UK Government Websites Spewing Spam | Hacker News Reader

UK Government Websites Spewing Spam

shkspr.mobi

65 pointschoult14 comments

This is a fantastic anology for what is happening to the fabric of British society as the current government guts 20-30% from the budget of every public service.

It is interesting to contrast this situation with the influx of pay-day lenders offering APR in the 1000's % for small loans, while the government performs a complete dismantle of the welfare state under the cover of fiscal responsibility.

On the contrary, the fact sites like this exist is an indication public funds have been wasted on unnecessary, poorly implemented IT projects. Not that this is surprising.

This sounds like a sales opportunity for WPEngine or Flywheel.

Economic stimulus by the government that actually works?

Perhaps these sites should never have been setup. If they were valuable, someone would have noticed they had been attacked and would do something about it.

I don't know, there is a place for the low-value occasional use site.

Shouldn't those be static then? Not that Apache or nginx are safe to keep around for years without update...

There are many useful projects which run for a fixed term and which have an associated Web site.

The problem is that there isn't a formal plan for decommissioning the Web site - perhaps turning it into static HTML with an 'archived' banner at the top.

The problem with that is that you are then putting the onus on your users to act as your net-sec team. Basically, if your user base is unskilled to begin with (old or economically disadvantaged) and the sites that are targeted to them break, they typically don't know how to let someone know.

This isn't entirely the same domain, but I used to work on a lot of sites for the Dept for Education and the major problem is that people have awesome ideas for "engagement" and spend months or even years gathering support for funding. But that funding will only be for a specific time period. It seems obvious to anyone working in tech that a site needs ongoing support, but it's not obvious to funding panels who sign off the 18 month funding plan.

From a webhosting perspective, few people ever notice when their site has been attacked.

To a degree, this is by intention of those doing the attacking. They would rather have the site up and running, while the spam, code injection and backdoor can sit there earning them money. It's not until the spam causes damage (or is visible enough) that someone calls someone who is in charge, who in turn might hire a web developer, who in turn calls the hosting company in order to figure out that a 5 year old WordPress site that someone else put together has not been updated. Then it can take even longer until the new web developers has negotiated a price to fix the situation.

Plus the less extreme examples were comment spam, which is present on the vast majority of commercial sites generating millions, simply because the cost of removing or effectively filtering the spam exceeds the damage done by the spam (especially spam in the form of polite comments about how lovely the website is).

Members of the public would have to look pretty hard to find the majority of these issues: they generally don't view source code and and even if they searched kidwelly.gov.uk for viagra the spam pages aren't indexed.

According to the blog below, the problem isn't that no-one considers them valuable it's that there is no-one actually responsible for their operation and control.

http://shkspr.mobi/blog/2014/03/2000-nhs-security-vulnerabil...

Surely someone is signing off the hosting bill (even if it's one line item among many)?

Reply on news.ycombinator.com