Live data from Hacker News

Show HN: Kate's App

katesapp.org

141–150 of 192 posts

Re: Show HN: Kate's App

#141
I wouldn't worry too much about what a lot of the comments are saying. I would heed some of the advice about being secure but I wouldn't worry too much about it being a problem or shutting down the app until you have it worked out.

I don't want to discourage you because it's always good to have multiple options but I would look at what Cariloop (https://cariloop.com) is doing, try and focus it like that but with unique aspect you have they do not. This is only the second caregiving app/service that I have seen.

Re: Show HN: Kate's App

#142
"Simple" "Safe" "Private": Marketing buzzwords without any proof or a reputation.

No idea who this person is. Could be some 15 year old scammer in Florida. Could be a billionaire heir in London. No contact information. The domain registration is hidden.

What is this "product" solving that is not much different from a shared Google Doc?

Re: Show HN: Kate's App

#143
Could this be used as a community “social network” where seniors or people with disabilities can reach out for specific asks like getting driven to a doctors office or getting a prescription picked up, etc.

Re: Show HN: Kate's App

#144

Telltale signs of application immaturity like using ids as urls https://katesapp.org/patients/41

What's wrong with that?

https://portswigger.net/web-security/access-control/idor

It's not, by itself, deadly but it does lower the safeguards against ACL slip-ups, which could easily exfiltrate the entire customer base

Re: Show HN: Kate's App

#145
post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

This is a frustrating conversation. It appears that anonymized data medical data are being sold en masse by providers (*) because money. But it's also obvious to us tech folk how trivial it is to combine anonymized patient encounters with location and credit card purchase data etc to de-anonymize it and resell as enriched. So the only people who are effectively bound by HIPAA are the well-intentioned ones who have to…

Forget about anonymous data; sometimes PII is not sold, it's just given away by staff who don't know better. See my comment here from my own experience: https://news.ycombinator.com/item?id=17183682

Re: Show HN: Kate's App

#146

Earlier quoted context omitted.

Yeah but, how can there be damages without a breach?

Kate is a citizen. She is 60 years old and the family lives away. She gets visited daily by a care worker. Kate downloads the app and enters her data. Kate shares her data with the care worker so it can be managed for things like appointments and medication. The manager of the care worker sees the app, checks that the site has no policy whatsoever. Shares the name of the app with the law department. Law department co…

Yeah but how does the "law department" gain money? The question I asked is "what's in it for them?"

Re: Show HN: Kate's App

#148

Telltale signs of application immaturity like using ids as urls https://katesapp.org/patients/41

What's wrong with that?

So my first professional programming job was at a place where people described themselves as "C# developers" instead of software engineers. The team was run by a guy who had built his entire career out of teaching people a very dogmatic, .NET-specific flavor of MVP that he'd learned from a Learning Tree course without understanding any of its theoretical underpinnings. He augmented his One True Design by looking up ASP .NET hacks and tricks on StackOverflow, implementing them, then copying the source code for each project that he worked on to a USB key so that he could reference his handiwork at later jobs. Because this was a step above people writing unintelligible 3000-line classes he was hailed as a minor hero by management. His teachings created a professional quasi-religion where he was the Pope and his USB key full of copy-pasted jQuery selectors and Linq statements was the Bible.

In this hallowed religion one of the most fundamental rules was that every domain object had to have both an integer identifier ("ID") and a UUID ("GUID", because Windows). When I asked why we didn't simply use one or the other I was told that we had to have an ID because we "need a primary key" and a GUID because "we can't put an ID in the URL because then you can go to another record by changing it!" It didn't matter that we performed permissions checks on these routes because _security_. As I learned more about data modeling and relational databases I periodically questioned this (in retrospect we should have just used UUIDs as the PK because we had no good performance or design reasons to have both) but never got a good answer. This religion didn't tolerate heretical nonsense - GUIDs are for URLs because of hackers.

No idea if that's what's going on here but it reminded me of it.

Re: Show HN: Kate's App

#149

Earlier quoted context omitted.

This is a frustrating conversation. It appears that anonymized data medical data are being sold en masse by providers (*) because money. But it's also obvious to us tech folk how trivial it is to combine anonymized patient encounters with location and credit card purchase data etc to de-anonymize it and resell as enriched. So the only people who are effectively bound by HIPAA are the well-intentioned ones who have to…

> the rest are laughing at them on the way to the bank. My understanding is that HIPAA is intended to stop providers from colluding against the patient, not to stop providers or middlemen from enriching themselves with our data.

And also to make PHI portable across providers.

Re: Show HN: Kate's App

#150
post #37

Earlier quoted context omitted.

How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.

Telltale signs of application immaturity like using ids as urls https://katesapp.org/patients/41

Never mind that URLs are identifiers.
Post reply on HN