5 ms·

When presented with an issue that poses a real and present danger to the drinking water supply of citizens of this country your contribution is pearl clutching

When presented with an issue that poses a real and present danger to the drinking water supply of citizens of this country your contribution is pearl clutching over notional mandates? To be clear, in your opinion "overstepping their mandate" is the bigger threat here? Here's a wild idea, how about we return to the concept of actual governance for the first time in a few decades and actually empower the EPA with both budget and enforcement rights to ensure that local and state run systems that our fellow citizens rely on aren't falling through the cracks?

roenxi 2y ago
> ...your contribution is pearl clutching over notional mandates... > Here's a wild idea, how about we return to the concept of actual governance for the first time in a few decades... These two ideas are actually somewhat contradictory, I recommend picking one. You can't return to good governance by ignoring governance every time you think something needs to be done. And you don't need the EPA to be involved to defend against these sort of risks. In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. If an adversary wants to attack there is a single point of failure they can target - the EPA process.
- d4mi3n 2y ago
  > In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. This is not a safe assumption to make. As an example: Standardized patching programs are very basic and reduce a lot of this risk. Without them (or incentive/budget for them), it’s typical for most private and public orgs to end up with pretty bad security posture. This is a known failure state that results in many known vulnerabilities that can be trivially exploited, regardless of how heterogeneous these various networks are. Sadly, from what I’ve seen in the news and in various reports, I don’t think many regional organizations have the funding, expertise, or incentive to run effective security programs.
- forgetfreeman 2y ago
  Clearly you need someone involved to defend against these sort of risks as they are demonstrably not being addressed currently. May as well involve the EPA, they already exist and water is already a thing they do. Given we're already discussing a diverse mix of insecure systems "heterogeneity" isn't much of a talking point. You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort. In a forum that generally favors efficiency this seems out of place.
  - roenxi 2y ago
    They are being addressed. By the headline something like >90% of the US isn't affected. If it was a more centralised system, there'd be a 90% chance it was all working and a 10% chance that the incompetent local officials were incompetent EPA officials instead, standardising everyone on insecure systems with nobody able to overrule them. It'd make a bad situation into an all-or-nothing gamble with substantially worse worst-case performance. > You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort. Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided.
    - dartos 2y ago
      10% of the us is like 30 million people. Is 30 million people’s water being at risk in one of the richest countries on the planet a success? Is it even good enough? Percentages like that aren’t as meaningful for government as they are for SaaS products.
    - forgetfreeman 2y ago
      > Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided. This suggests to suspicion you've never worked in or with local or state government agencies and have spent zero time in a water treatment facility. I've done both so here's a couple of things that might help form a more robust picture of the situation: 1. These organizations are typically operating with budgets below the minimum requirements necessary to maintain the systems they're responsible for. This is why municipal bond initiatives are so common for water system maintenance and expansion projects. 2. Private contractors created this situation. Local and State government agencies contract out all of their IT projects and do not have personnel on staff capable of performing the work under discussion.
015a 2y ago
There's many people who would reasonably disagree with a course like this, because there are no elected positions in the EPA. The whole "overstepping their mandate" thing is perceived as a very real and present threat among MAGA people, for this reason specifically. This is the whole notion of "The Swamp" Trump was going to drain; unelected career bureaucrats.
- forgetfreeman 2y ago
  That they would disagree isn't in question. That their position is reasonable is, however, very much up for debate. Career bureaucrats are literally the pool of experience and expertise that make government agencies function, to the extent that's possible given legislative hobbles. The only thing that gets drained when these people are replaced by elected officials or private industry is expertise and theoretically sane incentives.
  - dartos 2y ago
    It’s funny how it seems we care more about years of expertise for the engineers on our software teams than the people running government. There’s a balance that needs to be struck between new blood with fresh perspectives and old guard with decades of experience navigating Washington politics.

roenxi 2y ago

> ...your contribution is pearl clutching over notional mandates... > Here's a wild idea, how about we return to the concept of actual governance for the first time in a few decades... These two ideas are actually somewhat contradictory, I recommend picking one. You can't return to good governance by ignoring governance every time you think something needs to be done. And you don't need the EPA to be involved to defend against these sort of risks. In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. If an adversary wants to attack there is a single point of failure they can target - the EPA process.

d4mi3n 2y ago
> In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. This is not a safe assumption to make. As an example: Standardized patching programs are very basic and reduce a lot of this risk. Without them (or incentive/budget for them), it’s typical for most private and public orgs to end up with pretty bad security posture. This is a known failure state that results in many known vulnerabilities that can be trivially exploited, regardless of how heterogeneous these various networks are. Sadly, from what I’ve seen in the news and in various reports, I don’t think many regional organizations have the funding, expertise, or incentive to run effective security programs.
forgetfreeman 2y ago
Clearly you need someone involved to defend against these sort of risks as they are demonstrably not being addressed currently. May as well involve the EPA, they already exist and water is already a thing they do. Given we're already discussing a diverse mix of insecure systems "heterogeneity" isn't much of a talking point. You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort. In a forum that generally favors efficiency this seems out of place.
- roenxi 2y ago
  They are being addressed. By the headline something like >90% of the US isn't affected. If it was a more centralised system, there'd be a 90% chance it was all working and a 10% chance that the incompetent local officials were incompetent EPA officials instead, standardising everyone on insecure systems with nobody able to overrule them. It'd make a bad situation into an all-or-nothing gamble with substantially worse worst-case performance. > You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort. Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided.
  - dartos 2y ago
    10% of the us is like 30 million people. Is 30 million people’s water being at risk in one of the richest countries on the planet a success? Is it even good enough? Percentages like that aren’t as meaningful for government as they are for SaaS products.
  - forgetfreeman 2y ago
    > Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided. This suggests to suspicion you've never worked in or with local or state government agencies and have spent zero time in a water treatment facility. I've done both so here's a couple of things that might help form a more robust picture of the situation: 1. These organizations are typically operating with budgets below the minimum requirements necessary to maintain the systems they're responsible for. This is why municipal bond initiatives are so common for water system maintenance and expansion projects. 2. Private contractors created this situation. Local and State government agencies contract out all of their IT projects and do not have personnel on staff capable of performing the work under discussion.

015a 2y ago

There's many people who would reasonably disagree with a course like this, because there are no elected positions in the EPA. The whole "overstepping their mandate" thing is perceived as a very real and present threat among MAGA people, for this reason specifically. This is the whole notion of "The Swamp" Trump was going to drain; unelected career bureaucrats.

forgetfreeman 2y ago
That they would disagree isn't in question. That their position is reasonable is, however, very much up for debate. Career bureaucrats are literally the pool of experience and expertise that make government agencies function, to the extent that's possible given legislative hobbles. The only thing that gets drained when these people are replaced by elected officials or private industry is expertise and theoretically sane incentives.
- dartos 2y ago
  It’s funny how it seems we care more about years of expertise for the engineers on our software teams than the people running government. There’s a balance that needs to be struck between new blood with fresh perspectives and old guard with decades of experience navigating Washington politics.