I'm one of the team that did the initial implementation of the server and iOS app before handing it off to the CDS for the latter part of implementation, and I've been really, really impressed with the CDS. They're a great model for what tech in government should look like.
On a somewhat-related note: you wouldn't happen to be / know who is responsible for the BC CDC Covid results service, would you?
I was disappointed to see this page, which asks for personal information including your PHN, served over HTTP.
Not only that but there is actually a disclaimer saying it's fine to ignore the big red padlock because the iframe uses HTTPS (which is also technically not true as far as I can tell - the iframe _redirects_ to HTTPS though).
Canada is kind of... weird, in this regard. I knew about the CDS, and was on their mailing list (they talk about pretty neat stuff and it sounds like a neat place to work), so this didn't surprise me, but...
So a while ago, we (the company I worked for at the time) had some servers hosted at a hosting company based here in Vancouver, though the servers were in Seattle.
Well, we got an e-mail from our host, forwarding some automated e-mails that they had received from the Canadian government (possibly the CDS, but I don't think so) notifying us that we had open memcached ports (11211) on some of our servers.
I went and checked the configuration, and sure enough we'd had a configuration error, where memcached would only accept one IP address to bind to, but our script had provided two (because the servers had an internal and external), creating an invalid config which was never deployed, so memcached was just listening on [::]:11211, and since it wasn't supposed to be open we didn't have any ACLs on the access routers. We fixed the configuration issue and switched to a default-deny policy and all was fixed, but it was surreal that an e-mail from the government was what tipped us off.
We use bugsnag on many of our client web apps to catch javascript runtime errors and with one of our apps we frequently come across problems that reference javascript functions and variables that aren't ours.
Sometimes it turns out to be a benign plugin, but in many of these cases it is a known virus or dangerous browser plugin that is trying to log keystrokes, mine crypto, extract banking info, etc.
We have gotten to the point where we can often tell them which virus they have, how we know, and include removal instructions. Our app is very expensive so most customers are people who need our tools and use the app everyday, which means we can often tell them when they got the virus too. It's way out of scope for our role in their life, so it's a little bizarre for everyone involved, but the customers seem to appreciate it at least.
I worked on a project with them about 4 years ago, and it was a less than ideal experience. CDS was not entirely at fault, as there were other departments involved, but they were willing to bend on specific details that we (as an outside service provider) specifically recommended against.
It put us at odds contractually in terms of project timelines, but we were pushed between delivering securely or timely, and the stress from all sides for the latter caused a number of people to not only leave our company, but also take leaves of absense on the government side.
I strongly support them as a Canadian citizen, and sincerly hope that they've reached the zenith in that their stated position holds, because the alternative was a downright awful experience.
can you introduce me to someone? i'm working on this currently: https://www.youtube.com/watch?v=t9xFQFkvoLg&