US Needs Secure Coding Office

Trailrunner7 writes "If the United States wants to remain competitive in the global economy and prevent widespread penetrations of its strategic, corporate, and commercial networks, enterprises and government agencies should stop relying on commercial software and go back to writing more of their own custom code. 'If we're going to maintain our place in the world, software is not a strategic problem, it is the strategic problem going forward,' security expert Marcus Ranum said in a speech Tuesday. 'Covert penetration becomes something that you think about on a five, 10, or 20-year scale. Why don't we have a government coding office? We have a government printing office. Why don't we have a strategic software reserve? Our own software is probably a greater threat to us than anything other people can do to us.'"

Comments

OpenBSD

[Anonymous Coward]

Hire the OpenBSD boys. They have a proven track record.

Re:OpenBSD

[K. S. Kyosuke]

No, that's called a frak record.

Re:OpenBSD

[abigor]

Unfortunately, they got fired: http://www.infoworld.com/t/platforms/openbsd-contract-suspended-due-world-events-727

Re:OpenBSD

[Anonymous Coward]

Hire the OpenBSD boys. They have a proven track record.

SELinux has a pretty good track record too, and they wouldn't even need to outsource.

Really that's what they ought to be doing anyway: Not rewriting internal government clones of proprietary software, but giving the spooks a mandate to improve the security of open source software, and then use that.

Re:OpenBSD

[OeLeWaPpErKe]

Why does one always find the argument "X must spend more on open source software" ? It's ridiculous, especially when, as usual, right next to "open source software is free !" ?

Re:OpenBSD

[daveime]

Open source software is free, retraining staff to use it is not. Neither is hiring uber-expensive consultants when something goes wrong (which in the case of OSS can actually mean the ONE person still involved who wrote some of the original source).

Don't believe me ? I worked for a travel company for about 10 years, and when we had some database optimization issues, one of the actual lead coders from the project came and spent 2 days in our office. Nice guy though, optimized our queries and indexes like you wouldn't believe. But the point is still valid.

Tinfoil hats

[Zironic]

Why don't we have a government tinfoil hat office? Clearly we're under great threat of alien mindrays.

Re:Tinfoil hats

[Z00L00K]

Already forgotten NSA?

In case you live in the US.

Anyway - if everyone uses the same software it means that everyone knows how it works which also means that more people are able to crack any security measures involved. This also makes it easy for people making malicious software.

A more mixed environment causes other types of trouble. So what's necessary is to find a balance between standard software and custom softwares.

Agreed

[geekoid]

In house software for government jobs is the way to go.
1) You own the code
2) You're goal is to have software that works for a long time. You vendor does not share that goal. They want you to rebuy software every 5 years.

3) It's a lot cheaper to maintain.
4) It's written to get a job done. Once that's done, you don't have to worry about some revising the requires new hardware.

Re:Agreed

[CannonballHead]

They want you to rebuy software every 5 years.

I don't disagree that many vendors do; but it seems in the past, that wasn't always the way it was, or something... because there are a lot of servers still running some pretty old software.

I'm thinking primarily of IBM stuff... but I guess IBM sold support, too, so they still got money, even if you didn't rebuy.

Re:Agreed

[Zironic]

It's clear you've never seen the government at work. There's two issues with the govenrment writing it's own software.

1) Each individual part of the government only needs custom made software once every 5 years or so
2) Every government in the known history of mankind has been utterly incompetent in cross-department communication

Since you can't reasonably expect the government to hire teams of programmers to write software one year and sit on their asses for 4 years while there's on demand and that traditionally trying to centralize the work leads to horror stories, you can see why most governments (even the socialists) have opted for contractors.

Re:Agreed

[lorenlal]

In house software for government jobs is the way to go.
1) You own the code
2) You're goal is to have software that works for a long time. You vendor does not share that goal. They want you to rebuy software every 5 years.
3) It's a lot cheaper to maintain.
4) It's written to get a job done. Once that's done, you don't have to worry about some revising the requires new hardware.

1) We own the government, so we all own the code?
2) It seems to me that vendors are more interested in selling you support for the software. That has no end of life.
3) Until the folks who wrote it leave for other jobs, and they leave behind all that lovely documentation....
4) Until someone makes new *faster* hardware that has no compatibility with the old hardware.

Re:Agreed

[sunderland56]

There's a third issue: salaries. Programming talent is used to silicon valley pay grades, not military pay grades. How many employees would be willing to leave their current position and take a 50% pay cut to work for the government? Would you be willing to trust the code of someone working for $40K/year?

Re:Agreed

[1729]

There's a third issue: salaries. Programming talent is used to silicon valley pay grades, not military pay grades. How many employees would be willing to leave their current position and take a 50% pay cut to work for the government? Would you be willing to trust the code of someone working for $40K/year?

Actually, there are a lot of government programming jobs that pay decently. I work at a government research lab, and the pay is competitive with industry (though no stock options, etc.), and I've seen a lot of FBI/NSA/CIA job postings for computer scientists that advertise 6-figure salaries.

Re:Agreed

[Anonymous Coward]

Federal IT workers do a bit better than 40k/year. Most enterprise level IT positions are GS12 or GS13, non-supervisory. That's a range of $68,809 through $106,369. More if you live in an area with a high cost of living.

Re:Agreed

[geekoid]

I did. I make less money, 75K as opposed to 120K, but I get more time to enjoy my life.
after 25 years, I was real tired of pointless 60 hour weeks and day long meetings.

You really don't understand people. I pity someone that places all value someone could possible have on their salary.

Re:Agreed

[jlechem]

Just for shits and giggles I looked at applying to NASA until I realized my starting pay grade was around 45,000 USD per year. It would be a huge pay cut and even if the cost of living was lower that's a big blow to the wallet.

Re:Agreed

[binarylarry]

Working at NASA is like working in the game industry, it's the coolest gig around and attracts tons of people which creates more competition and ultimately drives salaries down.

Re:Agreed

[geekoid]

1) Each individual part of the government only needs custom made software once every 5 years or so

False. maintenance is always an issue, no matter what software you have. #rd parties know this, that is why they make most there money off consultants you have to hire from then at 250 or more per hour.

"2) Every government in the known history of mankind has been utterly incompetent in cross-department communication"

Way to buy into a myth. This is false for two reasons:
1) it assumes that sort of thing never happens in the private sector
2) The US government does very well at cross communication. there are problems, but not as bad as people who sell solution would lead you to believe.

"Since you can't reasonably expect the government to hire teams of programmers to write software one year and sit on their asses for 4 years"
because the government would only ever need one application? and that application would never need new features?

Are you stupid or just blinded by fallacy's about the government you believe without question?

" trying to centralize the work leads to horror stories"
Only when centralizing work that should not be centralized. Usually done by people who don't understand how a government works.

"you can see why most governments (even the socialists) have opted for contractors."

no. The have opted for contractors becasue of political ideoolgy and ignorance, not for a trong business need.

For the record:
I worked in the private sector for over 25 year.
most of the was as a software engineer, programmer, analyst.
I have worked in the public sector for almost 5 years.

1) It isn't nearly as political as the private sector corporations
2) The people here have a breadth and depth of knowledge about the business you can't find in the private sectr any more.
3) the people I work with care and work hard to saver money and work efficiently
4) running a city is far more complex then you can imagine.
5) I work with programmers that could write circles around pretty much everyone else. Plus they document their work, and almost always write in a readable manner.
6) There is no 'up or out ' attitude. That means if you like you're job, you can keep doing it.

|

Re:Agreed

[mlts]

There is one thing forgotten. For the most part, US government "GS" jobs have job security. Unless someone commits a felony on the job, they know that their badge and CAC will work the next day. Private industry has higher salaries, but there is always the chance of being pitched out like last night's garbage if a PHB decides to swallow outsourcing/offshoring Kool-Aide.

And people know this. Government jobs have a lot more competition going for them than private jobs in a lot of places, from what I've seen.

Don't forget benefits. A $60k/year job may not be as alluring when one realizes that they have to spend $15k a year after taxes for health insurance for them and their family.

Re:Agreed

[Anonymous Coward]

6 figures.... No. If you look at the GS Scale, GS12-13 do get that high but that is nowhere near mid career level.

Re:Agreed

[bill_mcgonigle]

In house software for government jobs is the way to go. 1) ... 4) ...

You seem to have left off 'junkets to the tropics' from your list. Perhaps that was an oversight.

Re:Agreed

[Kaboom13]

That's an accounting problem, not a technical problem. It can be solved quickly and easily. Raise the pay to whatever is necessary to attract appropriate talent. HR departments across the world somehow manage to figure this out. I know government jobs are fond of pay grades and other such nonsense, but if our legislators gave a crap about the security and prosperity of our nation they could fix the issue in an afternoon.

Re:Agreed

[Bigbutt]

When I was working as a contractor for NASA, all of the Government computer jobs were contracted out (the "smaller government" initiative) so the people who were left could concentrate on the business of running NASA. This was through the 90's into the early 00's. Don't know how it is now.

[John]

Re:Agreed

[sparrowhead]

If you had ever worked with z/OS you wouldn't worry with old code; usually that's the watertight stuff. New software on the other hand seems to be written under more time pressure with less thought put into the maths and consequences on both existing and future code.

Certainly running mainframes isn't cheap, but if it's consistency and stability you're after, nothing can compete with that platform. And it's not like support contracts with IBM's competitors are a lot cheaper, in fact that's why IBM won the bidding in first place.

Re:Agreed

[Zironic]

It should be noted that I base this mostly of experience with the Swedish low level government, but I get the impression government work pretty much the same everywhere.

"Way to buy into a myth. This is false for two reasons:
1) it assumes that sort of thing never happens in the private sector
2) The US government does very well at cross communication. there are problems, but not as bad as people who sell solution would lead you to believe."

It doesn't matter if that sort of thing happens in the private sector or not, what matters is the number of bureaucratic loops you have to jump through to get work done (Though there is a lot of that for contracting private companies aswell). There's also the very common issue of "We're low on manpower right now, we'll start coding your project in 2 years".

"because the government would only ever need one application? and that application would never need new features?

Are you stupid or just blinded by fallacy's about the government you believe without question?"

Each individual part of the government usually only needs one custom application and it only needs to be updated if the law changes to such a degree the specification doesn't apply anymore (For instance if someone decided that from now on your social security payment should be a multiple of your IQ then then the department incharge of social security would probably need to have their software rewritten), the government as a whole does need a ton of software and the software developed by department of X in state A would probably work just fine in department of X in state B too but the problem is as noted that they have a hard time coordinating and just saying they should coordinate better doesn't mean they suddenly will.

"no. The have opted for contractors becasue of political ideoolgy and ignorance, not for a trong business need."
Are you trying to claim with a straight face that the social democrats use contractors for ideological reasons?

Re:Agreed

[DeadDecoy]

That's not exactly a good thing. I know a few friends that say the hours can be pretty brutal, especially around crunch time and you get paid on contract, so no overtime or pay if things go past their due date. I.e. you have to be extremely passionate about it because your quality of life will suck.

Re:Agreed

[Jawnn]

Socialist nonsense!
Why, the free market will take care of everything, including providing securely coded applications to government customers. There is almost no risk that any corporation large enough to be a "real" government contractor would cut costs on anything. That would be inexcusable. Right?

Re:Agreed

[Attila Dimedici]

There's a third issue: salaries. Programming talent is used to silicon valley pay grades, not military pay grades. How many employees would be willing to leave their current position and take a 50% pay cut to work for the government? Would you be willing to trust the code of someone working for $40K/year?

Currently in the U.S., government workers outside of the military are better paid than their private sector counterparts. I'm not sure why you think this office would be paid according to military pay grades.

Re:Agreed

[Anonymous Coward]

> I've seen a lot of FBI/NSA/CIA job postings for computer scientists that advertise 6-figure salaries.

A good computer scientist is not necessarily a good programmer, let alone a good software engineer.

Re:Agreed

[tepples]

1) We own the government, so we all own the code?

Correct. Unlike a few other countries, the United States Government releases all of its own work to the public domain. This includes VistA CPRS, a digital medical record system originally developed for use in veterans' hospitals.

Until someone makes new *faster* hardware that has no compatibility with the old hardware.

If you have the source code, you can port the old software to run on the new hardware. In the worst case, you could wait for five years of Moore density doublings and emulate the old software.

Re:Agreed

[timeOday]

Currently in the U.S., government workers outside of the military are better paid than their private sector counterparts.

Cite?

I do hear a lot of complaints about overly generous govt. pensions, but it seems to me those are often offset by sub-par salaries and bonuses.

Re:Agreed

[DamnStupidElf]

Hardware-wise, I'd like to see TPM hardware that is made in the US, and supervised vetted from the ground up by DoD employees. This won't completely stop any backdoors, but it would lesson the chances of some added "functionality" on a chip appearing from the fab out of Shanghai when it shouldn't be there (such as storing keys unencrypted for later retrieval via an undocumented command.)

Every TPM chip stores its endorsement key unencrypted, otherwise it would have the functionality of a brick.

Re:Agreed

[Attila Dimedici]

http://www.usatoday.com/news/nation/2010-03-04-federal-pay_N.htm Here is a cite for you. There are many more, but I will leave that research to you.

Re:Agreed

[timeOday]

Thanks, that is interesting, and the general finding is that federal workers earn significantly more than counterparts in private industry. The story even does a decent job of covering some caveats, which include: the comparison is apparently not adjusted for years of experience; state and local workers show the opposite trend, they make much *less* than in private industry; and even in the federal government, "computer support specialist" is an exception to the rule, averaging $54,875 in private industry and only $45,830 in federal govt.

Re:Agreed

[elnyka]

> I've seen a lot of FBI/NSA/CIA job postings for computer scientists that advertise 6-figure salaries.

A good computer scientist is not necessarily a good programmer, let alone a good software engineer.

But most of the time, bad software developers (let alone bad programmers) were never good, or even decent computer scientists to begin with. It takes a unique mindset and analytical skills (and/or abundant exposure to programming-related technologies such as in a *good* MIS program) for someone to be a good programmer and software developer without being a computer scientist.

And for the type of jobs for which the article concerns itself, we are usually talking computer science related work (or at least heavily influenced by computer science topics.)

Re:Agreed

[elnyka]

6 figures.... No. If you look at the GS Scale, GS12-13 do get that high but that is nowhere near mid career level.

By mid-career level, salaries tend to be in the very high 80's, low 90's. The % of difference (and the tax ranges) make a 8-10K difference to a 6-figure salary to be not that strong (compared to $70K vs $80K).

Also, by mid-career, when working intelligently, we are talking perhaps 7-8 years of *relevant* experience (or 5-6 with a good MS degree). By 10+ years, one should have enough experience to work at a senior level (be it in the government, defense or public sectors.)

10 years at work get by really fast.

Where's the USDS/W?

[Anonymous Coward]

We have a US Dept of Agriculture (USDA) because agriculture is a essential part of our nation's prosperity and well being. In this day and age so is software.

Having said that, I'm a little skeptical that the gov't could be as effective at being a source of knowledge, studies, research and tools in the realm of software.

Re:Where's the USDS/W?

[Zironic]

We don't make enough food, we starve to death, we don't make enough software we.......?

At the end of the day software is just yet another export product, while it would be bad for the economy if the software industry wasn't competitive (just like it would be bad for the economy if the car/toys/foresting industries wern't competitive) the country doesn't literally die if it fails, you'll just have to live with it being slightly less prioritized.

Re:Where's the USDS/W?

[BrotherBeal]

we don't make enough software we ......?

... have to go outside for a change?

Re:Where's the USDS/W?

[jasmusic]

And Democrats have placed it beyond all doubt. The feds are great at one thing: destruction. Hence they're given the war power. And not a whole lot else.

Re:Where's the USDS/W?

[Ephemeriis]

we don't make enough software we.......?

It isn't a matter of making enough software. Nobody is suggesting that the government code up five different word processing packages and sell them to the highest bidder. It's about knowing that the software running our essential government functions is reliable.

At the end of the day software is just yet another export product

No it isn't. It's a tool that lets people get their jobs done.

the country doesn't literally die if it fails, you'll just have to live with it being slightly less prioritized.

Depends on what fails.

If the word processor on some senator's desktop dies, I doubt if anyone is terribly inconvenienced.

If something big and important breaks at the IRS, it may very well be a very big problem.

Software used for essential functions of the federal government probably shouldn't be off-the-shelf. It probably should be somehow verified or authenticated. It might be a very good idea to bring the development of that software in-house, rather than to outsource it. Because if that software fails badly enough, it can render those essential functions essentially disabled.

Why bother flying a plane into a building if you can do as much, if not more, by simply breaking a bit of software?

Re:Where's the USDS/W?

[Bing Tsher E]

If something big and important breaks at the IRS, it may very well be a very big problem.

True. Taxes wouldn't be collected and the economy might even grow. Very big problem, grasshopper.

Re:Where's the USDS/W?

[strikeleader]

What's even more amazing is that you have been convinced by the Democrats that it is a flimflam by the Republicans. Seriously, what is the government efficient at?

How does that koolaid taste anyway?

Re:Where's the USDS/W?

[Tubal-Cain]

We don't make enough food, we starve to death, we don't make enough software we.......?

Not quantity. Quality. It's about not being driven by the whims of software companies.
No planned obsolescence.
Able to patch a security hole in $OLD_VERSION rather than installing $CURRENT_VERSION on every PC in the office.
Not needing to change document formats every few years.
That sort of thing.

Re:Where's the USDS/W?

[geekoid]

fall back into a 3rd world, fail to be able to support are current society, and loose are place at the big boys table.

IN general, the US provides plenty of food. We are now past that.

Re:Where's the USDS/W?

[Zironic]

Because inhouse software is famous for being so much better in those respects?

I don't know how it works in the US, but in Sweden when the government needs some sort of custom software made they write down the exact specifications they want and get it ordered. That is as far as I can tell the exact same process you'd go through when ordering it inhouse.

It's irrational to believe that the contractors would be any worse at writing the code then inhouse.

Re:Where's the USDS/W?

[Tubal-Cain]

Either option is better than off-the-shelf.

Re:Where's the USDS/W?

[sheph]

Clearly you've never seen Live Free or Die Hard. Our critical infrastructure is highly dependent on computers and the software running on them. Imagine not having power, or water, or natural gas, and all of the traffic signals down at once. Chaos would be the rule of the day. While it's not food it's not insignificant either.

Re:Where's the USDS/W?

[sheph]

Are you sure it's republicans that have that market cornered? When I hear about $800 hammers, planes that are purchased and then destroyed before they're even used, stand in line at DMV, or try to get a passport it get's pretty clear. I don't need anyone to convince me that the government lacks the capacity to do things efficiently. I can see it for myself.

Re:Where's the USDS/W?

[Zironic]

That really depends on what you're trying to do. I think it's ludicrous to expect the government to write it's own OS/browser/text editor. When you're doing some generic task then generic off the shelf software is best for the job. Custom software is only viable when you're doing something rather specialized.

Re:Where's the USDS/W?

[Tubal-Cain]

Fair enough.

Re:Where's the USDS/W?

[xclay]

They will be a source of knowledge, studies, research and tools in how to keep itself alive rather than be at the forefront of the technology. I don't understand why you would want more red tape and not less? I think this is a ludicrous idea, especially coming from a supposedly intellectual on the net. Progress has been made admittedly both by commercial, entrepreneurial efforts as well as cooperative efforts of people who are genuinely passionate about this stuff. You throw a government in there, and the hearts of all this highly idealized and motivated individuals will freeze over unless we have a reformed perception of the role of the government in this type of thing. Don't you remember the recent public reaction to gov't agencies having mere "access," albeit hidden, to our private information? And they (such as CIA/FBI) aren't even in the business of sharing information with others or selling our private information like Facebook is.

Re:Where's the USDS/W?

[DamnStupidElf]

The military industrial complex is inefficient. That's no secret. The DMV is quite efficient; look how many citizens they can serve at once with only 5 low paid FTEs in the whole place! You reap the rewards of that efficiency with your relatively low tax rate and you only have to put up with a little inconvenience for the savings. Low wait times aren't efficient. They're expensive because most of the time there are workers sitting idle.

What?

[fahrbot-bot]

1. Why don't we have a government coding office? We have a government printing office.
2. Why don't we have a strategic software reserve?

1. Why indeed, Marcus, "coding" and "printing" are so similar.
2. And the shelf-life of that software "reserve" is...

Re:What?

[K. S. Kyosuke]

2. And the shelf-life of that software "reserve" is...

At least a few decades, isn't it? At least Maxima, Emacs and others work perfectly on my modern PC.

Re:What?

[Ephemeriis]

1. Why indeed, Marcus, "coding" and "printing" are so similar.

Sure, the end products are pretty different... But most folks just buy off-the-shelf paper for their needs. Or maybe outsource the custom printing to someone else. Just like most folks buy off-the-shelf software or outsource the custom coding to someone else.

If you move enough paper... Or have unique needs... Or are concerned about the authenticity/security of your printed documents... Then moving it in-house makes a lot of sense.

Similarly, if you use enough code... Or have unique needs... Or are concerned about the authenticity/security of your code... Then moving it in-house may make a lot of sense.

2. And the shelf-life of that software "reserve" is...

Theoretically infinite.

Oh, sure, there'll be new hardware... And new requirements... And new features...

But once you've got a piece of software that actually does what you need it to, you can keep using that pretty much forever - unless something forces you to make changes. If it's your own code, you choose when to make the changes and how significant they're going to be. If it's somebody else's code, you upgrade when they tell you to.

There's plenty of software out there that's been running just fine for the last couple of decades.

Re:What?

[fahrbot-bot]

At least a few decades, isn't it? At least Maxima, Emacs and others work perfectly on my modern PC.

I would argue that the more general the software, the longer the shelf-life, the more specific the shorter. The main reason for in-house (or custom) software is specific purpose application. The two examples you provided have very general use - in the sense that Math and editing are general and constant over the long term. But, for example, network / system monitoring or battlefield management software is more specific and will need more frequent updating to be useful.

Re:What?

[aztracker1]

Don't you mean vim? Because vi just wasn't good enough. I jest though. I do think that a certain amount of software development in the government should be brought in-house, or at least made public. The same should go for K-12 educational materials for general subjects as well though. The fact is, as long as there's lobbyists it won't happen that way. Also, I don't know that it *should* happen that way. FYI, there already are a number of software developers in-house. And the IRS examples in terms of failure, much of those systems are developed by employees of the IRS.

Re:What?

[OldSoldier]

2. And the shelf-life of that software "reserve" is...

At least a few decades, isn't it? At least Maxima, Emacs and others work perfectly on my modern PC.

And I could argue that for software created today it could be much longer. Many things seem to have stabilized or at least compartmentalized their growth. Think air traffic control. IIRC the machines they run on now are 20+ years old as is the software. Not only that the scale of the problem has grown significantly from 20 years ago, but will we see that same growth in: computer performance, software tools and air traffic in the next 20 years? Probably not. Again, IIRC reliance on radar for air traffic control may be on the way out, but realizing that sort of modularity, seems like you could design a system where a GPS module could be added with much less pain than re-writing the whole system.

Re:What?

[Bing Tsher E]

If it's somebody else's code, you upgrade when they tell you to.

Where do you get this idea? Upgrades are not mandatory. They're often not needed at all.

I don't upgrade my electric pencil sharpener or file cabinet every time a new model comes out.

Re:What?

[Ephemeriis]

Where do you get this idea? Upgrades are not mandatory. They're often not needed at all.

Obviously it depends on the software...

Nobody is going to force you to upgrade the copy of Microsoft Word installed on your home computer.

But the HIS software we run at work has to be at the latest version if we want to be able to receive support. And support is kind of a big deal for us.

Re:What?

[astar]

shelf life is a good point

If you want to consider software that is immeadiately vital, you would look first at software that was directly embedded in the physical production process. Just looking at current popular concerns that match this, consider electrical utilities and freight transportation.

If you are looking at electrical utilities, you see 50 year old software, which is pretty good for a shelf life.

On the other hand, in a sensible society, you produce a lot of machine tools, and you make lots of continuous improvements. So the shelf life of the controlling software is real short. And putting a government critical path component in gives me lots of warm fuzzies (NOT).

So I guess you could play programmer licensing games and so on. So we might know more than we did about programming than 50 years ago, but if you eliminate all the current fads, what do we really know and how often do we really apply it? So what body of knowledge do you base compentcy (spell) for licensing upon?

acm sometimes has occasion to make official statements on licensing issues. For some reason texas get this in their head every once in a while.

I suppose I should mention that proveability approaches get a little further along over time. I recall that somebody recently managed to prove a microkernel. At the present time, I suppose we could talk about some sort of proven components to use when possible, maybe government generated. But last I looked you almost had to have special languages.

Re:What?

[sheph]

LOL!!! Now you did it. Hope you brought your fireproof suit.

Poor comparison

[Dan East]

"Why don't we have a government coding office? We have a government printing office."

That comparison is ridiculous. A proper comparison would be "We engineer our own government printing presses and copiers, why don't we engineer our own software?" But of course the government doesn't engineer printing presses...

Re:Poor comparison

[Ephemeriis]

That comparison is ridiculous. A proper comparison would be "We engineer our own government printing presses and copiers, why don't we engineer our own software?" But of course the government doesn't engineer printing presses...

We do engineer the documents though. We specify what kind of paper, what kind of markings, what kind of anti-forgery devices.

Of course, I was under the impression that we also specified what kind of code to write... Is this no longer true? Is the government just basically buying off-the-shelf software these days?

Does Intuit make some kind of IRS Edition of QuickBooks?

Re:Poor comparison

[blueg3]

In general, we don't specify strong enough requirements and we don't do sufficient validation. Of course, validation of software is hard when you have the source and is nearly impossible without it.

Re:Poor comparison

[obi1one]

I dont think he meant that all software used by the government must be built by the government coding office, but rather that all software created for government should come from the theoretical government coding office. If that is what he meant, it makes sense to me. Most shops wouldnt let the marketing department, for instance, hire a group of programmers to build some software for them without at least involving IT, and really most shops would require that the software be created by developers in the IT department. Having programmers or contractors working for every government agency imaginable, reporting to people who dont specialize in managing software development, is silly.

Re:Poor comparison

[phantomcircuit]

Actually yes there was a big push for COTS software in government a whiel ago. The idea was that it would reduce costs, but it was a short term cost reduction with a long term significant cost increase. The problem is that those doing procurement often are not responsible for long term negative effects, because they will be long gone.

Re:Poor comparison

[ClosedSource]

That assumes that there are developers in IT.

Re:Poor comparison

[Anonymous Coward]

America used to custom engineer everything, but then commercial companies beat the pants off the custom stuff in categories like features, ease of use, and cost. Then the mantra became Commercial Off The Shelf. http://en.wikipedia.org/wiki/Commercial_off-the-shelf

It's still a tremendous ripping pain to do business with the government, so most companies won't bother. See for example http://www.governmentcontractslawblog.com/2009/02/articles/country-of-origin/new-rules-for-commercial-offtheshelf-products-exempts-baa-components-and-exempts-recycled-content-reporting-requirement/

Re:Poor comparison

[scamper_22]

There are two issue here.

1. Worrying about security threats in closed source software. I'm apt to dismiss. Not because all commercial software is secure or anything. Just that I don't see the government producing anything more secure than Red Hat, Microsoft, Google, Qnx... could not develop on their own and the government can audit it if they want.

2. Preserving technological know how. I'm much more sympathetic here. There are certain industries where you have to have it to have more of it. The old analogy is that you need to keep your military manufacturers alive by ordering from them regularly. If they go broke, that knowledge and process is gone. You can't just restart submarine building on a whim when war breaks out. You need your engineers, assembly line workers... all ready and trained. I'm an engineer, but I certainly wouldn't have any clue how to build a military sub without being in the field. Similarly, with software, the industry and know how needs to be there. This is why Silicon Valley is still so dominant. That's where the trained talent is. The US needs to maintain a critical mass of trained talent in all these areas for improvements to be made in these areas.

But again, this is government trying to push a monopoly position when what is needed is better trade and profession policies. Things like certain software must be written by US engineers; just like working in the US legal system requires you to be a US lawyer. Maintenance of code must also be valued. Every piece of software in use should have maintainers tied to it... For government projects, it can demand open source...

Writing code is error-prone and expensive!

[Anonymous Coward]

Writing code is fundamentally error-prone, and expensive! Programmers, young and experienced, make mistakes. Young programmers in particular overestimate their abilities, and wildly under-test, and pretty much totally fail to think about compatibility or vulnerability. Proper management to enforce testing, reviews, documentation, security, etc. is very expensive. And once you've written the code, the marginal cost of sharing it widely is very low ... which is why I believe that this proposal will fail: it will always be cheaper to use either commercial code, or open source.

Re:Writing code is error-prone and expensive!

[TheKidWho]

Who says the government code wouldn't be open source?

For the people, by the people eh?

Re:Writing code is error-prone and expensive!

[ducomputergeek]

However, for security reasons, the software has been declared secret under the states secret act.

Re:Writing code is error-prone and expensive!

[dwiget001]

Not necessarily, take SE Linux, for example.

Re:Writing code is error-prone and expensive!

[Skapare]

So ... you are saying ... software is hard to do, so let's go to the least reliable source for it ... ?

Both commercial software (off the shelf ... COTS) and open source (also off the shell ... FOTS) are full of bugs. At least open source is subject to peer review (in a wider peer space) and gets bugs fixed sooner (there's rarely a coverup of bugs in open source, unlike commercial).

One big problem is that the internal review process, that still has to be done inside the government, will be weaker at this job because the people who would know how best to do that won't be working in the kinds of jobs that would be in a track to the analyst positions that can do these reviews. At least one reason to have an in-house programming team in the government is so that some of them can move up to being top level analysts without being biased in favor of certain commercial interests.

Re:Writing code is error-prone and expensive!

[Chris Tucker]

And the problem with capitalism is that eventually, the government runs out of money to give to the wealthy.

Because we don't need one.

[ADHVfFsvjLIViaglKlqo]

We have Halliburton.

Re:Because we don't need one.

[Nadaka]

I've seen some of the code produced at big shops like that. Not Halliburton, but Northrop Grumman started the project I am currently working on. After they lost their last round of bidding, my employers company picked it up. They lost for very good reasons. We inherited unbelievably bad and broken code.

Re:Because we don't need one.

[Bing Tsher E]

By definition you've only seen the bad code that comes from such outfits. As so, you don't have a full picture of the quality of code from 'big shops.'

Just what we need ... bring back Ada !!!

[rimcrazy]

That worked so well, I mean it's just ubiquitous now with overwhelming support right?

Re:Just what we need ... bring back Ada !!!

[darkstar949]

It may be a niche language, but it's still really good in areas where safety is a concern. The 777 uses it for the control software - http://www.adaic.org/atwork/boeing.html

Re:Just what we need ... bring back Ada !!!

[TrashGod]

Yes, it works well, and an implementation has been part of the ubiquitous GNU compiler collection for several revisions: gcc.gnu

Re:Just what we need ... bring back Ada !!!

[tiptone]

For what it does, it's the absolute best tool there is, hands down. I hardly think it's the fault of the language that it hasn't seen widespread acceptance. If you look at where it has been accepted, and what it's doing there, it's obvious why it was chosen. I think lots of folks learn C/C++ first (or, $diety forgive Java) and poke around at Ada and find it's "hard to get things to compile".

Re:Just what we need ... bring back Ada !!!

[glwtta]

The 777 uses it for the control software - http://www.adaic.org/atwork/boeing.html [adaic.org]

Just goes to show that these guys don't take security seriously - that should at least be Boeing 775. This is just common sense, there is no excuse for such sloppiness.

While you're at it

[trifish]

Don't forget about hardware.

Oh, wait...

Haha, software is the anwser to it all?

[Anon-Admin]

Having worked in government IT, and worked for government military contractors I dont think that the software is the issue.

I would start by upgrading all the equipment that went EOL (End Of Life) more than 5 years ago! (90%+ of the hardware they run)
Then move to the equipment that is EOL now.
I would then work on implementing a proper patching and patch management plan.
Documentation would be useful as well, Stop expecting the new IT staff to understand how AIX v3 works on the H50's you are running. Especially when the old IT staff thought it was good security to replace the login with one that used a password file stored in the /var/log directory.

Security through obscurity is all that would happen if the government tried to make all systems code come from an internal group. I am sure we all know how well that works!

I say mandate that the government groups run only opensource software. Then hire select coders to quick patch any problems or security issues that are found and make the parches available to everyone. That way the government can be secure as well as any other company or person that runs the same software.

Re:Haha, software is the anwser to it all?

[mlts]

Eek.... 3.2.5.x? That should have been killed off with a flaming chainsaw a decade ago. Heck, even an old 220 with the abacus in the back would run 4.x without issue, much less a vintage H50 still in the rack.

Here is what I'd do (assuming a perfect world):

In the hardware department, I'd see if the old AIX machines can't be upgraded (I've seen some embedded applications that depended on a hardware/OS stack which could not be upgraded without a complete retool of a lot of physical robotic hardware, so even though they were running an ancient version of an OS, it stayed.) If they can be upgraded, I'd just yank the H50s out, drop in some modern iron, and carve out LPARs. I'm sure that even a small chunk from a modern POWER6/POWER7 box would do the job.

In the process department, I'd drill into people's heads that doing a job is half the battle. The second half is documenting what was done. This can be leaving proper comments in code if in a development house, or a decent changelog if in IT.

There is one thing I have encountered though which may be a hard political battle, regardless of if you are in the public sector, academia, or the private sector: Programmers who deliberate obfuscate code and go as far as to leave misleading comments in order for them to have job security. This used to work in the past, but these days, PHBs will just ask the friendly offshoring firm to either fix that for a relative pittance, or just have the module recoded, new bugs and all. I have seen some companies pay for a total rewrite of core code just so they can be free of someone who does this.

Re:Haha, software is the anwser to it all?

[mlts]

I've seen people do the same thing but with hostnames. And because the in-house apps had the names hard-coded, it was well nigh impossible to change them. At least adding proper names in DNS helped mitigate that a bit once I convinced the PHBs that naming the DNS servers "dns1" and "dns2" instead of zwerty and azerty (not using the real hostnames) were not going to have any impact to the security of the institution.

This idea is dumb.

[Maxo-Texas]

A better idea would be to have an office that analyzes the code of existing software for security issues, develops solutions, and hands them over to the software owner.

Owner doesn't want to share the code? Don't use their software for government work.

But redeveloping from scratch at this point does not make fiscal sense any more. We stand on the shoulders of 30 year tall giants. There is no need to rewrite the TCP IP stack from scratch, to write a word processor from scratch, to write a web server from scratch, etc.

Re:This idea is dumb.

[Ephemeriis]

Meh.

Just mandate genuinely open source software for all government work.

You don't have to rely on your government to analyze code and submit the fixes back to the original author - anyone can look at the code. And you don't have to rely on the original author to incorporate the fixes - anyone can. And you don't have to trust that the binaries you're running actually match the code you're looking at - just compile your own.

The big problem with all of this isn't necessarily that the code is crap or anything like that... It's that the stuff is closed-source. We're basically trusting that the code does what it is supposed to, and we've got very little ability to verify that.

Re:This idea is dumb.

[PeterM from Berkeley]

Having an agency which uses public dollars to enhance and secure open source software for use both within Government and for the public at large makes a huge amount of sense. It's important that the Government not *own* the code, just provide patches/alerts to the project leaders, and customizations for internal Government use, as needed. (The reason for non-ownership is because, well, who *really* trusts the Government?)

In this way, software could become a public good and much cheaper in general rather than a profit center for a few companies and a millstone around the necks of most companies.

--PM

We do

[greenbird]

Why don't we have a government coding office? We have a government printing office. Why don't we have a strategic software reserve?

We do. It's called open source. And it's run by a militia just like the one that started this country.

Re:We do

[Em Emalb]

What? Open Source Contributors are the same as the standing militia from when this country was founded?

Holy shit, that's insulting.

Re:We do

[Anonymous Coward]

A bunch of anti-royalist terrorists.

Re:We do

[geekoid]

This country was not started by a militia, you idiot. It was started by people who managed to sway the public to march and die for a cause that really didn't exist.

Re:We do

[greenbird]

A bunch of anti-royalist terrorists.

More like a bunch of anti-Corporatist terrorists. At least if you ask MS or some of the other Corporations that are ruling this country.

Re:We do

[greenbird]

The people who do open source are decidedly not like the founders of this country, whose primary beef was taxation without representation and the continued stationing of British troops here--in people's homes no less.

I think it's far more similar than you give credit (Microsoft Tax). Proprietary code, formats and protocols encumbered with anti-capitalist monopolist IP protections versus open code, open formats and open protocols that allow capitalist competition based on products meeting consumer needs. The incumbents in the tech industry, just like those in the content creation industry, are trying to use anti-capitalist IP laws to control the industries so they don't have to compete in the new technologies that are making their old products and ways of doing business obsolete. And in creating those laws the government sure as hell isn't representing the people.

Re:We do

[religious freak]

it's run by a militia just like the one that started this country.

I thoroughly and truly appreciate the contributions you and others make to the open source community, but you sitting on your fat ass writing code eating Cheetos is NOTHING like the men who marched hundreds of miles only to die in fields cold and lonely, for the independence of the United States. Get over yourself dude.

Re:We do

[greenbird]

Get over yourself dude.

Hmmm...I don't recall mentioning myself anywhere in any of those posts. I was just comparing the situations and remarking on the similarities. This battle is just starting though. We haven't even really reached the "tea party" (no reference to the recently established political movement) stage as of yet. Hopefully the democratic processes set forth by the sacrifices of the ones who created them will allow it to never reach the stage of marching and dieing. Oh, and I'm not fat and I did my 4 years in the Infantry. How about you? I do love Cheetos though. Puffs, not the really crunchy ones.

What the hell is a strategic software reserve?

[Nadaka]

Seriously. WTF. How can anyone ask that question and expect to not be laughed at.

Re:What the hell is a strategic software reserve?

[robot256]

The only thing it could possibly mean is a reserve of *coders* ready to jump at any problem or bug that arises. Oh wait, that's called the NSA. Just need to give them more resources and jurisdiction to fix any code anywhere in the government. That'd work great:

Setting: Nondescript cubicle farm full of people working an eating donuts.
Cubicle farm is suddenly stormed by a SWAT team with M16s and tablet PCs.
Team leader: "Everybody freeze! Hands off the keyboards! We've detected a buffer overrun condition! Move, move, move!"
Guys with tablets rush to the PCs and networking closet and start typing like mad. Soldiers round up all the people into the middle of the room.
A five-star general walks into the room.
General: "What's going on here?"
Team leader: "Sir! We're neutralizing a threat in the PR office happy-hour scheduling system. We should be finished soon."
General: "Good. I'll want a full report when this is over. We need to catch the idiot who's responsible for this."
A soldier escorts an intern with hands behind his head to the leader.
Soldier: "This guy did it. We found non-compliant source code on his machine."
Team leader: "Good work, sergeant. Hand him off to headquarters at 1300."
General: "Glad to see that was taken care of quickly."
Team leader: "All in a day's work, sir."

Re:What the hell is a strategic software reserve?

[emmons]

A 5 star general? We haven't had one of those since the Korean War. Security bugs in the PR office happy-hour scheduling system must be a big deal!

Re:What the hell is a strategic software reserve?

[microbee]

I would think that as a huge pile of Windows XP DVDs..

You mean like Magic Lantern?

[SteveFoerster]

We've had this. It was called Magic Lantern. Really, I think we can do without any more of it.

And where will the secure coders come from?

[SirGarlon]

I concede the point that government and industry are awash in misconfigured, insecure, and buggy code. However, I fail to see how developing more code in-house will result in code that is more secure and less buggy. Where will the expertise in secure coding come from? From TFA:

As a result, there are fewer and fewer people inside the agencies who understand what it takes to write and deploy good software.

So, if that is true, how exactly will it coding in-house help? There's no one in-house who can do it right and that's the whole problem!

Ranum's thesis seems to be "contractors suck" but buried in his article is the kernel of the real issue in my opinion: project managers don't understand security and aren't accountable for making their products secure. If they did and they were, we would get more secure code regardless of whether the development were in-house or outsourced.

So Ranum seems to think that the solution is to create more government jobs (maybe he wants one or something), but really I see this as a management challenge. If large institutions can set a priority on security and develop expertise in their managers, then I think the picture will start to look better. Until that happens, I don't think playing musical chairs with the development team is going to help.

What Ranum is proposing is simply yet another fake silver bullet.

Putting the cart in front of the horse

[MikeRT]

Using the federal government as an example, Ranum pointed out that many, if not most, of the internal software development groups that used to exist in federal agencies are now largely gone. In their place now is an army of contractors doing much the same job, but with a couple of important differences. Because the internal development teams no longer exist, the contractors are reporting to program managers instead of managers who were developers themselves.

As a result, there are fewer and fewer people inside the agencies who understand what it takes to write and deploy good software. And the software they're getting is costing several times what it used to because it's coming from contractors rather than internal employees.

Contractors are favored by the federal government mainly because they can be hired and fired more easily than employees. Big commercial contractors are favored because they are the ones most capable of jumping through the flaming hurdles that the feds put up to keep up the appearance of saving tax money. The solution is simple: change the damn laws and regulations so that they can be easily hired and fired, and any 1099 can big on a small project without being an expert in government processes.

Re:Putting the cart in front of the horse

[geekoid]

A) You generally need a history of bad work to get fired. This is true. I also think this is generally how it shoudl be everywhere.

Before we had laws to protect people, it was like that. people could hire and fire for any reason. This lead to sweat shops and people working them selves to death.
No thanks, I perfer a decent civilization.

For the record, I read proposal from small companies for contract work in the government. The 'hoops' aren't that bad. The hoops are there because the government want to keep the risk low that they are going to get screwed.
The hoops are there because the public hold the government responsible for their decisions. So there need to be some sort of frame work to minimize risk.
Yes, that is a good thing.

Re:Putting the cart in front of the horse

[Stradivarius]

Before we had laws to protect people, it was like that. people could hire and fire for any reason. This lead to sweat shops and people working them selves to death.
No thanks, I perfer a decent civilization.

"Easily hired and fired" does not equate to sweatshops or other abuse.

In many parts of the United States, employment is "at will", meaning either the employer or employee may chose to terminate the relationship at any time. The employer could be a great company. The employee could be a great employee. But if the relationship is no longer a good fit, in the judgment of either party, they go their separate ways.

Of course there are some basic laws against discrimination on basis of race, sex, religion, etc. Thus we have civilization without the excessive employment rules imposed by entities such as unions.

This seems to me better than requiring someone to work poorly to be fired. If an organization needs only half as many workers as it used to (maybe it lost a large customer) it seems wrong to require it to maintain its previous level of staff just because nobody was a bad employee. That just makes companies reluctant to hire anybody to begin with, because they know they won't be able to adjust downwards when necessary. That reluctance to hire inhibits companies' growth and fosters unemployment problems in the workforce.

We already have a secure coding office...

[onionman]

Here's the link: http://www.nsa.gov

Re:We already have a secure coding office...

[flyingfsck]

Yup, the poor sap is so totally clueless.

Hmm... what would it be called?

[Anonymous Coward]

I know! Let's call it the National Security Agency... and they could do things like work on securing our systems. Take Linux for example... maybe they could create a more secure environment... and call it SE Linux...

Nah... that's silly...

That just sweeps vulnerabilities under the rug...

[2obvious4u]

Dumb idea. You now have isolated code custom built for each group. Someone would have an easier time exploiting it without detection because there would be a smaller user pool. At least with commercial software there is a larger audience to find and fix security holes and if one is exploited there is an accountable party to hold responsible for fixing it.

So where does the OS come from then?

[ErichTheRed]

There are some big reasons why this might be a good idea:
1. Vendors have every incentive to pull the rug out from under you support-wise and make you buy their product again every few years.
2. Having people in-house who _actually know_ everything about how a system works really helps with debugging. Oracle, for example, is the king of finger-pointing when it comes to blaming some other part of the system for crashing a database.
3. Custom code would still have holes, but at least they wouldn't be the exact same ones being exploited in the private sector.

There's also some really good reasons not to do it:
1. You will still need to source an OS from somewhere. Whether $LinuxDistribution, IBM, Sun/Oracle, HP or Microsoft, ti wouldn't make sense to build a single purpose OS unless you were working on embedded systems. This OS would still have the same problem of limited-time support, publically available security exploits, and crappy support when you do get it.
2. Government organizations are very bad with communication. At the state level, practically every department sets their own standards. How could you get agencies with very different priorities to sign on to something that centralized?
3. Quality of code (see below.)

I work in systems integration, and have done so for many large companies. This is the place where we take applications, figure out how they can fit together, and merge them into a platform of clients/servers/network connections/databases. Software written by in-house IT is often the biggest bug-filled, resource hogging mess to get working. This goes double if the dev work is outsourced to a provider that doesn's know about the environment the app will run in. Think about the in-house apps you use -- the order entry client that requires a dual core processor and 2 GB of RAM, or the app that crashes with no explanation or a dialog box that says "You should never see this message." It's not all that bad, and some apps actually work really well. But developer training and skill levels are all over the map. At the very least, a vendor is responsible for their code, and can be persuaded/paid to fix bugs instead of letting them fester. A vendor specializes in building software meant to be used outside of their little corner of the world, so some companies do take time to make sure bugs are fixed.

This would work well when the field of software development matures a little more, and best practices aren't dictated by companies trying to sell you something. That's why IT has a very hard time being recognized as a branch of engineering - there's very few standard ways of doing anything. On the OS front, you have major vendors, hundreds of Linux distributions and other small players. On the database front, you have a few huge vendors that take totally different approaches.

Not so poor comparison

[DragonWriter]

That comparison is ridiculous.

Its actually not: printing and software development are both services that most government agencies regularly need, but that in general most don't need the same subtype of the broader service enough to justify retaining the capacity to meet all their needs in-house without outsourcing, but where the needs of the government as a whole would be more able to justify maintaining resources centrally and then making them available to individual agencies.

The fact that the necessary resources in the case of printing involve a mix that is heavier on physical capital than human capital, while the resources in the case of software development is a mix that is heavier on human capital than physical capital is a difference, but its not a difference that is particularly relevant to the point of the analogy.

You'd probably have a better case if you argued that the "strategic software reserve" was a bad comparison. Software isn't an physical resource with an interruptible supply that you can horde in advance against a future crisis. OTOH, I can see a useful "strategic software reserve" in one sense -- not a reserve of software but of software-related IP. If you accept as a baseline the current US system of fairly strong software-related creator IP rights (copyright and patent, most particularly), it might make sense for the government to strategically exercise the power to acquire property for the public use by eminent domain with a payment of the fair market value to "buy out" existing IP rights where there is a substantial public good to be served by doing so. This might -- structured properly -- be a system that serves the public interest and the Constitutional purpose of IP protections better than either maintaining the status quo without such a system, or just weakening IP protections generally.

Re:Not so poor comparison

[DerekLyons]

The fact that the necessary resources in the case of printing involve a mix that is heavier on physical capital than human capital, while the resources in the case of software development is a mix that is heavier on human capital than physical capital is a difference, but its not a difference that is particularly relevant to the point of the analogy.

Except neither you, nor the author of the TFA, seems to realize that Government Printing Office isn't a printer (in the normal sense of the word, though it does print some things) - it' a publisher and book warehouse and a book distributor and a book seller. But that's not all - it's also sets standards, certifies vendors, and acts as an office supply closet (for government forms and such).
 
Even so, that doesn't mean something from the government with a GPO number on it was printed on a government owned press by federal workers as it has outsourced printing for years and years.

Re:Not so poor comparison

[DragonWriter]

Except neither you, nor the author of the TFA, seems to realize that Government Printing Office isn't a printer (in the normal sense of the word, though it does print some things) - it' a publisher and book warehouse and a book distributor and a book seller. But that's not all - it's also sets standards, certifies vendors, and acts as an office supply closet (for government forms and such).

Actually, I do realize all of those things, it was just a lot easier to say "printing" than "the set of tasks that the GPO does". The analogy remains the same in terms of the case for centralized vs. individual agency needs, as does the difference (which remains irrelevant to the point of the analogy) that what the GPO does is somewhat more physical capital heavy than software development, whereas software development is more human capital heavy.

Re:Not so poor comparison

[DerekLyons]

Actually, I do realize all of those things

Except it's blatantly obvious you *don't* realize all those things when repeat the mistaken assumption that they are more physical capital heavy than human capital heavy.

Re:Not so poor comparison

[DragonWriter]

Except it's blatantly obvious you *don't* realize all those things when repeat the mistaken assumption that they are more physical capital heavy than human capital heavy.

Uh, I didn't say they were more physical capital heavy than human capital heavy.

I said the functions they do are more physical capital heavy than software development, which in turn is more human capital heavy than what the GPO does.

That is, I was saying:

pc(GPO):hc(GPO) > pc(software):hc(software)

Which you apparently misread as:

pc(GPO):hc(GPO) > 1

(Now, I'll admit that what I actually said could be wrong, its based on intuition about the physical capital requirements of, e.g., the warehousing and related functions vs. archiving code and documentation and so on, not an actual detailed cost analysis. But, at any rate, the more relevant thing is I said is that the difference is irrelevant to the validity of the analogy. Arguing that the difference doesn't actually exist, would reinforce, rather than challenge, the idea that it is irrelevant.)

Re:And the government has such a fine track record

[FlyingBishop]

The government's primary problems in this area are an excess of bureaucracy holding back stable software development. A very good first step is removing contractors from the equation, since that's an enormous layer of bureaucracy. We need to be funding real power-plays, not keeping the system as is.

"Government" has a terrible track record the same way "corporations" or "people" have a terrible track record. It only gets better if you look for improvements.

Mostly cultural, not technical

[wurp]

IMO the place to start if you want to fix computer security is with the culture of software use rather than the software itself.

There are plenty of places where security can be made better technically, and it is our nature as "software guys" to focus on those, but most significant break-ins come from the way people treat software and password information.

• Leaving USB drives or laptops lying around without using existing encrypted drive technology
• writing your password down
• believing someone is there in an official capacity because they talk in the expected way and are dressed correctly
• etc.

are all bigger problems than

• buffer overflows
• privilege escalation
• sql injection

Not because the latter aren't issues that need work, but because those are issues that get recognized and fixed quickly. As far as I know, there is no widely accepted way of fixing the social problems that plague computer security.

Re:Mostly cultural, not technical

[wurp]

I agree - I meant writing your password down and leaving it sitting beside your computer, and should have said that.

Re:Mostly cultural, not technical

[mcrbids]

...
are all bigger problems than ...
sql injection

Speak for yourself. When you see an address like

http://www.myagency.gov/reports/show.php?sql=Select+%2A+from+customers+where+id%3D39

then you can be pretty sure that sql injection is a bigger problem than just about anything else. Yet, sadly, this is often what you get when you have an internally developed application. Especially when you are talking about an intranet application hacked together by a 1-year software major who switched to English and which was not designed to be put on the wild, wooly Internet but is put there anyway after the fact.

This is very *typical* of internal development teams.

Re:Mostly cultural, not technical

[wurp]

And again, this problem is easy to spot, and can be fixed in one place. When the people with permissions just honor all requests given to them in a stern voice, it's a harder problem to resolve.

Re:Mostly cultural, not technical

[Intron]

Correct. It needs to be on the bottom of your keyboard or stuck to the side of your monitor, not left out carelessly.

What's that expression...

[HockeyPuck]

Something about not reinventing the wheel.

utilities

[Chirs]

I'm in Canada, so things are a bit different. Generally I've found that things that are "utilities" (that is, basically necessary for normal living) are provided quite efficiently by the government.

My car insurance is via the provincial insurance company and the rates are some of the best around.

My phone and internet service is via the provincial telco. The rates are competitive and there is no usage cap.

Electrical and natural gas rates are via the provincial corporations and their rates are among the lower ones in the country.

"the government" is responsible to us, the people. There's no excuse for letting government be inefficient--hold them to account.

Re:utilities

[Mr. DOS]

My phone and internet service is via the provincial telco. The rates are competitive and there is no usage cap.

What version of Canada do you live in, and how do I move from my version to yours?

Re:That just sweeps vulnerabilities under the rug.

[geekoid]

"You now have isolated code custom built for each group"

How would having many small software piece that is open and used throughout the country lead to that?

"At least with commercial software there is a larger audience
false.

" to find and fix security holes "
ohn yeah, corporation are real well know for jumping on security holes~

" exploited there is an accountable party to hold responsible for fixing it."
yeah, try holding a private company to that. good luck.
With a government body there is a specific person you can go to and hold responsible. You don't just have to be a shareholder or someone spending thousands of dollars. You just need to be a citizen.

Ahhh Marcus....

[GPLDAN]

Marcus is something of a muckracker. At one time, he was in charge of whitehouse.gov website security, and has at times been incredibly critical of the US Gov - see his book The Myth of Homeland Security in which I think he rips every major division of federal government (but especially the DHS) a new asshole.

As such, many beltway types have tuned Marcus out. He's almost always right, but he goes about telling us the problems in the most confrontational manner possible.

Re:coding - yuk

[Mindcontrolled]

Well, there are coders and software engineers, indeed completely different species, but sometimes hard to distinguish in the field without careful analysis. The problem you described exists also the other way around - way too many coders view themselves as "software engineers"...

The COTS battle is over, get over it

[cdrguru]

Sorry, but the COTS battle started in the 80s and has been over for a while. Nobody builds when they can buy anymore. If you believe your business is utterly unique and needs custom-written software... well, you are wrong. And nobody outside of a few folks just emerging from college really believe that way.

Would it be better if the government (and businesses) paid for software development rather than paying for packaged software? Maybe, but it would cost more - it certainly did in the 70s and 80s. The difference for nearly everyone today is they are buying a package for $500 instead of paying a year or two salary for a programmer. Sure, when the project was done there would be something else to do - this is a basic maxim that work expands to fill available staff. But today just about everyone has figured out that COTS is the only way to go. The buyer is isolated from personality quirks of the developers and isolated from the development process itself. The buyer also never has to worry about being held hostage by some lone wolf developer.

Yes, there can be the dreaded upgrade cycle where support for really old creaky software is discontinued no matter what the desires of the customers. And it does mean that the package you bought in 1993 for Windows 3.1 absolutely does not work on Windows 7 x64. But the world does not stand still and there generally needs to be some movement on the upgrade front.

Solving the wrong problems

[inertia-warrior]

Secure coding initiatives can only buy you so much. Most attackers are going to utilize client side attacks (think PDF, SWF, etc) rather than coming in through the "certified secure" front door. Also, operational security is more likely to burn you than your code (bad patching, misconfiguration and other miscellaneous bits of human error).

Isn't it obvious?

[SEWilco]

The Duke Nukem Forever crewe knows how to keep code under wraps.

WTF?

[Jodka]

Why don't we have a government coding office?

The government already funds software development and the past results of that funding predict the would-be future success of a government coding office; It would be a massive, expensive failure. The Census Bureau IRS, FBI and FAA have records of incredible, mind-boggling, massive failure in producing software. Not to mention state funded universities, the University of Wisconsin being the most recent travesty.

The unstated assumption that government involvement in software production would improve, and not degrade, the quality of software is ludicrous in light of evidence from past results.

But it would not only fail. As with other government agencies, it would be subverted by special interests for nefarious causes. Patents and Trademarks, established to promote creative works, are abused by patent trolls to threaten innovation and by politicians who extort campaign donations in return for incremental, perpetual copyright extension. The Department of Agricultural, now a wholly owned subsidiary of ADM, runs welfare-for-millionairs programs. Oh, and have you heard of Fannie Mae and Freddie Mac?

Government coding office? What could possibly go wrong with that?

Re:WTF?

[jjohnson]

Without saying so, you identified the problem: The IRS, census bureau, FBI et al. were acting like typical squirrelly clients who don't really know what they want, they just want it now and have deep pockets. There's no shortage of private sector equivalents, such as Hershey's or Coke's attempts to implement SAP resulting in billion dollar failures (and in Hershey's case the near bankruptcy of the company).

OTOH, Newell Rubbermaid had its homegrown ERP that was of a high enough quality to be one of Walmart's top tier vendors. The difference is obvious: organizations that have software development as integral parts of their business succeed, while deep pocket clients who don't really know what they want fail with consultants. So make software development an integral part of government services.

Re:WTF?

[DragonWriter]

The government already funds software development and the past results of that funding predict the would-be future success of a government coding office

The whole point of the suggestion of a government coding office is to replace the current system of individual government agencies buying software development services.

So I don't think it makes a whole of sense to use as your whole argument agains the proposal the fact that the current system is broken. The fact that the current system is broken is why a fix is proposed.

The unstated assumption that government involvement in software production would improve, and not degrade, the quality of software is ludicrous in light of evidence from past results.

That's not the assumption. The government is already involved in software production. What is suggested is a centralization of the government involvement in software production to a central agency whose core competency is software production, rather than having it handled by units in other agencies where it is not the agencies core competency.

Not a proper role for government

[hargrand]

Obvious jokes aside, the government doesn't innovate very well. It has clear limits to its power under the Constitution, and this would just be another example of it stepping outside of those bounds... Kind of like this little red star. All in the name of security? Yeah right.

Re:Not a proper role for government

[jjohnson]

Government doesn't need to innovate in software. The point of a GSO isn't to create new products, it's to provide secure services to government agencies. Nothing they would need to do would be more complicated than building existing functionality in approved ways--and if the NSA can do it, then a more general government department could as well.

Seriously, the IRS doesn't need innovative software, it needs to be brought up to 2005.

Re:Not a proper role for government

[blair1q]

"It has clear limits to its power under the Constitution"

The limits that are clear prevent it from doing certain things, but developing software is not mentioned anywhere.

People who say that the Constitution says that the government doesn't have this or that power intrigue me. They seem to understand the concept of reading comprehension, while simultaneously exhibiting a total inabiltiy to execute it. There's a clause in the document that basically gives the government total power, right before the clauses making certain powers clear and restricting certain others.

Section 8 - Powers of Congress: The Congress shall have Power To lay and collect Taxes, Duties, Imposts and Excises, to pay the Debts and provide for the common Defence and general Welfare of the United States...

That "common Defence and general Welfare" thing is very, very broad. If it weren't, Congress would have been done passing all the laws it had the right to pass by about 1801.

It's pretty clear to me that the federal government has the right to pay people to develop software in the interest of general welfare and common defense, which seems to be the point of this article.

Re:Not a proper role for government

[blair1q]

I take it back. Congress wasn't allowed to ban the importation of slaves until 1808. So they'd have sat around for 7 years waiting to bang that gavel, if they chused to.

Re:Not a proper role for government

[hargrand]

So you're suggesting we should measure the intent of a law appealing to the General Welfare clause rather than the actual outcome? You missed the point. Just because Congress and the President say that something promotes the general welfare doesn't make it so. Most of the programs that tie back to that clause have largely failed to achieve their stated goals and have instead had exactly the opposite effect. So what's the Washington answer: throw more money down the cespool and hope that something good comes of it and that the taxpayers don't notice the whole thing was a sham in the first place.

I see no evidence that while appealing to the general welfare to create an office of Secure Coding that network / software vulnerabilities will be any less prevalent in fifty years than they are right now. In fact I see a great deal of evidence that they would be far less successful at such an initiative than if they were to leave it in the hands of the private sector.

As for your assertion that I have no understanding of the meaning of the Constitution, well then I guess those 20 years I spent supporting and defending it were rather wasted then.

Re:Not a proper role for government

[blair1q]

You missed the point. Just because Congress and the President say that something promotes the general welfare doesn't make it so.

No, the Judiciary has to subsequently agree that it does when someone raises the issue to their level.

Guess what. They have, many times. We've got 200 years of case law to that effect. You don't get anywhere these days claiming the General Welfare or Common Defense clauses don't have meaning. You'd be better off trying to find a way to paint this law as being in direct contradiction of the welfare and security of the nation. That is remarkably effective, and is how certain elements are eroding our rights, in the manner of farcical irony lapped up by their sheeplike partisans.

And in case you didn't notice by observing those around you, comprehension and reason were not requirements for wearing a uniform. Took me all of two years to figure out that my mental abilities were being wasted in that environment, no matter how much fun the toys were. It's not lost on me that you confused fighting for the Constitution with understanding how it works.

Re:Not a proper role for government

[hargrand]

No, the Judiciary has to subsequently agree that it does when someone raises the issue to their level.

Okay, well, I'm clearly not the legal scholar you are. So perhaps you could answer a question for me. When was the last time any court ruled (and was not later overturned) that a progam funded with taxpayer dollars and administered by the U.S. Federal government which was designed to promote the general welfare or common defense was deemed unconstitutional because it was found to actually be detrimental to that which it had intended to promote?

I can think of plenty of programs the government has funded that actually made worse the social ills they were supposed to solve. The War On Poverty for instance was supposed to end poverty, but we still have the poor; it wasn't until it was scaled back that people started to realize that they didn't have to be beholden to the government to earn a better living all by themselves. What about Social Security and Medicare? Well they're just taxpayer backed Panzi schemes. There are plenty of exmples of corporate welfare, and other redistributive programs that have inflicted demonstratable harm on those they were meant to help or had unintended consequences that adversely affected others.

As for this issue of a government secure coding office, the author of the original article advocated the government develop its own software in house. And that aspect, while I still don't think it's a good idea, is not an unreasonable function of government. However, when he starts making comments about it being "the stratigic problem" and implying that this office should also be developing software for the private sector, I have a real problem with that in terms its Constitionality. Why? Having seen government (not) work up close for quite a while now, I don't believe they'll get it right. I believe (and point to those past failures as evidence supporting this belief) that the end result will be to detract from the general welfare and the common defense, not enhance or promote it.

That's not to say that there is no government role in this area, but it's in the area of regulation and enforcement (regulating interstate commerce), not providing software development services. I think NSA and NIST are both very capable of providing insight into what those standards should look like, though neither are equipped to perform an enforcement function.

And in case you didn't notice by observing those around you, comprehension and reason were not requirements for wearing a uniform

While that's certainly a true statement, I generally found your that most of those with whom I had the honor to serve had a strong appreciation of the Constitution and a deeper understanding of its intent and the reasoning behind its structure and content than the vast majority of Americans.

Took me all of two years to figure out that my mental abilities were being wasted in that environment, no matter how much fun the toys were

Well, I guess you joined for the wrong reasons. Still I would like to thank you for your willingness to serve; perhaps if you had a different perspective on the reasons for service, you would feel a bit differently about it now.

Re:Not a proper role for government

[hargrand]

In response to your closing thoughts above...

That's not what we do. We're Americans.

Re:Spending is the goal

[AndersOSU]

Government doesn't expand in terms of power and revenue because it's getting better, it expands because the economy is expanding.

http://www.nationalpriorities.org/Federal%20outlays%20and%20revenues

We need a few very secure systems

[Animats]

We need a few special-purpose boxes that are highly secure, as examples. The components exist. There are hypervisors certified to EAL-7. They show up in industrial systems, DoD systems, and avionics. They should be showing up in routers, firewalls, DNS servers, and ATMs.

A push by Homeland Security to increase the security level of critical infrastructure would not be out of place.

Re:We need a few very secure systems

[owlstead]

Having a very high level AEL certification is certainly a boon (I'm personally responsible for an AEL-4+ application). There are a few things though: AEL certification only covers part of the security of an application. Even though it is probably the best certificate to acquire regarding security, it's not all telling. Testing and evaluation by (sideways thinking) security experts may produce additional results.

Having a security certificate for systems is very very expensive. It can only be accomplished for smaller systems. This goes double for anything above AEL-4 where you have to have formal proofs in place. You certainly cannot currently do this for entire software stacks. What you can do is take components like a login process and certify that. But there may be quite a few critical systems that are simply too complex to certify.

(you'll probably know this, but others here may not)

Re:We need a few very secure systems

[kestrel bait]

No, not "certified to EAL7", it is "designed to be certified at EAL7". Vendor assertion vs 3rd party evaluation.

Not a case for tinfoil

[betterunixthanunix]

Take a look at Reflections on Trusting Trust, where Ken Thomson basically admitted to introducing a backdoor into a commercial operating system by hacking the compiler. The conclusion of the paper, in his own words, was not to trust commercial software to be secure -- the only secure code is code you control from the ground up. That paper was published in 1983.

Re:Not a case for tinfoil

[Zironic]

In theory, in practice you'll have to live with that secure software is a dream you'll never achieve.

If I had to choose between the Government using a large well known OS like Windows 7 or something they hacked together themselves, I'd much prefer Windows 7 because you can be reasonably sure it won't randomly implode and if it had glaring backdoors we'd know about them by now. (Though I'd probably feel even better if they'd use something linux based)

Re:Not a case for tinfoil

[betterunixthanunix]

Really though, the absence of glaring backdoors does not imply the absence of deliberate and major security flaws. Even very subtle changes could potentially have serious security implications -- even a change as subtle as the way memory is aligned (this may, for example, amplify side channels).

General purpose commercial software packages raise a yellow flag for security as far as I am concerned. They are not necessarily a problem, but there are risks. The general purpose nature is itself a problem; a system that is intended to be used to schedule appointments should not have the capability to execute a shell, nor should it even have a shell installed. The problem with general purpose systems is that they ship with a lot of code that is never needed for a specific installation, but which an attacker could potentially make use of. This is the basic concept behind a "return to libc" attack, or more generally "arc injection."

Re:Not a case for tinfoil

[Gr8Apes]

In theory, in practice you'll have to live with that secure software is a dream you'll never achieve.

If I had to choose between the Government using a large well known OS like Windows 7 or something they hacked together themselves, I'd much prefer Windows 7 because you can be reasonably sure it won't randomly implode and if it had glaring backdoors we'd know about them by now. (Though I'd probably feel even better if they'd use something linux based)

Did you say that with a straight face?

I can be reasonably sure that if Win7 is used, it will sooner or later implode via a glaring backdoor we don't know about.

Thanks Ric Romero, the Government is Incompetent

[salesgeek]

Basically the article is saying that the government is incompetent and then comes to the logical conclusion that adding a new layer to the government will fix the incompetence. It's completely rational!

Pony-Tailed Security Advice

[Grogan The Destroyer]

Here's the problem with the "solution" of having government write its own code. 1. Insiders are an arguably pre-eminent cause (arguably, because insider problems are often not reported because of embarrassment) of so-called "penetrations" 2. Just because an insider is trustworthy and stable on the day they were hired, does not mean that they are trustworthy and stable on every day thereafter. 3. Software code runs on hardware. The corollary of having the government write its own code is to have the government design and manufacture every component that goes into hardware. 4. See points 1 and 2. I could go on, but gawd am I ever bored of pony-tailed security consultants telling us to isolate ourselves to be secure.

Re:Pony-Tailed Security Advice

[blair1q]

Structured software processes do not allow that to happen.

One engineer doesn't put code into the code base without several other engineers getting a look at the code and the testing, and other organizations doing further testing and inspection.

However, any piece of software brought in from the outside is an opaque collection of bugs and vulnerabilities, unless it comes in as source code to be vetted as though newly written.

BTW, Your boredom does not make your disdain for those pony-tails any less of a canard. The only security that has ever worked is isolation of the secured items from any sort of access except by trusted individuals.

Re:Pony-Tailed Security Advice

[Grogan The Destroyer]

I hear your BTW re my gratuitous expression of frustration, and apologize for the expression and distraction. However, I would argue -- and there is a disturbing example in the case of the recently declassified Project Gunman, in which the US discovered that the Soviets had compromised IBM Selectric typewriters in the US Embassy in Moscow -- that suggests "the only kind of security that has ever worked" doesn't really exist. The trend seems to be that the gap between the sophistication of attacks and the sophistication of defense is growing. Security by isolation gives the people who have to work in that environment a range of unreasonable hurdles to overcome in doing their work; being human, they start to take shortcuts because the processes piss them off. We need a different way of thinking about this problem. I don't have the answer. I do know that what we're doing now is not quite a waste of time, but almost so (if someone is really determined to mess with us).

Well, no.

[blair1q]

"Our own software is probably a greater threat to us than anything other people can do to us.'"

No.

The greatest threat of all was that our own business leaders would decide to ship millions of engineering jobs to China and India.

Analyzing the code is not enough

[betterunixthanunix]

What if the compiler was hacked, the way Ken Thomson described in Reflections on Trusting Trust? You could have a perfect codebase that the compiler inserts backdoors into.

No, the highest security systems must be based on a codebase that is controlled by the government from the ground up, and implemented in languages that are not as susceptible to bugs and mistakes as C++ is.

Re:Analyzing the code is not enough

[Maxo-Texas]

I agree with your basic point. Would it not extend to the hardware as well?

The most secure systems should be based on formally tested, provably save, closed hardware made by u.s. factories.

Good point on the compiler-- another argument for open source-- then you compile your own executables.

My after thought was that if you had a group dedicated to finding and fixing security holes in government used software, that they would get pretty good at finding and fixing security holes after a while.

OP must not work in the industry

[devleopard]

or they could answer their own question. Three reasons:

1) Government already writes much of its own code. I see gigs posted all the time. Thing is, each office/department/etc tends to be a silo, so there is no "central" coding department. Can you imagine the bureaucracy around change processes then? Sheesh...

2) On average, public sector pays less. The idea here is to improve the quality of code, right? Not really possible if you can't attract the best and brightest.

3) Using external (this can be commercial or open source) products is key. Who makes the computers? Who makes the IDE's? How can we guarantee compiled code is fully secure if you aren't controlling every step of the process? Not possible. Even the government's most important asset, the President, is transported around in products made by commercial interests (albeit, with some customizations after the fact).

German government does this

[Anonymous Coward]

German embassies around the world use open source infrastructure to communicate with the home network. They've realized a long time ago that relying on closed source software that may contain backdoors accessible by foreign countries is a really dumb idea, so now they build their own based on open source solution, and occasionally contribute back to the community.

Missed the point

[spaceman375]

The goal is security. Centralizing software development, whether closed source or not, will change the landscape but not solve the problem. Yes, closed source and hard-to-get binaries may impede small hackers, but not government-level cyber-espionage. They'll infiltrate or socially hack your now centralized, easy pickings, offices. The biggest problem with Microsoft's dominance is not code quality, business practices, or other [insert rant here]; it's the ubiquity of their code. Once a security hole is found by someone, it can be exploited fricking everywhere. I've felt for years that all banks should do in-house only development from the hardware up; no outside operating systems, not just applications. What SHOULD be public is communications standards and other APIs, but what is under the hood should be new and different. Anyone who wants to be a cyber-criminal would have to specialize pretty hard on just a small niche, and would therefore be both easier to trace and catch and would have a much smaller chance of "making it big." Even viruses would be less able to spread.

You need to think about this one...

[sean.peters]

I work as a defense contractor, and most of the stuff we work on these days has a software component (whether commercial off-the-shelf, commercial/custom, or gov't developed). I'm pretty sure I don't want my missiles being launched by gnuFireControl or KLauncher. For one thing, there aren't all that many people with expertise in military software development outside of the existing M-I complex. And yes, military software is considerably different from other business software - for one thing, there are very complex safety requirements that have to be met, and if you don't know what they are, you won't be able to do it. More importantly, a lot of the military software in use today is classified - if you could look at the source, you'd get a lot of information about our own forces' capabilities and limitations, plus you'd be able to infer intel data on what we know about adversary systems. Not the kind of thing I want available to Boris and Natasha (or whoever our favorite bad guys are this week).

So you'd have to establish at least some exceptions to the all open-source rule. And once you start allowing exceptions, it can be hard to know where to stop.

Re:You need to think about this one...

[Ephemeriis]

When I said "genuinely open source software" I did not mean that it necessarily had to be released under the GPL and publicly available on an FTP site somewhere.

I mean that upon delivery of the software to whatever government office, full source code was provided as well.

Maybe the government wouldn't do a thing with it... But at least they'd be able to compile their own binaries and check them against those that were delivered. Or just use them instead of the binaries delivered. And they could easily audit the code whenever they wanted to.

Re:You need to think about this one...

[Hatta]

Open source means that everyone who has access to the binary has access to the source too. If you're not distributing the software (I hope we're not distributing missile control systems), then you have no obligation to distribute the source. There's also no implication that you have to accept patches from anyone. All that matters is that those who use the software have the ability to maintain it themselves.

So nothing you brought up really excludes the possibility of using the GPL for missile control software. The fact that it's so specialized makes the GPL less useful, but it doesn't make it a bad idea. If the government isn't getting the sources for this kind of software, then it can't check whether it does what it's supposed to do, and it can't shop around for contractors to make modifications to it. These are both reasons why we would want missile launcher code to be licensed to the government under some open source license. It would be better if the government owned the copyright to such code. Can you share a bit on how these projects actually tend to be licensed?

Replying to my own post, bad form...

[sean.peters]

... but it's certainly possible to go too far in the other direction too, particularly with off-the-shelf software. The DOD recently bought a system from a defense contractor in a friendly foreign country (keeping the details vague here on purpose) that included a bunch of software controls. Our outfit was tasked with doing a safety analysis of the system. So we contact company X, asking for, among other things, a code listing. They flat out refused. "Well, you've analyzed it, right?"... "Oh, of course". "So can we see the analysis?" Nope. Not very smart on the part of company X, as it's hurting their chances of getting more business in the future, but in the meantime... we've bought this damn thing and we're having to treat the control system as a black box for the purposes of safety analysis. So it's not like this issue doesn't exist... it's a real problem. I'm not sure open source is really the answer, though.

Re:Replying to my own post, bad form...

[Ephemeriis]

And if the government had required open source software, you'd have a copy of the source code to peruse at your leisure.

Re:And the government has such a fine track record

[nbauman]

Let's expand it some more.

Please, do some thinking rather than repeat the "government can't do anything right" propaganda meme that you got from the Republicans.

I used to work with medical software. The Veterans Health Information Systems and Technology Architecture (VistA) http://en.wikipedia.org/wiki/VistA is one of the best systems out there, as good as or better than any commercial medical information system. And it's open source.

If there's one thing the U.S. government has done well, it's develop software. I'd be interested to know what other informed people thinkl, but that's what I've seen. (As I recall, NASA employees wrote the first dBASE-style database, which was why it was so widely adopted.)

In fact...

[sean.peters]

Big commercial contractors are favored because they are the ones most capable of jumping through the flaming hurdles that the feds put up to keep up the appearance of saving tax money. The solution is simple: change the damn laws and regulations so that they can be easily hired and fired, and any 1099 can big on a small project without being an expert in government processes.

IAADC (I am a defense contractor). Actually, there are plenty of gov't contracts that are small business set-asides, which include any number of one man shops. And all the contracting shops include small-business liaison types whose job it is to make any flaming hurdles go away for small businesses. And even full & open competitions (those that are open to large businesses as well as small) frequently have small business participation goals, so the large business prime would have to go recruit some small business and give them some of the work

I really don't understand why you'd want to make it easier to hire and fire gov't employees. The gov't side is where you need more continuity. The reason you have contractors is because 1) they're frequently cheaper, and 2) they are, in fact, easier to hire & fire. The reason you need gov't employees is that contractors don't necessarily have the taxpayers best interests at heart. Not that they're lying scumbags (usually), but the incentives are different.

Umm, no it's not

[sean.peters]

Sure, there are plenty of situations in which OTS software will get the job done just fine. But in the defense market... suffice it to say that you can't buy My Missile Launch Program for Windows 7... and you wouldn't want to. Prefab software is great if there's a package made for what you need to have done... but there's a whole world of software requirements out there that don't correspond to anything you can go out and buy.

No kidding.

[sean.peters]

For every example of software failures discussed above, you can come up with a fine example of a government system that worked great. I'm not going to spend a lot of time digging up examples, but here's one: the Navy's Aegis Combat System. Aegis is just Skynet's littler (and nicer) brother - it's vastly complex, and under certain circumstances is capable of conducting difficult anti-air battles more-or-less autonomously. It detects, tracks, and engages subsurface, surface, air, and ballistic missile threats. And yes, this was a program run by the government.

As the parent points out, the common thread in massive software implementation failures isn't that the customers were government agencies - it's that they didn't have their requirements nailed down before they started shoveling money at their problems. There's plenty of that going on in the private sector as well.

Right problem wrong solution

[minstrelmike]

Contractors writing code for Federal Agencies is a costly problem.
Hiring government coders to work directly for Agencies that are trying to meet their missions is the correct solution--turn coders into subject matter specialists
Putting all coders into one central agency may make the sw more secure but it certainly won't make the coders more responsive to the individual Agencies and Programs.

Re:Spending is the goal

[moeinvt]

"Government doesn't expand in terms of power and revenue because it's getting better, it expands because the economy is expanding."

That's an interesting perspective given that the chart you referenced clearly shows Federal government spending as less than 5% of GDP in 1930, and ~25% of GDP right now.

Recall also that government spending is part of GDP. Therefore, showing spending and revenue as a % of GDP tends to obscure the picture of the size of government relative to the private sector. A $3.6T budget is ~24% of a $15T GDP, but ~31.5% the size of the real productive economy which has to bear the burden.

I also love the little inflection points showing that in the next few years the deficit is going to drop from 10% of GDP to 5% of GDP. I'd like to see it happen, but I see no evidence of any leadership or political will to make that happen.

I'll agree with one point however:

"Government doesn't expand in terms of power and revenue because it's getting better . . ."

It expands because it's filled with a bunch of self-serving parasites.

     

Re:coding - yuk

[Stradivarius]

Don't you want your "coders" to be "software engineers"? After all, if they don't understand the practice of software engineering, the software they develop is going to be a nightmare to maintain.

Re:Spending is the goal

[bit01]

but ~31.5% the size of the real productive economy which has to bear the burden.

Not that simple. The government (one person, one vote versus one dollar, one vote) does a lot of productive work just like private industry. There is waste in both sectors but sometimes for different reasons. The question is how much waste.

---

How many million man hours has the advertising industry cost today?

Re:The COTS battle is not over, get over it

[bit01]

nearly everyone today is they are buying a package for $500

The government is not buying one package for $500, they are frequently buying a million identical packages for $500,000,000. Less some virtually useless feel-good discount.

That pays for an awful lot of in-house development or open-source tweaking.

---

Any large public or private organization paying recurring, per-seat licensing for software is being economically stupid.

Re:Spending is the goal

[bigngamer92]

It expands because it's filled with a bunch of self-serving parasites

I find it harder to swallow that word after playing Bioshock.

Yes!

[daem0n1x]

Yyyyyyesss! Jobs!

No, not agreed.

[elnyka]

There's a third issue: salaries. Programming talent is used to silicon valley pay grades, not military pay grades. How many employees would be willing to leave their current position and take a 50% pay cut to work for the government? Would you be willing to trust the code of someone working for $40K/year?

For starters, there are people in the commercial sector working for that amount, either as contractors who make a meager $60K/year with no benefits (and no O/T) or as employees doing $40-50K/year with some meager benefits (and both working 45-55hr/weeks.) It is not the norm, but it ain't that rare either.

Second, most developers (specially those graduating since the dot-com bubble) remain junior in terms of skills, and yet make salaries that are inflated wrt to their skills... and they expect they deserve it! This is more common that the previous case. Do you trust their code?

Third, consider a job with, say, the NSA. They certainly pay you below the industrial average (say $60-70K/year tops). But 1) they train you, 2) they pay your post-grad education, 3) give you benefits that are phenomenal, and 4) they give you a goal or end product (whether good or bad) that is far more stimulating than doing the same e-commerce shit all the time.

This is the problem with so many software developers nowadays. They equate quality with high salaries despite the fact that software is usually written like shit and those who write it get paid far more than in other engineering disciplines. And to add insult to injury, they equate quality of work with base salaries (without taking into consideration all the other benefits like medical coverage, fat retirement plans, and generous vacations according to seniority.)

Furthermore, how many people working out there in the software industry get paid to go get their masters as it is usually done with public/private defense-related jobs? That's one big fat amount of money being received as a benefit.

Base salaries are just part of the story, and the trustworthiness of software has more to do with processes than with individual salaries.

Re:Spending is the goal

[AndersOSU]

That's an interesting perspective given that the chart you referenced clearly shows Federal government spending as less than 5% of GDP in 1930, and ~25% of GDP right now.

That's your honest assessment of that chart? In 1930 we didn't have a modern economy. Do you seriously not think that the most striking feature of that chart is that outlays sits more or less at 20% from WW2 to 2009?

You'll also note that revenues and outlays began diverging right around when Reagan became president.

The gist of the article

[elnyka]

It's clear you've never seen the government at work. There's two issues with the govenrment writing it's own software.

1) Each individual part of the government only needs custom made software once every 5 years or so 2) Every government in the known history of mankind has been utterly incompetent in cross-department communication

Since you can't reasonably expect the government to hire teams of programmers to write software one year and sit on their asses for 4 years while there's on demand and that traditionally trying to centralize the work leads to horror stories, you can see why most governments (even the socialists) have opted for contractors.

The gist of the article is that the government (or defense contractors working on its behalf) should not rely on commercial off-the-shell software. Unless I'm missing something, the article is not about having all software *that matters* developed by developers directly under the government payroll.

Using defense contractors (which are commercial entities) for developing custom software over COTS is pretty much in tandem with the gist of the article.

Militia

[lennier]

Specifically, Eric S Raymond.

Suggestion

[Arancaytar]

If you call it something that doesn't result in an acronym of "SCO", you'll find the idea to be much more popular.

Re:Spending is the goal

[dontbgay]

That's an interesting perspective given that the chart you referenced clearly shows Federal government spending as less than 5% of GDP in 1930, and ~25% of GDP right now.

Do you know what that ~25% of GDP buys us? Civilization. You know, the framework that allows the rest of the economy to continue on? The cost of civilization might be a little too high right now, but I'm sure the markets will take care of it. As soon as another company offers Civilization. Last I checked, if it weren't for regulation, we'd be all pumping Standard Oil and BP and wouldn't have a chance. Then that "free market controlled by the companies" becomes that "free market controlled by that one company."

Here's an interesting note: back in 1930, weren't we in the middle of some financial trouble? That was waaaaay back in the golden age of America when the Free Market ruled all. Back then they were spending less than 5% GDP on Civilization. 35% is probably too much, but saying gov't is a cancer is not realizing where the REST of the dangers lie.

Re:And the government has such a fine track record

[Octorian]

A very good first step is removing contractors from the equation

Just one thing most people forget. By and large, most technical things you all think of as "government developed" are actually developed by contractors (even if the gov't owns the code), with federal employees only existing on the management/contracting/paperwork/requirements* side of things.

* except when they contract out the requirements work, which also happens

Re:Spending is the goal

[AndersOSU]

The real son of a bitch is trying to define government waste. If it were easy, the budget would just sail through congress every year.

Is NASA wasteful? Is it less wasteful to buy homeless people houses or to clean up after them? Is it more wasteful to wage a war on drugs or to deal with the consequences of available drugs? Is the FBI less wasteful when it investigates kidnappings, white collar crime, or terrorism? How do you identify waste in the highway system? What about education? That's worse than advertising, as in "I know half my money works, I just don't know which half." FDA, FCC, EPA, OSHA ... where's the waste?

Then you get into the heavy hitters. Is the army wasteful? What can you eliminate? Does outsourcing a la Blackwater/Xe Haliburton, etc. make the army more or less efficient? Is medicare wasteful in spite of providing more service per dollar than any private insurance? Is social security wasteful? How the F do you deal with that? Raising the retirement age seems the most sensible, but what does that do the the millennials just getting out of college?

That's a position I can get behind

[sean.peters]

Sorry, I thought you were advocating all-out community development of military software... my apologies. I agree that not being able to see the source code at all is a serious issue. Luckily, it's not one that we face all that often.

I don't actually get to see the license, usually

[sean.peters]

Hmm.

So nothing you brought up really excludes the possibility of using the GPL for missile control software.

Reflecting on this more, I think you're right. Realistically, I don't think the actual GPL does anything for you that you couldn't get with a well written contract, and it introduces the scare factor into the acquisition community ("what! we can't have everyone looking at the software!"... same mistake I made). But in any case, I think we're all in violent agreement about the need for the gov't customer to be able to look at the source code.

Re:coding - yuk

[JustNiz]

Companies always seem to try to de-skill stuff then find cheaper replacements. And it always comes back and bites them in the ass.
Software development is a skilled job. Calling it 'coding' is just one of the ways they use to try and de-skill it.