Hacker News Reader

Comment by diegorbaquero | Hacker News Reader

Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million

Talk about waste of resources.

A minor but important correction. Krebs wrote that the Gov claimed that “fixing the flaw could cost the state $50 million.” That’s not quite right. In the press conference linked in Kreb's post, the Governor actually claims that the “incident alone may cost Missouri taxpayers up to $50 million.” I’d guess this number includes an estimate for the legal cost of dealing with the data breach plus any statutory penalties the state might incur (plus a grossly inflated price for fixing the bug).

It's a disgrace the agency who produced this website is not liable for this substandard quality.

How crazy is it that code like this is deployed to production and then the customer has to pay 50 million to get it up to standards? The senator should be ashamed they are being scammed like this.

> fixing the flaw could cost the state $50 million

It's hard to imagine the kind of contorted bureaucracy that could turn such a fix into a $50 million change request, and yet, I wouldn't be surprised at all if it did cost that much.

Governor’s cousin need to eat, too.

I mean it wouldn’t be a weekend fix because it’ll have to involve an audit of all existing systems to identify where else similar tomfoolery occurred.

But 50 million is a high estimate.

30 minutes removing a piece of output: $100

Knowing where sed output is generated: $49.9999M

> Knowing where sed output is generated

Is the use of "sed" intentional or a typo? Either way, I love it.

Seems quite intentional. As it is a levenshtein distance of 2, along with i being physically far away from e and a on most commonly used keyboard layouts.

Remove SSN field from DTO - 49 million

Invoice Fee - 1 million

Not bad for -1 lines of code.

I could totally fix it for $49 million. /s

This is a race to the bottom and why tech workers need to unionize. Soon someone could be fixing it for a measly $1 million. /s

Contractors in Missouri must be drooling in anticipation.

I would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.

I know right. An immediate fix shouldn’t cost anything, right? Just don’t send social security numbers to the browser.

Turns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll need to go back and forth with some unrelated department for months to make it happen. Also there's no testing environment, no information about how to get it running—let alone any useful scripts or config/deployment management—is in the repo or otherwise available at all, and there are no tests. And it's all written in an unholy combination of ASP.NET and Java server pages. And the "database" is a standards-nonconforming CSV.

(pure speculation)

Cheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.

Yeah maybe the current system is an emalgamation of 20 such cheap solutions accrued over decades. If they are not i a crisis, they should do ot properly

What are the odds it will be going to someone he knows?

Reply on news.ycombinator.com