Just to clarify for other readers, you post makes it sound like "NASA Doesn't do much" at NASA ARC.

I work at ARC, and it's a wonderful research facility! In just my short time here I've been involved with groups doing pioneering work in computer science and robotics, supercomputing, avionics, aviation safety, cockpit design, UAVs (for science, not war!), earth science, biology, astrophysics, planetary discovery, and so much more!!

NASA Kepler, which just found a "twin" earth (Google: Kepler 22-b) was begun here, and the science operations are still performed here.

Quite a lot of great stuff comes out of NASA Ames, for a very small overall price tag.

Hi all; I actually work for NASA as an IT Security guy.

While I can't answer specifics about this incident, you should remember that a great many things done by NASA are "General Science", and the data output from them is specifically and consciously made public.

It's possible that the FTP server is meant to be serving those files "to the public".

Why FTP instead of SFTP? Usually when you choose to make data public to the world, you don't bother implementing crypto on the data. And just because it's available via FTP for distribution, does not mean insecure FTP was used to *place* the data on the server.

You're quite right, actually. I didn't really want to go into all that detail with my post though, and knowing the "average" IT guy I think I'm still safe saying that they'd say "Hey, that should be in a datacenter!". ;)

Before everyone gets all spun up on government waste, inefficiency, etc - I'd like to point out that numbers like these are never accurate. (For the record, I work for the feds, in the IT field).

The problem with "The feds have X datacenters" as a metric is that various audits occur at different times and by different auditors. These auditors almost always have differing definitions for what a datacenter actually is.

In one audit, a group can come through and define "Datacenter" as a big room where servers are co-located and services run on behalf of others. They'll find 2 at my center. Then a year later, a different group comes in and defines "Datacenter" as anywhere that more than 5 computers are running and left on all night. They'll find 200 at my center. Yes, this actually happened! The auditors came through dozens of science labs, found project servers sitting in the labs, and labeled each lab a datacenter.

Now here is the trick to why the statistics are complete mush. A normal IT guy would walk through the lab and say "Hey, that server should be in a datacenter!" -- but the auditors make the reverse conclusion. "Hey, this lab is a datacenter".

Yes, there is waste in the federal sphere and we absolutely need to take action to be more efficient at all levels. However, this article is basically pushing a number that came from someones' imagination, and pretending it's meaningful.

Duh, how could I not think of a prompt + whitelist. :P

Then again, that presents the "NoScript" problem. While techies generally tend to use noscript, I pretty much see non-techies clicking "Temporarily allow all this page" on every page they visit that "doesn't work right" without even looking at the URL lists. So, a prompt to whitelist content would probably just get the same treatment. Better than status quo I suppose, but not a panacea either.

Wouldn't this feature also kill things like OpenID and other "Single Sign On" services?

If one strace's the chrome flash plugin process one discovers that in 10 seconds it issues 56,000 system calls -- 53,000 (95%) of them are useless gettimeofday() calls

Per my co-worker: That's probably why flash sucks so bad on MacOS. Apple won't give them the time of day!

One of the well documented problems is that if you cut wood that is "too wet" then the brake will activate, thinking that it's hit flesh.

So really the article should say "Each time you cut wood that's too damp (which you have no way to determine beforehand) you pay $169 to replace the blade and brake". That puts into focus why some woodworkers who know how to be careful do not WANT the safety feature.

Sounds like an excellent idea for foreign espionage. Set up a private shell company, then invite a bunch of former officials who know exactly how the real systems work, to get together in a hotel you've bugged and start pretending they're responding to a cyber attack of some sort.

Official1: "Call the NSA Task force Orange, tell them to begin operation Stork."
ForeignAgent: (making notes) Operation Stork.... NSA... means X..."

FYI, NASA does not have a pension plan and has not for years. Lately, we're all on the "TSP" - Thrift Savings Plan. It's the government equivalent of the 401k.