These Parents Built a School App. Then the City Called the Cops (wired.com) 133
Stockholm's official app was a disaster. So annoyed parents built their own open source version -- ignoring warnings that it might be illegal. From a report: Commissioned in 2013, Skolplattform was intended to make the lives of up to 500,000 children, teachers, and parents in Stockholm easier -- acting as the technical backbone for all things education, from registering attendance to keeping a record of grades. The platform is a complex system that's made up of three different parts, containing 18 individual modules that are maintained by five external companies. The sprawling system is used by 600 preschools and 177 schools, with separate logins for every teacher, student, and parent. The only problem? It doesn't work. The Skolplattform, which has cost more than 1 billion Swedish Krona, SEK, ($117 million), has failed to match its initial ambition. Parents and teachers have complained about the complexity of the system -- its launch was delayed, there have been reports of project mismanagement, and it has been labelled an IT disaster. The Android version of the app has an average 1.2 star rating.
On October 23, 2020, Landgren, a developer and the CEO of Swedish innovation consulting firm Iteam, tweeted a hat design emblazoned with the words "Skrota Skolplattformen" -- loosely translated as "trash the school platform." He joked he should wear the hat when he picks his children up from school. Weeks later, wearing that very hat, he decided to take matters into his own hands. "From my own frustration, I just started to create my own app," Landgren says. He wrote to city officials asking to see the Skolplattform's API documents. While waiting for a response, he logged into his account and tried to work out whether the system could be reverse-engineered. In just a few hours, he had created something that worked. "I had information on my screen from the school platform," he says. "And then I started building an API on top of their lousy API." The work started at the end of November 2020, just days after Stockholm's Board of Education was hit with a 4 million SEK GDPR fine for "serious shortcomings" in the Skolplattform. Integritetsskyddsmyndigheten, Sweden's data regulator, had found serious flaws in the platform that had exposed the data of hundreds of thousands of parents, children, and teachers. In some cases, people's personal information could be accessed from Google searches. (The flaws have since been fixed and the fine reduced on appeal.) In the weeks that followed, Landgren teamed up with fellow developers and parents Johan Obrink and Erik Hellman, and the trio hatched a plan. They would create an open source version of the Skolplattform and release it as an app that could be used by frustrated parents across Stockholm. Building on Landgren's earlier work, the team opened Chrome's developer tools, logged into the Skolplattform, and wrote down all the URLs and payloads. They took the code, which called the platform's private API and built packages so it could run on a phone -- essentially creating a layer on top of the existing, glitchy Skolplattform.
The result was the Oppna Skolplattformen, or Open School Platform. The app was released on February 12, 2021, and all of its code is published under an open source license on GitHub. Anyone can take or use the code, with very few limitations on what they can do with it. If the city wanted to use any of the code, it could. But rather than welcome it with open arms, city officials reacted with indignation. Even before the app was released, the City of Stockholm warned Landgren that it might be illegal. In the eight months that followed, Stockholms Stad, or the City of Stockholm, attempted to derail and shut down the open source app. It warned parents to stop using the app and alleged that it might be illegally accessing people's personal information. Officials reported the app to data protection authorities and, Landgren claims, tweaked the official system's underlying code to stop the spin-off from operating at all.
On October 23, 2020, Landgren, a developer and the CEO of Swedish innovation consulting firm Iteam, tweeted a hat design emblazoned with the words "Skrota Skolplattformen" -- loosely translated as "trash the school platform." He joked he should wear the hat when he picks his children up from school. Weeks later, wearing that very hat, he decided to take matters into his own hands. "From my own frustration, I just started to create my own app," Landgren says. He wrote to city officials asking to see the Skolplattform's API documents. While waiting for a response, he logged into his account and tried to work out whether the system could be reverse-engineered. In just a few hours, he had created something that worked. "I had information on my screen from the school platform," he says. "And then I started building an API on top of their lousy API." The work started at the end of November 2020, just days after Stockholm's Board of Education was hit with a 4 million SEK GDPR fine for "serious shortcomings" in the Skolplattform. Integritetsskyddsmyndigheten, Sweden's data regulator, had found serious flaws in the platform that had exposed the data of hundreds of thousands of parents, children, and teachers. In some cases, people's personal information could be accessed from Google searches. (The flaws have since been fixed and the fine reduced on appeal.) In the weeks that followed, Landgren teamed up with fellow developers and parents Johan Obrink and Erik Hellman, and the trio hatched a plan. They would create an open source version of the Skolplattform and release it as an app that could be used by frustrated parents across Stockholm. Building on Landgren's earlier work, the team opened Chrome's developer tools, logged into the Skolplattform, and wrote down all the URLs and payloads. They took the code, which called the platform's private API and built packages so it could run on a phone -- essentially creating a layer on top of the existing, glitchy Skolplattform.
The result was the Oppna Skolplattformen, or Open School Platform. The app was released on February 12, 2021, and all of its code is published under an open source license on GitHub. Anyone can take or use the code, with very few limitations on what they can do with it. If the city wanted to use any of the code, it could. But rather than welcome it with open arms, city officials reacted with indignation. Even before the app was released, the City of Stockholm warned Landgren that it might be illegal. In the eight months that followed, Stockholms Stad, or the City of Stockholm, attempted to derail and shut down the open source app. It warned parents to stop using the app and alleged that it might be illegally accessing people's personal information. Officials reported the app to data protection authorities and, Landgren claims, tweaked the official system's underlying code to stop the spin-off from operating at all.
News Flash (Score:2, Insightful)
Government doesn't like competition for power or authority, even in the smallest things. Especially from the people it rules over.
Re:News Flash (Score:5, Insightful)
Dig deeper and you'll find some politician's cousin holds the contract for the shitty app. The goal was never to help children - that was the excuse.
It's a big club and you ain't in it.
Re:News Flash (Score:4, Funny)
The contracts are spread around FIVE companies. The entire city council has a relative to one degree or another involved.
Re: (Score:3)
Re: (Score:3)
"Government doesn't like competition for power or authority, even in the smallest things."
If what you assert is true, how do you account for the fact that the government of the United States constantly and enthusiastically submits to the authority of Corporate America?"
Re:News Flash (Score:5, Funny)
how do you account for the fact that the government of the United States constantly and enthusiastically submits to the authority of Corporate America?
Simple...employees generally submit to the will of their employer.
Re: (Score:3)
"Government doesn't like competition for power or authority, even in the smallest things."
If what you assert is true, how do you account for the fact that the government of the United States constantly and enthusiastically submits to the authority of Corporate America?"
The government could shut corporations down in a heartbeat if it wanted to. Crush them like a bug.
The government finds corporations useful for their purposes. Simply put. Especially tech corps.
Re: News Flash (Score:3)
People with Power (Score:5, Insightful)
I have come to the conclusion that a lot of the types of people who seek leadership roles, especially in government, are the exact people who should never be allowed leadership roles. It attracts egotistical pigheaded sociopaths who are utterly incapable of Making Good Decisions or understanding what is going on around them.
It's not that I don't understand having concerns about this, I do. However, the reaction should be, "Wow, the old system was so bad you spent all this time writing your own? And it's open source? And it's working better? We've had all these problems with the system since it was rolled out, let's get together and start figuring out a way forward to leverage the work you've done". Instead it's, "You did something that I haven't controlled since it's inception and which undermines the perception of my own competence? I'm calling the police".
Re:People with Power (Score:5, Interesting)
"Anyone who is capable of getting themselves made President should on no account be allowed to do the job.." --Douglas Adams
Re: (Score:3)
I don't know how old you are, but I went through a similar thing and then it went a bit further.
I was probably 20, when I realized that people who seek leadership roles are the exact people who should not be allowed in leadership. Went down a reasonably libertarian path.
Today, I'm 40. My outlook has changed to recognize that we need leadership to function. Our goal as regular people who generally don't seek leadership is to choose the best sociopath to be our leader :)
I use that word sociopath on purpose. N
They're easy to spot (Score:2)
Re: (Score:2)
I couldn't agree more. Thank you for posting such insightful post. d-;)
Natural reaction (Score:3, Insightful)
The natural reaction to being shown one's own incompetence is to bury the messenger in legal shit.
I see it is the same in many places (Score:2, Flamebait)
Very similar situation (Score:5, Interesting)
A very similar situation happened at the University of Alberta in the early 2000s.
They spent millions on a new registration system that turned out to have a completely crap web interface. So a student wrote his own, which rapidly became the only one used by anyone.
I believe the university eventually just bought it, and hired the student⦠rather than trying to shut it down.
https://www.itbusiness.ca/news/u-of-alberta-gets-behind-student-developed-it-system/5587
Re: (Score:3)
That's the sane solution: cut your loses and embrace what works.
Reality check (Score:4, Informative)
--Time to remind these indignant city officials of who they actually work for, and whose taxes are paying their salary.
Re: (Score:2)
--Time to remind these indignant city officials of who they actually work for, and whose taxes are paying their salary.
LOL. When has that ever worked? What you gonna do? Vote for someone who pledges to lead an inquiry into what went wrong? Ooooh I'm sure those incompetent public servants are absolutely quaking in their boots. /s
I have so many questions (Score:3)
So, first off, were the school APIs (I assume they are either REST or GraphQL queries) at least secured? That is, did you require at least some kind of access token that regularly expires? If so, how is that token acquired? Does it require at least 2 factors?
If they were not at least secured, then the school system itself has a shitload of explaining to do.
Re: (Score:3)
I do not know if the Stockholm school APIs are secured. However, I am almost certain that authentication is required. That is not the same as the application being secure. My children's school district has a web app for parents, and it uses authentication. Once I have authenticated to the app, I can view information by putting any student ID in the URL's query string. This would be OK if the student ID was a UUID, but student IDs are sequentially assigned numbers. It would be easy to write a script that che
Re: (Score:2)
Re: (Score:2)
Huge post (Score:2)
Re:Huge post (Score:4, Funny)
Re: (Score:2)
It's not your imagination - it's become the new Slashdot "style", or lack thereof. I complained about it a while ago and IIRC was modded down for doing so. It used to be that summaries were just that - the writer summarized the article, largely in his or her own words. Now TFS is just a copy-and-paste of a substantial portion of TFA - in some cases the 'summary' contains close to half the article.
Maybe we brought it on ourselves because we seldom RTFA - now we read it whether we want to or not.
The city reversed that a month ago (Score:5, Informative)
Re: (Score:3)
Re:The city reversed that a month ago (Score:5, Informative)
Re: (Score:2)
Mod parent up.
Considered this way, the city reaction is understandable (it doesn't mean I approve). The have no control over the open source app, and it may indeed contain malware or vulnerabilities, introduce bugs by using the private API incorrectly, maybe even DDOS the platform.
It is not clear if they changed the API in order to block the open source app or to fix some issue or upgrade, but it highlights one of the reason you may not want to allow 3rd party apps: controlling both the client and server al
A telltale sign of politically motivated design (Score:2)
This here is a key sign that the process of a bullshit political process for technical design. There is no sensible reason that I can fathom (but of course, I would be happy to hear sensible claims otherwise) that any component needs to be a consortium of 5 different firms. This inflates costs, messes up timelines and makes every problem a recursive dumpste
Re: (Score:2)
It's because they have segmented it into 5 different services (which is not to say that this way is dumb or smart) and then they (and here comes the real problem) that interoperability would be handled by the city itself and the individual contractors should not focus on that.
The five different services are
Re: (Score:2)
I think you missed the point. Yes it was segmented -- I believe this is a terrible idea from an engineering perspective because it begets a lack of responsibility and ownership.
I also suspect that this was motivated to allow 5 different companies to get government contracts and "share the bounty" as it were rather than just picking a firm to deliver it end-to-end.
Not Invented Here (Score:2)
This ain't just a problem with the city or the incompetents they hired to do their coding for them. This is a problem with human psychology--if it didn't come from their in-group it's suspect. Especially if it makes their in-group look bad.
The most important part about solving someone else's problem is making them think the solution was their idea in the first place. This goes double if they hired you to solve their problem.
Stockholm Syndrome? (Score:2)
The good news, is if anybody is arrested, they will eventually come to identify with and even love their captors.
Canvas... (Score:2)
was started as a grad student project answer to the almost universal frustration with "the only game in town" Blackboard.
Moodle was similarly started as an alternative to WebCT.
Re:fuck vigilante coders (Score:5, Insightful)
Re: (Score:2)
The article goes pretty hard on the "OMG, poor parent just helping out" angle, but I think the issue was probably that he's made an app that asks parents for their login credentials. You can probably imagine how that might be a problem?
The city probably could have been less dickish about it and gotten there sooner, but they eventually arrived at the right decision and implemented a licensing system so there's some accountability.
Re: (Score:3)
Well, an email client app will ask you for your email credentials.
So an app accessing your school account data will ask for your school account.
Yes, of course you should use something like OAuth instead of giving out your password, but you can't blame that on the client if as long as the server API doesn't support that.
Re: (Score:2)
Yes, and if you use an e-mail program you don't have reason to trust, you're an idiot. Your bank will probably also look dimly on you using some random app to access your account. Same thing here.
If you think otherwise, I have an app you should try....
Re: (Score:2)
Well, not many better ways to not use "some random app" than an open source community app. Not perfect, but worked well so far with email apps, and even banking apps (e.g. Gnucash, hibiscus)
Re: (Score:2)
Excellent. Go to the Android or Apple store and download "{MISSPELLED BANKING APP}". It's totally open source, you can verify yourself what it does on Github. It's totally the same app, honest. And all your banking sign in stuff runs in an internal browser it can't access anyway. Honest.
Just put in your banking information. It'll be great. Honest. Oh, and it can check your STD screening results too if you like. Totally secure. Honest.
Re: (Score:2)
Re: (Score:2)
You might be able to look at what he claims is the source code of his app, but most people won't be able to compile the app themselves or sideload it. So they still have to trust that a binary they download from the app store is secure.
Re: (Score:3)
That is true of any app, if his app is harvesting username passwords then they should prosecute him for that, what their real problem is they look like fools spending 100 million dollars on a badly written app that somebody wrote better in a few weeks.
Really I see this happen all the time, applications that seem to cost billions that I don't see why I couldn't write in a year. I don't even get paid 1 million dollars a year. I also see this other areas, painting houses, roadworks https://crux.org.nz/communit [crux.org.nz]
Re: (Score:2)
Don't your toes get tired, clinging to the edge out there all the time?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I think the issue was probably that he's made an app that asks parents for their login credentials.
The program is open source, so it would be trivial to determine if the credentials were being misused.
Re:fuck vigilante coders (Score:4, Insightful)
"The program is open source, so it would be trivial to determine if the credentials were being misused."
Provided the shared code matches the deployed binary, which means access right to the file level for auditing.
Re: (Score:2)
And?
You get the binary file delivered, and easily intercepted, with every app download. And typically you know the compiler version and settings that were used for an OSS project - so compile the code and see if you get the exact same binary as is being distributed. If they don't match, someone is up to something. That's OSS auditing 101.
Re: (Score:2)
Sure. And that's what they did.
Re:fuck vigilante coders (Score:4, Insightful)
Trivial if you are a programmer and know how to program mobile apps. Ask the accountant or store clerk to check the code out. It's open source. This is one of the lamest arguments around open source that I constantly hear. I like open source, especially real open source licenses like Apache, MIT, BSD, etc. But this whole "anyone can review the code" is pure bullshit. Only a very small percent of the population has the skill, and most of them don't want to because they are arguing about how shitty the other guy's code is and forking projects to be able to concentrate on a smaller population of code in order to make it work better (including security checks).
Re: (Score:2)
But this whole "anyone can review the code" is pure bullshit.
Again with the fucking strawmen.
No one has ever said that literally anyone can review the code. It just means anyone who wants to can review the code - that there is no barrier to anyone who wants to review it.
Fucking fauxtistic nerds never understand that things are said in CONTEXT. You can't just take a single sentence and strawman the fuck out of it.
Re: (Score:2)
Re:fuck vigilante coders (Score:5, Insightful)
All web API's are fundamentally public. "Private" APIs on public servers can become public at any time with no notice. It's like sending an email and later arguing that it shouldn't have been made public. Once the message is sent, it can no longer be secured.
If you want an API that only talks to one specific client, then every API request must be authenticated. Traffic must be encrypted too.
Otherwise the security system devolves into either:
a) An open API that relies on no-one other than a particular custom-written client knowing about it.
b) The limited-combination remote garage car-keys and garage door openers. They are a effective at preventing your neighbor from accidentally starting your car. However, any serious thief can get past the "private" API in seconds.
Re: (Score:2)
Absolutely. Any internet-facing API is inherently public.
You forgot a bit in the "alternatives" though. It should be:
a) An open API that relies on no-one other than a particular custom-written client (and any malicious actors that care to pay attention) knowing about it.
Re:fuck vigilante coders (Score:5, Insightful)
If the API is intended to be used by a non-public audience, then it's reasonable to assume it's not going to include all the safeguards expected for a public API.
Absolutely not.
That kind of reasoning is exactly what leads to hacks and data leaks. When Facebook had an API that allowed anyone to lookup someone's personal details just based on their phone number, we didn't say "Ohh, that's okay - it was only *intended* to be used by the Facebook app when finding people's friends. It's not reasonable to include all the safeguards expected for a public API." Hackers don't care that you didn't intend the API to be public. If the API is available on the internet it is a public API and it must be secured. That's not "high minded principle" that's the basics.
Re:fuck vigilante coders (Score:5, Insightful)
1. If the API is intended to be used by a non-public audience, then it's reasonable to assume it's not going to include all the safeguards expected for a public API.
No this is security 101. If it is possible for the public to get at the API then it must be secured as if a malicious member of the public will attack it. It's not "not best practices" to secure an outward facing API it's negligence. Nefarious actors don't generally politely ignore things that they're not meant to see.
People here are treating this kind of hacking as "good" simply because it's to workaround something that's "bad", without realizing you can believe both things are "bad", and in this case, yes, both things probably are bad.
Well in this case the city eventually did an about-face and welcomed third parties. Seems like it did make things better.
Third parties with no documentation shouldn't be reverse engineering access to someone else's database without permission.
I don't see why not. This makes at least 3 systems I know of which were reverse engineered by a frustrated user and eventually got adopted in place of the original to the great appreciation of the users.
Re: (Score:3)
Is it really too much to ask to have government have an independent party do a security audit for a service which exposes personal information before it's pushed live? They don't have competitors breathing down their necks, only an electorate who is used to delays. The software won't become irrelevant because of a competitor.
Re: (Score:2)
I'd argue that any API endpoint that starts with https is a public URL and as such should be treated as one.
https://mysite.com/users [mysite.com] vs https://mysite.com/api/v1/user... [mysite.com] should be treated identically as accessible by the internet. It's a web page, just one that takes some json/xml/whatever and spits back the data.
If you don't like it, do your rendering server side. Otherwise, expect it to be hit by anyone with half a brain and a web browser.
Re: (Score:3)
If the API is intended to be used by a non-public audience
then it's reasonable to assume it's not going to include all the safeguards expected for a public API
Only if it was secured appropriately, otherwise, no, that is not at all a reasonable assumption.
Moreover, this is so much bigger than simply abid
Re: (Score:2)
If it's not intended for a public audience then it should either not be on the internet, or have a professional grade level of security. A basic rule is that you don't put shit on the internet if you don't want the entire world to see it.
Re: (Score:3)
You mean more than the shitty app already costed?
Oh, right, it may have to go to an actual company that can clean up the mess instead of someone who curiously happens to be somehow related to whoever gets to assign that billion Krona. It just ain't pork if it doesn't go to the right pig.
Re: (Score:3, Insightful)
Re: (Score:3)
Re:fuck vigilante coders (Score:5, Insightful)
It sounds as if you don’t know what an API is. By definition, it’s the interface you program against when you want to interact with an application. If their API is so poorly implemented that it permits the behavior you suggest, it shouldn’t be publicly available to begin with. Publicly available APIs, of which this is an example, are supposed to be designed with the assumption that they will be receiving communication from untrusted devices and should handle it accordingly.
Re: (Score:3)
It's designed to be accessed by un-validated clients over the open internet. It's public.
It can only be "private" in the same sense that the out-of-the-way make-out spots in the public park are "private". I.e. it's out of the way and doesn't get a lot of traffic.
Except for the fact that you've widely published an app that demonstrates *exactly* how to get to that "private" spot to anyone who cares to watch it. Like having regular bus service directly to the make-out spot.
If you want a private internet-fa
Re: (Score:3)
Thing is, isn't really a 'public' API. They reverse engineered a private API.
I very specifically said "publicly available", not "public", because the "public API" vs. "private API" distinction simply doesn't matter here. Someone can call an API "private" all they want, but it doesn't change reality: if an Internet-reachable API isn't otherwise secured, it is, by definition, a publicly available API and should have been hardened in the manner that you and I are both talking about. After-the-fact declarations that a publicly available API was intended to be private are a typical prote
Re: (Score:2)
This is the same argument as "we didn't expect anyone to use 'view source'" which is used by idiots whose shitty websites leak personal information on the regular.
There is no such thing as a "non-public" API when that API is internet facing and unsecured.
Re: (Score:2)
As far as I know, there are only two ways to make an AP "private. The first is that the API itself only allows particular IPs to call it, or the server sits behind a firewall that does the IP checking, and neither appears to be the case so by default, the API should be considered public. Just because the school system wants to all the API private does not make it so.
Re: (Score:2)
If you are hosting a API publicly on the internet it is just undocumented, yet public.
If you don't want it to be public either
a) don't make it available over the internet
b) use an auth scheme that allows you to verify it's your client.
Otherwise it's just an undocumented public api.
Re:fuck vigilante coders (Score:4, Insightful)
What a shitty take for Slashdot, of all places.
Some of the greatest code has been "vigilante" code. Which is one of the dumbest terms I have ever heard.
Fuck you, and fuck your closed source.
It's not a take (Score:3)
Re: (Score:2)
By that logic I win almost all my exchanges. And the less I actually say anything logical or coherent the more I win!?
Wait, this is giving me complete insight into the social justice warriors internal "logic"... and it's fucked.
www.fart.com/politics
Re: (Score:2)
And the less I actually say anything logical or coherent the more I win!?
If your goal is purely to create outrage then yes. Remember Slashdot has banned Anonymous Cowards, so everyone posting as AC has an account. If they aren't leaking sensitive information in their post you know you're responding to someone who doesn't actually believe their own bullshit, they are just trying to ignite rage through trolling.
Clearing Up Others' Mess (Score:5, Informative)
Just because you can write an app doesn't mean you should.
Perhaps, but when you definitely cannot write an app - apparently like the people originally hired - you definitely should not and, if you go ahead and do it anyway, then someone is going to have to come along and clear up the mess you have left.
Indeed, you clearly seem to admit what a rubbish job the original people did if you think that they wrote a public API that is capable of causing damage to the database even when used by good actors trying to work with the system. If the API is that bad imagine what a malicious hacker could do!
Re: (Score:2)
Just because you can write an app doesn't mean you should.
Perhaps, but when you definitely cannot write an app - apparently like the people originally hired - you definitely should not and, if you go ahead and do it anyway, then someone is going to have to come along and clear up the mess you have left.
We don't know, from TFS, what the remit for the original writers was. Perhaps it was poorly specified and they were paid peanuts.
Re: (Score:2)
Re: (Score:2)
It's the result of someone who can't even write an app properly, goes on and attempt to create an API.
I mean, what else can be expected other than a disaster?
Re: (Score:3)
Re: (Score:2, Troll)
> What he did was embarrass them a single person with few resources (i.e. $) did what their billion krona system couldn't
The entire world is turning into a equity driven welfare state. Their plan probably wasn't to make a working system. It was to create a mess that requires thousands of jobs to keep contained. That way thousands of low IQ idiots are inside working on problems they can't solve instead of smashing windows and looting stores because they have nothing better to do.
Re: (Score:2)
instead of smashing windows
Interesting choice of words when you've just accused them of implementing the broken window fallacy!
But I doubt this inefficiency is deliberate. The overhead of management, communication and QA can be insane, and especially so in government.
Re: (Score:2)
You seem to forget the part where he is calling all their API's.
He made a client shell, not the entire app, and certainly none of the back end.
So your claim is specious.
Please play again.
Re: (Score:2)
You don't actually mean that. If you did you wouldn't post AC. Go troll somewhere else.
Re: (Score:2)
Online it seems like everyone is this master security focused coder who make bullet proof code. While when ever I get a job someplace (Big company, small Company, government, Not for profit, Startup, well established...) They are filled with programmers who are just trying to make their next paycheck, and follow the specs given to them. If a vulnerability is pointed out, they will often just lest their bosses talk their way around it, such as saying the user shouldn't have been granted access to where th
Re: fuck vigilante coders (Score:2)
Re: (Score:3)
If you can't be bothered to make your internet-facing API bulletproof, then there are really only two options:
1) Restrict all API access to an encrypted channel that only your own front-end can access. This is pretty easy, lots of OSS and even public domain examples on how to do it using robust and well-tested encryption.
2) Accept that everyone + evil dog will have complete access to your API, and that your system will be strip-mined and/or demolished by the first malicious actor who is so inclined.
Re: (Score:2)
> They are filled with programmers who are just trying to make their next paycheck, and follow the specs given to them
Data validation. Never trust anything incoming through a file descriptor to be properly formatted? Really, this doesn't get applied?
I will admit I skipped a few checks in my parsers too, but it very quickly caught up with me.
> Besides the API can have the best security, and still cause misuse, because what you do with the data after you get it, is where the problems happen.
That's where
Re: fuck vigilante coders (Score:2)
Re:Utopia (Score:5, Informative)
Re:Utopia (Score:5, Insightful)
1. Sweden is not socialist, they're free market capitalists with a social democratic government
There’s a certain breed of modern Neanderthal that believes any government which does more than operate a military qualifies as “socialist”.
Re: (Score:2)
Correction: The school lunch, at least for years 1-9, is decidedly not amazing (but it is free). It is in most instances horrible (there are known deviations), and is allowed to cost around 1/5 of a lunch for a prison inmate.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
"People want an organization to do a job and do it correctly; Get mad when organization sometimes fails; Demands improvement"
What a fucking *radical* concept.
Re: Let's delegate more authority to governments (Score:2)
If the same *person* keeps fucking up a series of tasks assigned to them, is it sensible to expect competence on the n+1th task, or is it sensible to assign it to another, less demonstrably-incapable, individual?
One definition of insanity is doing the same thing but expecting a different result. An equally radical idea, I'm sure.
Re: (Score:2)
This is profoundly simple compared to the bullshit "course management systems" that we are stuck with in American universities.
And then, separate from the CMS, I have to submit end-of-term grades on PeopleSoft...