Hacker News Reader

Comment by HideousKojima | Hacker News Reader

My most recent job was for a local government, and even though I made a push for open sourcing our code, I never made much headway. Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file, so it could have been a bit disastrous if my efforts had actually made any headway

View on HN

> Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file

Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?

>Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?

Because most local governments are 10 to 20 years behind on anything remotely approaching best practices. It wasn't my choice to run things that way.

If it's hard enough for to tech companies to hire skilled developers, I can only imagine what the bar is for public work. They might even resort to hire some brain damaged people.

Here in Australia, only citizens can work for the Commonwealth (federal) government. The end result is that, due to a lack of competition from immigrants, the public sector is basically just a jobs program for those too incompetent to work in the private sector.

The same thing happens in the US with any jobs requiring security clearance.

I'm not surprised. Even great devs sometimes slip up and when you have enough people, someone is always slipping up. The only real solution IMO is to have safeguards in place like credential scanning (ideally both locally and on the server). It's not foolproof, but it can help avoid or minimize a lot of incidents.

Reply on news.ycombinator.com