News for hackers. Stuff that matters.

A comment on The FCC.gov Website Lets You Upload Malware Using Its Own Public API Key. Parent comment

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by throwaway2016a on Thursday August 31, 2017 @10:07AM (#15140372)
On my team as a private company it looks like:

Dev: "Can I have a domain?" Me: "Sure" 10 minutes later done

In government I imagine you need a procurement order which needs to be approved. And my anecdotal experience has been that the dev teams don't always take high priority in those queues.

I'm sure it's not as hard as I made it out to be but it is certainly not as straight forward as many of us are used to.

[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by namdnay on Thursday August 31, 2017 @10:31AM (#15140566)
It's not really linked to private vs public. It's more of an organisation size question. I can guarantee that if you were working in a megacorp it would be the same issue
[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by 52-6F-62 on Thursday August 31, 2017 @10:36AM (#15140604)
I work in a megacorp. Can confirm. Have to file tickets, and they have to seek approvals for either delegation of server allotments and subdomains or new dns pointers or worse.

I regularly need to host internal applications accessible by other staff and often just do so from my machine during the daytime and send them updated IP addresses/ports where they can access them... boss didn't even think it was possible...

Yeah. I imagine the government processes are pretty convoluted.

[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by paulmd on Thursday August 31, 2017 @12:59PM (#15141742)
And this is how you get departments running their own infrastructure lava-layered over the top of the unresponsive corporate IT...
[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by 52-6F-62 on Thursday August 31, 2017 @05:20PM (#15144033)
Pretty much.

Some of the tools are temporary mind you, and it's much quicker to run the temp tool on my machine through the local network for a couple of weeks than to spend a few days waiting on resource allocation and then getting it shut down afterward.

Some of them are scheduled to be merged into larger projects that will seek out the necessary permanent resources... in time.

And things always take their time. It's my first excursion into such a large company and it is boggling at times. Things that would be small flaws in a smaller business are magnified 10, or 100x.

[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by spicyj on Thursday August 31, 2017 @10:48AM (#15140674)
I work in a megacorp. I'd expect it to take about a day (but of course we also already have domains for exactly this purpose too).
[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by jofer on Thursday August 31, 2017 @10:35AM (#15140595)
To be fair, at every large company I've ever worked for (mostly major oil companies, not tech companies) it's at least a two to three month process.
[ Parent | on HN ]
Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by Godel_unicode on Thursday August 31, 2017 @10:24AM (#15140510)
It's actually worse than you made it out to be. In order to buy a dotgov domain, you not only need your management's approval (and since it's "representing the department to the public" that chain goes very high up) you also need to convince GSA (the registrar for dotgov) that you have a need for a new domain. It's not fun unless you're 18f under the Obama administration, and they don't count.
[ Parent | on HN ]