UK Government's Payment Infrastructure Is Now Open Source

https://govukpay-docs.cloudapps.digital/#contribute

by edent • 9 years ago

258 56 9 years ago

govukpay-docs.cloudapps.digital

pyb2• 9 years ago

This looks more like a manual. Where does it say that the infrastructure is open source ? I didn't see any source code.

NotThatOwl• 9 years ago

https://github.com/alphagov?q=pay-

robin_reala8• 9 years ago

Look at the section marked ‘Key Open Source components’ and click on each microservice’s name to get to the repo.

pyb2• 9 years ago

Well spotted thanks !

markyjones• 9 years ago

Read down a bit further https://govukpay-docs.cloudapps.digital/#key-open-source-com... the main components are linked to in the 'components' column. The link to the GitHub account also provide a filter on AlphaGov https://github.com/alphagov?q=pay-

robin_reala8• 9 years ago

If you haven’t heard of this before there’s a good introduction to the project at https://gds.blog.gov.uk/2015/07/23/making-payments-more-conv...

peteretep• 9 years ago

Linked from that: "Nearly two million adults in the UK do not have a bank account"

http://www.bbc.com/news/business-31830117

pjc503• 9 years ago

There is actually a legal requirement for banks to offer no-credit no-fee accounts, in order to help people get into the banking system and take advantage of the associated discounts, but obviously they don't advertise it much.

Nursie3• 9 years ago

Still got Google Analytics on the page.

I do not feel that reporting every online interaction I have with my government in the UK, back to a huge corporate in the US, is in any way appropriate. But I can't even get anyone to engage on the issue.

When I tried to raise it I got directed to a helpdesk ticket on a site run by an SV helpdesk-as-a-service company.

I appreciate that gov.uk have done some great stuff getting the UK government online, and their designs and Open Source attitude are refreshing, but this is a a serious privacy issue.

robin_reala8• 9 years ago

GDS’s GA Premium account contractually prevents Google from investigating the data, and Google self-anonymises with a flag in their API[1]. If you don’t trust them then that’s fine, but for functionality vs cost it seems to be the best option.

For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance.

You’re also welcome to block that specific JS or just turn off JS completely on GOV.UK properties - everything has to work without JS to go live on GOV.UK.[2]

[1] https://support.google.com/analytics/answer/2763052?hl=en

[2] https://www.gov.uk/service-manual/technology/using-progressi...

splike• 9 years ago

It's nice that Verify uses an internal analytics system, but the whole point of Verify is to outsource identifying people to private companies.

dchest• 9 years ago

GDS’s GA Premium account contractually prevents Google from investigating the data

Does it prevent US government from getting this data with a court order?

joosters• 9 years ago

So how does the average user verify this API flag then?

This kind of stuff should be opt-in for users, but Google know that hardly anyone would want to be tracked by them if they were given a clear choice.

watermanio2• 9 years ago

I still can't believe people are happy using Verify.

I very reluctantly tried to use it as I don't want to give all my data to any of the companies you listed, and yet it failed to identify me using the two companies I was allowed to pick.

I really don't see how it's acceptable to force users to give so much personal data to a handful of randomly selected private companies, on the off-chance that they already have it.

yomly• 9 years ago

Are you at GDS? Please can you tell your friends at HMRC that the login system is the most janky UX I've ever experienced and is prone to social engineering due to how complex it is.

Nursie3• 9 years ago

> GDS’s GA Premium account contractually prevents Google from investigating the data

And we all know that means it's safe forever, and isn't in any sort of jeopardy the moment it crosses a border, or in fact the moment it escapes to a third party at all.

It's all industry standard so it must be fine!

> For what it’s worth, for extremely sensitive projects like GOV.UK Verify other options are fine; Verify uses a local Piwik instance.

Then gov.uk should use a local Piwik instance for everything, GDS are clearly not incapable of it.

FYI I can and do block google analytics JS. It shouldn't be there in the first place, I shouldn't have to block it when interacting with my own government.

hellbanner• 9 years ago

That's all good; but most users aren't aware of blocking Javascript on specific domains.

Privacy is opt-in, not opt-out.

msla• 9 years ago

GDS’s GA Premium account contractually prevents Google from investigating the data

What's the penalty for completely disregarding that?

Is it anywhere near large enough to justify them not disregarding it?

More to the point: Pretty much the only thing a contract can do is impose a monetary penalty. Even if it's quite large, it's still only money, and Google rakes in money by the bushel basket from selling data to advertisers. Therefore, it isn't a very convincing penalty.

DanBC• 9 years ago

I know you get asked this kind of question in every thread, but do you know where I can send questions about the judiciary.gov site?

They hold the coroner's letters to prevent future deaths, but the search is not useful.

It would be good if I could search and return every letter about eg deaths by suicide or railway deaths or etc.

It seems a shame to have all these reports to prevent future death locked away.

toyg2• 9 years ago

The UK is in Five-Eyes and Google is a US intelligence partner - they would know even without analytics on the site, don't worry.

pjc503• 9 years ago

I would have thought the UK government would know who was visiting UK government web sites without having to ask GCHQ, but who knows.

aembleton• 9 years ago

I'm not seeing GA on that page. Has someone removed it in the last 48 minutes?

Nursie3• 9 years ago

That page is some docs about the service.

https://www.payments.service.gov.uk/

That's the actual service and it includes GA, or at least it did earlier.

sametmax2• 9 years ago

Well that's the point of making it open source. So you can point that out. I just hope people will finally get than opening is just half of the work, the other half is actually properly interacting with people crossing the door you just opened.

rekado• 9 years ago

I'm happy to see that they are using GNU Guix: https://github.com/alphagov?q=guix

camus2• 9 years ago

Interesting, if you check out the tech it's mostly Java for the backend and Javascript for the front-end.

sitepodmatt2• 9 years ago

Every interaction I have with a gov.uk portal is a painful UX disater - most recently passport and driver license, both had a submitting payment stage. I can't imagine anyone saying 'wow look how at the gov.uk got it right' lets use their code, a glorified CMS system with forms and payments bolted on - badly - so badly.

Just rechecked it's still complete crap. They can't support the back button, no post / redirect pattern, confirm form resubmission. https://passportapplication.service.gov.uk/

robin_reala8• 9 years ago

The ‘Apply for a passport’ you linked to service is pretty old now and doesn’t reflect GDS’s current recommendations; as far as I understand it it was more of a reskin of an already existing system than anything done from the ground up. However there’s a newer service available from https://www.gov.uk/apply-renew-passport that is much more modern and actively developed. I’m not sure why they’re both still up (although HM Passport Office could probably tell you), but I’m also not sure how you got to the old one because all of the generic ‘passport’ searches I did on GOV.UK took me eventually to the newer version.

sitepodmatt2• 9 years ago

The link you posted redirects to original UX disaster after answering ten or so questions (each their own page and a click next). Seems you will only stay on the new site for booking and paying for a traditional walkin appointment.

chatmasta2• 9 years ago

I went through a visa application process for the UK over the past few months. The main gov.uk site is a very good website for finding information, well designed, works on mobile, etc. Coming from the US, that was quite refreshing -- there's no equivalent in the US as everything is scattered across 100 different agency websites in 50 states.

However the "business logic" of gov.uk is still sorely lacking. For the actual visa application process and payment, I was bounced around between 4-5 different third party websites handling different aspects of the process. I'm sure further integration with gov.uk is on the roadmap, and it will certainly be nice.

As a new resident of the U.K., though, I have to admit I've been pleasantly surprised and very happy with the gov.uk website so far.

maverick2• 9 years ago

Canada's is same way. I am from India, and been in US for about half a decade. US's process is completely old school.

Canada had plans to integrate all citizen services through one account dashboard, curious to see how countries roll-out services like those in next decade or so.

chatmasta2• 9 years ago

It will be especially difficult in the US where many of those services are federated across all fifty states.

confounded• 9 years ago

There are very few positive comments here, but I think it's fantastic that this progress has been made (even if it's not perfect). I had no idea the sites could be used without JS at all; that's brilliant!

Yakkety1610• 9 years ago

does this affect MiCard`s ?

http://www.manxradio.com/news/isle-of-man-business/micard-de...

UK Government's Payment Infrastructure Is Now Open Source

Related Stories