Should gov.uk run a bug bounty? | Hacker News Reader

Should gov.uk run a bug bounty?

shkspr.mobi

19 pointsedent36 comments

I think it's impressive how far they've come the last few years. Props to the gov.uk team if any of them lurk here, they even came and commented when the initial designs were posted here:

https://news.ycombinator.com/item?id=3811052

Yes, the probably eventually should, but given how we've gone from terrible websites by contractors to decent ones in a short time, I'm not going to start jumping up and down about it yet.

Although if they could get round to redesigning the 'gateway' crap sooner rather than later it'd be much appreciated. I have already been given 25 different gateway IDs.

I am and I'm not impressed.

Whilst the outcome is positive, the technology churn isn't. In fact, it's a right mess. They've ended up with a huge stack that doesn't need to be there. They're there to provide content efficiently, not redesign the infrastructure. They're using tech because it's cool and fun rather than suitable for the task and cost effective.

I know people are going to compare them to EDS and say "look how far we've come" etc but they are still spending public money and are not beyond scrutiny from us tax payers.

They're not a startup either. The ground they're standing on is different to what they think they're standing on.

Edit: downvoters, please at least have the honour to explain yourselves.

Having a central body which sets government digital policy on how to provide information across departments is great.

That they're doing a fantastic job of providing content to users efficiently, using appropriate technology and without favouring commercial solutions, is incredible.

Compare the clusterfuck that is http://www.cyberstreetwise.com. Contracted-out websites cannot match the quality and cost effectiveness.

I downvoted you because it's really very difficult to understand what you are actually complaining about: you are trolling.

I'm not trolling. I've watched them build their own stack, throw it away, build it again, throw it away. That's waste.

That is experimentation. Experimentation is a necessity and is a cornerstone of a good design. Don't you agree?

Yes and no. Some notes:

* Experimentation doesn't make it into production twice unless you're doing something wrong.

* There are proven solutions off the shelf both open source and commercial.

* They should be value driven rather than innovation driven. We aren't paying them to be a research agency.

* There is an ongoing maintenance cost and in-house only knowledge when you do an NIH job of something. That is not efficient.

It would be even more wasteful to build a stack, then even if it didn't work / new features needed to be added / old cruft needed to be removed / new devices and services need to be supported, just keep using and developing that stack.

It's called agile development, and it lets them respond quickly and efficiently to changes in requirements / mission.

See also: Facebook, Twitter, most other tech companies.

That's fine but the first iterations were because they fucked the requirements up. Regardless of Agile/not, due diligence when selecting products or deciding to write them is required.

Requirements, especially in government, will change quite quickly whatever you do, so I'd argue that fast agile development is more beneficial and cost-effective than slower development cycles.

Can you expand? Can you give an example of requirements changing quickly or frequently in government? Given that they're constrained mostly by budget and legislation I'd argue the opposite.

That notwithstanding, I'd also be very interested to know how agile is a panacea to fast-changing requirements, especially as opposed to techniques such as designing for change (at the architectural level, so not just the implementation level, i.e. loose coupling, encapsulation and abstraction interfaces).

How close are you to these guys? When you say "I've watched them build their own stack", are you referring to having read some blog posts, or do you know them personally?

The money that the fairly small team are spending is a drop in the ocean compared to many government funded projects. If you want to get angry about misspent public funds, I can think of countless other areas that are orders of magnitude worse. The reality is that a small team of people directly employed by the government working fairly effectively can build and discard their stack as many times as they want and still be significantly cheaper than getting a big company to do it.

I watch github, I watch their blog, I read interviews, I get the picture.

It's my job to look at dysfunctional teams both from a technology and a process perspective. I've seen teams like this many times before. They are expensive, inefficient and the return is considerably lower than the investment has promised.

Just because the historic approaches are worse doesn't exclude these guys from scrutiny. They'll quite happily piss £40k of dev cost up the wall while other departments are arguing over £200 ultrasounds for cancer patients. Scrutiny must be universal and unforgiving.

So long answer, short, you don't know.

I've not been watching them closely, but they are delivering, which seems an extremely strong indication they're not dysfunctional at all.

Every now and then I end up on a gov site they've redone and it's immediately obvious they've had at it because it's easy to use, responsive, etc.

You're sounding like one of those pointy haired bosses that don't understand that good developers play to succeed, and it doesn't always pay off. But if you stop them you end up with crap because the good people leave.

Got to say it sounds like you were pretty far away too, but the page loads quick so it is ok they redeveloped the stack with Ruby, Scala, Go, and when they get bored and want to learn Elixir or Erlang, maybe they rewrite it again. After all, it is only our taxes paying for it.

Sounds more like a pointy haired boss to me.

The criticism that I've seen recently was due to their choice of Go to implement a router to pass requests to the right back end application. According to their blog post this replaced a previous router written in Scala which nobody really understood. I think they received some criticism for being too quick to pick up fashionable new technologies which then had to be replaced because they were unmaintanable (the scala router).

The poster you're replying to is being very vague though, and I think the downvotes are probably deserved in that case. Either give concrete examples of why you dislike the way someone's doing something, or don't post.

That is the primary example I'm referring to recently.

There are many more. I'll write them up at some point.

The downvotes are no surprise. It's illegal so say anything negative about them, didn't you know?

Personally, I agree with you. I've had some experience of them, and was shocked by the general level of inexperience (they build web sites, with virtually no enterprise experience), the unwavering and dogmatic commitment to agile and open source (don't misunderstand me - both are good things but there are times where it just! doesn't! make! sense!), and the lack of security understanding.

UK government security in general has always been compliance-oriented. Want to run a system at a particular sensitivity level? Implement this checklist of controls. Security should be risk-based, and that doesn't happen. Not even at gov.uk.

Some of their exemplar projects have been running since 2011 and still aren't complete. But they're being heralded as poster-children of agile. So spin isn't limited to Whitehall...

The team is talented, without a doubt. It would be nice to see it mature.

The problem is they were all Rails Brogrammers, then they wanted to be Scala Brogrammers, and they were not good at either.

Waste of tax pounds!

That's what the devil on my shoulder said to me but they're just really too inexperienced to make a call on half of the stuff they do.

Ultimately this is probably because experienced people got better offers elsewhere.

As a UK tax payer who has to regularly interact with government websites looking for information I am very pleased with the ROI of this project. It's faster, smoother, better organised and less daunting to try to find stuff. It's not perfect but it's a truck load better than the previous versions and, if I understand the reporting, cheaper than outsourcing it via a tender process that would have landed up being built and then abandoned anyway.

No. They shouldn't. They are publicly funded so efficiency of cash flow is important. No reward should be required in this circumstance apart from perhaps an acknowledgement.

They should operate an open submission policy though i.e. a bug report form and actually feed back to people.

I can think of a purely utilitarian reason to offer a bug bounty: Getting paid a bounty directly by the government is easier and safer than selling an exploit to someone who will use it for criminal purposes.

Granted that in an ideal world this sort of incentive wouldn't be necessary, but if we lived in an ideal world, code wouldn't have bugs in it, too.

And another reason: If the government pays bounties for confirmed bug reports, a prospective reporter can have some confidence that they won't react to the report by taking punitive action, which might otherwise be a very real concern; HN periodically sees threads about employers and clients reacting extremely badly to unsolicited exploit reports, and the worst those can do stops short of imprisoning somebody.

Of course, all of this assumes a government not so sclerotic that it'll take an interest in fixing bugs without first having to be motivated by a horribly embarrassing public compromise, which means it's probably not going to work in the UK, or for that matter in the US either. But it's a nice thought, I suppose.

But in offering a bug bounty you will effectively give the okay for anyone anywhere to attack your assets. This would remove the ability to detect or easily prosecute attackers as up to a point the bounty hunters and bad guys will look exactly the same.

> They are publicly funded so efficiency of cash flow is important

Bug bounty rewards are orders of magnitude cheaper than the damage the bugs can cause.

If they have a bug report form at all and employ people to screen and respond to bug reports, the bounty costs probably wont even add up to the cost of 1 additional employee

Depends. In the UK we just wait for the minister in charge to resign. That's cheaper than a bug bounty :)

I disagree, when you understand the way UK government works, any compromises will be cheaper in nearly every case along with requiring no action on their part in the first place which is even better. Planning the creation of a team to handle this will likely run in to the millions before you've even begun, that is the way it works. And noone resigns they just go in to hiding for a while ;)

Do you think that private companies that use bug bounties are being inefficient then?

Probably but that's moot.

They're pissing away profit and investor's cash in private companies.

In public organisations, taxpayers don't get to choose if that money is spent or not.

I'm still waiting for a response on what sort of privacy analysis took place when they decided to use Google Analytics to track and analyse UK citizens interactions with UK government.

It still doesn't smell right.

Maybe there should be a public record of the bugs and who found them, something you could point to on a CV.

That could be a very interesting idea. I know Google run a Hall of Fame, and Facebook do something similar.

If bugs are an issue, why not get started and fix them?

* https://github.com/alphagov/

* http://alphagov.github.io/

* https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/

Looks great on your CV, you're helping your government do it right, everyone's a winner.

I'm not specifically talking about https://gov.uk/ but rather all of X.gov.uk - like HMRC, DWP, etc.

That said, is there a way on GitHub to privately raise a security related issue without the whole world seeing it?

Not that I'm aware, they should probably have a disclosure email address/policy

Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferred route would probably be to do that. gov.uk could have an email address that functions as the front end to a private bug tracker.

Many of them are now open source too:

* http://government.github.com/community/

For example:

* https://github.com/hmrc

Sure it's not everything yet, but it's progress. You can still reach the right people and get involved.

Reply on news.ycombinator.com