Comment by joshdotsmith | Hacker News Reader

Comment by joshdotsmith | Hacker News Reader

I really like the work of folks at 18F, USDS, CFPB, et al.

Bearing in mind that I'm ecstatic to see this collection of projects and someone clearly put a lot of time and effort into this already, I do have couple points of hopefully constructive feedback here:

- Please list all of your repositories and feature ones that you think deserve special recognition. Seeing all your repos is a 4-step process otherwise: click on the project, click on the link, click on the acknowledgement that I clicked a link, click on the organization name on GitHub. [1]

- Some information on contribution policies, pulling in your README.md, etc would be helpful on this site. [2]

- When I click on the link to go to your repo, I know I'm clicking a link that leaves your site. You even say so. "But you probably knew that already." Don't hijack it, please. [3]

- The activity feed doesn't provide much value in its current form. Most of these GitHub events are completely without context. [4]

EDIT:

I've since opened the following issues on https://github.com/presidential-innovation-fellows/code-gov-.... Anyone who has feedback, definitely let them know (kindly!).

[1] https://github.com/presidential-innovation-fellows/code-gov-...

[2] https://github.com/presidential-innovation-fellows/code-gov-...

[3] https://github.com/presidential-innovation-fellows/code-gov-...

[4] https://github.com/presidential-innovation-fellows/code-gov-...

I'm impressed with how quickly they responded to [3], but unfortunately the answer was exactly what I expected on this one.

> We fought the law and the law won unfortunately. We're hoping to get more leeway on this in the near future from the legal team. Stay tuned!

Lawyers. The answer is always lawyers.

Getting a quote from The Clash from the US Government, that's actually pretty awesome.

The Clash?

Breaking rocks in the hot Sun

The Clash.

https://www.youtube.com/watch?v=KsS0cvTxU-8

"I Fought the Law" is a song written by Sonny Curtis of the Crickets and popularized by a remake by the Bobby Fuller Four, which went on to become a top-ten hit for the band in 1966 and was also recorded by the Clash in 1979.

Yes indeed you're correct. Another nice theory of mine ruined by actual evidence. I'm still hoping that the guy making the comment got it from The Clash though, just cause I'm biased towards them.

The past.

> Lawyers. The answer is always lawyers.

The law is just software for people.

I really hope this sort of promotion of innovating in the tech sector remains growing.. with the current political climate, I doubt many sectors (besides military/finance) will see governmental spending growth in coming years.

If you're a US citizen, vote for someone that will keep it going. Some have promised to undo a lot that the current administration has done, and this might be part of that.

I'm not aware of any free code from Trump so far, btw.

Also, when his campaign has tried to code, they fail:

http://qz.com/762424/trumps-campaign-donation-website-used-o...

"A programmer named Shu Uesugi, an engineer at a California company called EdSurge, discovered a major flaw with the way Trump’s website was using jQuery. Instead of downloading the open-source code from GitHub and running it off a server they controlled, the developers who built Trump’s website simply ran the code off GitHub directly, Uesugi found.

While the code’s location might seem like a minor detail, running it off GitHub meant that the person who controlled the code on GitHub could change the code at his whim, and those changes would take hold on Trump’s website. Since GitHub is for open-source projects, it also meant that any user could submit a request to modify the code and impact Trump’s website, if the change was approved by the plug-in’s author, a developer in Lisbon named Igor Escobar."

Then Igor tweeted about how he could have modified it: https://twitter.com/igorescobar/status/766367306662440960?re...

> Since GitHub is for open-source projects, it also meant that any user could submit a request to modify the code and impact Trump’s website, if the change was approved by the plug-in’s author, a developer in Lisbon named Igor Escobar."

That's how it works for any open source project you use, regardless of where it's been hosted. Unless you review the entire codebase (as well as all changes made in new releases), you're trusting the maintainers' judgement.

I agree it's overblown (based on the article).

Was it sourced from a particular SHA or a "latest" link?

Oddly enough, it appears to have linked to the project's Github Pages site: 'https://igorescobar.github.io/jQuery-Mask-Plugin/js/jquery.m... (see https://web.archive.org/web/20160817080309/https://secure.do... for the original page).

This still wasn't a good idea, but for a different reason - it's relying on the demo at https://igorescobar.github.io/jQuery-Mask-Plugin/ continuing to exist, and continuing to host the plugin at that same path.

Full disclosure, this mistake was not made by the campaign directly, but rather by Revv.co, who is the payments software provider (not processor, DJT is using Stripe).

That's not exactly the same as choosing to use something that is hosted on someone else's server, which they could then subsequently modify now that you are using it in a very high-profile project.

Of course, judging candidates' by the code quality of their campaign websites is a rather obscure and somewhat useless pastime.

True (on both counts). And yet it's common practice to include libs, fonts, and other bits from third party sites that the dev has no control over

It's a stupid and lazy practice. It's common because most web developers aren't exactly highly trained specialists who know what they're doing.

I agree that it's still bad practice. My main objection was to the statement "Since GitHub is for open-source projects, it also meant that any user could submit a request to modify the code and impact Trump’s website". If don't trust the maintainers' judgement in merging PRs, hosting it yourself isn't a solution (short of reviewing the entire project yourself).

I think the concern here is that the maintainer could subsequently merge a malicious PR knowing who was using the library from GitHub. That wouldn't be an issue if that group was hosting a version themselves (before the maintainer might find out who was using it).

Reply on news.ycombinator.com