this post was submitted on 05 Dec 2023
577 points (89.9% liked)
Technology
58303 readers
11 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Now I know what to blame for every single US government website being so poorly put together they they barely function, if they function at all.
The Free Software Foundation Europe has an awesome initiative called Public Money Public Code where they try to convince lawmakers to use as much open source software as possible when using public funds. I really hope they succeed.
What about security? If it's open source, anyone can poke around in the code and find vulnerabilities to exploit way easier.
Security through obscurity doesn’t, work the vulnerabilities are still there. Also if the vulnerabilities are visible they’re also easier to close.
Tell me you have never worked in IT security without telling me you never worked in IT security.
To give you an actual answer, instead of pure Internet snark, the concept you're proposing is called "security through obscurity" if you want to research it.
The TL:DR of it is it doesn't work. If it did, all software would be proprietary and things like viruses wouldn't exist. The source code for Windows isn't available, but Windows gets exploited constantly.
More eyeballs are from people wanting those flaws fixed that wanting to exploit them.
Proprietary source code has much fewer eyeballs, none of which you can verify belong to competent or trustworthy people.
FTFY. Open source software is more secure than closed source, not less
No, you can't really make blanket statements like that at all.
Open source doesn't compromise security on its own and closed source is the same.
Open source might be more secure but that's only if people actually audit it properly and some closed source codes are audited more closely than some open source code.
Depends how u interpret it. I would assume they talking averages.
Is this a serious question?
This is the exact same ridiculous argument that proprietary software corporations make. It never made any sense, security through obscurity will never work. Linux is open-source used on ~80% of all web servers, in your logic these servers would all be vulnerable. It just doesn't make any sense. Linux is also used in many embedded devices and Android is based on the Linux kernel. But Android (which is also entirely open source) has one of the best security models out there.
That's the same bullshit line politicians and corporations use, it's simply not true
Vulnerabilities can and are usually found without code inspection. Fuzzing, reverse engineering, etc. At the same time, it is easier to find vulnerabilities having the code to check, but it is easier also for those who want to have them patched. That's why we have tons of CVEs in Windows, iOS etc., and they don't all come from the vendor... Depending on the ratio of eyeballs looking at something to fix and the ones looking at something to exploit, open source can be more secure compared to closed source.
Lol
And 100% of it is dog shit. I have seen custom products from Accenture, Deloitte, and E&Y, and they were passable prototypes at best.
Accenture doesn't make shit. They bring in expensive ass consultants with 25 years of experience (on paper), then they sell something basically off the shelf. What's left of the budget goes to a subcontractor, who now has to glue the already purchased pieces together with spit and gum, now on a very tight timeline before the funding runs out and your tiny company gets the blame
Haven't worked directly with the others, but the Accenture story was the same everywhere
That's the opposite of most UK government websites. I've always found them very well designed and easy to use. I think they're well regarded by web designers
The UK outsources too.
But they limit the amount of kickbacks, America has the freedom of unlimited corruption. (j/k, but only kinda)
We just 'hide' ours better.
Never attribute to malice what is better explained by incompetence. Someone's razor or something.
UK gov site is pretty good, NHS can be an absolute mess, especially going into the different trusts.
USWDS is new and is a response to exactly that problem. You'd be blaming people who have nothing to do with the status quo who were hired to fix the problems you've experienced.
Not to derail a good point but there are at least a few government entities with brain cells. Check out digital.gov and cloud.gov, the latter of which has created a responsive, accessible platform for government websites.
Bold of you to assume that people writing contracts or working them know about these standards at all.
Well, that plus CGI
So, just like the rest of the internet? A technology, that popularly speaking, has only been around for 30-years?
And you expect an entity, as huge and diverse as the US government, on federal/state/local levels, to be on the same page?
I can safely make 2 predictions about you:
This clusterfuck is both expected and natural. Or did your science teacher tell you evolution was orderly? Or perhaps intelligently designed?
And anyone else wanting to complain, I'll remind you, this is how the government vs. the free market works.
Government works by rules that are not broken or bent. And this pisses some people off. Private enterprise works by what works and what doesn't. It's fast and fluid, and not designed to take "the people" in mind. And this pisses some people off.
Some tasks are appropriate for the government, some for the public sector. We're still working this shit out. (website_under_construction.gif)
You might wanna check the reception on your crystal ball, Nostradamus, cuz you're wrong on all counts. I'm 38 and have worked in general IT as well as network engineering.
What a weirdly arrogant, condescending response. I also started on basic on a vic20, had a dad who worked in IT for the government, and have done all of that except the physical wiring on any noteworthy scale. This is utterly unhelpful.
This thread is filled with people who don't make a connection between shitty government websites and the roads that are filled with pot holes, several train derailments every day, a tax collection agency that doesn't have enough staff to do audits on wealthy people, and schools that ban books that have rainbows in them but teach books by Prager U.
We could have better government websites - but not if we elect "starve the beast" politicians.