Live data from Hacker News

Stockholm parents built their own school app, then the city called the cops

wired.co.uk

231–240 of 357 posts

Re: Stockholm parents built their own school app, then the city called the cops

#231
Open APIs is what we need because too many programs are badly designed. Unfortunately, the API may also be badly designed, but sometimes it is OK. Designing the open API may also avoid the data breach due to making less likely that the design is not designed in the way to cause such a breach, I should expect.

User interfaces seem bad enough that I think it might be better to design the API primarily and even only the API; you can then just use that. If it is simple enough, it can be used from command-line interfaces, and others, easily enough if a protocol is designed well enough to support such multiple uses in a simple way. (It can even make the form automatically too, with the user's display settings rather than using the form author's CSS or whatever.)

However, they also should not require schools to use such a app, especially to require one of their locked systems only. You can do education without it, too. That doesn't mean such a system is useless (you can use it if you find it useful), only that it is possible to work without it, too. They didn't used to have such a app in the school and shouldn't require it now either; it can be voluntary.

Re: Stockholm parents built their own school app, then the city called the cops

#232

Earlier quoted context omitted.

Your parents already had access to the app, just in the form of a folder you were sent home with that had everything printed out. This is just a digitized version, its not the 2nd coming of the Gestapo. Also you need to think about this from the perspective of the parents, having kids in school mean you have to do things, you can either be informed ahead of time and do them in a leisurely manner or you can find out l…

It sounds like you may have had a very unorthodox childhood and may not realize it. No, my parents didn't have access to, or knowledge about my things. As soon as you entrust a child with a document, it is up to that child whether that document survives more than a few steps out of the classroom, let alone whether a parent ever knows about it. That is a very strong form of autonomy, important to a child's development…

I think maybe we are thinking of distinctly different age groups. My kids are in elementary school, they are sent home with a folder everyday that lists what is due. Teacher told us at the beginning of the year that this would happen. If my kid suddenly did not bring his folder home I would know something was wrong.

"The stress you are talking about seems to me like the hallmark of an overbearing parent" Maybe but I have kids, and most of the parents I know are the same way, so I guess there are a ton of us that are wrong. Your opinion may change once you have kids.

"Let your child fail sometimes. That's ok, they need to experience that, that's how you learn." Appreciate the advice and I accept it as its advice I would have given when I did not have kids, thought I had it all figured out and believed raising kids was easy.

Re: Stockholm parents built their own school app, then the city called the cops

#233

Earlier quoted context omitted.

There is clearly an API in play here. The article mentions it numerous times. The client app has to use an API to get its data, that's a downside of deploying a SPA. You need to make an API for it to get data from. If you don't want to make an API that exposes raw data just write a SSR app. If you want to deploy a SPA, well, you have to deploy an API as well and you need to plan around the fact that when you throw an…

Using SPA vs SSR as the sole factor in determining "published" status rings hollow for me, because it completely excludes any analysis based on intent, and intent usually matters in law! (Though I admit I'm not familiar in this case and this country.) Also it's easy to poke holes: does this mean that scraping data from html is always hacking, regardless of the expressed intent? (See recent Missouri case for what that…

Publication intent is trivial to verify.

Q) Are you able to retrieve a document using the credentials issued to you by the API? A) Yes: Then you're authorized to view it. No: You're not authorized to view it.

An API is the encoding of business rules around data access and modification. If your API is allowing access that you don't intend a user to have, fix your authorizations.

Re: Stockholm parents built their own school app, then the city called the cops

#234
post #208

It would be interesting to know what contractor delivered the original $120m mess, and actively sabotaged open source efforts. The combination of large budget and terrible result suggest some of the very large contractors used to doing work for fortune 500 companies. Shame on those who work there.

Well originally there were 4; TietoEvry, Nova Software, Ping Pong and Itslearning [1]

[1] https://axbom.se/oppna-skolplattformen-stockholm/

Re: Stockholm parents built their own school app, then the city called the cops

#235
post #225

Earlier quoted context omitted.

Privately documented APIs are still APIs.

I don't disagree (though when it comes to this particular case it's a question of what the opinion of Swedish courts is) but there's just a lot of grey area there. Would you consider `ls` an API for exposing your filesystem?

> Would you consider `ls` an API for exposing your filesystem?

I don't see why not.

It has an interface for input and output, conforms to well known specifications and is publicly documented.

There's also multiple implementations behind the API.

Re: Stockholm parents built their own school app, then the city called the cops

#236
post #187

Earlier quoted context omitted.

It might technically look like an API - but it could still not count as an API legally (for the constitutional trick) if the interface was not intended to be public. If you want to stretch the terms, everything on and off the web that does communication is basically an API - it's just that some of those APIs use JSON to encode their data and make it really easy to access... and some of them bury it in mountains of HT…

> One outcome of this fight might be that government organizations are directed to use more proprietary communication methods which would be a poor outcome for everyone involved. I agree with the rest of your argument, but I think that this part is not necessarily a good example of the risks. Far easier would be to use a shared key between the app and the site, and thus use encryption to prevent reading the data, whi…

I think it depends on the outcome of the case - I could see some possible resolution like the Swedish supreme court declaring that JSON counts as a public record and that forcing a block on prohibitive encryption of JSON endpoints offered by the government (assuming everything the OP said about constitutionality is correct).

We've seen such bizarre technical decisions from high courts before.

Re: Stockholm parents built their own school app, then the city called the cops

#237
post #73

Earlier quoted context omitted.

(I am Christian Landgren, cofounder of the project) You are right, the city believes they have ownership of the data, mainly because they fail to understand that they aren’t showing data in an app, but rather publishing data in an API. In Swedish law, once you have released data from a government, the receiver have the right to do whatever they want with the that data (as long as it isn’t violating any other laws). T…

But there is no API here. The article makes it clear that you were intercepting client-server communication not meant to be used by third parties in order to write your own client. That it could be used as an API doesn't matter since the intent wasn't to create an API. I could do the same thing and write an app for, say, the tax agency by scraping its website but it would be a legal gray area.

I'm not sure I follow why that would matter. Their constitution says once data has been released, it is no longer their property (because it's a public institution). They created a way to access the data, so the data has been released to the parents and so the data now belongs to the parents. The parents own the data and as such it would seem to follow they can access it anyway they want.

Re: Stockholm parents built their own school app, then the city called the cops

#238
post #22

The first thing that jumps out is Sweden has a national identity system, BankID. The APIs appear to be protected using those credentials. With that in mind I have two questions: 1. Who owns the data? 2. Should public funds be used for the creation of private APIs that manage the data? The answer to (1) has consequences for (2). I think many HN readers, including myself, and certainly these parents would argue that th…

I'm obligated to point out that bank id is not a national id. It's an electronic ID issued by private banks.

Re: Stockholm parents built their own school app, then the city called the cops

#239

Earlier quoted context omitted.

"I think this digital child managing system sounds moderately dystopian to be honest" I disagree, I have 2 kids in elementary school and it is very useful to be able to look up what the kids have scheduled for the day to determine what to dress them in, see what's for lunch and if I need to pack them something if they won't like the available option. Most importantly though its very helpful to look up what homework /…

Back when I was in school we had a schedule, for the semester. That worked perfectly well for me and my parents. Our kitchen had a pin board with these schedules pinned to it. After a month or so we all had a new schedule internalized anyway. As for food, we had a cafeteria which served warm meals, usually at least two different options, and various other things like sandwiches, along with two "kiosks" where the jani…

The main problem with the current set of schooling management systems is that they require a lot of work from parents to extract any useful information, and that level of effort amplifies an imbalance between parents having the time and ability and the parents that don't.

What would have been helpful to me as a parent (while my children were enrolled in school) would have been a short weekly email, one from each teacher/class, simply summarizing the topic for the next week or two. That* would be useful in helping parents engage with their children before the material is covered in class. Instead my experience over the past four years has led me to believe that most teachers and school administrators are very poor communicators.

* Another option would be for teachers to provide a course syllabus at the start of each semester. But for whatever reason teachers no longer provide those, either because they think the online stuff is sufficient (it's not) or because they haven't planned ahead.

Re: Stockholm parents built their own school app, then the city called the cops

#240
post #215

Earlier quoted context omitted.

Interesting strategy. How have your kids performed under it?

Not him, but generally to large extend I have that strategy and kids do well. Both have good grades and are motivated. Obvious caveat is that if their grades were not good, I would get involved more. When their grades fallen a bit, I was there telling them that they need to learn, analyzing test with them and so on and blah blah. When homework was not done, I got involved for a while until the kid got into habit of d…

How did you know the homework wasn’t done?
Post reply on HN