581–590 of 705 posts
[0] https://en.wikipedia.org/wiki/Greg_Gianforte#Election-eve_as...
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…
Earlier quoted context omitted.
> It really is hard sometimes, to not just withdraw into a shell of isolation and decide "fuck it, this world is too damned stupid for me to bother with." In moderation, I think this is actually the correct response. Unless you live in Missouri, who cares what stupid things the Governor of Missouri says? In a previous era, you never would have heard about this story at all. It's just a politician in a minor state try…
> Unless you live in Missouri, who cares what stupid things the Governor of Missouri says? Because that person literally rules over millions of people, the overwhelming majority of which didn’t vote for him (1.7m votes out of the 6.1m population). Right now he is literally threatening state violence against a reporter for looking at a government website that accidentally leaked personal information.
Getting a prosecutor to risk their career on prosecuting a journalist for politics is quite a bit more difficult. Journalists are well aware of their rights, and have lawyers between them and law enforcement.
I think its dumb, but as a former photojournalist who had a very large oil company (Haliburton) use a very small police department to come after me for trespassing, I can assure you that the newsroom is NOT scared right now.
Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
Earlier quoted context omitted.
You left out the best bit: "through a multi-step process"
Right click. View Page Source. That's 2 steps. Hence, multi-step.
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
I would have thought using incrementing IDs in a URL was as beaten of a dead horse as sanitizing your strings in a SQL query. Then again, ACA websites behaved as lowest bidder was selected.
Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
It seems stupid to us, but non-techies just won't understand unless we come up with reasonable analogies.
Why is everyone here acting like the governor is merely stupid? He is not arguing from ignorance, he is arguing in bad faith. Mike Parson wants to feed the narrative that the American free press is the "enemy of the people" because it suits his politics, nothing more. The only message here is "be careful embarrassing fascists."
Nearly all politicians act like this when they're in power. The general public is easily mislead. HN notices it when it's a tech issue, but it happens in economics, medicine, basically everywhere. They have zero incentives to accept responsibility.
To make matters worse, incrementing a number in the URL cycled through different hospital waiting rooms.
I emailed the vendor who build the tool about the issue and they responded letting me know that system worked as it was designed, and that no HIPPA violations existed since there was no full last name.
I meant to make a bigger deal about this, but then got busy.