nvas

Thanks, that's good feedback. I will make it stand out a bit more.

Can you elaborate? There is no requirement for an email sign up or any kind of registration.

Don't get me wrong, I really like the stuff you guys are doing, but I think 18F and the rest of the Gov operate in two different realms of bureaucracy and feasibility. Your management is on board with this stuff, while for the rest of the Devs in the government it's an uphill battle from the bottom.

There is still a large gap between software that is on the approved list and the stuff you use, but as I am sure we both know, there are waivers and blind eyes for that. If someone really wants it, it will happen.

You guys are paving the way with your tools and process. But, please be careful, one serious security breach and it's kaput. For example; the incident with slack. I know it was trivial and people chose to blow it out of proportion, but regardless, it will now be harder for me to get slack approved for our team.

The way I see it, there are multiple grades of free software. There is difference between downloading a linux distro or apache project and downloading some dude's python library from pip.

Any software used on government systems has to go through an accreditation process. This is to prevent you from pulling in some random code that may have security vulnerabilities or backdoors. Just because it is open source doesn't mean it is secure.

As an example, we've had to run security scans on jquery for god's sake and justify every occurence of random number generation to make sure it wasn't used for anything security related....

There are other things like warranty, support, size of the community, etc...

Overall, GSA is one of the best agencies when it comes to open source. It has definitely come a long way, but still a long way to go.

Lol, why don't we discuss it in the open?

I work in GSA as well, and I have a lot of trouble getting software approved that you use all the time, even getting nginx approved took a long time. Forget about vagrant, virtual box, recent versions of python, etc...

How were you able to get ATOs to operate most of your systems and work through these policies?