Hacker News Reader

Comment by vlovich123 | Hacker News Reader

I'm not a fan of Microsoft, but this is some amazing blame shifting. The root cause of the problem is the government single-sourcing a vendor and being incapable of negotiating with said vendor. The US government is 10% of Microsoft's annual revenue just on security services (if I read the article correctly) but is failing to negotiate. The right answer here is if the situation is that bad, make a very public long-term commitment to shift to something else & up-level your IT department to be able to execute multi-year projects competently. Instead of meeting Microsoft on the business playing field, it's trying to use scary "national security threat" verbiage to try to bully them in the court of public opinion.

Regarding security, at the end of the day, the US government is a huge target for adversaries. You can't outsource your security practices & if MS software is really that much worse they should be fixing their purchasing requirements. The reality though is that whatever software the US government would switch to would become the focus of adversarial research.

View on HN

Well you can't not outsource your security because gov payscale limits do not match market reality. You have to realise that a ton of people who should be directly employed by NSA etc. are actually working for their contracts for this reason.

The US government isn't in need of a thousand high-skilled hackers. They are in need of a million normal employees with some basic security awareness. Anyone with a modicum of skill can find thousands of areas to improve. The issue is that almost nobody is in a position to get anything changed. Even basic software choices are a multi-year epic.

Well I obviously have no clue what the numbers are on the offensive side doubt they are smaller than a thousand. But there are def thousands of cyber security professionals working for government through myriad of contractors purely because of caps.

The NSA isn't actually supposed to be a massive Statsi-like bureaucracy, it's meant to crack codes used in wartime so that our troops know what the enemy will do next.

And provide the standards to be used within US systems ... Which is basically a definition for bureaucracy.

You're thinking of the CIA. The NSA's job is to spy on citizens.

>The NSA's job is to spy on [US] citizens

They're not supposed to (according to for example the Foreign Intelligence Surveillance Act of 1978).

If a US citizen needs to be spied on by the US government, the FBI is supposed to do that.

> If a US citizen needs to be spied on by the US government, the FBI is supposed to do that.

Semi-autonomous collections systems generally aren't capable of determining citizenship.

Once the data is at rest, much of it is made available to a surprisingly large number of federal and state agencies - and even local agencies via fusion centers, etc.

The system is built for dissemination. Within that, some checks on citizenship could be possible for some data. But even then, once a foreign person is part of the data/comms transaction, all the related data is available - citizenship of the other participants is no barrier.

What the spook box says and what's inside are two completely different things, by design.

Um, NASA?

The government is able to employ tons of smart people that could be making way more money elsewhere.

They might not get the absolute best security people in the world, but they could get good enough - as good as they're getting from MS for a fraction of the price.

Additionally, government salaries aren't terrible when you factor in the pension. Most people want the money now. But if you want financial security in the future - that's a reason a lot of people chose to work for the Fed.

Almost all the work done at NASA is done by contractors that work in better conditions than allowed for by the federal payscale.

I mean this is categorically not true, but definitely makes for a pithy comeback.

At least in the Shuttle era, I once heard it said in a way that was something along the lines of “contracted support is basically working to rule; NASA employee components are working to solve problems.”

Referring here to contractors as the body of private sector contract organizations that had outsourcing contracts for various support roles, not the individual people. Speaking to working environment.

> Additionally, government salaries aren't terrible when you factor in the pension. Most people want the money now. But if you want financial security in the future - that's a reason a lot of people chose to work for the Fed.

This varies by agency and field. The older pension system was replaced with a newer model a while back so a prospective federal employee is looking at the combination of effectively a 401k, a pension of 1% top salary per year of service, and social security. That’s not bad but your salary is capped at under $200k so you're not getting anyone with IT skills turning down FAANG positions unless it’s for a cause they support (NASA, the VA, etc. can do that a lot more effectively than Agriculture, etc.). In other professions, of course, that can be pretty different – if you’re an academic who isn’t able to/interested in switching careers to ad-tech, that might be a great job compared to getting in a cage fight for a handful of tenure-track positions.

This matters a lot for security because the defense needs to be everywhere. NASA will never run out of people who want to work on robots because rovers are cool; the IRS needs people who can modernize internal business systems and that’s not only not cool but will get mockery from the more clueless people they know.

Partly this is due to the concentration of wealth, inaccessible to taxing.

Naturally government pay would lag behind even the more mediocre H1Bs.

> Partly this is due to the concentration of wealth, inaccessible to taxing.

This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly.

The problem is that there’s an entire political ideology holding that government is inherently wasteful and its adherents will oppose any attempt to track market salaries because that allows them both to say they’re saving money at the time and later to cite the struggling/failed project as proof that they were right.

Yup. When a VC-backed company goes bankrupt, no one bats an eye. When Solyndra's loans go bad, even though it was a tiny fraction of the government's green energy portfolio, you get headlines and congressional hearings.

How many middle class workers were robbed through income tax to pay for the $524million dollars lost on solindra? Government money totally ruins any private business, to the tune of a huge party where everyone takes as much as possible with no accountability

How many orders of magnitude more money is “robbed” by Comcast/Verizon/Charter, the medical industry, manufacturers who hiked prices up during the pandemic, etc.? Large organizations of all persuasion need oversight but that doesn’t mean we should give up on the concept any more than Enron meant we should give up on the stock market or private energy companies.

And when a big contractor has an 8+ figure write-off, they have a PR team working to prevent accountability and none of the people who were talking about private-sector innovation and efficiency will be asked whether they had a more realistic position now.

> This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly.

It certainly has something to do with it.

The market rates for engineers was distorted because FAANG had a lot of money to throw around, so therefore hiring staff at government pay rates is quite difficult and is subject to the General Schedule (https://federalnewsnetwork.com/pay-benefits/2023/12/biden-fi...).

Contractors work from bills and projects, where the money is carved out; I agree it’s terribly inefficient.

The other issue is how difficult it is to get into government vs getting in as a contractor.

I tried the former many times without success; the latter? Easier than FAANG or finance.

Yes, the GS scale is a problem. My point was that it’s not a problem because we’re trying to save money – if that were the case, someone would notice that raising the cap to allow a $300k civil service job is cheaper than allowing the same job to be performed by a $500k contractor who takes home less and is replaced more frequently.

Politics enters the picture because the pay cap is derived from the salaries for politicians rather than what expertise is valued at on the open market:

https://www.opm.gov/policy-data-oversight/pay-leave/pay-admi...

Yes, but “saving money” is your point and strawman; I never said anything about saving money, nor did I imply it.

GS in general cannot grow when the market pay was distorted by both lack of tax funds; and when those driving market pay has a disproportionate amount of wealth to corner the labor market, in order to prevent the hiring of engineers by other industries.

I think you misunderstood: I agree that lack of tax funds is a problem in other areas but in this specific case it isn’t because the same or greater amount of money is already being spent.

I think it's more about greasy palms than political ideologies. No proof though.

> The problem is that there’s an entire political ideology holding that government is inherently wasteful and its adherents will oppose any attempt to track market salaries because that allows them both to say they’re saving money at the time and later to cite the struggling/failed project as proof that they were right

Why is it a surprise that employees who are essentially unfirable don't perform well? Aside from a very small percentage where the hiring culture is exceptional, it's almost universal. This is a problem with governments across at all levels in almost all countries.

How many times do we have to match this movie before realizing that just increasing the salaries won't make a difference, and instead will be wasteful.

> Why is it a surprise that employees who are essentially unfirable don't perform well?

This is a great example of that political dogma: notice that you’ve accepted as an article of faith the trope that government employees can’t be fired or disciplined or that this is not true of contractors, despite neither of those being true?

If your goal is successful projects, what you’re looking for is accountability and managerial discretion. The managers you think can’t direct civil servants directly aren’t magically more capable of selecting and overseeing contracts, either, and without technical staff they won’t have someone they can turn to for advice who doesn’t have a financial conflict of interest.

> This is a great example of that political dogma: notice that you’ve accepted as an article of faith the trope that government employees can’t be fired or disciplined or that this is not true of contractors, despite neither of those being true

Nice strawman. It is harder to fire govt employees than to fire private employees. Disagree?

Just look up at-will employment law that doesn't apply to government entities. Looks like you're the one following political dogma and accepting articles of faith and tropes.

Otherwise why would ignore that a very consequential law is different for private vs govt employees?

> The managers you think can’t direct civil servants directly aren’t magically more capable of selecting and overseeing contracts, either.

Where did I say they cannot? Please stop with the strawmen. They just don't have enough incentive because it's very hard to fire them, unlike managers in the private sector.

> Nice strawman. It is harder to fire govt employees than to fire private employees. Disagree?

Let’s see, so it’s not a straw man when you say government employees are “essentially unfirable” but it is when someone corrects you?

Lets ignore the personal back and forth, and get back to the argument.

It is harder to fire govt employees than to fire private employees. Disagree?

At-will employment law doesn't apply to government entities.

A very consequential law is different for private vs govt employees.

> The managers you think can’t direct civil servants directly aren’t magically more capable of selecting and overseeing contracts, either.

Never said in my comment they cannot direct civil servants. They just don't have enough incentive because it's very hard to fire them, unlike managers in the private sector.

That's like the farthest I've seen goalposts move within a span of two comments. You went from "essentially unfirable" to simply "harder to fire" and continues to act like you're so right. Like it's almost pointless to discuss something with someone who pretends those are even close to the same.

That's three comments where folks are attacking me instead of addressing the topic because they know they lost the argument. Sad to see that happen. And also look up the meaning of the word essentially.

> Lets ignore the personal back and forth, and get back to the argument.

I mean, were you not attempting to make an argument when you said that government employees were “essentially unfirable”? Your argument just sucked/was factually incorrect and you want to steer away from the “interpersonal” aspect of someone pointing that out.

It’s gauche to point this out on HN but you aren’t engaging in good faith here - wnd when someone else engages you in actual good-faith you fall back to juvenile debate-club attempts to frame them as the wrongdoer.

That’s highly rude and a bad attitude and approach to bring to this community. Act better and take some accountability for your own misbehavior.

I had two options, either continue the personal back and forth by debating that you folks don't understand the meaning of the word 'essentially', or take the high ground and debate the topic.

Sad that both you and the other poster lost the argument so hard that you have to resort to ad hominems and make it about me instead of the topic. Thats very telling. And also look up the meaning of the word essentially.

> Why is it a surprise that employees who are essentially unfirable.

A government needs employees right? One way to attract and retain employees is to offer competitive wages, another is to offer a relatively low workload and high job stability. Government worker salaries are easy targets and the people who set them are elected officials, so its not a surprise most governments today lean on job security over wages.

> Naturally government pay would lag behind even the more mediocre H1Bs.

Those "mediocre H1Bs" work their ass off compared to non-H1Bs because they get laid off/fired and deported on short notice with barely enough or sometimes no time to sell their belongings if they don't perform [1]. Meanwhile it's next to impossible to fire a govt employee for bad performance.

Maybe the solution is to fill the govt with mediocre H1B employees, not pay govt employees even more without accountability if they don't perform.

[1] https://www.timesnownews.com/technology-science/techie-on-h1...

> Those "mediocre H1Bs" work their ass off compared to non-H1Bs because they get laid off/fired and deported on short notice with barely enough or sometimes no time to sell their belongings if they don't perform [1]

H1Bs wouldn’t be so easy to fire if the skillset were rare or difficult to fill.

Instead, companies are gaming the H1B lottery to create much lower-paid indentured servants while a sliver of the business rakes in 40% to 60% of the spread.

And the Federal government employees are paid at the same level or less.

I don’t find the H1B abuse defensible, but certainly a useful discussion point on relative salaries.

> H1Bs wouldn’t be so easy to fire if the skillset were rare or difficult to fill.

By the same token a good chunk of government employees would be paid higher if their skillset were rare or difficult to fill, and they worked hard. The good ones that work hard switch to the private sector, even if the pay isn't much higher, so that they can get stuff done and not be surrounded by folks just existing while collecting a paycheck.

Within your disdain for government workers is a small sliver of truth. One problem with the Federal government--and why contractors are preferred--is that Government Schedule pay is decent for some jobs and insufficient for others.

For software engineers--and the reason contracting is better--is that government schedule pay is far below market. But you see the same problem even in private industries like Lockheed Martin, where the brightest engineers (with security clearances) are really doubling/moonlighting with other jobs and the managers look the other way.

Also: The private sector is extremely inefficient, when it's handling areas of high upfront costs/high risk. Private military companies

If you want to defund government, start by tearing down the TSA which nobody in any party believes is anything but a job-creating sham. Of course, the loudest calls for defunding or non-growth are for deparatments that provide real value--like the FDA or the IRS.

So while you're happy the government is being defunded, most US citizens don't feel like promoting a national security problem for short-term gains.

The single most well funded organization the world has ever seen struggles to pay the market rate, which the government also regulates?

This is a straw man. Even if the top richest people paid an additional 16 billion in taxes that would run the gov for like a day. Our problem is with spending.

I’m not sure where that 16 billion figure came from, but what about the top 100 businesses?

The ones that have been gaming the tax system for 3 decades?

I agree. We don't spend enough money on everything, most notably housing.

The top earners only need so many houses and places to live, even including corporate housing.

The median population doesn’t have the money to spend.

Isn't that a problem caused by inflation which is driven (right now) by gov spending.

No. Artificial inflation where the median wage doesn't adjust is from a handful of key industries and it's rippled across.

Focusing on government spending is a distraction.

How can we possibly spend more?

The US government spent $6.1 TRILLION dollars in 2023. I don't think raising taxes is the solution to the government offering a more competitive wage.

Is your entire argument that it's a really big number? Are we afraid of big numbers? How much do you think it should spend? It's the federal government, they do a lot of stuff. Stuff costs money. We can complain about how they spend the money, or that the money is being wasted or stolen, but pointing out that it's a big number isn't a very convincing argument.

That number is meaningless without also considering US GDP (even if you write trillion in caps). The US averages about 14% government spending as a fraction of GDP, placing it at ~90/140. For the size of the US economy, spending should be significantly higher.

You are ignoring state government expenditures.

>...The US government's Bureau of Economic Analysis as of Q3 2023 estimates $10,007.7 billion in annual total government expenditure and $27,610.1 billion annual total GDP which is 36.2%.[1]

https://en.wikipedia.org/wiki/Government_spending_in_the_Uni...

>For the size of the US economy, spending should be significantly higher.

The percentage shot up during the Covid spending and is still slightly above the historical average.

Is this actual spending, or are you rolling pass-through savings programs into this? Cause the caveat there is people always seem to want to count the outflow but not the associated inflow…

  because gov payscale limits do not match market reality

The same people and corporations who leach off govt contracts and subsidies speak often about how govt spending is wasteful.

State/federal govts receive 10-20% of every single citizens salary on top of being able to literally create money. They aren't hurting for money.

This is entirely caused by corruption and incompetence.

I’d imagine that these proclamations are part of the negotiation.

I wouldn’t want to be a Microsoft account executive on the US govt contract right now; they’re about to have a massive load of additional requirements.

And if they don’t play ball, possibly antitrust to weaken their stranglehold on being the only real enterprise player.

I’m not saying any of this is the right approach, but it’s a tool in the governments toolbox.

any commercial channel filled with this much money will attract hordes of smiling useful idiots filling every possible niche. Now you have another problem, managing useful idiots over time.

source: knows some idiots

> The right answer here is if the situation is that bad, make a very public long-term commitment to shift to something else & up-level your IT department to be able to execute multi-year projects competently.

The problem is that there isn't much in terms of alternatives, especially not if you prefer to have one software / vendor / tech stack.

- In groupware, there used to be Lotus Notes, but that went down the drain years ago. Thunderbird can do everything Outlook can (i.e. provide an email client, calendar and address book), but there is no official(ly supported) Thunderbird server software suite so there's always a potential for subtle bugs between whatever one chooses for directory, email and calendar backends.

- for AD there's obviously Samba but it, again, lacks a management UI that supports all of its features, so yet another potential for issues.

- the Office suite alternatives are even more of a nightmare, both in terms of usability, stability as well as compatibility with the millions of legacy files originating from Office. Or hell, even compatibility with old versions of the same app isn't a given in LibreOffice. (And I'm not sure stuff like MS Access even has a FOSS counterpart)

- And then, there's all the other stuff that integrates with AD for authentication/authorization. In a lot of cases, it's "either use MS AD or you're on your own when you hit issues".

- finally, Windows itself. Essentially, the US Government would have to sink billions of dollars into ReactOS development to make it compatible enough with mainstream Windows versions to run all the legacy software that people use - and no, WINE alone is not enough, not for anything that deals with hardware directly. And I wouldn't assume it's possible to even hire enough developers that are skilled to develop for WINE/ReactOS and fulfill the project requirements of never having been exposed to Windows source code.

Microsoft has achieved an insane amount of vendor lock-in, even Apple with all its financial and technological might or Valve (who invested a huge amount of money and work into getting WINE feature-rich enough to run a ton of AAA games on their Steam Deck) have been able to even come close. They can provide as shitty a service/software as they want, their audience literally has no other choice.

(Me personally, I'll keep my Windows 7 and 10 VMs alive for as long as I can, but no way in hell I'm ever moving to the ad-ridden, bling-bling flashy pseudo-hipster-UI disaster that is Windows 11)

>Thunderbird can do everything Outlook can (i.e. provide an email client, calendar and address book), but there is no official(ly supported) Thunderbird server software suite so there's always a potential for subtle bugs between whatever one chooses for directory, email and calendar backends.

Thunderbird is a lot more reliable than outlook - I use both daily. But yeah there's no 'thunderbird software suite'. I don't think that's really an issue though. Outlook breaks regularly, and our desktop support group had to deploy an 'outlook reset' app because the vendor is unresponsive. Being that unresponsive lessens the attractiveness of a 'software suite'.

>Or hell, even compatibility with old versions of the same app isn't a given in LibreOffice.

If I find MS word can't open a file, Libreoffice always does. I've never had a problem opening a libreoffice writer or MS Word file. I'm no 'power user' though.

The reason businesses and organizations stick to microsoft is because it's what they're used to, not because the apps themselves are better.

As for microsoft as a vendor - they are as obtuse a vendor as I've ever dealt with. Nearly always 100% unresponsive - even with projects involving hundreds of thousands of yearly dollars in licensing fees. I think being unresponsive is some kind of corporate culture thing with them. They're like the McDonalds of IT vendors. You get what's on the menu and that's it. If it doesn't work, well too bad because they know the perceived cost of switching is believed to be too high.

> But yeah there's no 'thunderbird software suite'. I don't think that's really an issue though.

For me, it is. Outlook natively integrates with Teams, Onedrive and the rest of the Office suite. Everything is available at once, with one click, in a reasonably similar UX/UI pattern (okay, outside of the horror that is Teams with direct chats, meeting chats and Teams team chats). Let's just take a Teams meeting invite... in Outlook it directly opens the Teams meeting, in Thunderbird first the web browser pops up, which then opens Teams, and leaves a stray tab behind. It may be just ten seconds, but it's so much more annoying.

Wine can run apps that access hardware without issues.

The main problem is the catch-22: there's not much point in developing competitors to Microsoft's stack if businesses aren't going to ever consider them, and government departments won't consider alternatives if they can't get everything from a single vendor in a 100% risk free manner thanks to the "nobody ever got fired for buying Microsoft" and "one throat to choke" mentality you get there.

Governments do this to themselves. The USG doesn't even have to pick Microsoft. They could potentially sign contracts with Apple for workstation hardware and services, that would encourage and feed the alternative ecosystem based around Apple, or they could fund Linux, etc. They don't though. It's just soooo much easier to sign one giant contract, because that minimizes work for them and it's not really important to get value for money if you're in the public sector. Signing a great deal won't get you a big bonus or anything like that, but taking risks can get you blocked from promotions. So, why risk anything?

> Wine can run apps that access hardware without issues.

Depends on the hardware. Stuff like mice, keyboards or game controllers yes, as long as they're supported by the host OS stack (don't get me started on bluez and the clusterfuck that's Linux audio in general). But anything dealing with user-mode USB drivers (looking at you Samsung ODIN or a truckload of webcams) or more exotic hardware is out of luck.

> Governments do this to themselves. The USG doesn't even have to pick Microsoft. They could potentially sign contracts with Apple for workstation hardware and services, that would encourage and feed the alternative ecosystem based around Apple, or they could fund Linux, etc. They don't though.

Apple shot themselves into their own foot here by completely discontinuing their Intel x86 lineup. You can run Windows stuff on the M series SoCs but performance is atrocious (unless it's ARM Windows, but good luck finding software compatible with that oddity, no thanks to Qualcomm here who couldn't be arsed to put out actually usable chips for years).

As for Linux, there is already a huge amount of government funding into Linux because of servers and their support contracts. That's how RH, SuSE and the other commercial Linux distributions are surviving. The problem is the desktop software stuff, here the chicken-egg problem comes into force - and made worse by the fact that unlike Microsoft who can just decree whatever they want and the rest of the world has to accept it, FOSS projects are mostly driven-by-consensus, and if you're a commercial or government entity needing a feature you have to either fork off with all the cost that entails or herding cats and playing petty politics with people from all around the world (who might just block your idea out of principle after finding out you're working on behalf of the government/Monsanto/whoever is problematic these days, on top).

I think that's maybe more due to lack of demand/effort than any fundamental technical limitation. You can run USB drivers in user mode on both Linux and Windows. If someone paid enough for such support to be added, it'd appear.

A lot of the software getting hacked isn't even truly Windows-specific stuff to begin with though. VPN appliances, firewalls, they're probably all running out of date Linux distros. Active Directory servers could have some open source competitor too, aren't they mostly Kerberos? And for the rest, ChromeOS could knock it off too with a mix of web apps and RDP.

> You can run USB drivers in user mode on both Linux and Windows.

Yeah, but you'd need to rewrite the whole Windows app for a native Linux or macOS port because WINE to my knowledge can't access devices even if there were a Linux/macOS driver.

> Active Directory servers could have some open source competitor too, aren't they mostly Kerberos?

AD is so much more than just LDAP+Kerberos. You have a fully integrated file store, native and direct integration into Exchange (on-prem and cloud), group policies for users and machines, DNS, DHCP, NTP... one vendor, one tech stack, one management way. Set it up and you're done, and even a novice can set up a minimal working small-business environment in a day.

With Linux, you have to integrate/configure Samba (LDAP, GPO, file storage), Heimdall/MIT Kerberos, postfix/exim (Mail), no idea what one could even use for calendar sync, BIND (DNS), ISC DHCP server, Jitsi (Video calls), Mattermost (Teams chats). Each of these software pieces have their own configuration syntax, nothing integrates automatically on its own, guides are sometimes horribly outdated, there's subtle differences in behavior between distributions, some of these tools have web UIs for management, others are CLI, and all of them look and behave differently.

https://wiki.winehq.org/Hardware

"Wine includes some limited support for direct hardware access, including running native Windows drivers. This comes with several restrictions, but we still have been able to successfully access some native devices."

"For example, the SteelSeries USB mouse driver offers the ability to modify the mouse's LED settings as well as simply driving the mouse, and in this case Wine is able to pass through the LED settings"

I used to think the way I’d try to tackle a challenge like that would be essentially embracing the ChromeOS model by going web-first for everything so you’d avoid accumulating new accidental dependencies on proprietary software, and trying to shift legacy apps to WINE, terminal servers, etc. Obviously you’d need thousands of exceptions but the important part would be removing the inertia which means that new code starts out being non-portable.

Unfortunately, these days the browser engine market is pretty lopsided so that strategy would need to be paired with something like a requirement to test in Gecko and WebKit because I trust Google’s long-term management even less than Microsoft.

If you want to use Windows outside of an air gapped environment, it’s reckless to use anything less than Windows 10, and even for that you have only about a year left unless you pay for extended support.

Also, as someone who actually uses Windows 11 Professional all day, every working day, I honestly haven’t encountered these adverts everyone is always referring to (maybe it’s because I’m not in the US).

As for the UI, initial release didn’t allow ungrouping of Windows on taskbar and context menus hid most things behind an extra click. This was crap, but a major update a while back has resolved these.

I’ve tried Linux, I occasionally need to use it or macOS for development of our cross platform Electron based product, and I would still choose Windows as it really has consistently “just worked” for me since around Windows 2000.

But if macOS or Linux works well for you, I’m happy you’re happy and perhaps you in turn could be happy for people who are happy with Windows (and ideally without thinking they must be deluded or something).

> The US government is 10% of Microsoft's annual revenue just on security services

How are you able to conclude that?

I assume it's the $20 billion in security services statement compared against their ~$200 billion yearly revenue. I'm not sure those security services are all for the U.S. govt though.

My assumption is that the revenue figure is not exclusively the US government spending. Otherwise what percentage of their yearly revenue is security services to all the other countries as well as businesses in the world? The US government is of course a large customer, but a considerable part of the world runs on windows and other Microsoft products.

"& up-level your IT department to be able to execute multi-year projects competently."

Cheaper just to pay up.

IME, paying up is HOW you level up.

The pay isn't great, but there are other structural issues when dealing with the federal government.

Your post is some sort of victim blaming, how would multiple vendors or a better price improve security?

Could be the opposite. Every provider is an attack vector of the government's network.

The problem is MS fucked up big time by not only losing a key but also that this key is a master key due to an error.

Not to mention they downplayed the problem afterwards and tried to charge customers for the logs needed to identify the attack.

The Pentagon can’t even pass an audit for the past 6 years, but yeah Microsoft is the national security threat.

What does one have to do with the other? It’s possible to have more than one threat.

Security is frequently only as strong as the weakest link. If you’re an adversary, would you spend more time on an org’a poor security practices (pentagon failing audits) or a more difficult software vendor?

The audits in question are financial. There’s no doubt some overlap with security – e.g. failing to replace out of date software due to financial constraints exposes them to risk – but it’s not a simple relationship.

That's not just a 6 years thing. The Pentagon has never passed an audit (the first Defense Department audit in its history was in 2017).

The Marine Corp actually just became the first military branch to pass an audit:

https://www.military.com/daily-news/2024/02/24/marine-corps-...

What do you think 'can't pass an audit' means in the context of the DoD?

At best, incompetence. At worst, corruption.

If so, you don't seem to understand why the DoD is failing to pass one, but are very well versed in the outrage you're supposed to feel when it does.

Care to enlighten me?

It's an enormous organization (one of the largest in the world) that is largely getting audited on physical objects that either spend 99% of their life sitting in stockpiles, or getting actively used and discarded.

Passing an audit isn't having its checkbook balanced. Passing an audit is like your employer delivering a full and accurate account of how many chairs it owns, as well as providing all the necessary paper trail for how all of them were acquired, moved, and discarded.

Doable in a 5-person company, or a 50-person company, next to impossible in a 5,000-person company, actually impossible in a 500,000 person company.

And the DoD has hundreds of thousands of different types of such items to keep track of, all of which were tracked by disparate physical-fingers-counting-stuff accounting systems, that were historically not up to the expected standards. Updating them and reconciling all of them is a long process, which the DoD is working through.

I hate war departments as much as the next liberal, but I also recognize that this is an incredibly difficult ask.

And that the failures are generally not caused by Lt. Billy Bob filching Stinger missiles to sell to some warlord in East Oblastan.

The grift in the DoD comes from contracts for buying more crap that it doesn't need, or for paying good money for contract work that doesn't get done (Iraq, Afghanistan), not from having stuff that was bought 'fall off the back of the truck'. The organization "has* an audit problem, but it's main issue is one of procurement.

Wow, thank you for the detailed write-up. Your points make a lot of sense and I do think the general hate for the military industrial complex makes people look at these failed audits as malicious, probably prematurely.

Do you think the Pentagon will be able to pass that audit anytime soon (within the decade)?

Negotiate? They even can regulate.

we have a company that has a monopoly that is honestly unimaginable (how does someone monopolize computation of all things...)

and we know that all monopolies require government enforcement to prevent others from competing...

then we know that there's no such thing as a conflict between Microsoft and the us government

the us govt is to serve Microsoft and that's that. any conversation like this about the merits of Microsoft as a market participant are laughable and disingenuous

theres no programmer alive that knows the history of Microsoft that would speak about them as you have just done, as an honest company trying to make a product

actually sick to see how HN has been corrupted

Then go after them for monopolistic abuses. Arguably Lina Khan is the first FTC chair to be making noise about it yet the only thing about Microsoft has been their OpenAI partnership because it's sexy & nothing about their traditional marketplace participation. The EU is going after them a bit more aggressively & having some success. Ultimately this would still be the US government's failings - claiming that makes Microsoft a national security threat is a joke & disingenous.

I know the history of MS anti-trust fairly well having grown up during the core part of their monopolist years - now they're part of the familiar oligopaly that's strangling tech.

> and we know that all monopolies require government enforcement to prevent others from competing...

Do we know that? That may be true of government run monopologies, but I'm pretty sure most marketplace monopolies rely on lack of government enforcement. For example, here's some analysis showing how US case law makes the government wary of going after Amazon for driving Quidsi out of business & forcing an acquisition by Amazon: https://cei.org/blog/amazons-private-labels-dont-threaten-co.... Ironically US does enforce rules against dumping from international players which shows that it realizes the harm that such activity can have, it just chooses to allow it for domestic players abusing smaller domestic players.

it's ok, they said they're "not a fan of microsoft", clearly that means they're not corrupted.

Reply on news.ycombinator.com