571–580 of 705 posts
Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
I prefer to call them muggles.
No this didn't actually happen but it's the analogy that came to mind.
Earlier quoted context omitted.
Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…
I am now questioning the wisdom of having shared this story, and I apologize for derailing the discussion.
[1] Parson commits $50M to investigate alleged hack of Missouri educator database. Includes video press conference by Parson himself. [1] https://fox2now.com/news/missouri/missouri-education-departm...
$50m? Wouldn't that be better spent on the actual education system and educators itself? Talk about corruption - spending taxpayer money to cover-up mistakes made by government employeers - AND libellous statements made by government officials...
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
People have gone to jail for incrementing integers in URLs like that (most famously, weev).
So I'm hopeful that the courts are slowly starting to wisen up in that respect.
Earlier quoted context omitted.
Years ago, I worked at this place, they tried to install these new core routers. The first core router worked fine, but connect the second and the whole campus network would go into meltdown. The network team could not work it out. The vendor could not work it out. But one of the IT managers had an explanation: me. Firstly, it was due to an OpenVPN I installed on a server (with permission-as a stopgap measure so we c…
Wow, I'll keep this in mind next time I complain about my manager.
> Parson said...the reporter was “attempting to embarrass the state and sell headlines for their news outlet.” Literally a reporter's job.
And the governor's helping!
Earlier quoted context omitted.
No, it's not, because computers and humans are not the same. A computer might give away too much information because someone misconfigured it. The closet human analog to that would be if the human was improperly trained in what information they're supposed to give out. But the human also has other options: they could be tricked into giving out more information than they should, or they could be giving out more inform…
> Yes, it is obvious: the clerk is liable for giving you something they shouldn't have, and you are liable for fraudulently representing yourself as someone who should have access to those files. It's always okay to ask for things. There would be no way for society to adapt, progress, or change if people were limited to only asking for things that they knew in advance they were allowed to have. If it's legal for a te…
If you know doing x will cause y, then when you do x you are doing y and you are responsible for the consequences of doing y. It doesn't matter what x was.
This is especially true in the real world.
Earlier quoted context omitted.
Tell me if I'm reading this wrong. I want to be reading this wrong. Is this saying that when you viewed a certain page (which I assume had only one person's SSN visible, or perhaps other teacher information like names), the "invisible" SSNs were just hidden with `display: none` or similar?
I think what actually happened is that there was a page where you could get information about a particular educator. In the HTML source the server returned for that page private information about *that educator* was included in non-displaying elements.