Probably a bit unfair. They were early to the market and met all the usual UK Govt. paper-firewall rules well before the hyperscalers were viable options. It's just they haven't found a good fit in between the global forces of G.A.A and the legacy Fujitsu datacentre style approach and the Govt. has become somewhat more pragmatic over cloud for many workloads.
Yes exactly, it lets public sector teams / orgs quickly host something without needing experts or a load of red tape. It's a go-to approved hoster with internal government support available.
Looks like a decent CloudFoundry implementation, doing what its good at: keeping developer teams abstracted from lower level cloud infrastructure and orchestration internals.
But when it gets big enough, it might be worth the government spinning up their own hardware and competing.
Are there any other cloud providers who have started by reselling another cloud providers products? Even as a reseller they ought to be able to make a decent profit by relying on volume discounts.
Probably not - this is probbaly done to ensure apps are hosted correctly, and conform to specific security requirements while also being easy to deploy and maintain.
I doubt the UK government is interested in setting up competing infrastructure.
It will if Amazon keeps boiling the frog with pricing.
Having a consistent platform like this also gives them negotiating muscle because if they wanted to up sticks and move completely it is much more feasible.
AWS's pricing may be eye watering in a few cases - looking at you egress - but one thing they definitely get right from my PoV is rarely if ever hiking prices
They don't change unit pricing if that is what you mean not even at very high volume.
That means bill increases become costlier at scale as the volume discounts are not deep enough in a build vs buy on a pure cost basis (Lock-in, ease of use, reliability, talent reasons apart) at 100's of millions or billions spends governments do not to consider inhousing.
I doubt it, I worked on gcloud that provided several government departments access to our public cloud (and others, vetted and signed up to gcloud intiative) running openstack. They ended up going all in on AWS as it was simpler than managing multiple workloads across different cloud providers (not all Openstacks are the same!), oh, and DynamoDB.
"But when it gets big enough, it might be worth the government spinning up their own hardware and competing."
Not really, this is not something we want governments doing.
In Canada, we spent almost $1B on a simple gun registry - the equivalent of a few spreadsheets with a few million records with security overlay, and almost $1B on a Federal Payroll system that doesn't work.
IT, particularly products, is one of those areas where budgets can go over by infinity, it's systematic white collar corruption.
If AWS becomes less than ideal, there's maybe another service provider that can do it.
Even this initiative, while laudable, may not be perfectly operationally ideal.
Just like AWS actually has carved out a special government offering of their services, I believe a host of other providers should as well ...
A PaaS/SaaS customized for a given domain, like a country, that built out basic identity services and privacy features given the local regulatory environment, would be ideal.
Then the gov. can legislate, communicate, provide oversight while risking the fewest dollars doing the trickiest things.
It's not entirely implausible that things can be managed effectively, Sweden has done some amazing things in particular with process and communication. But they are small and special and take 'design' seriously literally as a culture.
> Are there any other cloud providers who have started by reselling another cloud providers products?
For government, yes. The USAF has a common infrastructure provider called Cloud One, built on top of AWS GovCloud. You can try to go to their website at https://aws.cdl.af.mil, but you won't be able to, since it requires a CAC and mutual TLS.
Among the things it gives you on top of AWS:
- CAC authentication, so MFA isn't optional like with vanilla AWS and you don't need separate IAM for human users (at least not the "I") since every user already has an externally provisioned and managed identity
- Air Force managed firewalls, so you can't just choose to be completely open, which vanilla AWS is perfectly happy to allow
- A limited subset of AMIs and managed services that are pre-approved as being sufficiently mature and secure for DoD production use
- Only pre-approved roles and policies, i.e. you can't accidentally create a publicly accessible S3 bucket because the system won't even allow that as an option
And yes, there are economies of scale and volume discounts and what not that have allowed some DoD infrastructure and platform providers to operate without any appropriated spending at least for some period of time, as in they fund themselves entirely by charging other government programs that use them. Platform One was like that I think for at least the first 18 months it existed, but then eventually received its own direct funding.
Also, there are some instances of the government building its own data centers. Raytheon used to own the computing infrastructure for basically the entire NRO, and had their own commercial cloud offering built on top of OpenStack they called "EVE" but it never ended up being used outside of this single client and has since been effectively abandoned going forward now that C2S exists using AWS in classified data centers run by Amazon. There is still a limited subset of NRO programs using something called the "AUE" or Agency Unique Equipment, however, which is another Raytheon contract called Palinode, and this serves applications with extremely specific hardware needs that Amazon can't currently meet, i.e. FPGAs, ASICs, non x86/ARM architectures, bare metal clusters with guaranteed not-shared Infiniband SANs, but it will probably one day go away when commercial cloud providers are eventually able to do that, too.
Sounds lovely but limits competition and innovation, promoting oligopolies. I admire the nerve of "10% Procurement fee". Wait until there is a guideline that demands the use of GOV.UK Platform as a Service (PaaS) for the UK Public sector.
A sensible approach would have been a list of certified service providers and contact points for contracting.
Do you realise this is the government building software for the government?
That's like complaining that Amazon have a monopoly on hosting Amazon services.
> A sensible approach would have been a list of certified service providers and contact points for contracting.
No let's not for example ask the Forestry Commission to build or contract their own cloud services... that's not what they know about or what they're going to be good at.
In this case Gov.UK PaaS has a single vendor, AWS. I am in favour of multiple options, multiple vendors. The certification can be done by Gov UK agency that guarantees vendors up to spec. The current model "Forestry Commission" still needs to build, develop, define spec, buy and pay Gov.UK PaaS.
I would expect to see a 10% procurement discount, since they presumably have more negotiating power with AWS when buying £££££'s worth of stuff annually, rather than every individual government team setting up a small account for a few ££'s.
For that 10% fee, a Government department gets a whole host of DevOps support, all the contractual stuff dealt with, all the security vetting / compliance bits sorted out. The alternative is they can go and hire all those people to make that happen and it takes months or years and cost £000's more than the fee!
Individual Government departments (or more accurately, individual teams or even individuals) procuring their own cloud services and creating a technical and bureaucratic FUBAR nightmare is exactly the problem the Gov.UK PaaS aims to solve.
As a user, Notify is my favourite service ever. It's just so well designed, you can get up and running in about two minutes, and you can even use it to send yourself official looking letters in the post. What's not to love?
They are not selling it to you, but "public sector services". It's effectively the national government telling the various bureaucracies "hey, we got this cool service over here, easy to use and probably cheaper than what you are doing - give it a spin maybe?"
In more "Napoleonic" countries the State would just mandate adoption and you'd never know it, but in the UK the public sector is awfully balkanized, so there is a need for public marketing.
> Balkanization is the fragmentation of a larger region or state into smaller regions or states, which may be hostile or uncooperative with one another.
https://en.wikipedia.org/wiki/Balkanization
Applying this to a government you will have one where you have a lot of separate agencies that are hostile, uncooperative, and don't want to follow any unified standards.
Which means it is not an accurate description as most agencies are not hostile to one another or uncooperative, its just that they are independent and have (sometimes) competing goals. They have no requirement to work together, but some are realising that there are benefits to doing so.
You can read that sentence in Sir Humphrey Appleby's voice for top comedic effect.
Jim Hacker would have probably replied "So you're telling me they are not playing against each other, except when they are playing against each other...?"
Not sure why this is here (it's been in use for a while), but for the uninitiated, the GOV.UK PaaS is an abstraction over AWS that helps to standardise what has historically been a fragmented approach to hosting applications.
A bit off-topic, but gov.uk is quickly improving into an actual usable site. The GDS (Government Digital Service [0]) and the GDS (Government Design System [1]) - who run the posted link too - are doing a great job. Want to renew my passport? Easy, same UI/UX for getting a drone license, taxing my car and filing for benefits. Want to renew my driving license? Well, that's yet to move from the old DVLA site, but it's all getting there!
> A bit off-topic, but gov.uk is quickly improving into an actual usable site.
In my experience gov.uk has been vastly superior compared to other websites for a long time. Gov.uk seems to be more consistent with everything than most company websites are.
Yeah the British government's IT projects have a bad reputation but credit where credit's due gov.uk is really good in my opinion. I remember reading (probably here) that it was designed with a philosophy of 'our users don't have a choice but to use our software, so we must make it as un-infuriating as possible'.
Agreed. I was delighted that my passport renewal process from first applying all the way to getting my new valid passport was about 12 days. The UK government's digital services is honestly a big factor in keeping me a UK resident
Credit where credit is due, this is the legacy of the Cameron government (although the conversation started under Brown, iirc, it was the first Cameron cabinet that really pushed it, by basically setting up a skunkworks group that answered directly to the PM). The efficacy and power of GDS has since ebbed and flowed, but clearly they managed to entrench some great practices that continue to this day.
> setting up a skunkworks group that answered directly to the PM
Isn't that massively excessive? Why does the Prime Minister need to be spending his time listening to a report direct from a team implementing software services?
Because otherwise the effort will end up in the quagmire of civil service politics, the sort of stuff you see on "Yes Minister" (greatly exaggerated, of course, in the same way "Silicon Valley" exaggerates Californian startup culture).
With a direct line to the PM, every time a mandarin tried to block things (likely in order to favour his golf buddies from this or that vendor), GDS could go "ok, shall we take it up with the PM then?" and that would be the end of it.
It's effectively the nuclear option, in terms of civil-service management, but sometimes it's the only way to get stuff done.
Gov.uk is _the_ primary way that anyone interacts with the UK government. Why shouldn't it be one of the highest priority aspects of government? I don't think the Prime Minister was sitting in on daily standups and sprint planning, but it makes sense that they should have a good overview of progress and development in GDS during its infancy.
Effectively it was in the PM's department directly, which means it was not subject to cross-department jealousies etc. Watch some series of Yes Minister, even though set in the 1970s and 80s, it's still all true.
I recall GDS being initiated for internal DOH stuff circa John Major, going into Blair era (yip was there when Blair took over the role).
Not that I'd attribute it to any PM, believe it was driven by the government security services (which department/flavor I could not say).
That all said, it may of been a different aspect but certainly has a longer story than told. With that, it started as an intranet project iirc.
https://gds.blog.gov.uk/story/ has some insight but that seems more to cover the more public web aspects and even they say it is "a story" not "the story".
So be fascinating to peace the "full story" and history together.
If any credit should be laid, it would be upon the civil servants and associates that came up with the initiative, who sadly will probably remain nameless even if their names were known. Politicians just green light so much and claim credit, so much goes on behind the scenes of any government. With that, best think of politicians as orchestra conductors who depend upon musicians knowing how to do things, often able to do things right without eye sight of the conductors at times.
There was a significantly renewed manifesto-driven push to open source/open standards with the coalition in 2010; some of gov.uk really is down to Cameron rejecting the (Microsoft/EDS/Fujitsu-heavy) approaches of the previous administrations.
I don't really like giving them credit for anything but there it is.
What is there now was significantly rehashed under the first Cameron administration. I remember talking to a few insiders at PyconUK, around 2010-11, and they were saying they basically had carte blanche to nuke it all from orbit and rebuild how they saw fit. The government wasn't particularly popular at the time (what with the sweeping cuts to social services), but the people in question were adamant that, on digital services at least, the big guys really wanted to make a difference for good, and that it was a clean break from the past - hence why they were going to places like PyConUK to recruit motivated forward-looking people. That government effectively lasted 5 years, so they did a lot of work in that timeframe. I later heard through the grapevine that the waters got choppier after 2016, and I've not really heard anything after 2019 (beyond the occasional coded grumble on twitter), so I don't know how things are today.
> it would be upon the civil servants and associates that came up with the initiative
From what I understand, the power of this was precisely that it came from people outside the career civil service. Although this narrative came from Conservative quarters (who occasionally indulge in civil-service bashing), I find it credible. Established powers in the system tend to have established friends among deep-pocketed vendors, particularly these days that doors tend to revolve quite furiously. For all the good they did elsewhere, one undoubtedly bad legacy of the Blair-Brown years was eccessive trust on friendly vendors vs in-house.
The Cameron government learned the lessons of the massively wasteful failed IT projects from the Blair era (see Fujitsu NHS contract).
The GDS started well, but I don't think the GDS can continue to cruise on its earlier reputation. It too has started to fall back into the bad old days of massively wasteful projects with unclear scope, such as the Verify system, that is absorbing hundreds of millions of pounds for dubious benefit [1].
"Unfortunately, Verify is also an example of many of the failings in major programmes that we often see, including optimism bias and failure to set clear objectives." [2]
I think the idea of GDS is a good one, but evidently it needs to continue to reevaluate itself to avoid regressing into what it was originally setup to avoid.
Exactly, through recall this was Conservative and Liberal Democrat coalition government, so Nick Clegg (you might have head of him) may have a claim.
Actually the credit should go to the brilliant and dedicated people in GDS doing great work; though I do not know enough to pick out names. The UI/UX and implementation was first class from the get go.
As a Brit my life is made remarkably easier as a citizen and startup entrepreneur. The benefits to the UK ecomnomy are enorous but not measured. In contrast my personal experience of govt engagement when setting-up and running startups in US between 1991 and 2013 were painful. And would have been very painful without help (thank you YC).
Finally if we are going to give leadership credit it should go to Francis Maude [0]. He happened to be my local MP, so I met him quite a few times, and he was most helpful and astonishingly effective in helping us navigate two big challenges we had in facing down, shall we say, "unethical quango-business partnerships". A remarkable, thoughtful man and effective operator, who was in government over three decades [1].
They all tore up the rulebook. The rule being: Government can’t do computers. Outsource to favourite big consultancy. Twenty years were wasted on that nonsense approach.
Some of the greatest resistance comes from the big departments who are actively hostile to many of the changes required to work in this way. There’s a lot to be said for a round of golf at The Belfry with the splendid chaps from the IT consultancy your department spends £2bn a year with.
I've moved from Germany to the US and then to the UK. gov.uk is by far the most impressive government website i've encountered. Accessible, consistent and just works. Really a good show of what a government website can offer if done right.
The German idea of an online platform is a website developed by Telekom (outsourced by them to the lowest bidder) which makes available the fax number of the Behörde, and the timings that the fax machine will receive incoming faxes.
That's as German as you get. I'm sure there is a German idiom for "that's how it's always been done and the change is someone else's fault" because that's the attitude. Had that a couple of times in shops. Business is bad because we're closed at peak times and that's the customer's problem. Business is bad because we don't accept cards and that's the customer's problem. Business is bad because our customers don't have fax machines these days and that's the customer's problem.
Recently I was with a German friend and she nearly fell on her ass when I showed her that you can actually pay at a car parking machine in the middle of nowhere with Apple Pay here in the UK.
I still remember last time I visited. One Sunday morning, I went to the Bäckerei and tried to pay for my Brötchen and Stückchen with my card and they just looked at me in disbelief. I quickly realized my mistake but it was too late. I had no cash so I left without any baked goods.
not so much, some of the redesigns ripped out the usable data and replaced it with holding pages. Specifically to do with immigration, that hit us a couple of years ago.
However its pleasing to see a site that works well on crappy computers.
> Want to renew my driving license? Well, that's yet to move from the old DVLA site, but it's all getting there
Some important UK government services are still lagging behind. DVLA, since you mention it, has a mix of okay and truly appalling services. I'm in the position of trying to renew my driving licence after it was revoked for medical reasons. It's now six months since my cardiac arrest and I now meet the medically-fit-to-drive criteria. But, I face an 84 day delay in my application being processed, as detailed on the DVLA's 'how-slow-are-we-today' page [0], which is actually labelled as a COVID-19 update. Furthermore, I have to post a paper application form to them as they haven't yet digitized the medical review service [1]. This is life-wrecking stuff for anyone who needs a driving licence for their work or similar.
I do like the gov.uk sites in general, but a lot of the back-office stuff is still disastrous. Some of this is due to strike action and COVID, but a big part of the problem is the continual failure of the various UK Govt departments to successfully manage large IT projects.
The (old) DVLA web site is merely a shallow front end for the 30 year old incompetent bureaucratic triangle of carnage that hides behind it.
To get a decent result on any IT project you have to fix the organisation behind it before you even think about replicating that organisation digitally.
> To get a decent result on any IT project you have to fix the organisation behind it before you even think about replicating that organisation digitally.
Exactly. I've seen this myself back in the day when I supported the MOD's system development (simulators for training, as it happens). As a techie, I was asked to develop some interoperability middleware between disparate systems. As my career matured, my focus changed to trying to get the systems to use common interfaces protocols / standards. Then I thought - why can't they have common requirements since may of them are doing very similar things, and drive tech commonality top-down. So I started working with the respective acquisition teams to get them to adopt common conventions. Then I started to question why they had disparate acquisition teams in the first place. This turned out to be because there were multiple customer project teams. Why was that? Because the different tribes in the army (infantry, armour, etc) didn't speak to each other at that level.
I eventually realised I was seeing a sort of example of Conway's Law [0], and was finally able to develop a proper briefing for a senior decision maker who was concerned about the technical / contractual complexity at one of his training schools (which had multiple different types of simulator, each with out own through-life support programme). This I believe finally led to some coherence-focussed reorganisations of the MOD teams involved, which was perhaps the most impactful thing I achieved in a couple of decades working in this space.
Does the DVLA driving license service still only work during office hours? I couldn't believe they had an online system for renewing licences but it couldn't be accessed at night. Allegedly it's based on an ancient system that can't be trusted to be left running unattended.
Not actually tried this, as the online systems don't support the service that I need in the first place.
Part of the problem is that they have multiple back-office legacy systems. I remember reading recently about a modernization of the personalised number plate system. This was apparently completely separate from the licence management so could be modernised quite easily. How convenient that it just happens to be a good revenue generator for DVLA, so presumably it was easier for someone to justify the development costs.
> A bit off-topic, but gov.uk is quickly improving into an actual usable site
Where've you been?
Agree with your points but the things you mention have been around for almost 10 years now (driving license/passport renewal easy UX etc). I renewed my passport around 7 years ago and it was much easier to use then.
It's true there's some services that tail off into the older systems (and you can tell), but the modern things gov.uk has owned have always been good since launch.
Like a lot of users of the services of several government, gov.uk is consistently the best for many reason: simplicity, language clarity, accessibility, very lean design. There’s a certain… brand, i.e. the four aforementionned qualities taken as far as possible, that I really like -- but not everyone enjoys the assertive use of screen space. Just remember: visually impaired people pay taxes too.
But for web developpers, that’s not all: it’s very deliberate, there’s detailed public guidelines, a scrutiny that developpers of the most popular open source project might recogonise. The overall result is that the people working there are very good. They are principled, and typically very complementary of the independent-minded polymath that many of us have worked with. They understand accessibility in detail and many dimensions (think: both rare handicaps and aging web-clients).
I’ve worked with several and I would strongly recommend considering experience at the Government Digital service (GDS) as a very good signal on a CV, akin to senior role at a big tech, or early engineer at a successful start-up.
off-off-topic: i've recently discovered (through a job listing) that the moj has been doing some open-source work around all the software they use to manage prisons and prison-related stuff. surprisingly interesting - e.g. https://github.com/ministryofjustice/prison-api
FWIW San Francisco is doing something similar. The have a digital services department and want to convert all city websites to the same design language:
Very cool. Worked adjacent to something similar in public sector. If you are doing this for a govt, may I recommend you include the following services:
- IAM Federation and brokerage service that takes arbitrary IDPs (every application is a simple document management problem at the tip of the iceberg, with a giant authN/AuthZ problem underneath. Consider authZ as a service as well)
- HSM/Vault for standard secrets management across applications
- Encrypted backup to data lake service, with cold storage option.
- vulnerability scanning and patch management (lines of business can't be trusted to do application patching)
- CI/CD pipeline service
- Jira/ADO or other "standard" project collaboration scheme
Managers don't usually know about this stuff, and they're the dealbreakers when you don't have them.
indeed, adding IAM is massive scope creep. I'd estimate anyone who understood that comment and didn't know it already saved about $100k in consulting fees and hundreds of hours of souding out why someones project is failing. These are the underlying issues.
I had to deal with public administration in the UK, Italy, Spain and Sweden. The UK one is probably the easiest to use. You can definitely see that there is an excellent team behind.
There is one weakness, in my opinion, but it's not the service's fault as much as a national problem: identification is still messy. Whereas most continental administration have standardized on some sort of electronic-signature standard (which can be used to communicate safely and reliably as well as signing actual documents), the UK has not. The result is that the ID system is still excessively amenable to fraud and prone to problems identifying complex identities across all services.
This seems to be a national issue though, akin to the rejection of ID cards.
I moved from the UK to Scandinavia and there is a BankID system that allows you to authenticate yourself for any digital service, public or private, and it's amazing how useful that is. I work in financial services and the ability to correctly identify a new customer removes a bunch of problems that we'd have elsewhere.
The flip side is that if you don't want this ID it becomes more difficult (but not impossible) to access any digital service. It also relies on an integrated public population register, which some people have problems with. But it's not a physical ID that you can be asked for or are required to have, so doesn't have the ideological & political issues of requiring a universal ID card.
I did the opposite move, from Scandinavia to the UK - it wasn't easy to adapt to the various identifications methods here like GOV.UK Verify and other platforms versus just using BankID everywhere. It was also weird seeing how every bank here has their own authentication method!
Italy has the SPID, Spain has ID cards with personal certificates since ages. I guess other countries have similar systems. The UK, with its reliance on "what is your date of birth" is the outlier really...
Agreed. In the UK with all the paranoia about IDs it's complicated. In Spain I got my first Https certificates (client side) in 2008 or even before. Their system are technically pretty cool, but UX is a mess.
There is an initiative at EU level to have a common electronic ID, which would make a lot of sense, though probably not applicable to the UK.
If anyone is interested in doing similar work at UK Parliament, we're on the same journey that UK Gov are on, although not quite as advanced yet so there's a lot of scope to shape what we're working on from an early stage:
Enterprise architect at £50-60k per year seems like a role that has been put on the jobs website to provide evidence that it cannot be filled and thus can go to a service company rather than an honest expectation of getting any realistic candidates
I don't know about that particular role, but I can say that many people work in public service knowing full well they could probably double their salary in the private sector, but do it anyway. Mainly because of the large amount of annual leave and a pension that is unbeatable in the private sector, but also the opportunity to do really interesting work in genuinely unique environment, rather than work for another food delivery startup.
I am a civil servant and while it's technically true that I could double my pay in the private sector, I would likely be on the top 1 percentile or higher.
I'd guess that salary is on the bottom 10 percentile for enterprise architects.
Edit
Pension is a good reason too, it is my main reason :)
While I understand that some people want to work in public service because they find the kind of work more meaningful; I think those reasons are a bit weak.
From what I can see, the annual leave for these roles is 30 days per year, this is nice but 25 days is pretty standard in most tech jobs in the UK, with some employers allowing you to sacrifice salary in exchange for more days (+ or - 5 days in exchange for equivalent days of salary)
I know the pension plan for civil service is particularly good, but I wonder how it compares in terms of actual pension pay with having worked for big tech and contribute part of a salary that is, as you said, probably double – plus company contributions or matching which can be quite high (5-10%). Also, the RSUs you get and yearly refreshers kinda become your pension plan for a lot of tech workers.
Life isn't all about money, but for most people money is the primary reason to choose one company over another.
Then I would suggest the public sector probably isn't for you, which is fine! But clearly, many people do enjoy working there and are quite happy with a lower salary.
The fact that we struggle massively to recruit people and that there are teams with a majority of contractors would suggest that perhaps there aren't enough people willing to look at the tradeoffs and maybe higher salaries would deliver better value for the tax payer ( we get paid a lot less than contractors)
Obviously anecdotal evidence regarding the above but still
Clicking through shows it to be on the low-end of that range, too, at £50,870. While I work in government UX and appreciate there's a level of serving one's country and fellow constituents, that is simply not enough salary to recruit a highly-qualified individual. Especially considering government services are under constant attack by nation-state threat actors, we should be hiring the best individuals to protect parliament.
I went for an interview with GDS a few years ago. The interview itself was 5 hours long, which was gruelling, but it looked like a great setup. I'm not surprised they're doing well. (I got an offer, but turned it down in the end.)
Absolutely aced the interview, they offered me the role of the boss of the boss that I was interviewing for, a massive sign on bonus, a salary so large that it would have affected the debt to GDP ratio of the country and the biggest corner office they had. On my way out through the lobby everyone applauded, it was a great day for all.
I worked on this for nearly four years. It’s a great fit for a lot of government needs: they need a stable, reasonably secure platform that helps them build medium-complexity websites.
It’s based on Cloud Foundry, a “run your own Heroku”-type project. That’s starting to show it’s age now but it’s been a great model and had major benefits in government.
We've maintained the core Cloud Foundry experience, and added value around the edge with service brokers, good documentation, support, app autoscaling (using the CF-blessed autoscaler, which doesn't come "in the box"), some additional metrics, and a couple other bits.
That's interesting. Where I work we've got an in-house deployment of a CF fork (public, not ours) which... yeah, nobody likes, and AWS and GCP are getting more of our money every year as we shift stuff off.
Just the autoscaling wouldn't be enough to keep us on it, but running it on someone-else's-infrastructure with a proper support model might.
Yaknow, I was expecting somebody would make a CF plugin for Waypoint. I just didn't expect it'd be before 1.0! I'm going to take a look at this, thanks.
Taxpayers of the UK ought to get free hosting with this platform, considering they already paid for it. Cut government spending if it has resources to do this sort of work. Government is not to provide business services.
Nothing is free, if they did that Tax's would have to raise to cover the costs. Plus this is not for busineses but for the Government Department(s) themselves and Quangos.
125 comments
[ 37.0 ms ] story [ 2592 ms ] threadThere are already a ton of snowflake "single platform for X department" deployments.
That said, I applaud the effort and hope it becomes the norm.
Are there any other cloud providers who have started by reselling another cloud providers products? Even as a reseller they ought to be able to make a decent profit by relying on volume discounts.
I doubt the UK government is interested in setting up competing infrastructure.
Having a consistent platform like this also gives them negotiating muscle because if they wanted to up sticks and move completely it is much more feasible.
Do they?
AWS's pricing may be eye watering in a few cases - looking at you egress - but one thing they definitely get right from my PoV is rarely if ever hiking prices
That means bill increases become costlier at scale as the volume discounts are not deep enough in a build vs buy on a pure cost basis (Lock-in, ease of use, reliability, talent reasons apart) at 100's of millions or billions spends governments do not to consider inhousing.
Not really, this is not something we want governments doing.
In Canada, we spent almost $1B on a simple gun registry - the equivalent of a few spreadsheets with a few million records with security overlay, and almost $1B on a Federal Payroll system that doesn't work.
IT, particularly products, is one of those areas where budgets can go over by infinity, it's systematic white collar corruption.
If AWS becomes less than ideal, there's maybe another service provider that can do it.
Even this initiative, while laudable, may not be perfectly operationally ideal.
Just like AWS actually has carved out a special government offering of their services, I believe a host of other providers should as well ...
A PaaS/SaaS customized for a given domain, like a country, that built out basic identity services and privacy features given the local regulatory environment, would be ideal.
Then the gov. can legislate, communicate, provide oversight while risking the fewest dollars doing the trickiest things.
It's not entirely implausible that things can be managed effectively, Sweden has done some amazing things in particular with process and communication. But they are small and special and take 'design' seriously literally as a culture.
For government, yes. The USAF has a common infrastructure provider called Cloud One, built on top of AWS GovCloud. You can try to go to their website at https://aws.cdl.af.mil, but you won't be able to, since it requires a CAC and mutual TLS.
Among the things it gives you on top of AWS:
- CAC authentication, so MFA isn't optional like with vanilla AWS and you don't need separate IAM for human users (at least not the "I") since every user already has an externally provisioned and managed identity
- Air Force managed firewalls, so you can't just choose to be completely open, which vanilla AWS is perfectly happy to allow
- A limited subset of AMIs and managed services that are pre-approved as being sufficiently mature and secure for DoD production use
- Only pre-approved roles and policies, i.e. you can't accidentally create a publicly accessible S3 bucket because the system won't even allow that as an option
And yes, there are economies of scale and volume discounts and what not that have allowed some DoD infrastructure and platform providers to operate without any appropriated spending at least for some period of time, as in they fund themselves entirely by charging other government programs that use them. Platform One was like that I think for at least the first 18 months it existed, but then eventually received its own direct funding.
The issue seems to be with Firefox, there's no issue in Edge. I assume Chrome would be fine as well
https://imgur.com/35cLwPH.png
That's like complaining that Amazon have a monopoly on hosting Amazon services.
> A sensible approach would have been a list of certified service providers and contact points for contracting.
No let's not for example ask the Forestry Commission to build or contract their own cloud services... that's not what they know about or what they're going to be good at.
In more "Napoleonic" countries the State would just mandate adoption and you'd never know it, but in the UK the public sector is awfully balkanized, so there is a need for public marketing.
What does this phrase mean?
Applying this to a government you will have one where you have a lot of separate agencies that are hostile, uncooperative, and don't want to follow any unified standards.
Jim Hacker would have probably replied "So you're telling me they are not playing against each other, except when they are playing against each other...?"
https://cloud.gov/ https://github.com/cloud-gov
[0] https://www.gov.uk/government/organisations/government-digit... [1] https://design-system.service.gov.uk/
Edit: Yes, I know the UK Gov's system for benefits isn't easy to understand. That's on the Gov, not GDS :)
In my experience gov.uk has been vastly superior compared to other websites for a long time. Gov.uk seems to be more consistent with everything than most company websites are.
Isn't that massively excessive? Why does the Prime Minister need to be spending his time listening to a report direct from a team implementing software services?
With a direct line to the PM, every time a mandarin tried to block things (likely in order to favour his golf buddies from this or that vendor), GDS could go "ok, shall we take it up with the PM then?" and that would be the end of it.
It's effectively the nuclear option, in terms of civil-service management, but sometimes it's the only way to get stuff done.
Which is another way of saying it conveys the reality more realistically than a documentary could ever get away with.
There seems to be a much longer history of MPs and PMs being corrupt than the mandarins.
Not that I'd attribute it to any PM, believe it was driven by the government security services (which department/flavor I could not say).
That all said, it may of been a different aspect but certainly has a longer story than told. With that, it started as an intranet project iirc.
https://gds.blog.gov.uk/story/ has some insight but that seems more to cover the more public web aspects and even they say it is "a story" not "the story".
So be fascinating to peace the "full story" and history together.
GDS was a whole catchment in the early days, that included the phone services and that was contracted to Mercury telecom at one stage, or aspects were. https://en.wikipedia.org/wiki/Mercury_Communications
If any credit should be laid, it would be upon the civil servants and associates that came up with the initiative, who sadly will probably remain nameless even if their names were known. Politicians just green light so much and claim credit, so much goes on behind the scenes of any government. With that, best think of politicians as orchestra conductors who depend upon musicians knowing how to do things, often able to do things right without eye sight of the conductors at times.
I don't really like giving them credit for anything but there it is.
> it would be upon the civil servants and associates that came up with the initiative
From what I understand, the power of this was precisely that it came from people outside the career civil service. Although this narrative came from Conservative quarters (who occasionally indulge in civil-service bashing), I find it credible. Established powers in the system tend to have established friends among deep-pocketed vendors, particularly these days that doors tend to revolve quite furiously. For all the good they did elsewhere, one undoubtedly bad legacy of the Blair-Brown years was eccessive trust on friendly vendors vs in-house.
Martha Lane Fox, bless her.
And the brilliant Tom Loosemoore, also behind https://www.theyworkforyou.com/
https://www.writetothem.com/
https://www.fixmystreet.com/
https://www.whatdotheyknow.com/
The GDS started well, but I don't think the GDS can continue to cruise on its earlier reputation. It too has started to fall back into the bad old days of massively wasteful projects with unclear scope, such as the Verify system, that is absorbing hundreds of millions of pounds for dubious benefit [1].
"Unfortunately, Verify is also an example of many of the failings in major programmes that we often see, including optimism bias and failure to set clear objectives." [2]
I think the idea of GDS is a good one, but evidently it needs to continue to reevaluate itself to avoid regressing into what it was originally setup to avoid.
[1] https://www.computerweekly.com/opinion/Back-to-the-past-with... [2] https://www.nao.org.uk/report/investigation-into-verify/
Actually the credit should go to the brilliant and dedicated people in GDS doing great work; though I do not know enough to pick out names. The UI/UX and implementation was first class from the get go.
As a Brit my life is made remarkably easier as a citizen and startup entrepreneur. The benefits to the UK ecomnomy are enorous but not measured. In contrast my personal experience of govt engagement when setting-up and running startups in US between 1991 and 2013 were painful. And would have been very painful without help (thank you YC).
Finally if we are going to give leadership credit it should go to Francis Maude [0]. He happened to be my local MP, so I met him quite a few times, and he was most helpful and astonishingly effective in helping us navigate two big challenges we had in facing down, shall we say, "unethical quango-business partnerships". A remarkable, thoughtful man and effective operator, who was in government over three decades [1].
[0] https://gds.blog.gov.uk/2012/10/16/gov-uk-the-start/ [1] https://en.wikipedia.org/wiki/Francis_Maude
Martha Lane Fox also deserves mention for: https://www.gov.uk/government/publications/directgov-2010-an...
They all tore up the rulebook. The rule being: Government can’t do computers. Outsource to favourite big consultancy. Twenty years were wasted on that nonsense approach.
Some of the greatest resistance comes from the big departments who are actively hostile to many of the changes required to work in this way. There’s a lot to be said for a round of golf at The Belfry with the splendid chaps from the IT consultancy your department spends £2bn a year with.
Golf days: https://parliamentlive.tv/event/index/abfe49d3-f24c-4b93-b8e...
Recently I was with a German friend and she nearly fell on her ass when I showed her that you can actually pay at a car parking machine in the middle of nowhere with Apple Pay here in the UK.
It continues from strength to strength.
However its pleasing to see a site that works well on crappy computers.
Some important UK government services are still lagging behind. DVLA, since you mention it, has a mix of okay and truly appalling services. I'm in the position of trying to renew my driving licence after it was revoked for medical reasons. It's now six months since my cardiac arrest and I now meet the medically-fit-to-drive criteria. But, I face an 84 day delay in my application being processed, as detailed on the DVLA's 'how-slow-are-we-today' page [0], which is actually labelled as a COVID-19 update. Furthermore, I have to post a paper application form to them as they haven't yet digitized the medical review service [1]. This is life-wrecking stuff for anyone who needs a driving licence for their work or similar.
I do like the gov.uk sites in general, but a lot of the back-office stuff is still disastrous. Some of this is due to strike action and COVID, but a big part of the problem is the continual failure of the various UK Govt departments to successfully manage large IT projects.
[0] https://www.gov.uk/guidance/dvla-coronavirus-covid-19-update
[1] https://www.gov.uk/reapply-driving-licence-medical-condition
To get a decent result on any IT project you have to fix the organisation behind it before you even think about replicating that organisation digitally.
Exactly. I've seen this myself back in the day when I supported the MOD's system development (simulators for training, as it happens). As a techie, I was asked to develop some interoperability middleware between disparate systems. As my career matured, my focus changed to trying to get the systems to use common interfaces protocols / standards. Then I thought - why can't they have common requirements since may of them are doing very similar things, and drive tech commonality top-down. So I started working with the respective acquisition teams to get them to adopt common conventions. Then I started to question why they had disparate acquisition teams in the first place. This turned out to be because there were multiple customer project teams. Why was that? Because the different tribes in the army (infantry, armour, etc) didn't speak to each other at that level.
I eventually realised I was seeing a sort of example of Conway's Law [0], and was finally able to develop a proper briefing for a senior decision maker who was concerned about the technical / contractual complexity at one of his training schools (which had multiple different types of simulator, each with out own through-life support programme). This I believe finally led to some coherence-focussed reorganisations of the MOD teams involved, which was perhaps the most impactful thing I achieved in a couple of decades working in this space.
[0] https://en.wikipedia.org/wiki/Conway%27s_law
Part of the problem is that they have multiple back-office legacy systems. I remember reading recently about a modernization of the personalised number plate system. This was apparently completely separate from the licence management so could be modernised quite easily. How convenient that it just happens to be a good revenue generator for DVLA, so presumably it was easier for someone to justify the development costs.
Where've you been?
Agree with your points but the things you mention have been around for almost 10 years now (driving license/passport renewal easy UX etc). I renewed my passport around 7 years ago and it was much easier to use then. It's true there's some services that tail off into the older systems (and you can tell), but the modern things gov.uk has owned have always been good since launch.
But for web developpers, that’s not all: it’s very deliberate, there’s detailed public guidelines, a scrutiny that developpers of the most popular open source project might recogonise. The overall result is that the people working there are very good. They are principled, and typically very complementary of the independent-minded polymath that many of us have worked with. They understand accessibility in detail and many dimensions (think: both rare handicaps and aging web-clients).
I’ve worked with several and I would strongly recommend considering experience at the Government Digital service (GDS) as a very good signal on a CV, akin to senior role at a big tech, or early engineer at a successful start-up.
https://digitalservices.sfgov.org https://medium.com/san-francisco-digital-services
- IAM Federation and brokerage service that takes arbitrary IDPs (every application is a simple document management problem at the tip of the iceberg, with a giant authN/AuthZ problem underneath. Consider authZ as a service as well)
- HSM/Vault for standard secrets management across applications
- Encrypted backup to data lake service, with cold storage option.
- vulnerability scanning and patch management (lines of business can't be trusted to do application patching)
- CI/CD pipeline service
- Jira/ADO or other "standard" project collaboration scheme
Managers don't usually know about this stuff, and they're the dealbreakers when you don't have them.
The developers behind this effort are great, and well, they use Ruby which is my language of choice at the moment.
[1]: https://github.com/alphagov
This seems to be a national issue though, akin to the rejection of ID cards.
The flip side is that if you don't want this ID it becomes more difficult (but not impossible) to access any digital service. It also relies on an integrated public population register, which some people have problems with. But it's not a physical ID that you can be asked for or are required to have, so doesn't have the ideological & political issues of requiring a universal ID card.
https://www.parliament.uk/about/working/jobs/
Maybe I'm being too cynical
I'd guess that salary is on the bottom 10 percentile for enterprise architects.
Edit
Pension is a good reason too, it is my main reason :)
From what I can see, the annual leave for these roles is 30 days per year, this is nice but 25 days is pretty standard in most tech jobs in the UK, with some employers allowing you to sacrifice salary in exchange for more days (+ or - 5 days in exchange for equivalent days of salary)
I know the pension plan for civil service is particularly good, but I wonder how it compares in terms of actual pension pay with having worked for big tech and contribute part of a salary that is, as you said, probably double – plus company contributions or matching which can be quite high (5-10%). Also, the RSUs you get and yearly refreshers kinda become your pension plan for a lot of tech workers.
Life isn't all about money, but for most people money is the primary reason to choose one company over another.
Obviously anecdotal evidence regarding the above but still
It’s based on Cloud Foundry, a “run your own Heroku”-type project. That’s starting to show it’s age now but it’s been a great model and had major benefits in government.
Happy to answer more questions.
We've maintained the core Cloud Foundry experience, and added value around the edge with service brokers, good documentation, support, app autoscaling (using the CF-blessed autoscaler, which doesn't come "in the box"), some additional metrics, and a couple other bits.
Just the autoscaling wouldn't be enough to keep us on it, but running it on someone-else's-infrastructure with a proper support model might.
[0]: https://www.waypointproject.io/
[1]: https://github.com/swisscom/waypoint-plugin-cloudfoundry