Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The People's Code

code.gov

Post reply on HN
Print view View original

151–160 of 203 posts

Re: The People's Code

#151

Post by joepie91_ »

Alupis wrote: post #148
CiPHPerCoder wrote: post #138

Earlier quoted context omitted.

In this case: I did, and it was immediately closed without any change to the code, documentation, process, or culture.

> In this case: I did, and it was immediately closed without any change to the code, documentation, process, or culture. You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited.[1] > While this is an issue it does not affect us as we aren't using session cookies with slim You then started to rant about how they don't updat…

> You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited.

This is completely irrelevant. Vulnerable dependencies are vulnerable dependencies, and trying to avoid updates because you're "not affected" is a really good way to get owned.

This is for the exact same reason that "yes, there's an XSS vulnerability in the admin panel, but that doesn't matter because it requires an admin login" is invalid. At some point, somebody is going to combine multiple "unexploitable" vulnerabilities or exploitation paths that you overlooked, and successfully compromise your system.

A vulnerable dependency means that you need to update that dependency, full stop. No exceptions.

Re: The People's Code

#152

Post by dnissley »

pdkl95 wrote: post #147

Why the subsidy to Google? Sending tracking data to Google isn't appropriate for a government site. /* i='GTM-M9L9Q5' */ /* ... */ src='https://www.googletagmanager.com/gtm.js?id='+i /* ... */ Also, requiring Javascript in a single page application is a terrible design for this kind of site. Almost all of this can be static pages or traditional web frameworks. Requiring Javascript made the download much larger than n…

Looks like the US government makes widescale use of Google analytics, so it's hardly inappropriate: https://analytics.usa.gov/

Re: The People's Code

#153

Post by schmidty »

trendia wrote: post #128
mi100hael wrote: post #127

Earlier quoted context omitted.

Voting machines are products produced by private firms. Getting them to publish the source code is about as likely as getting Apple to publish the source for iOS.

Actually, with monopsony it's rather simple: "If you don't publish the code, then we will have to use paper ballots."

No effort towards innovation would then go into that sector. Ever again.

Re: The People's Code

#154

Post by Alupis »

joepie91_ wrote: post #151
Alupis wrote: post #148

Earlier quoted context omitted.

> In this case: I did, and it was immediately closed without any change to the code, documentation, process, or culture. You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited.[1] > While this is an issue it does not affect us as we aren't using session cookies with slim You then started to rant about how they don't updat…

> You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited. This is completely irrelevant. Vulnerable dependencies are vulnerable dependencies, and trying to avoid updates because you're "not affected" is a really good way to get owned. This is for the exact same reason that "yes, there's an XSS vulnerability in the admin p…

Whether it's relevant or not is up for the project maintainer to decide. All anyone can do is point out what they perceive as a potential problem, and then let the others take it from there.

CiPHPerCoder didn't exactly do that. He came out guns ablaze from the start, using bolded text, italics and inflammatory phrasing - basically just stopping short of calling the project maintainer a complete idiot.

It's not surprising CiPHPerCoder got the reaction he did - it is, however, surprising he decided to do all this under his company's name.

It's almost like CiPHPerCoder is personally offended that some joe random developer hasn't heard about some obscure CVE CiPHPerCoder was involved with, or that they didn't handle it like he would like. "Do you know who I am!?"

The initial issue was he came here and ranted about it, instead of pointing it out to the projects. Eventually he "gave in" and reported it to a single project, but took this holier-than-thou tone and was aggressive the entire time. That's ridiculous.

Re: The People's Code

#155

Post by brainfire »

kensai wrote: post #3

"The Federal Source Code Policy is designed to support reuse and public access to custom-developed Federal source code. It requires new custom-developed source code developed specifically by or for the Federal Government to be made available for sharing and re-use across all Federal agencies. It also includes an Open Source Pilot Program that requires agencies to release at least 20% of new custom-developed Federal s…

The 20% number is part of the initial 3-year pilot program, not necessarily the ultimate goal. That's also the mandatory minimum, with agencies "strongly encouraged" to release as much as possible.

See the policy [0], linked from the launch announcement [1].

[0] https://www.whitehouse.gov/sites/default/files/omb/memoranda...

[1] https://www.whitehouse.gov/blog/2016/08/08/peoples-code

Re: The People's Code

#156

Post by jonknee »

pdkl95 wrote: post #147

Why the subsidy to Google? Sending tracking data to Google isn't appropriate for a government site. /* i='GTM-M9L9Q5' */ /* ... */ src='https://www.googletagmanager.com/gtm.js?id='+i /* ... */ Also, requiring Javascript in a single page application is a terrible design for this kind of site. Almost all of this can be static pages or traditional web frameworks. Requiring Javascript made the download much larger than n…

Just a wild guess here, but I bet they're using Google Analytics for the same reason everyone else uses Google Analytics--to see what their audience is looking at.

> Also, requiring Javascript in a single page application is a terrible design for this kind of site.

Good luck making a single page application without Javascript! It is all in 25 requests and 668KB, not the lightest site, but that's actually less data than the homepage of Google is today. It's also properly setting expires headers so future page loads are very quick.

Re: The People's Code

#157

Post by sametmax »

godelski wrote: post #149
sametmax wrote: post #139

Earlier quoted context omitted.

That would not improve things. A voting system must be able to be checked by any citizen at any moment. Most of the citizen can't: - understand a complex code. - ensure the machine is running this code, easily, conveniently or quickly. - ensure the machine is not, or will not be hacked, by software or hardware mean. - ensure the program does calculate the votes correctly, with no bug. - do any of this in an autonomou…

Most people can't understand the code in openssl. So we shouldn't use it? Let's just make all cryptography closed source then. The average person doesn't even know what an elliptic function is. The point is that there is a large amount of people that do. They check. Not every citizen needs to check, but it is harder for there to be an error or to hoodwink someone if there are more eyes on the code. Essentially why op…

Crypto and democracy can't be compared.

You can delegate advanced science, you should not delegate democracy, because it's the root of all the rest.

Re: The People's Code

#158

Post by sametmax »

bbatha wrote: post #143
sametmax wrote: post #139

Earlier quoted context omitted.

That would not improve things. A voting system must be able to be checked by any citizen at any moment. Most of the citizen can't: - understand a complex code. - ensure the machine is running this code, easily, conveniently or quickly. - ensure the machine is not, or will not be hacked, by software or hardware mean. - ensure the program does calculate the votes correctly, with no bug. - do any of this in an autonomou…

Don't let perfect be the enemy of good. Opening up code in voting machine would be leagues better than leaving it closed source. At least other experts in the field could verify it. Its also not like every citizen today can or understand all of the vote counting procedures with paper ballots, even when just constrained to their ballot.

Oh yes, I don't discourage it.

I just think that you can't be satisfy with it. Open source voting machine are still an abomination for the democratic process.

Re: The People's Code

#159

Post by brainfire »

matthjensen wrote: post #13

I wonder how they will determine which open source projects are included at code.gov. For instance, I contribute to a few projects that are used within government for determining the economic impacts of fiscal policy, and the code is in the public domain. I'd love for them to be included at code.gov, but I'm not sure whether they meet the criteria.

The general guidelines are in the policy [0], linked from the launch announcement [1], but each agency's CIO is responsible for the particulars at their org. If it's not a new project post-August it won't contribute to the 20% so it might not be reviewed for release without someone suggesting it specifically, I would guess.

[0] https://www.whitehouse.gov/sites/default/files/omb/memoranda...

[1] https://www.whitehouse.gov/blog/2016/08/08/peoples-code

Re: The People's Code

#160

Post by CiPHPerCoder »

Alupis wrote: post #154
joepie91_ wrote: post #151

Earlier quoted context omitted.

> You left out the part where they told you this perceived issue did not impact their codebase, due to how they were using the upstream project you cited. This is completely irrelevant. Vulnerable dependencies are vulnerable dependencies, and trying to avoid updates because you're "not affected" is a really good way to get owned. This is for the exact same reason that "yes, there's an XSS vulnerability in the admin p…

Whether it's relevant or not is up for the project maintainer to decide. All anyone can do is point out what they perceive as a potential problem, and then let the others take it from there. CiPHPerCoder didn't exactly do that. He came out guns ablaze from the start, using bolded text, italics and inflammatory phrasing - basically just stopping short of calling the project maintainer a complete idiot. It's not surpri…

> It's almost like CiPHPerCoder is personally offended that some joe random developer hasn't heard about some obscure CVE CiPHPerCoder was involved with, or that they didn't handle it like he would like. "Do you know who I am!?"

Except this isn't "some joe random developer", this is software created by and for the US government, which is featured on code.gov.

I'd expect them to take security seriously and apply all upstream security patches immediately, not sit on them for years after they've been resolved.

Anything but that is sheer negligence. What else hasn't been updated which contains vulnerabilities that do affect them?

> The initial issue was he came here and ranted about it, instead of pointing it out to the projects.

That's what joepie91 was trying to explain to you.

> Eventually he "gave in" and reported it to a single project, but took this holier-than-thou tone and was aggressive the entire time. That's ridiculous.

Would you rather I do that or not report it to them at all? Choose only one. If I'm going to do it, I'm not going to do it your way. You can if you want.

Personally, I'd rather not report bugs at all. Until you've reported vulnerabilities to two or three dozen different projects, this might not mean much, but: It burns you out to keep reporting the same flaws to different projects.

Having developers respond to security risks with an air of entitlement just turns up the heat on the burn-out engine.

The first response to my comment here was

  You should send in a pull request, or file a bug report in the repo.
Pay attention to the order of operations here. The "should" is immediately associated with a large amount of unpaid work, with an alternative that would also be a large amount of unpaid work disguised as a hypothetically smaller amount of effort. But as others have stated: It's not.

> It's not surprising CiPHPerCoder got the reaction he did - it is, however, surprising he decided to do all this under his company's name.

Even if I had remembered to switch Github accounts, people would still associate it with my employer anyway. Kind of a moot point, really.

I gave you what you asked for. Next time, maybe don't tell people what they should do? It's rude to bark orders like that, and it won't get the result you want.

Post reply on HN