5 ms·

Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million Talk about waste of resources.

by diegorbaquero 5y ago

cure 5y ago
I could totally fix it for $49 million. /s
- _3u10 5y ago
  This is a race to the bottom and why tech workers need to unionize. Soon someone could be fixing it for a measly $1 million. /s
- vjust 5y ago
  Contractors in Missouri must be drooling in anticipation.
elliekelly 5y ago
I would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.
- kizer 5y ago
  I know right. An immediate fix shouldn’t cost anything, right? Just don’t send social security numbers to the browser.
- handrous 5y ago
  Turns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll need to go back and forth with some unrelated department for months to make it happen. Also there's no testing environment, no information about how to get it running—let alone any useful scripts or config/deployment management—is in the repo or otherwise available at all, and there are no tests. And it's all written in an unholy combination of ASP.NET and Java server pages. And the "database" is a standards-nonconforming CSV. (pure speculation)
  - tppiotrowski 5y ago
    Cheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.
    - ClumsyPilot 5y ago
      Yeah maybe the current system is an emalgamation of 20 such cheap solutions accrued over decades. If they are not i a crisis, they should do ot properly
willcipriano 5y ago
Remove SSN field from DTO - 49 million Invoice Fee - 1 million Not bad for -1 lines of code.
newsbinator 5y ago
I mean it wouldn’t be a weekend fix because it’ll have to involve an audit of all existing systems to identify where else similar tomfoolery occurred. But 50 million is a high estimate.
- nerdawson 5y ago
  30 minutes removing a piece of output: $100 Knowing where sed output is generated: $49.9999M
  - nofinator 5y ago
    > Knowing where sed output is generated Is the use of "sed" intentional or a typo? Either way, I love it.
    - Akronymus 5y ago
      Seems quite intentional. As it is a levenshtein distance of 2, along with i being physically far away from e and a on most commonly used keyboard layouts.
comeonseriously 5y ago
What are the odds it will be going to someone he knows?
tinco 5y ago
It's a disgrace the agency who produced this website is not liable for this substandard quality. How crazy is it that code like this is deployed to production and then the customer has to pay 50 million to get it up to standards? The senator should be ashamed they are being scammed like this.
christophilus 5y ago
> fixing the flaw could cost the state $50 million It's hard to imagine the kind of contorted bureaucracy that could turn such a fix into a $50 million change request, and yet, I wouldn't be surprised at all if it did cost that much.
- miohtama 5y ago
  Governor’s cousin need to eat, too.
a785236 5y ago
A minor but important correction. Krebs wrote that the Gov claimed that “fixing the flaw could cost the state $50 million.” That’s not quite right. In the press conference linked in Kreb's post, the Governor actually claims that the “incident alone may cost Missouri taxpayers up to $50 million.” I’d guess this number includes an estimate for the legal cost of dealing with the data breach plus any statutory penalties the state might incur (plus a grossly inflated price for fixing the bug).

Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million Talk about waste of resources.

cure 5y ago

I could totally fix it for $49 million. /s

_3u10 5y ago
This is a race to the bottom and why tech workers need to unionize. Soon someone could be fixing it for a measly $1 million. /s
vjust 5y ago
Contractors in Missouri must be drooling in anticipation.

elliekelly 5y ago

I would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.

kizer 5y ago
I know right. An immediate fix shouldn’t cost anything, right? Just don’t send social security numbers to the browser.
handrous 5y ago
Turns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll need to go back and forth with some unrelated department for months to make it happen. Also there's no testing environment, no information about how to get it running—let alone any useful scripts or config/deployment management—is in the repo or otherwise available at all, and there are no tests. And it's all written in an unholy combination of ASP.NET and Java server pages. And the "database" is a standards-nonconforming CSV. (pure speculation)
- tppiotrowski 5y ago
  Cheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.
  - ClumsyPilot 5y ago
    Yeah maybe the current system is an emalgamation of 20 such cheap solutions accrued over decades. If they are not i a crisis, they should do ot properly

willcipriano 5y ago

Remove SSN field from DTO - 49 million Invoice Fee - 1 million Not bad for -1 lines of code.

newsbinator 5y ago

I mean it wouldn’t be a weekend fix because it’ll have to involve an audit of all existing systems to identify where else similar tomfoolery occurred. But 50 million is a high estimate.

nerdawson 5y ago
30 minutes removing a piece of output: $100 Knowing where sed output is generated: $49.9999M
- nofinator 5y ago
  > Knowing where sed output is generated Is the use of "sed" intentional or a typo? Either way, I love it.
  - Akronymus 5y ago
    Seems quite intentional. As it is a levenshtein distance of 2, along with i being physically far away from e and a on most commonly used keyboard layouts.

comeonseriously 5y ago

What are the odds it will be going to someone he knows?

tinco 5y ago

It's a disgrace the agency who produced this website is not liable for this substandard quality. How crazy is it that code like this is deployed to production and then the customer has to pay 50 million to get it up to standards? The senator should be ashamed they are being scammed like this.

christophilus 5y ago

> fixing the flaw could cost the state $50 million It's hard to imagine the kind of contorted bureaucracy that could turn such a fix into a $50 million change request, and yet, I wouldn't be surprised at all if it did cost that much.

miohtama 5y ago
Governor’s cousin need to eat, too.

a785236 5y ago

A minor but important correction. Krebs wrote that the Gov claimed that “fixing the flaw could cost the state $50 million.” That’s not quite right. In the press conference linked in Kreb's post, the Governor actually claims that the “incident alone may cost Missouri taxpayers up to $50 million.” I’d guess this number includes an estimate for the legal cost of dealing with the data breach plus any statutory penalties the state might incur (plus a grossly inflated price for fixing the bug).