Live data from Hacker News

The Single Sign On

thedailywtf.com

31–40 of 73 posts

Re: The Single Sign On

#31
post #13

Is it just me, or did was the annoying sales guy completely right about the technology being possible, able to satisfy the client, and successful in closing a profitable deal for the company? What weird dailywtf parallel universe is this?

The WTF is the fact that a single employee would cost a company several tens of thousands of dollars plus several weeks of development time all because that employee didn't want to remember a password.

[deleted]

Re: The Single Sign On

#32

“But we don’t need to change it for everyone,” Craig jumped in, “just one client. Surely, you can do that!” That's probably the most frustrating thing I hear from non-technical people, because they really think they're making it easier. Sadly Kolmogorov complexity is not yet a required course in schools.

Can you elaborate on Kolmogorov complexity and its relevance to someone who has not encountered the term before? (I have wikied it: http://en.wikipedia.org/wiki/Kolmogorov_complexity but sleep deprivation may be hindering my ability to spot the link)

In other words, what orangecat meant is that adding more code, even "simple" code, adds complexity to a software project. Adding 50 easy features is equal to adding one heck of complex feature made of 50 sub parts.

The link with Kolmogorov is, I believe, that each piece added moves the set away from being simpler.

First time I read about Kolmogorov, hopefully I got it right. Anyway my first paragraph is true!

Re: The Single Sign On

#33

“But we don’t need to change it for everyone,” Craig jumped in, “just one client. Surely, you can do that!” That's probably the most frustrating thing I hear from non-technical people, because they really think they're making it easier. Sadly Kolmogorov complexity is not yet a required course in schools.

Can you elaborate on Kolmogorov complexity and its relevance to someone who has not encountered the term before? (I have wikied it: http://en.wikipedia.org/wiki/Kolmogorov_complexity but sleep deprivation may be hindering my ability to spot the link)

I think the grandparent meant cyclomatic complexity rather than Kolmogorov complexity. Special-casing a change for one person means at least one more execution branch.

Re: The Single Sign On

#34
post #29
post #27

Those of you with sales teams, what guidance do you have about sales people promising features that don't exist without getting input from the rest of your team?

Fine as long as it's for a lot of cash. If the customer is willing to pay for it, I'm happy to jump through crazy hoops.

Really? What if the client demands that your application is in "3D holograph" and won't accept anything that doesn't pop out of the monitor without any special assistance from the user? You're OK with selling that even though, no matter how much money they produce, it would take years and years of development, and may not even be possible until some other foundational technical breakthroughs occur?

Please don't take this too literally and tell me all the reasons why 3D holograph is feasible, you get the point.

Re: The Single Sign On

#35

OK, I'm not a web developer: I do embedded systems and hardware interfacing, so go easy on me :-) Assuming that the hospital network was secure, then why couldn't the system, when receiving a request from that single IP, request a cookie? If the cookie doesn't exist, then that user has never logged in and is then given an identifying, non expiring cookie and from then on is allowed access and is identified? Knowing t…

That's not a problem if you know the end game, which is that only one person in the hospital will ever know about it, but if you assume more than one person in the hospital will need access, you need to provide user-level permissions to prevent patient records from falling into the wrong hands; if you just give everyone in the hospital the exact same level of access, you're exposing a lot of things to a lot of people that shouldn't know about them.

Re: The Single Sign On

#36
"And not just followed, but followed, tested, certified, re-certified, and double-tested."

HIPAA doesn't prescribe specific technological mechanisms or official certifications. IIRC, a username and password assigned to an individual user is sufficient. I believe there are some audit-ability (who saw/wrote what) requirements as well, but it's been a few years since I dealt with HIPAA.

As a user of a system for which inappropriate data access can get you fired, you should be concerned if it does not have strict authentication mechanisms. Sally can blame Bill for having looked at some famous person's medical record.

Such snooping is actually is a recurring real problem at major hospitals which treat famous people. The Cleveland Clinic sort of solved it by assigning people like Drew Carey (widely known to be a Clinic patient) a pseudonym. All electronic records are under that name, so most people looking wouldn't realize who the patient was. A VIP office handled billing reconciliation. It's a cute security through obscurity mechanism although it's probably well known on which dates Drew visited the Clinc and which physicians likely saw him.

Re: The Single Sign On

#37
post #13

Is it just me, or did was the annoying sales guy completely right about the technology being possible, able to satisfy the client, and successful in closing a profitable deal for the company? What weird dailywtf parallel universe is this?

The WTF is the fact that a single employee would cost a company several tens of thousands of dollars plus several weeks of development time all because that employee didn't want to remember a password.

Well, it was probably an important employee.

Re: The Single Sign On

#39
post #12

I don't think it's funny and I don't think either the hospital or the consultants/contractors/employees who built this system are worth their weight in salt. It was a horribly expensive move and had very little benefit to the system or the patients or the hospital. It was a huge waste of money and it is decisions like this that are sending health care costs through the roof. How incompetent must you be to go through…

Well, keep in mind that this is the DailyWTF, so the story has probably been enhanced for your entertainment/outrage. It's rare that you can take a story on the site at face value.
Post reply on HN