Anyone Can Push Updates to the DOGE.gov Website
-
To be fair, healthcare.gov had a rocky rollout too. No gaping security holes AFAIK though, so this is a new low.
-
Crowd source your database, what could go wrong?
-
No, penis.
-
I can’t wait till the next dumbass gets into the White House and turns this pile of grabage off. Paying these idiots millions to power and run the hardware this pitiful excuse of a website runs on. And all we got for that money is some shit that is about on par as the shit you get from some O’Reilly book called “Building a Government Website Crash Course” with a Bald Eagle dying of bird flu on the cover.
Thanks, I needed that. Poetic.
-
EIQL
Not enough 'X'
-
Well, it's sloppy for a government website. This is not a private enterprise running out of someone's garage. There's many reasons why that should not be an acceptable paradigm for posting government information.
If you're running a sandwich shop or a metal working shop, posting your phone number and address through CloudFlare Pages is probably fine.
-
Firing the IT people because they cost too much is always a good thing to show you the incompetence.
-
This is not a private enterprise running out of someone’s garage
Neither is the company I work for. We're not Amazon, but we handle billions of revenue, our users have very high risk jobs, and they are using our software more and more to do these high risk jobs. We have a lot of controls about how things get released (QA team, and every change is tested before and after deployment), we just use our source control to handle the actual deployment.
Whether it's sloppy depends on their processes (i.e. who validates the change?), not the tools they use.
We don't use Cloudflare Pages, but we do use automatic deployments, and pretty much anyone on the team can submit a change for deployment. It'll get reviewed before going live, but that's a limitation we've placed on the tools and process.
-
Unwitting? No. They are knowingly and intentionally doing this.
-
No doubt your company has more invested in the domain name than a pointer to pages.dev, as well.
Do we think doge.gov has a QA group? Do we think there's more than two people who review changes? Or that they even review changes at all?
The setup your company has and what this appears to be (it's true, this is speculation) is probably vastly more than just "we both use git to manage production pushes". I'd bet you company has spent a fair number of years getting to this point, and doge.gov has not even secured a proper certificate while suggesting they're competent to handle the entire financial information of the United States Government.
-
Yeah I think the static page thing was just there to illustrate how the coders reverse engineered the api and saw what was getting called.
I agree static content alone on CF isn't "bad". This perfectly illustrates why you have to have your API shit together when you go with this approach.
-
Is it really a breach if they'll just hand it over to anyone who pays and/or stroke's Mango Mussolini's ego?
-
Still more than Elon himself
-
Do we think doge.gov has a QA group? Do we think there’s more than two people who review changes?
Idk, I don't work there, nor have I looked into how they're structured. I'm not going to make assumptions though.
I’d bet you company has spent a fair number of years getting to this point
Yeah, we have a bunch of tooling to make all that magic "just work." It runs tests, check the health of deploys (and has a sane failover if it's unhealthy), etc. There's a lot to it, but at the end of the day, if I really want to, I can push and deploy straight to prod w/o anyone else being involved (I'd probably get fired, but I could do it).
The tech stack isn't nearly as interesting as the processes surrounding it.
proper certificate
I assume you're talking about the DB and not the website itself, which is protected by a proper certificate, at least as of Tuesday (that's when the certificate starts being valid). I don't know when the website was launched, so I can't comment on anything before that point, though the domain seems to have been registered since the day after inauguration.
the entire financial information of the United States Government
That's largely public info, no? I don't know what exactly is exposed, but honestly, pretty much all financial information (aside maybe from the military and intelligence) should be public record. If it's not, I'd welcome a breach that exposes it so journalists can look it over and find out what they're trying to hide.
-
I still think it's incredible he named his not yet an actual government department after a should-be-treated-as-a-security-by-the-SEC that he pumped and dumped
-
Current economic indicators aren't looking good. If the largest employer in the country performs mass layoffs there'll be a loooot of people out of work and likely not enough jobs to go around
-
Does "ужасшоу" sound kind of like "asshole"?
-
Username checks out
-
And as high! haha
Wait . . what?
-
I'll need ketomine too to cope with this presidency.
