Hacker News Reader

Comment by missed_out | Hacker News Reader

After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

View on HN

This kind of stupidity is why I think I can never take a gov't job. I don't think I'd last a week. Sorry you had to put up with it.

Any reason why you think this is unique to government employment? My experience in both gov't and private sector work suggests it's ordinary human nature.

What about things the US Digital Service or 18F? The image they present is that those teams are different and outside the standard government bureaucracy. I'm skeptical.

Employee of 18F here, speaking unofficially. We care a lot about security - both from the technical side and from the policy compliance side!

How was recruitment?. Someone I know tried to get a got job there, got stuck in the queue forever. Was told to wait months. So eventually gave up and took another job.

Sometimes it's a matter of being in the right place at the right time. I applied (and was rejected) for at least 50 federal positions before I was hired. My organization needed someone fast to replace a 20-year fed who was retiring. They compiled a list of all the candidates who made the cert, and in the end, a veteran was selected. Except she wasn't a veteran, not even close. She had lied on her application, and assumed that no one would follow through - and she was almost right, because OPM clearly didn't do anything. But one of my bosses is an Air Force reservist, and he caught it right away. They went back to the original list, and to make a long story short, I was hired even though I'm a non-veteran with only private sector experience. To anyone who is really determined to make it happen, I've heard Kathryn Troutman's books recommended by coworkers.

USAJobs is badly in need of an 18F overhaul.

Hiring in gov't is hard. We've had to pause and refactor our hiring process several times. Long delays are just as frustrating to us, trust me. It's getting better all the time though.

> We care a lot about security

Which is doubtless why you ignore the TIC guidelines, etc

Sounds like one of those situations where you're damned if you do and damned if you don't. Even the most eloquent bitchslap directed at such users, even if you disguise it as user education, can still cause strife. :/

> you're damned if you do and damned if you don't

Most of my military experience followed this maxim. For example: You witness your squadmates doing something against the rules. Do you do the Official thing and report that to your unit commander, as you required to by guidelines and the definition of "good soldier"? Because if you do, now your entire squad will ostracize you, make your life complete shit, and possibly leave you to die on the battlefield. If you don't, you had better hope they don't get caught, because if it comes out that you knew about it and didn't say anything, now you are in just as much trouble.

This happened literally every day.

Sucks. Consider writing a book / get in touch with theintercept on a new machine from public wifi. https://theintercept.com/securedrop/

FWIW: Someone I know whom worked for DIA as a sysadmin about 10-15 years ago recalled multiple instances of TS/SCI folks being fired for surfing for porn over monitored networks... career- & clearance-ending. Maybe that's the only culturally-unacceptable sin in that community, apart from making the org/folks look bad?

Seriously? I don't think I've ever seen a security policy where it was not written that you cannot share passwords!

This was probably at State Department. They have difficulty communicating security guidelines to staff and management.

Reply on news.ycombinator.com