konklone
Joined 14 years ago
Karma
1,284
Submissions
213
Member since
Oct 26
Recent submissions
Comment · 2 months ago
Ah, that is too bad. It's certainly always possible the countries list could expand in future, but it's not something I have insight into and unfortunately can't give you too much to go on.
Comment · 2 months ago
Wikimedia Foundation | Lead Product Manager, Security | REMOTE (US + 18 countries) | Full-time
I lead the security and safety team for Wikipedia, at the Wikimedia Foundation. I’m hiring a product manager to lead our security roadmap and steer the priorities of our security engineering team.
It’s a high-pace, shipping-heavy time for the whole project right now, as we are dedicating ourselves to surviving all the ways AI is messing with us and the internet, and getting to the other side of it. I joined myself about a year ago, and have found it to be a great time and place to swing big and surprise people.
This is a PM role and PM background is certainly helpful, but it’s not strictly required (everyone has the first PM job at some point). A technical background and security expertise are a must for this role, so we’re also open to people in engineering roles, who have demonstrated PM-relevant skills and are interested in making a pivot.
You can apply at https://job-boards.greenhouse.io/wikimedia/jobs/8140060?gh_s... - we don’t auto-filter based on AI or anything like that, I will personally see your resume.
Comment · 2 years ago
On isitchristmas.com, this happens for several days surrounding Christmas. The defined use case is informing you of whether it is Christmas.
Comment · 4 years ago
The document distinguishes between enterprise-facing and public-facing systems. For enterprise-facing (government employees, contractors, etc.), it's talking about discontinuing use of TOTP. For public-facing systems, it doesn't impose any restrictions, since (as you're saying) the general public really needs options.
Comment · 4 years ago
Login.gov does support identity verification. Not all uses of Login.gov require it, so many accounts are just used for email with MFA.
Comment · 6 years ago
Author of the post here :)
In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few graphs for the Chrome-observed one): https://transparencyreport.google.com/https/overview
Firefox has reported similar numbers. It's now more common for new web features to require HTTPS when they are introduced, to avoid developing HTTP sites as dependencies: https://blog.mozilla.org/security/2018/01/15/secure-contexts...
That doesn't mean that HTTP is banned, but given the magnitude of the change and the size of the web, I think it's fair to say that it's being deprecated.
More practically, anyone who wanted to build a product (or a government process) on intercepting or modifying people's unencrypted web traffic would find their dataset to be an order of magnitude smaller, and orders of magnitude less useful (since so much of the remaining HTTP traffic is in the long tail of small/older sites).
Comment · 7 years ago
There's not federalism within states in a legal sense the way there is between states and the feds, but cities value their independence too and prefer to have their own infrastructure. I would expect the city, rather than the state, to be the reason they don't use a subdomain of the state's .gov domain.
Comment · 9 years ago
CLAs are frowned upon by some, but they don't completely kill contribution from 3rd parties. I've signed plenty, and I've encountered plenty of projects that use them that continue to have a good community of outside unaffiliated contributors.
Comment · 9 years ago
I wouldn't use the word "illegal" - it's a directive of OMB (the White House's management and budget office), not a law or a regulation or an executive order. The only true enforcers are OMB themselves.
But to answer your other question, as part of the Department of Commerce, a "CFO Act" agency, USPTO would not be exempt.
Comment · 9 years ago
The policy is still in effect, and its supporting home page is here: https://https.cio.gov
Comment · 9 years ago
Cloud Foundry doesn't have a problem injecting headers, as HTTP traffic is plaintext inside the system itself. It's once it starts traveling across the public internet that encryption is needed. This does make it harder for network edge caches and for middleboxes, but that's not totally a bad thing either.
Comment · 9 years ago
Just so it's clear, NSA is technically part of DoD. (Though it's a bit like FBI's relation to DOJ, they operate very independently.)
Also, the DoD CIO has had, since ~2003, this excellent FAQ supporting open source:
http://dodcio.defense.gov/Open-Source-Software-FAQ/
But as people on this thread and elsewhere will tell you, that hasn't resulted in widespread support at DoD for open source.
Comment · 9 years ago
I'm from 18F, and I'm now a "contributor", but only because they accepted my pull requests. :)
Comment · 9 years ago
In fact, there are now way more state/local .gov domains (~4,000) than federal .gov domains (~1,300).
I currently work for as a technology advisor to the General Services Administration. I help 18F and other technology programs at GSA build open, secure technology inside the US federal government. Before that, I spent 5 years with the Sunlight Foundation working on open data infrastructure and policy.
[ my public key: https://keybase.io/konklone; my proof: https://keybase.io/konklone/sigs/9Iwmw27600DiYlztkLB1x2b2vIGIiPJ6DpXE76ekFkY ]