Azure instead of AWS could have helped here. [1] https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...
djtango 2y ago
> GOV.UK Notify makes it easy for public sector service teams to send emails, text messages and letters. Doesn't seem that critical to me. Important, but doesn't pass the sniff test of "is this a matter of national security" that would justify self-hosting ultimately slowing down development and making it more expensive and in effect less feature-rich for taxpayers EDIT the API docs suggest this is used for sending formal Notifications en-masse rather than mission-critical comms
scaryclam 2y ago
The kinds of messages that get sent via email or text are usually pretty unimportant. Important things tend to be sent via letter or a phone call. It's not likely to be anything critical.
- jamessb 2y ago
  Gov.Uk Notify does support sending letters (as well as email and SMs/text messages): https://www.notifications.service.gov.uk/using-notify https://www.notifications.service.gov.uk/using-notify
- vindex10 2y ago
  In Norway, I received my residence permit by email, and I mean the official document. I stressed a bit when after a year I was trying to find the paper letter, until I eventually realized xD
PontifexMinimus 2y ago
You should also add GCHQ, MI5 and MI6 who all use AWS to host top secret material (https://archive.md/n2cNB https://archive.md/n2cNB). As an IT professional, I would question whether that makes sense. But what do I know? I'm sure the people who run the country -- people of the calibre of Liz Truss, no less -- know what they're doing!

BartjeD 2y ago

Yes, personally I don't think it's a good idea to host these things with the US companies. As a citizen I prefer it's in my own country, unless it's really not critical or interesting information / services. The UK made a different choice.

patrakov 2y ago
Is the gov.uk website infrastructure compliant with their own Cyber Essentials requirements? I very much doubt it, as the anti-malware requirements applicable to cloud providers that are not using Windows or MacOS ([1], section 5, subsection "Requirements", option "Application allow listing" on page numbered 14 in the corner) are not implementable as worded. Using Azure instead of AWS could have helped here. [1] https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...

djtango 2y ago

> GOV.UK Notify makes it easy for public sector service teams to send emails, text messages and letters. Doesn't seem that critical to me. Important, but doesn't pass the sniff test of "is this a matter of national security" that would justify self-hosting ultimately slowing down development and making it more expensive and in effect less feature-rich for taxpayers EDIT the API docs suggest this is used for sending formal Notifications en-masse rather than mission-critical comms

scaryclam 2y ago

The kinds of messages that get sent via email or text are usually pretty unimportant. Important things tend to be sent via letter or a phone call. It's not likely to be anything critical.

jamessb 2y ago
Gov.Uk Notify does support sending letters (as well as email and SMs/text messages): https://www.notifications.service.gov.uk/using-notify https://www.notifications.service.gov.uk/using-notify
vindex10 2y ago
In Norway, I received my residence permit by email, and I mean the official document. I stressed a bit when after a year I was trying to find the paper letter, until I eventually realized xD

PontifexMinimus 2y ago

You should also add GCHQ, MI5 and MI6 who all use AWS to host top secret material (https://archive.md/n2cNB https://archive.md/n2cNB). As an IT professional, I would question whether that makes sense. But what do I know? I'm sure the people who run the country -- people of the calibre of Liz Truss, no less -- know what they're doing!