Still pwnable

From the Slashdot peanut gallery:

I had the unfortunate experience of dealing with a government agency whose website was hacked. After a month-long "security audit", their in-house security experts devised a comprehensive plan to lock down their server and prevent it from ever being compromised again.

The solution, in its entirety, was to turn http://www.dumbass.agency.gov into the new, "secure" https://www.dumbass.agency.gov.

I wish I was kidding.