Hacker News Reader

Comment by dbg31415 | Hacker News Reader

Look, virtually nowhere in the public sector is security taken seriously. And nowhere in local government is security taken seriously. City governments might as well be pinatas... the way their budgets work, they'd never be able to replace large systems that were compromised. Without legislation banning them from paying, paying the ransom is likely really appealing to them. Security should be bumped up, but let's face it... that's not going to happen given how nobody who knows anything about tech would be caught dead working for local government. So many things have to change.

View on HN

It really doesn't make sense to me that software isn't created at the government level for cities and states to use. This way it's easier to make sure everything is functioning properly and the cost is only paid once.

Do we know the problem is in the software? There's a lot of other things that go into securing a large system like this, training and testing staff to resist phishing attacks, apply security patches promptly, maintaining least privilege as requirements, hardware and staff change, etc. It seems to me that unless your software package encapsulates every use case and enforces the security protocols itself the only defense is an on-site security professional who is listened to.

With full SCADA integration for any type of system (water, sewer, electric)?

Might be some problems with the competitive bidding aspect of things, as well.

> It really doesn't make sense to me that software isn't created at the government level for cities and states to use.

What government level? The federal government?

> This way it's easier to make sure everything is functioning properly and the cost is only paid once.

The federal government is no paragon of software virtue, nor is it likely to produce software adapted all that well to all of the needs of various states and cities, so what you'd end up with is software less fit for purpose, not particularly free from vulnerability, and where all of the vulnerabilities expose every state and local government in the country rather than just one jurisdiction.

And that's still assuming good intent, but in many cases the state and federal government have adversarial relations on particular issues, which might lead to the federal government actively designing software in a way to frustrate the needs of particular states.

Government jobs like creating software are required by law in most cases to be done as contracts that are put out for bid. Then the lowest cost or most corrupt choice wins. This entire system creates massive perverse incentives. Failing to complete the project on time is a business win. Making it hard to maintain is a business win (because maintenance will be separate ongoing contract and the company that authored it is thought to have some advantage on getting that contract). Making it hard to modify is a business win. Delivering as little actual functionality as possible is a business win (they might make new contracts or contract mods to add more functionality).

I worked on a system for over a decade that originally got awarded as a contract to build 3 systems. When all was said and done, 3 contracts had been awarded to get it to completion and 1 system (which required 9 months of full time work to get into a state to be used in production) was delivered. There are only 2 words for that in the contracting world: stellar success. That was a bigger win than they could ever have dreamed. Just drag it on, hiring the lowest paid new grads you can find to slap something together, stack the project with absurd layers of management, and collect the checks. Eventually, after years and years of this leeching, someone in the government will decide to make it an achievement in their career that they actually got the thing across the finish line. To do that they will sign off on the project and accept it no matter how short of contract requirements anything is. Their goal is to get the thing in the door and get credit for that, no one is going to blame them when its terrible. And the idea of actually punishing the companies that do this, penalizing them financially and legally for violating their contract when they don't deliver a working system on time? Forget it. Never happen. The companies will get the public fighting against 'big government' and crying crocodile tears for how harangued the billion-dollar megaconglomerates are with the RNC clanging finger cymbals while whirling around chanting 'jobs jobs jobs'.

Every state is going to have their own requirements. Some intentionally different, others unintentionally different. I can totally get on board with mandated open-source software for governments, but the reason the federal government doesn't just make the software is because most of the contracts involve support and training services. You can't rust government employees to do things for themselves now, come on. (=

Think of government as your grandparents. You can give them the best computer and software, but odds are they'll still call you in the middle of the work day to ask questions you don't really have time to answer. This is why Accenture and other big shops get big government contracts. At some point, it's easier to just send Geek Squad to your grandparent's house... knowing full well that they'll get upsold on crap they don't need, and charged more than they should... it's still easier than having to deal with teaching your grandparents not to write their passwords on PostIts they leave next to the computer.

> Look, virtually nowhere in the public sector is security taken seriously.

The same is true of private sector. It's not like a bunch of businesses haven't had to pay ransom too you know.

> nobody who knows anything about tech would be caught dead working for local government

People like you are part of the problem.

> People like you are part of the problem.

The problem of what? We seem to be at an equilibrium, non-federal government offers neither the compensation nor the work environment to attract people who have better options. Maybe you can make an argument for civic duty, but that runs into the same problems as working for a company that's "changing the world" but not treating you very well. It just seems like a recipe for burnout, except the tech experience you accumulate probably won't be as good. No?

"wouldn't be caught dead" is pretty strong language to be using when you're only suggesting that compensation isn't as good as it could be, which I'd have to disagree with anyway. Outside of SV startup funbux, the salaries, insurance, and retirement benefits I've seen for public sector postings have been at least competitive with other local business.

I think the real issue is the "work environment" aspect you're talking about. The public sector jobs I've worked have not been keen to chase resume-padding fads and have generally much preferred sensible and simple solutions to the complicated over-engineering that is commonly fetishized of our industry.

Anyway, my point about you being the problem is that you're unwilling to put up with whatever you see as the inadequacies of working for local government. You wouldn't be caught dead doing so, in your own words. You care far more about your own personal wealth enrichment than your community, so is it any wonder you end up with a government that isn't any good?

I didn't write the original comment, so I didn't say I "wouldn't be caught dead". But I'm skeptical that the choice is between "personal wealth enrichment" and "[my] community". It's far from obvious to me that working for local government means working for "[my] community", especially in my rather scandal-plagued city. Instead, working for my local government seems like it would force me to work with/for people with very different ethics who are nonetheless way better at playing the political power game, and who often don't care about tech to boot. That sounds bad.

> I didn't write the original comment, so I didn't say I "wouldn't be caught dead".

Fair enough, I wasn't paying attention.

> It's far from obvious to me that working for local government means working for "[my] community", especially in my rather scandal-plagued city.

How do you think it is that governments get this way? It's because the people who care about the community don't take part, so it is left to the people who want to exploit it.

Reply on news.ycombinator.com