Hacker News Reader

Comment by neffo | Hacker News Reader

It's hard to give non-Australian investors a sense of how bizarre this was. The ASX still provides CHESS holding statements (updates when you transact shares, when codes change or you are otherwise issued new shares)... by post. On paper. There is no other option.

Before they fixed that they wanted to move CHESS to a blockchain. Wild.

View on HN

It's even crazier talking to the people involved.

The project got the underlying Blockchain tech from VMware... AND had a requirement for a backup "traditional" RDBMS system.

So, complete feature duplication of the core, mission critical application.

Scope creep was crazy. Someone who doesn't understand the technology went "blockchain yeah sure mate let's go."

Good project managers are so important.

Good PMs would be replaced when they say a firm no in such top down projects

Yeah that my thougt as well. That type of things fall from the sky on PM and they have to deal with the new direction.

Maybe product director / VP or whatever

> Good project managers are so important.

That's more an issue with Product Management.

It could also be an issue for Program Management or even Engineering Management. All of those roles can be flexible from company to company, and many companies do not staff every effort with all of those roles.

> So, complete feature duplication of the core, mission critical application.

A requirement likely put in place by someone who realized that even if executed properly, a blockchain solution would do no better than what the "legacy" RDBMS already could.

I too am sick of getting those paper letters getting sent, so much waste when I end up shredding or throwing all of them out.

Really the ASX should just focus on providing a solid modern platform for trading. Simplicity, security, and speed. None of that requires any form of blockchain which is slower, scammier, and more complex. It just requires writing a modern electronic computerised system.

Reminds me of the Australian Bureau of Meteorology (BoM). They have a web presence, in glorious HTTP like it's still the 1990s and everyone uses NetScape Navigator:

    http://www.bom.gov.au/

They've been called out about the lack of HTTPS on their site in the media several times. In 2022, it's just shameful.

Maybe there's a technical reason, you're about to say. Maybe they have an enormous load on their systems and they can't afford the overhead of TLS? Or something?

Get a load of this: https://www.bom.gov.au/ works!

It shows a full-page error message -- via correctly configured HTTPS -- that says:

    The Bureau of Meteorology website does not currently support connections via HTTPS.

    You will shortly be redirected to http://www.bom.gov.au.

What kills me is that you if you use F12 network tools to have a look at their site, you'll notice that they're behind the Akamai CDN, which 100.000% certainly supports HTTPS and probably serves little else in this day and age... except for the Australian Bureau of Meteorology and other backwards organisations.

Their excuse for this was that there already was an ongoing project by some consultancy (Accenture or Deloitte, I can't remember) to uplift their site. Years later that seems to have gone nowhere despite tens of millions of dollars spent.

Australian organisations seem to love this kind of thing. Still clinging on to the old system for dear life while burning a huge pile of money that doesn't actually deliver any improvements and gets abandoned after years...

FYI: https://weather.bom.gov.au/ supports HTTPS and is pretty much a "modern" drop-in for the top-level.

I think by "modern" you mean that it makes my browser stutter when scrolling from what appears to be layer upon layer of transparent divs?

Also, I can't select a location manually, it forces the use of GPS location finding. Even if you bookmark a specific location and then load it in a new tab, it'll immediately prompt to use your location. If you refuse...

    Unable to detect location.
    To use your current location, allow permission via browser settings.

It simply hides the content of the page, so you can't see or do anything with a URL somebody sends you if you don't grant location permission.

I bet this page cost millions. It hides the information I'm looking for "below the fold". It shows a grand total of 276 bytes of readable text on an entire page of HTML that took 198 requests, 2.32 MB and 19 seconds to load.

As I mentioned, I have to scroll down to see the content I actually wanted, which is the hourly forecast. But despite making you scroll, it still hides half the content with a "show more" expanding section you have to manually click. The "saved" area is a tiny, tiny fraction of the multi-page screen real estate they waste on enormous empty space.

The radar map no longer shows temperature measurements or anything useful, and is staggeringly slow. It stutters my very high-end gaming laptop. This is in part because BoM was too incompetent to host ESRI ArcGIS themselves and used the cloud-hosted "tiles.arcgis.com", which is hosted in the United States, 230 milliseconds away from Australian users.

Speaking of United States data centers used for Australian Government websites, I've noticed that it seems to be the policy of both state and federal departments to add the Google Analytics to all pages to ensure that Google can track our citizens during their interactions with their government...

We're the lucky country mate.

Someone came along and gave me that site. Bugger if I know how to change it. Once it's gone it's gone!

On the one hand, https on BOM might not be a big deal / low priority in the grand scheme of things, but in the other hand it could be done in like half a day by anyone there who knows computers.

It's probably safe to say they don't know how to computer

As someone who worked on a Deloitte government project in Aus, they'd have got a better product (or anything at all for that matter) for way less money by just hiring a small dev team internally. Instead, it was outsourced, and they were offered a bloated Sitecore .NET monstrosity. The project had completely stagnated before the pandemic, and then that was the final nail that got it abandoned.

They (the ministers at least) know this, this is working as intended under our previous Liberal governments.

IT procurement in Australia is a piece of shit because, in the name of fairness, everything needs to go out to tender, but the only companies big enough to deal with a tender process are mostly lawyers with a couple of coders attached (or worse still, they just subcontract the coding). Almost all the money goes to people who sit in meetings discussing the scope, and some poor sap ends up doing the code for next to nothing.

The government just needs to hire coders directly, that's what Service NSW does and it shows.

This seems to be the correct answer based on my experience.

This is a problem almost everywhere today.

Lots of businesses are now tech companies, but the managers are from a different age so you need layers of other managers to do exactly the same job (when people talk about weak productivity growth from technology, this is it...it took half a decade plus after the industrial revolution for things to filter through, it will be a bit quicker this time but there are massive institutional roadblocks...perhaps even bigger than in the 19th century which was all de novo innovation).

1,000x this.

There are a bunch of potential projects I could knock over personally in a month or two each that I will never ever be allowed to bid on.

Instead, it goes through an internal process at the department that takes months, which means a bunch of people have to justify their positions, driving up the minimum cost.

These non-technical people architect the solution, put it a scribble of a Frankenstein's monster of a design in the tender with a laundry list of requirements, none of which are actually needed because what they really wanted was a mostly static website any idiot could develop.

A couple of years later (I wish I was kidding), the tender process is finished and a Big Consultancy begins the hard work of... subcontracting the work. To my parent company, that finally gives it to me. Out of the $millions on the tender, I now have 2 weeks to a job that should have been 2 months.

The design is now hilariously out-of-date, and was wrong to begin with, but it is now a part of a legally binding contract between orgs I have zero leverage with. It MUST be implemented, verbatim. Including the bits that are actively harmful, stupid, backwards, legacy, or just idiotic. All of it. This stuff is audited to make sure there's no corruption or dodgy work!

The end result is a monstrosity built in a hurry by a poorly paid tech, while 10+ middle manager types all take their cut.

It's abhorrent.

Sure but why do I care if my weather reports are covered by HTTPS? What risk is that going to mitigate?

Tell that to Eisenhower as he’s postponing D-day due to bad weather.

Weatherman in the Middle

Malicious JS being injected.

Also Australian,

The only sensible reason I can think that BOM is not under https is that there are ancient mission critical consuming services somewhere that can't handle the upgrade.

For example: a network of regional flood warning alarms that are pulling flood/rainfall data from a feed on the same url. They could have been built in the early 80s, and cant be upgraded. Ignoring them would risk lives etc etc

Nevertheless there would be other ways to solve that.

Good example, but even so I can think of many way a well directed intern could solve that without touching the code of that things.

“Do not redirect from HTTP to HTTPS if source is IP is in list if legacy devices.”

There. I’ve solved it.

Similarly, a filter based on User Agent would likely also work.

I meant actually solve it by upgrading to HTTPS in a reverse proxy but yeah :)

They're already behind Akamai, and have a valid certificate and the site is reachable on HTTPS... but redirects back to HTTP.

That's purposeful incompetence, not an accident, oversight, lack of budget, or anything else that can be excused.

You're just making up things trying to find a reason. HTTP was only invented in 1989, so these imaginary early 80s clients likely don't exist

Adding HTTPS support doesn't necessarily mean removing HTTP.

Even if there was an ancient service that can't handle HTTP, keeping HTTP and adding HTTPS support will do just fine.

The web uses port 443 for HTTPS, so this example is unlikely to be an issue. Having said that, there are weird and wonderful corporate and government proxy configurations out there that do wacky things.

My guess is that their entire system is so tightly coupled that they can't unpick this without a huge amount of work that requires real developers to stick with it and get around it.

There is no sensible reason, except perhaps money. And using it as an attempt to increase funds or raise the low pay levels hasn't worked and won't work. It is likely to be stuck that way until Chrome stops serving plain HTTP at all from the Internet and someone gets a kick in the bum to fix it, after which a few clicks with Cloudflare or other HTTPS front end provider will sort the problem. And possibly even save money due to caching and not passing on much bad traffic.

> Accenture and Deloitte Both ? Here you go.

As someone that spent a decade in the Australian tech industry, and then a decade outside, I can say that Australia is famously a tech backwater.

London might be seen as conservative/cautious compared to SV or Austin or Lisbon, but it's far ahead of Australia where bloated big bang projects are well supported, and lean projects by actual tech companies are ignored.

UK may not be amazing but they do a lot correctly. Lots of systems integrated / running under the same umbrella. In-house infra with in-house ops. You can even browse through an the puppet and deployment scripts on public github.

The problem with Aus is that all the talent leaves and you're left with uneducated bogans like me

Aussie here. Speak for yourself mate. The tech I am working on in Melbourne (Rostering/Pairing) is world class. We are routinely beating international companies 100x our size.

Not to mention these letters have an identifier which is used basically as a password printed on them…

It's so wildly insecure that the holder identification number comes out in the mail. Then if you change your address, they send a notification letter to the old address just letting you know that it was changed. This means if you move house, and don't get a mail redirection, whoever lives at your old address will receive a letter containing your holder identification number.

Maybe the blockchain can fix that?

It's ok, because they often make you give your postcode as a second factor.

Or last name. Which is also printed on the letter…

Honestly I'm relieved to learn I'm not just an idiot who didn't know how not to get the letters.

ASX now offers electronic delivery of CHESS holding statements and notifications: https://www2.asx.com.au/investors/start-investing/electronic...

However, holders can’t opt themselves in; inexplicably this needs to be supported at the broker level. I’ve spoken to one of the large brokers who advised me they have no plans to support this feature.

Reply on news.ycombinator.com