this post was submitted on 09 Feb 2025
1069 points (97.1% liked)
Technology
62063 readers
4607 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don't know about government overall, but the military and HHS have has some of the most stringent security stances I've encountered. To the point where just working for them was a massive chore. (How effective they were I guess I don't know, but working for them sucked.)
That said, I'll take what you said on faith, because I think you're spot on with everything else.
Often, ridiculous and onerous procedural security is hiding massively incompetent actual software security or is used to constrain people from discovering security by obscurity holes. Everything I've done in government interfacing as a vendor would seem to confirm this, at least back when I was doing it a few years ago. You'd be hard pressed to convince me it's changed much since.
I once answered a phone call inside a com closet on base. Military IT was already escorting me. Security came because the cameras in the closet detected the camera on my phone. It's definitely physically tight security.
I mean, it's not a secret that governments everywhere run really outdated software (think things like Windows 7 and older) because "it works", so it really shouldn't be too surprising.
I had to help the SSA implement SAML authentication once and they weren't even allowed to share their screen so I could see what they were doing. Totally agree that it's a massive chore.