Hacker News Reader

Comment by phsource | Hacker News Reader

After reading the API docs, it appears that the FCC operates a mini-imgur/pastebin/file hosting service to help attach files to FCC filings:

https://www.fcc.gov/ecfs/public-api-docs.html#Full-Filing-St...

Unfortunately, these "temporary" file uploads end up accessible from the main FCC domain (i.e. fcc.gov), unlike e.g., Google (e.g., "googleusercontent.com" vs. "google.com"). In Google's case, the separate domain helps distinguish the content as unofficial.

It's understandable why it was originally engineered this way, since it's probably easier to create a subdomain under fcc.gov rather than to get an unrelated domain, but that's why we ended up here!

View on HN

"Easier" is a relative. And in this case relatively small.

The server and DNS configuration you need for a subdomain is identical to what you need for separate domain. Possibly slightly more to manage if you are using the "naked" domain because of the DNS issue with not supporting CNAME records on the naked domain.

If you already have a wildcard SSL certificate for the subdomain a separate domain might be more work because you need a new cert and you don't if you stick with a subdomain.

The most work is actually buying the domain.

Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.

More likely that the developer didn't even think about it, I know I probably wouldn't.

You should!

There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.

I'm not saying you shouldn't think about it, it's just a non-obvious vulnerability.

Most of them are. Thus the book.

My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default.

One method works, one doesn't.

But keep on telling people to read a book, for all the good it will do.

It's not like I'm in any position to do what you're suggesting. It's a bit late to revamp the entire web "security model" by this point.

And how many layers of red tape do you think the dev would have to go through to get a new domain?

On my team as a private company it looks like:

Dev: "Can I have a domain?" Me: "Sure" 10 minutes later done

In government I imagine you need a procurement order which needs to be approved. And my anecdotal experience has been that the dev teams don't always take high priority in those queues.

I'm sure it's not as hard as I made it out to be but it is certainly not as straight forward as many of us are used to.

It's actually worse than you made it out to be. In order to buy a dotgov domain, you not only need your management's approval (and since it's "representing the department to the public" that chain goes very high up) you also need to convince GSA (the registrar for dotgov) that you have a need for a new domain. It's not fun unless you're 18f under the Obama administration, and they don't count.

It's not really linked to private vs public. It's more of an organisation size question. I can guarantee that if you were working in a megacorp it would be the same issue

I work in a megacorp. Can confirm. Have to file tickets, and they have to seek approvals for either delegation of server allotments and subdomains or new dns pointers or worse.

I regularly need to host internal applications accessible by other staff and often just do so from my machine during the daytime and send them updated IP addresses/ports where they can access them... boss didn't even think it was possible...

Yeah. I imagine the government processes are pretty convoluted.

And this is how you get departments running their own infrastructure lava-layered over the top of the unresponsive corporate IT...

Pretty much.

Some of the tools are temporary mind you, and it's much quicker to run the temp tool on my machine through the local network for a couple of weeks than to spend a few days waiting on resource allocation and then getting it shut down afterward.

Some of them are scheduled to be merged into larger projects that will seek out the necessary permanent resources... in time.

And things always take their time. It's my first excursion into such a large company and it is boggling at times. Things that would be small flaws in a smaller business are magnified 10, or 100x.

I work in a megacorp. I'd expect it to take about a day (but of course we also already have domains for exactly this purpose too).

To be fair, at every large company I've ever worked for (mostly major oil companies, not tech companies) it's at least a two to three month process.

And how far removed is the sub-team that manages this specific content posting part of the web content from the DNS team/process/red-tape to even make the inquiry about how to?

Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.

It's not that bad.

It is slightly annoying that the procurement rules don't let sysadmins buy multi-year domain registrations---not even for .gov domains.

Ultimately, there's nothing stopping a federal employee or contractor from buying another domain except ignorance of good infosec practices. Even a .gov domain isn't all that expensive---$400/year is a drop in the bucket of federal spending.

Wait, .gov domains cost money? I guess I just thought the us government assigned them as needed to agencies. Never thought about cross agency bills.

41 CFR part 102-173, the law that authorizes GSA to run the dot-gov registry, allows them to recover their operational costs from registrants:

https://www.gpo.gov/fdsys/pkg/CFR-2010-title41-vol3/xml/CFR-...

It completely makes sense, I just never thought about it.

A lot of public universities had a homegrown dropbox lurking somewhere in their infrastructure. Thankfully they were already abused to the point that schools have been shutting them down over the last 5-10 years. (Usually abuse not in the form of malware, but in the form of file sharing movies, etc)

Reply on news.ycombinator.com