Live data from Hacker News

I “found” the database of a college app (2018)

yoginth.com

41–50 of 107 posts

Re: I “found” the database of a college app (2018)

#41

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

My university didn't officially track attendance, but lecturers did track it nonetheless. Poor attendance was used as a metric when deciding whether somebody deserves a late submission, resubmission, or aegrotat.

Re: I “found” the database of a college app (2018)

#42

What makes this even more sloppy for the school is that I know for a fact that Firebase will send your admin account an email when it detects that you have weak security settings on your database. It also sends said email repeatedly, once per day. I know because I intentionally have a developer db that is read access for the whole world and I get that email every afternoon. The admin of this app either is not compete…

> The admin of this app either is not competent enough to know what that email means, or is willfully ignoring it.

Or it's being filtered into their junk folder.

I'm not making excuses for them, btw (there's just so much else wrong here): just pointing out that this happens quite often with even legitimate automated messages.

Re: I “found” the database of a college app (2018)

#44
I had to code-review a Django app using Firebase as a DB and swore never again. He did features and promised to do validation and security later by going to their editor and writing Javascript files. Django lets him write valid forms and correct SQL queries in almost same lines of code. Pagination was a pain in current version and present only in a version forever in beta. All the hard work coaching him on exceptions went out of the window.

An Android dev finally enlightened me where Firebase shines: offline sync of mobile to a server by eliminating lots of explicit CRUD calls and error handling.

Re: I “found” the database of a college app (2018)

#45
post #33

The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an unlocked car in a bad neighbourhood and no one holds them accountable. Most people understand the concept of an unlocked car, not many understand that he didn't do anything special to hack his school db. He just strolled right in.

I did this when I was at high school with a friend. Basically the place had a shared Windows file system, and the only thing that prevented everyone from viewing it was that it was hidden in the UI. On the drive was lots of data, including some applications in PDF format - completely unprotected - full of personal information of minors.

At the time we had recently covered data protection in IT class, so we wrote up a document explaining what we did, and why it was bad, and gave copies to a few people in prominent positions (principle, head of IT, IT teacher) as well as posting it (with instructions redacted) on an internal message board.

Well of course they didn't take it very well. They threatened to expel us and call the cops, and suspended us for a week until they decided what to do. In the end a well written warning from my friend's parent made them drop the issue and let us back in. I doubt they did anything to change the "security".

Re: I “found” the database of a college app (2018)

#46

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

I'm not sure if you are in the industry, but attendance tracking is high up on most institutions lists of metrics to track. Aside from helping out the usual back office data, it's often a key indicator for students who are in trouble. The institution can then reach out and assist these students.

They might just not be from the US. Here in Germany, tracking or forcing student attendance is subject of large discussions and generally often frowned upon (or forbidden by regulation) in the University setting these days.

Re: I “found” the database of a college app (2018)

#48
post #22

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

Here in India, the University I attended requires a minimum attendance of 75%, or they won't allow you to sit the end of semester exams. Your attendance even accounts for 5% of the score of your end of semester exams for that course. Quite insane when you think about it.

[deleted]

Re: I “found” the database of a college app (2018)

#49

Earlier quoted context omitted.

I'm not sure if you are in the industry, but attendance tracking is high up on most institutions lists of metrics to track. Aside from helping out the usual back office data, it's often a key indicator for students who are in trouble. The institution can then reach out and assist these students.

They might just not be from the US. Here in Germany, tracking or forcing student attendance is subject of large discussions and generally often frowned upon (or forbidden by regulation) in the University setting these days.

This is mind boggling. Failing someone for missing one or two classes is ludicrous, but giving someone a certificate who didn't engage with the course is equally so. University education isn't about the destination/exam it's about the journey.
Post reply on HN