We're in the process of moving to GovCloud, but that's a relatively small part of the overall compliance...fun...that goes into getting a service FedRAMP-approved.
That's a bit out of our control. We are able to hire quickly because we use a "specialist" hiring authority, but that comes with downsides like what you describe. I'm a developer and am making more than I did at any previous job, if that helps.
The way we operate is that agencies come to us to do projects (or we initiate shared services like cloud.gov), so we don't exactly get to pick anything we want. That being said, there is a lot of freedom within the projects we have to work on things that interest you.
Those teams definitely exist in agencies (GSA included), but we (18F) are managing ATOs internally for our projects, and are working on tooling to clarify, simplify, and automate the process. https://github.com/18F/control-masonry/ is our first project around this.
that's kind of the point. CORS just tells the browser to block the response, so this proxies the request and simply changes the headers to avoid that restriction.
no commercial version planned - I threw it up because it was something I was going to use (to build hackerhours.org), and figured it would be useful to others as well
1a) feel free to download the source and host yourself or write three lines of PHP
1b) not if you use the AJAX version - any response will come in as a string, so just don't eval()
2) the limit is really how many concurrent connections Node can handle, and the answer is "many"
3) It's at least useful for small mashup sites where you can throw up an HTML file with some JS - no server code needed
It was quick for me to make and it doesn't really require maintenance - feel free to donate to the EFF in honor of the project.
In terms of scalability, the app is doing very little processing so it's really just a matter of how many concurrent connections Node can handle in & out, but I've read it's capable of hundreds of thousands or more. Let me know if you are seeing high latency.