Re:Public Money, Public Code
by HideousKojima on Wednesday April 27, 2022 @03:37PM
(#31184743)
My most recent job was for a local government, and even though I made a push for open sourcing our code, I never made much headway. Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file, so it could have been a bit disastrous if my efforts had actually made any headway
[ Parent
| on HN ]
> Plus, literally all of the other devs on my team repeatedly committed secure credentials to git no matter how many times I tried to teach them how to use a .gitignore file
Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?
Re:Public Money, Public Code
by HideousKojima on Wednesday April 27, 2022 @03:44PM
(#31184822)
>Why do they even need to have access to production secure credentials during development? Why not let them fall into the "pit of success" so local development never talks to a production server anywhere?
Because most local governments are 10 to 20 years behind on anything remotely approaching best practices. It wasn't my choice to run things that way.
If it's hard enough for to tech companies to hire skilled developers, I can only imagine what the bar is for public work. They might even resort to hire some brain damaged people.
Re:Public Money, Public Code
by toomanybeersies on Thursday April 28, 2022 @01:04AM
(#31188941)
Here in Australia, only citizens can work for the Commonwealth (federal) government. The end result is that, due to a lack of competition from immigrants, the public sector is basically just a jobs program for those too incompetent to work in the private sector.
The same thing happens in the US with any jobs requiring security clearance.
Re:Public Money, Public Code
by slaymaker1907 on Wednesday April 27, 2022 @05:39PM
(#31186149)
I'm not surprised. Even great devs sometimes slip up and when you have enough people, someone is always slipping up. The only real solution IMO is to have safeguards in place like credential scanning (ideally both locally and on the server). It's not foolproof, but it can help avoid or minimize a lot of incidents.