Articles by Eric Mill
Targeted News Service
GSA: Accelerating Secure Bridge Between Industry and Government - Roadmap for Federal Risk and Authorization Management Program March 29, 2024 WASHINGTON, March 29 -- The General Services Administration issued the following news on March 28, 2024: By Eric Mill, Executive Director of Cloud Strategy The American public expects government technologies and websites to be secure and easy to use.
Congress: There’s An (Android) App For That
Our Android app, “Congress”, is now published in the Android Market, for free. As I said in the beta release post, Congress is a pocket Congressional directory that takes full advantage of the Sunlight Labs Congress API and the Drumbone API. You can install it by visiting the Market, or scan the QR code in this post to take you right there. The features: Read the latest bills, laws, and see what bills were recently voted on.
Government APIs Aren’t A Backup Plan
When the government shuts down and takes most of its data with it, the public needs to have a backup plan. The laws still apply to us. Politicians are still raising money. We still have a population, unemployment, and social problems. But if you want to look up some of those basic facts, well, Data.gov can’t help you, you’ll have to ask about those campaign donations later, and the Census will get back to you someday. It’s not 1995 anymore. The government lives on the Internet, and so do we.
Why we’ve collected a hojillion inspector general reports
A few months ago, we kicked off [a new project on GitHub](https://github.com/unitedstates/inspectors-general) called `inspectors-general`. Part of [the @unitedstates project](http://theunitedstates.io), it’s a small, public domain tool with the goal of eventually gathering reports from every inspector general (IG) in the federal government. The `inspectors-general` project gathers reports by — you guessed it! — scraping government websites.
Federal Agencies Continuing to Weaken FOIA
The Freedom of Information Act (FOIA) is a foundational law that guarantees US citizens the right to request and receive information from federal government agencies, with some relatively narrow exceptions.
18F: Digital service delivery | The next step towards a bug bounty program for the Technology Transformation Service
On May 9, we took a big step toward creating a bug bounty program for our agency by issuing an award to HackerOne for a Software-as-a-Service bug-reporting platform. The TTS Bug Bounty will be a security initiative to pay people for identifying bugs and security holes in software operated by the General Service Administration’s Technology Transformation Service (TTS), which includes 18F.
National Day of Civic Hacking 2013 | Sunlight Foundation
This past weekend, over 11,000 individuals connected under the helm of the National Day of Civic Hacking (NDoCH) — a series of local #HackForChange hackathons, unconferences, and meeting of the minds that engaged local communities with open data, code, and tech. From what we can tell, the NDoCH events were magnetic, drawing together participation from local (and traveling) developers, government officials (including a few mayors!), community leaders, and even 21 federal agencies.
DotGov Domain Registration Program to Provide HTTPS Preloading in May
Effective May 15, 2017, GSA’s DotGov Domain Registration Program will begin providing HSTS Preloading services for federal agencies. HSTS stands for HTTP Strict Transport Security (or HTTPS, for short). This new service helps ensure that visitor communication with .gov websites is not modified or compromised, and hostile networks cannot inject malware, tracking beacons, or otherwise monitor or change visitor interactions online.
Get a U2F key right now and log into stuff with it
Since posting this, Dropbox and GitHub have both added support for U2F keys. Microsoft Edge has begun development on integrating U2F. Mozilla hasn't made any announcements, but this is Firefox's tracking bug for the feature. I just got a U2F security key, for less than $20, to use as the second factor to log into my Google account. My model is by Yubico, sometimes called a "Yubikey". It's a super-light USB wafer you put into your computer, with a button you tap to log in to websites.
Exciting Additions to Analytics.usa.gov
We’ve expanded analytics.usa.gov to include 15(!) more agency-specific dashboard pages. We now offer agency-specific analytics data pages for a total of 25 major federal agencies, and each one is accessible from the dropdown menu at the top of the site. Additionally, we’ve moved the downloadable datasets to their own pages, rather than be located on the dashboard pages themselves.
Analytics.usa.gov: Now with Agency-Specific Dashboards
Starting today, you’ll see a dropdown from the main analytics.usa.gov page that allows you to view the same dashboard, but filtered for websites that are administered by one of 10 specific agencies: These dashboard pages allow for greater insight into how the public interacts with specific agency websites as a complement to the aggregated view available at analytics.usa.gov.
analytics.usa.gov: New features and more data
This post was originally published on the DigitalGov blog. As of writing this post, 25,225 of the 124,878 total visitors on federal government websites participating in the Digital Analytics Program (DAP) are NOT located in the United States. And as a result of a new location feature on the expanded analytics.usa.gov, you are free to check for yourself how many current users are from outside the country, anytime you’d like.
JSON to CSV Converter
To convert JSON to CSV, paste your JSON below. Your data is never sent to our servers. Click your JSON below to edit. Please report bugs and send feedback on GitHub. Made by Eric Mill (@konklone). DROP JSON HERE Separator Since the conversion is done inside your browser, extremely large files may cause trouble. Microsoft Edge has a smaller limit than other browsers. There was an error parsing this JSON. If you're sure this JSON is valid, please file an issue. Below are the first few rows ( total).
Why It's Time to Encrypt Lawfare
The good people at Just Security, a fellow online security blog, recently moved their entire website to "HTTPS". This means you'll always see "https://" in your browser when you visit, with a little lock sign next to it that means your connection is secure and encrypted. Just Security kindly took the time to describe why they did that: We write frequently about online privacy, cybersecurity, electronic surveillance, encryption backdoors, and data breaches.
The U.S. government is moving to HTTPS everywhere
Today, the White House's Office of Management and Budget (OMB) finalized an HTTPS-Only Standard for all publicly accessible federal websites and web services. This standard is designed to ensure a new, strong baseline of user privacy and security across U.S. government websites and APIs. As an HTTPS-only technology shop, 18F has been an enthusiastic supporter of this initiative. As we've said before, every website, no matter how small, should give its visitors a secure, private connection.
Taking the pulse of the federal government's web presence
The U.S. federal government is launching a new project to monitor how it’s doing at best practices on the web. A sort of health monitor for the U.S. government’s websites, it’s called Pulse, and you can find it at pulse.cio.gov. Pulse is a lightweight dashboard that uses the official .gov domain list to measure two things: Analytics: Whether federal executive branch domains are participating in the Digital Analytics Program that powers analytics.usa.gov.
We're Deprecating HTTP And It's Going To Be Okay
Mozilla recently announced their intent to deprecate the insecure HTTP protocol in Firefox in favor of HTTPS ( ). In practice, they plan to do this by gradually removing the ability for HTTP websites to use various web features. They're joined by the Chrome security team, who declared something similar in December. Mozilla's announcement has gotten a lot of attention, more than Chrome's, and much of it negative.
HTTPS in .gov - April 2015
1DomainLiveRedirect ToValid HTTPSDefaults to HTTPSDowngrades HTTPSStrictly Force HTTPSHSTSHSTS Preload ReadyHSTS Header2acus.govTRUETRUETRUEFALSETRUETRUETRUEmax-age=31536000; includeSubDomains; preload3aids.govTRUETRUETRUEFALSETRUETRUETRUEmax-age=31536000; includeSubDomains; preload4TRUETRUETRUEFALSETRUETRUETRUEmax-age=31536000; includeSubDomains; preload5max.govTRUETRUETRUEFALSETRUETRUETRUEmax-age=864006notalone.govTRUETRUETRUEFALSETRUETRUETRUEmax-age=31536000; includeSubDomains;...
HTTPS in .gov - April 2015 - Google Sheets
Quotes are not sourced from all markets and may be delayed up to 20 minutes. Information is provided 'as is' and solely for informational purposes, not for trading purposes or advice.Disclaimer A browser error has occurred. Please press Ctrl-F5 to refresh the page and try again. A browser error has occurred. Please hold the Shift key and click the Refresh button to try again.
How we built analytics.usa.gov
The U.S. federal government now has a public dashboard and dataset for its web traffic, at analytics.usa.gov. This data comes from a unified Google Analytics profile that is managed by the Digital Analytics Program, which (like 18F) is a team inside of the General Services Administration, an independent federal agency. 18F worked with the Digital Analytics Program, the U.S. Digital Service, and the White House to build and host the dashboard and its public dataset.
For Public Comment: the HTTPS-Only Standard
Today, the White House's Office of Management and Budget is releasing a draft proposal for public comment: The HTTPS-Only Standard, at https.cio.gov. This proposal would require all new and existing publicly accessible federal websites and web services to enforce a secure, private connection with HTTPS. Feedback and suggestions during this public comment period are encouraged, and can be provided on GitHub or by email.
The first .gov domains hardcoded into your browser as all-HTTPS
Every website, no matter how small, should give its visitors a secure, private connection. Plain HTTP ( ) connections are neither secure nor private, and can be easily intercepted and impersonated. In today's web browsers, the best and easiest way to fix that is to use HTTPS ( ). Now, a number of government websites have taken a step further and are becoming the first .gov domains hardcoded into major web browsers as HTTPS- only.
A complete list of .gov domains
Excerpt of the .gov domain list (CSV) There are a lot of .gov domains: over 5,300 of them. About 1,300 of these are used by the federal government’s executive, legislative, and judicial branches. The rest are spread across states, territories, counties, cities, and native tribes. For a while now, the public has been able to download a dataset of the roughly 1,200 .gov domains used by the federal executive branch from data.gov, the nation’s data catalog.
How to Use More Open Source in Your Next Federal IT Acquisition
The history of open source software is a record of steadily turning tremendously expensive custom-built solutions into freely available infrastructure that you can simply take for granted. What once were astoundingly sophisticated, expensive human endeavors have become open source tools you can drop into place in your project on a whim. Open source has changed what it means to make software today.
Slack is now forcing users into arbitration and that is terrible
Slack, a young and wildly successful team chat and collaboration service, updated its TOS and Privacy Policy today. They have a friendly explainer that describes a very unfriendly new policy: mandatory dispute resolution through arbitration. You give up your right to sue, or to join a class action lawsuit, and instead agree that any disputes will be resolved through arbitration. We hope we don’t have any arbitration or any lawsuits, ever.
Taking control of our website with Jekyll and webhooks
A few of us here recently took a bit of time to drastically rework 18F's main website and blog — what you're reading right now — and take it fully into our own hands. It may not look a lot different on the surface, but we made some serious infrastructure changes. Namely, we migrated the site to Jekyll, and left Tumblr behind by moving the blog inside to join it. We also set up automatic deployment to staging and live sites, using GitHub's webhook system.
Why we use HTTPS for every .gov we make
The in government websites carries a lot of weight. Citizens expect government websites to be secure, trustworthy, and reliable. Citizens expect that anything they read on a website to be official, and they expect any information they submit to that website — especially if they're submitting personal information — to be sent safely and only to the government. On today's Internet, in today's web browsers, HTTPS ( ) offers the strongest guarantee of reliable information and secure transmission.
Be the Free Law Innovation you want to see in the world
The District of Columbia's legislature is hiring a legal-hacker-in-residence — a "Free Law Innovation Fellow", modeled in part on the success of the Code for America fellows program and the Presidential Innovation Fellows program. The program is designed by V. David Zvenyach, the general counsel for the DC Council, and a role model for legal hacking. A year and a half ago, David was instrumental in opening the DC's legal code.
Quora Keeps the World's Knowledge For Itself
I recently made the mistake of answering a question on Quora: "What is it like to be a member of the 18F team?" I have a Quora account, but I've almost never used it. I noticed this question because the user somehow found me and "asked" me to answer it, which caused Quora to email me. It's a fine question, the kind of question Quora excels at getting answered, and I think the answers it produced will stand as an accurate snapshot of how the early 18F team feels about their job and their work.
Why Google is Hurrying the Web to Kill SHA-1
Hilbert map of hashing algorithms, by Ian Boyd Most of the secure web is using an insecure algorithm, and Google's just declared it to be a slow-motion emergency. Something like 90% of websites that use SSL encryption — — use an algorithm called SHA-1 to protect themselves from being impersonated. This guarantees that when you go to , you're visiting the real Facebook and not giving your password to an attacker. Unfortunately, SHA-1 is dangerously weak, and has been for a long time.
Working In Public From Day 1
In the wide world of software, maybe you’ve heard someone say this, or maybe you’ve said it yourself: "I’ll open source it after I clean up the code; it’s a mess right now." Or: "I think there are some passwords in there; I’ll get around to cleaning it out at some point." Or simply: "No way, it’s just too embarrassing." These feelings are totally natural, but keep a lot of good work closed that could easily have been open. The trick to avoiding this is simple: open source your code from day 1.
18F: An Open Source Team
At 18F, we place a premium on developing digital tools and services in the open. This means contributing our source code back to the community, actively repurposing our code across projects, and contributing back to the open source tools we use. For a variety of reasons, we believe that doing so improves the final product we create. It is because of this that our policy is to: FOSS is software that does not charge users a purchase or licensing fee for modifying or redistributing the source code.
18F: An Open Source Team
At 18F, we place a premium on developing digital tools and services in the open. This means contributing our source code back to the community, actively repurposing our code across projects, and contributing back to the open source tools we use. For a variety of reasons, we believe that doing so improves the final product we create. It is because of this that our policy is to: FOSS is software that does not charge users a purchase or licensing fee for modifying or redistributing the source code.
Switch to HTTPS Now, For Free
From now on, you should see a delightful lock next to https://konklone.com in your browser's URL bar, because I've switched this site to use HTTPS. I paid $0 for the trouble. Why you should bother doing the same: This post shows how to do your part in building a surveillance-resistant Internet by switching your site to HTTPS. Though it takes a bunch of steps, each one is very simple, and you should be able to finish this in under an hour.
Hot off the press: 18F's API Standards
We recently released the first version of our API Standards — a set of recommendations and guidelines for API production. It is our intention that every 18F API meet these standards, to help us ensure a baseline quality and consistency across all APIs we offer now and in the future. These standards guide the user-facing implementation details of an API. Wherever possible, the standards prescribe a goal instead of a specific technology.
Intro to APIs: Working with URLs, JSON, APIs, and Open Data - Without Writing Any Code
GSA’s digital teams are offering a user-friendly intro course to APIs. Regardless of your skill level, you will walk away from this lesson understanding what APIs are and how developers use them. Every federal agency is scaling out its use of APIs so even if they are not a part of your normal daily work, learning what they are, how they work, and why they are changing government.
Why We've Collected a Hojillion Inspector General Reports
A few months ago, we kicked off a new project on GitHub called . Part of the @unitedstates project, it's a small, public domain tool with the goal of eventually gathering reports from every Inspector General (IG) in the federal government. The project gathers reports by — you guessed it! — scraping government websites. There is no central, public website linking to all Inspector General reports. That means they need to be gathered from each and every IG website.
Writing in Public and Syncing with GitHub
For a while now, I've admired my friend Ben Balter for writing out in the open. His blog is built on GitHub Pages, which means that for every piece on his blog, you can see each draft and revision along the way. As importantly, Ben takes advantage of GitHub to truly embrace collaboration — whether that's detailed debate on a complex topic as he works through issues, or just graciously fielding my constant typo fixes. The end product is better for it, and everyone feels engaged and invested.
Making JSON as simple as a spreadsheet
CSV and JSON are two of the most common kinds of files for open data you'll find on the web today. CSVs are just spreadsheets and are a common way to let people download data in bulk. Tables of data are simple, and a great many people are used to working with them in Excel or Google Docs. JSON has become the format of choice for APIs on the web today, but JSON data is trickier to work with for many people.
An all-Bitcoin super PAC opens, then immediately closes
The Bitcoin Voters PAC (BVPAC) — a super PAC intending to receive and spend money entirely in Bitcoin — opened its doors on Jan. 6, and promptly closed them just two days later. Its website, bitcoinvoterspac.org, now states: Due to the new compliance issues at the state level, we are unable to continue operations at this time. We would like to thank the FEC for their acceptance of bitcoin addresses instead of a bank account for deposits.
How to Hack the Developer Console to be Needlessly Interactive
A stray interaction with Garrett Miller about how he put a colorful easter egg in the developer console for Mapbox sent me on a journey of console self-discovery, which resulted in me putting way too much time into isitchristmas.com’s developer console this year. This makes use of four tricks: applying basic text styling to output, hacking in sprites through background-images, executing code without using parentheses, and suppressing return values.
Government APIs Aren't A Backup Plan
When the government shuts down and takes most of its data with it, the public needs to have a backup plan. The laws still apply to us. Politicians are still raising money. We still have a population, unemployment, and social problems. But if you want to look up some of those basic facts, well, Data.gov can't help you, you'll have to ask about those campaign donations later, and the Census will get back to you someday. It's not 1995 anymore.
The Library of Congress Really Really Does Not Want To Give You Your Data
It's 2013, and the Library of Congress seems to think releasing public data about Congress is a risk to the public. The Library of Congress is in charge of THOMAS.gov, and its successor Congress.gov. These sites publish some of the most fundamental information about Congress — the history and status of bills. Whether it's immigration law or SOPA, patent reform or Obamacare, the Library of Congress will tell you: What is Congress working on? Who's working on it? When did that happen?
A Modern Approach to Open Data
Last year, a group of us who work daily with open government data -- Josh Tauberer of GovTrack.us, Derek Willis at The New York Times, and myself -- decided to stop each building the same basic tools over and over, and start building a foundation we could share. We set up a small home at github.com/unitedstates, and kicked it off with a couple of projects to gather data on the people and work of Congress.
I Want To Know Links
It's been surprisingly frustrating to reliably track who's linking to my "Door to the FISA Court" post. I kept pretty on top of the major traffic drivers in Google Analytics and Twitter for the first few days after posting it, and it did pretty well. But 9 days later, my friend Brandon flagged a New Yorker piece that linked to it (among a long piece with many links), and I realized I had no practical way of finding these myself.
The Door to the FISA Court
Nobody will actually tell you where the door to the Foreign Intelligence Surveillance Court — also known as the "FISA Court" — is. It's understood to have moved from the Department of Justice to the E. Barrett Prettyman Courthouse in 2009, but when I visited Prettyman, the employees in the first floor District Clerk's office (gently) laughed at my attempts to find anything about the Court. They referred to it as the "Room of Requirement", and said they had no idea what floor it was even on.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Eric
Contact Eric, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack