4 ms·

For those of you with no government experience I suspect you have absolutely no idea why this is so challenging. The military is allergic to internal software.

For those of you with no government experience I suspect you have absolutely no idea why this is so challenging. The military is allergic to internal software. First of all you have to understand IT in the military is a different world far beyond your imagination because everyday they are under attack by the best nation-state cyber intrusion people on the planet. Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. The only commercial organizations that even come remotely close to what the military experiences daily are large financial organizations. Also, don’t forget the US military is the largest single employer on the planet, like 4.5 Walmarts. So the military monitors everything at multiple levels. That also means locking things down to approved software lists at different levels. The people writing the security policies and/or performing the monitoring likely aren’t experienced software directors. They look at things like NPM and Maven and just see unlimited attack vectors from people who have no idea about security, and they aren’t wrong. Then in the civilian and contractor space where do you put the code. If it’s paid for by the government then it’s owned by the government otherwise the contractor company wants to own it completely separated from the government so they can charge the government for it. Then consider if it’s a subcontractor not aligned to the financial goals of the prime contractor. Even when the government wants to do the right thing it’s complicated. As a software guy under a non managing co-prime I really don’t give a shit and say just give the government everything and it’s weird to see people try to throw up layers, especially since the government side is always less restricted because they almost always achieve vastly superior security accreditation on their infrastructure.

anshumankmr 2y ago
>They look at things like NPM and Maven and just see unlimited attack vectors from people who have no idea about security, and they aren’t wrong. Then what do they do? Aren't there tools to check for security vulnerabilities in the market like Sonar Qube? Wouldn't (or couldn't) the millitary run a beefed up version of that and developers can't check in code without ensuring 100% compliance to security vulnerabilities
- NegativeK 2y ago
  I'm not sure what the military does, but automated scanners will never be a panacea. And I encourage open source devs who get security compliance demands without patches or significant collaboration to ban the person filing the issue.
  - teitoklien 2y ago
    Haha, very true. It is insane how demanding and toxic some “developers” can be towards opensource creators and maintainers, as if they own them. But on the other hand, open source or giving things out for free for people to try out and use is also a great way to find interesting friends who just want to build cool stuff together, and make new friends along the way :D That part is prolly the only reason why I like opensource so much, it attracts certain kinds of interesting people depending on the project you’re working on.
- linuxftw 2y ago
  Lots of audit and compliance tooling exists. What happens is they turn on a new datacenter, get 150k vulnerabilities, and then try to address them one by one. There's a lot of dead weight and incompetence in government IT.
- cess11 2y ago
  Look at JVM exploits from the last years. They're usually chains of quite clever hops, for example from a serialisation or deserialisation vulnerability. Sonar is not going to help you with that and when something like it pops up it might already have been used 'in the wild' for some time, and then you have the problem of rolling out patches into the field. You'd be better off going back to Ada.
  - sk5t 2y ago
    > JVM exploits from the last years Entirely user/library serialization or fine cryptographic issues, and not the VM, no?
    - 2y ago
notesinthefield 2y ago
I quit contracting when over the course of a year I spoke to other sec teams in my branch, around my customers branch, my local contractor network and several vendors that told me another service branch had completed my exact project years ago and “why dont you just talk to them” was met with stares from my gov customer. Then you understand the racket that is gov contracting and why things take years longer than they should.
Someone1234 2y ago
The depiction of the military's IT as nearly impregnable overlooks the widespread issues with outdated infrastructure and cumbersome policies that significantly impair its effectiveness. While I'll acknowledge that certain areas within the US military might experience the level of threat and security sophistication described, the broader landscape is fraught with legacy systems that struggle to integrate modern solutions or best practices. These outdated systems/workflows/bureaucracy often result in inefficiencies and vulnerabilities rather than providing superior security. You never hear about the US military getting broken into, not because it doesn't happen, but because it is classified when it does. Avoiding public embarrassment is the No.1 use of classification, resulting in this type of belief in their competence. I'd put Facebook ahead of the US military any day of the week, and it ain't close (who incidentally are a payment processor).
- simoncion 2y ago
  > The depiction of the military's IT as nearly impregnable... Where was this depiction made by the OP? I only see descriptions of IT infrastructure that's under attacks of a nature and scale that not even software megacorps will ever see.
- FuriouslyAdrift 2y ago
  The infra for JWICS is pretty darn good. All the security failures have been at the human layers.
  - whatshisface 2y ago
    Somehow I am a little skeptical that knowledge of all JWICS security failures just got leaked here. :-)
georgeplusplus 2y ago
>>>Your start up will never experience this and the mega corp You writing this makes me believes you don’t work around or with the IC and speaking out of your lane.
- no_wizard 2y ago
  Its very likely any given startup will not be attacked by nation state backed hackers continually, 24/7 365. I don't think this is off base at all.
  - georgeplusplus 2y ago
    >>> it’s very likely any given startup will not be attacked by nation state backed hackers. On what assumption do you base this? Startups that have high research value don’t hit your radar as a target? And Really? Any given startup? Also the OP used Facebook. I am baffled at your sense of security in nation state activity. Read the 2012 annual report to Congress about China. They collect everything.
    - no_wizard 2y ago
      You’re misunderstanding. Resources even for nation states are finite. At minimum attention is a finite resource that limits ongoing operations. Active high value targets make sense: defense, infrastructure, finance and even to some extent media. With that in mind, do you really think they’re interested in a startup that optimizes Google ads? Or how about postgres as a service with no clients of interest? It’s not that I feel a sense of security but the low success rate script based attacks aren’t what I’m talking about here (or for that matter things like perpetual port scanning of the internet. Every entity seems to do this looking for holes), we are talking about active operations by skilled attackers. There is only so much of that to go around.
- austin-cheney 2y ago
  I don't provide dedicated security services to start ups, so maybe I am outside my lane. However, it is my baseless assertion that nation-states are not dedicating entire teams and months of social-engineering research to backdoor a startup for non-monetary motives. I also suspect startups do not own the entirety of their own distribution infrastructure in production from the wheels, through the ISP, to the local keyboard.
derangedHorse 2y ago
> Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important I guess someone who’s never worked there could say this. Facebook is a treasure trove of data for details on domestic and foreign politicians.
ukd1 2y ago
The MoD of India is larger, fyi.
- skyyler 2y ago
  I assumed it would be much larger, but it's a fraction of a percent larger: https://en.wikipedia.org/wiki/List_of_largest_employers https://en.wikipedia.org/wiki/List_of_largest_employers That's actually kind of shocking to me given the difference in population between the countries.
  - quickthrowman 2y ago
    It shouldn’t be that shocking, the United States is the only country able to project military power globally. India can’t even provide basic sanitation for all of its citizens.
    - ls612 2y ago
      Poor countries can have enormous armies. The PLA during the late 1970s had like 5 million people in the ground forces alone. They have since cut that number by over 2/3 as they modernized.
  - amenhotep 2y ago
    Indian MoD 200,000 civilian employees, US DoD over 700,000 civilian employees - that's the part where the difference you'd expect shows up, not in the raw number of soldiers.
- austin-cheney 2y ago
  Thanks for pointing that out. I had no idea.
simoncion 2y ago
> ...I really don’t give a shit and say just give the government everything and it’s weird to see people try to throw up layers... Yeah, this always struck me as so strange. I worked at a contractor where our customer really did own all of the deliverables, but I had peers who worked at contractors where that wasn't the case. To them, I was all like, "Guys. Our tax money is paying for this. Why are you rooting for pulling money out of everyone's pocket to massively enrich a few fat cats and sales guys in your company?". Like, if you're of a "We're not going to give everything to the government" persuasion, then the reasonable way to handle that is to give the government the deliverables to do anything they want with, just so long as you're free to sell the unclassified components of it (and things derived from them) in the private sector to interested parties without interference.
- scottyah 2y ago
  I've seen it where development happens under one Customer, then a few years later they get some bad management and flounder, then a new Customer team (or teams) has pretty much the same mission. It's nice to be able to carry what you've already done with you vs starting over. The Defense Sector is very much like the private sector in that it has hundreds of companies/teams doing pretty much the same thing.
  - simoncion 2y ago
    Oh yeah. Starting from something fairly-reasonable is far, far better than starting from scratch . And yeah, I used to do defense work. For the most part, it's exactly like non-defense work, with one of the big differentiators being that to work from home, you'd often need to build a SCIF in your home. (Good fucking luck with getting that approved.)
com2kid 2y ago
> and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I worked at Microsoft, and speaking to their security team my impression was that MSFT is under persistent attack from nation states on a non stop basis, up to and including working to get government assets hired to work at Microsoft to leak secrets out. Given the importance of AWS, I have no doubt Amazon is under similar threat.
- thinkingtoilet 2y ago
  I would imagine Microsoft is a bit different because of the OS. If you can hack Windows you have access to nearly every institution in the world. Linux and iOS don't have that reach. No need to hack AWS, you hacked the computer that is logging into AWS.
  - mrkeen 2y ago
    Why rob a bank when you can pickpocket a guy walking into the bank instead? Anyway Linux has 62.7% share of servers https://en.m.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.m.wikipedia.org/wiki/Usage_share_of_operating_sys...
  - soulofmischief 2y ago
    The majority of cloud infrastructure is run on Linux. You're saying there's no need to hack Linux when it's easier to hack Windows, and therefore Microsoft has better security fundamentals as the providers of a less secure but more prevalent OS? I don't follow the argument.
    - com2kid 2y ago
      If someone has a 0 day backdoor to Windows, they can steal the credentials from the employees who are logging into those Linux servers. Many high value servers don't have public IPs, and the really juicy ones are behind jump boxes. At that point the OS on the server isn't relevant.
crossroadsguy 2y ago
> US military is the largest single employer on the planet Maybe not on the entire planet? I know it doesn't matter and it's not really anything but I guess that's not USDoD. But then again who believes Wikipedia anyway https://en.wikipedia.org/wiki/List_of_largest_employers https://en.wikipedia.org/wiki/List_of_largest_employers. Besides even if it's true it's barely by a whisker and we shouldn't put further wars (i.e foreign freedom distribution enterprise) past the great nation of USA so that will change on a whim anytime. Cheers. Also if this link is to be believed then 4 Walmarts (or even 4.5) will be really a lot.
shwaj 2y ago
AFAICT this has very little to do with the military. Quoting from the actual bill: (A) IN GENERAL.—This Act shall not apply to classified source code or source code developed primarily for use in a national security system (as defined in section 11103 of title 40, United States Code). (B) NATIONAL SECURITY.—An exemption from the requirements under section 3 shall apply to classified source code or source code developed— (i) primarily for use in a national security system (as defined in section 11103 of title 40, United States Code); or (ii) by an agency, or part of an agency, that is an element of the intelligence community (as defined in section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)).
tester756 2y ago
>Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I dont believe it

anshumankmr 2y ago

>They look at things like NPM and Maven and just see unlimited attack vectors from people who have no idea about security, and they aren’t wrong. Then what do they do? Aren't there tools to check for security vulnerabilities in the market like Sonar Qube? Wouldn't (or couldn't) the millitary run a beefed up version of that and developers can't check in code without ensuring 100% compliance to security vulnerabilities

NegativeK 2y ago
I'm not sure what the military does, but automated scanners will never be a panacea. And I encourage open source devs who get security compliance demands without patches or significant collaboration to ban the person filing the issue.
- teitoklien 2y ago
  Haha, very true. It is insane how demanding and toxic some “developers” can be towards opensource creators and maintainers, as if they own them. But on the other hand, open source or giving things out for free for people to try out and use is also a great way to find interesting friends who just want to build cool stuff together, and make new friends along the way :D That part is prolly the only reason why I like opensource so much, it attracts certain kinds of interesting people depending on the project you’re working on.
linuxftw 2y ago
Lots of audit and compliance tooling exists. What happens is they turn on a new datacenter, get 150k vulnerabilities, and then try to address them one by one. There's a lot of dead weight and incompetence in government IT.
cess11 2y ago
Look at JVM exploits from the last years. They're usually chains of quite clever hops, for example from a serialisation or deserialisation vulnerability. Sonar is not going to help you with that and when something like it pops up it might already have been used 'in the wild' for some time, and then you have the problem of rolling out patches into the field. You'd be better off going back to Ada.
- sk5t 2y ago
  > JVM exploits from the last years Entirely user/library serialization or fine cryptographic issues, and not the VM, no?
  - 2y ago

notesinthefield 2y ago

I quit contracting when over the course of a year I spoke to other sec teams in my branch, around my customers branch, my local contractor network and several vendors that told me another service branch had completed my exact project years ago and “why dont you just talk to them” was met with stares from my gov customer. Then you understand the racket that is gov contracting and why things take years longer than they should.

Someone1234 2y ago

The depiction of the military's IT as nearly impregnable overlooks the widespread issues with outdated infrastructure and cumbersome policies that significantly impair its effectiveness. While I'll acknowledge that certain areas within the US military might experience the level of threat and security sophistication described, the broader landscape is fraught with legacy systems that struggle to integrate modern solutions or best practices. These outdated systems/workflows/bureaucracy often result in inefficiencies and vulnerabilities rather than providing superior security. You never hear about the US military getting broken into, not because it doesn't happen, but because it is classified when it does. Avoiding public embarrassment is the No.1 use of classification, resulting in this type of belief in their competence. I'd put Facebook ahead of the US military any day of the week, and it ain't close (who incidentally are a payment processor).

simoncion 2y ago
> The depiction of the military's IT as nearly impregnable... Where was this depiction made by the OP? I only see descriptions of IT infrastructure that's under attacks of a nature and scale that not even software megacorps will ever see.
FuriouslyAdrift 2y ago
The infra for JWICS is pretty darn good. All the security failures have been at the human layers.
- whatshisface 2y ago
  Somehow I am a little skeptical that knowledge of all JWICS security failures just got leaked here. :-)

georgeplusplus 2y ago

>>>Your start up will never experience this and the mega corp You writing this makes me believes you don’t work around or with the IC and speaking out of your lane.

no_wizard 2y ago
Its very likely any given startup will not be attacked by nation state backed hackers continually, 24/7 365. I don't think this is off base at all.
- georgeplusplus 2y ago
  >>> it’s very likely any given startup will not be attacked by nation state backed hackers. On what assumption do you base this? Startups that have high research value don’t hit your radar as a target? And Really? Any given startup? Also the OP used Facebook. I am baffled at your sense of security in nation state activity. Read the 2012 annual report to Congress about China. They collect everything.
  - no_wizard 2y ago
    You’re misunderstanding. Resources even for nation states are finite. At minimum attention is a finite resource that limits ongoing operations. Active high value targets make sense: defense, infrastructure, finance and even to some extent media. With that in mind, do you really think they’re interested in a startup that optimizes Google ads? Or how about postgres as a service with no clients of interest? It’s not that I feel a sense of security but the low success rate script based attacks aren’t what I’m talking about here (or for that matter things like perpetual port scanning of the internet. Every entity seems to do this looking for holes), we are talking about active operations by skilled attackers. There is only so much of that to go around.
austin-cheney 2y ago
I don't provide dedicated security services to start ups, so maybe I am outside my lane. However, it is my baseless assertion that nation-states are not dedicating entire teams and months of social-engineering research to backdoor a startup for non-monetary motives. I also suspect startups do not own the entirety of their own distribution infrastructure in production from the wheels, through the ISP, to the local keyboard.

derangedHorse 2y ago

> Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important I guess someone who’s never worked there could say this. Facebook is a treasure trove of data for details on domestic and foreign politicians.

ukd1 2y ago

The MoD of India is larger, fyi.

skyyler 2y ago
I assumed it would be much larger, but it's a fraction of a percent larger: https://en.wikipedia.org/wiki/List_of_largest_employers https://en.wikipedia.org/wiki/List_of_largest_employers That's actually kind of shocking to me given the difference in population between the countries.
- quickthrowman 2y ago
  It shouldn’t be that shocking, the United States is the only country able to project military power globally. India can’t even provide basic sanitation for all of its citizens.
  - ls612 2y ago
    Poor countries can have enormous armies. The PLA during the late 1970s had like 5 million people in the ground forces alone. They have since cut that number by over 2/3 as they modernized.
- amenhotep 2y ago
  Indian MoD 200,000 civilian employees, US DoD over 700,000 civilian employees - that's the part where the difference you'd expect shows up, not in the raw number of soldiers.
austin-cheney 2y ago
Thanks for pointing that out. I had no idea.

simoncion 2y ago

> ...I really don’t give a shit and say just give the government everything and it’s weird to see people try to throw up layers... Yeah, this always struck me as so strange. I worked at a contractor where our customer really did own all of the deliverables, but I had peers who worked at contractors where that wasn't the case. To them, I was all like, "Guys. Our tax money is paying for this. Why are you rooting for pulling money out of everyone's pocket to massively enrich a few fat cats and sales guys in your company?". Like, if you're of a "We're not going to give everything to the government" persuasion, then the reasonable way to handle that is to give the government the deliverables to do anything they want with, just so long as you're free to sell the unclassified components of it (and things derived from them) in the private sector to interested parties without interference.

scottyah 2y ago
I've seen it where development happens under one Customer, then a few years later they get some bad management and flounder, then a new Customer team (or teams) has pretty much the same mission. It's nice to be able to carry what you've already done with you vs starting over. The Defense Sector is very much like the private sector in that it has hundreds of companies/teams doing pretty much the same thing.
- simoncion 2y ago
  Oh yeah. Starting from something fairly-reasonable is far, far better than starting from scratch . And yeah, I used to do defense work. For the most part, it's exactly like non-defense work, with one of the big differentiators being that to work from home, you'd often need to build a SCIF in your home. (Good fucking luck with getting that approved.)

com2kid 2y ago

> and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I worked at Microsoft, and speaking to their security team my impression was that MSFT is under persistent attack from nation states on a non stop basis, up to and including working to get government assets hired to work at Microsoft to leak secrets out. Given the importance of AWS, I have no doubt Amazon is under similar threat.

thinkingtoilet 2y ago
I would imagine Microsoft is a bit different because of the OS. If you can hack Windows you have access to nearly every institution in the world. Linux and iOS don't have that reach. No need to hack AWS, you hacked the computer that is logging into AWS.
- mrkeen 2y ago
  Why rob a bank when you can pickpocket a guy walking into the bank instead? Anyway Linux has 62.7% share of servers https://en.m.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.m.wikipedia.org/wiki/Usage_share_of_operating_sys...
- soulofmischief 2y ago
  The majority of cloud infrastructure is run on Linux. You're saying there's no need to hack Linux when it's easier to hack Windows, and therefore Microsoft has better security fundamentals as the providers of a less secure but more prevalent OS? I don't follow the argument.
  - com2kid 2y ago
    If someone has a 0 day backdoor to Windows, they can steal the credentials from the employees who are logging into those Linux servers. Many high value servers don't have public IPs, and the really juicy ones are behind jump boxes. At that point the OS on the server isn't relevant.

crossroadsguy 2y ago

> US military is the largest single employer on the planet Maybe not on the entire planet? I know it doesn't matter and it's not really anything but I guess that's not USDoD. But then again who believes Wikipedia anyway https://en.wikipedia.org/wiki/List_of_largest_employers https://en.wikipedia.org/wiki/List_of_largest_employers. Besides even if it's true it's barely by a whisker and we shouldn't put further wars (i.e foreign freedom distribution enterprise) past the great nation of USA so that will change on a whim anytime. Cheers. Also if this link is to be believed then 4 Walmarts (or even 4.5) will be really a lot.

shwaj 2y ago

AFAICT this has very little to do with the military. Quoting from the actual bill: (A) IN GENERAL.—This Act shall not apply to classified source code or source code developed primarily for use in a national security system (as defined in section 11103 of title 40, United States Code). (B) NATIONAL SECURITY.—An exemption from the requirements under section 3 shall apply to classified source code or source code developed— (i) primarily for use in a national security system (as defined in section 11103 of title 40, United States Code); or (ii) by an agency, or part of an agency, that is an element of the intelligence community (as defined in section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)).

tester756 2y ago

>Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I dont believe it