Hacker News Reader

Comment by austin-cheney | Hacker News Reader

The US government, especially the military, is largely allergic to software. This is slowly starting to change, but only in small pockets. I am aware of three software teams in the military but they are highly specialized with small dedicated customers.

I have tried several times to get Node.js into the military on approved software lists for internal development and its a huge struggle. I suspect the main culprits are due to valid security concerns regarding package managers like NPM and old ignorant thinking about open source being either immature or open software being a wide open exploitation vector. That is really tough because there aren't official binaries of Node without NPM and ignorant thinking about open source is really persistent.

View on HN

i can think of no act more deviously effective in bringing down the american empire than introducing the NPM ecosystem into its vital bloodstream, well played comrade!

If you had to select a single programming language, for US government agencies to use, which one would you pick?

go or java, in that order

Thank you for your reply. If you were asked develop a web application using Go, how would you go about doing it?

I would assume he would use HTMX, being the creator of it.

Thank you

Yeah, go w/ htmx + vanillajs (or possibly alpine.js or https://github.com/gnat/surreal) would be a reasonable option for many government projects. You can audit the htmx codebase and it is dependency free (same w/ alpine & surreal) and self-host everything, go compiles to a single binary for deployment.

To be honest, not having node.js on the approved software list seems like a pretty good idea.

Considering the military has an offensive cybersecurity arm, maybe they know more about node js and why not to use it than you might assume.

This is actually really scary that you want NPM in the military... Thank god that I trust - this was denied - smart move.

I don't. I want Node available to write systems automation without dependency on OS specific code. I don't need NPM to make effective use of Node.

But is node worth it without the npm packages?

I feel like it's pretty much one of the worst runtimes/scripting languages if you can't utilize it's ecosystem.

Yes, absolutely. I can manually import the 2-3 packages I regularly use. TypeScript, for example, has no dependencies. The only thing I would miss is ESLint which has a billion dependencies that I wouldn't bother with.

If you can piggyback on an existing system, you may only need to pursue using the RMF assess only process with the gaining system owner. Once the assess only process is approved, the hardware, software and PPSM in the gaining system would be updated to reflect the new components. Those approved software lists don’t get updated very quickly. Using an assess only process may move things ahead more quickly.

> I have tried several times to get Node.js into the military on approved software lists for internal development and its a huge struggle

What's on the approved stack? I imagine .Net and Java/spring are the standard, right? anything else like php, python, go etc?

Well NPM isn't really your problem there, the registry its targeting is and that's a firewall & config change, no need to block npm.exe.

I mean… open source IS suffering insecurity issues.

A lot of the supply chain failures I can think of, were open source projects.

I’m not saying node or OSS has no place, but there is more than something to do t being a security issue.

How many years was heartbleed exploitable despite “all the eyes on it”?

The good part about OSS is all the people that can review it, the bad part is all the people that can review it. Now… which one is more incentivized today ignoring a future military use?

It only works when assets are put into hardening existing code.

Sorry, but I'm glad they are not open to node. Why would you want node within the militaries network?

To quickly spin up OS-agnostic systems automation.

Reply on news.ycombinator.com