Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stockholm parents built their own school app, then the city called the cops

wired.co.uk

Post reply on HN
Print view View original

281–290 of 357 posts

Re: Stockholm parents built their own school app, then the city called the cops

#281

Post by tofflos »

xmprt wrote: post #280
tofflos wrote: post #259

Earlier quoted context omitted.

No, because applications, publishing and intent doesn't factor in. Student grades and disciplinary issues become official documents as soon as the teacher documents them regardless of form (i.e. paper, audio recording, IT-system, etc). The school is then obligated to provide those official documents to anyone upon request. The school could argue that this information should be kept secret but student grades are not e…

Can a different parent look at my child's grades? Or is there still some level of privacy where only certain parties are allowed to view certain documents even if they are official.

Yes.

Edit 1: I figured I should back this up with a source but all the ones I could find are written in Swedish. So either accept my translation or ask a trustworthy Swede to translate it for you.

> Skolbetyg är allmänna handlingar, och vem som helst kan beställa fram betyg från arkiven. Journalister brukar t ex ofta vilja se på nytillträdda ministrars skolbetyg.

Source https://riksarkivet.se/skolbetyg

Translation:

School grades are official documents, and anyone can request grades from the archives. Journalists often like to see the school grades of newly elected government officials.

This source is the Swedish National Archive but this also applies to non-historical grades.

Edit 2:

> Or is there still some level of privacy where only certain parties are allowed to view certain documents even if they are official.

The government can, and will, opt-in to secrecy for things like social services and medical records.

Re: Stockholm parents built their own school app, then the city called the cops

#283

Post by barry-cotter »

pwdisswordfish8 wrote: post #140
drcongo wrote: post #128

Every edutech platform I've ever had to use (UK, with 3 kids going through school) is an abomination, the whole sector needs disrupting. My current nemesis is Iris Parentmail [0], a convoluted jumble of javascript that presents the user with a challenge - try to read the apparently important message the school has sent you before Parentmail crashes your browser. If the message is particularly long, then there's an en…

For anyone who's been burned by these: Why aren't you equally as mad at the personnel at your child's school? It's one thing for a national or semi-national rollout of broken enterprise junk, it's another thing for your child's instructor to go along and demand that you use this broken system instead of providing reasonable affordances (e.g. low-tech, paper-based notices/forms that get sent home with your kid). For t…

> Why aren't you equally as mad at the personnel at your child's school? It's one thing for a national or semi-national rollout of broken enterprise junk, it's another thing for your child's instructor to go along and demand that you use this broken system instead of providing reasonable affordances

You don't expect people who face no consequences for anything short of criminal conduct to change their behavior. Being mad at civil servants is like being mad at the weather and only slightly more likely to accomplish anything.

Re: Stockholm parents built their own school app, then the city called the cops

#284

Post by kwdc »

wonderwonder wrote: post #16
raxxorrax wrote: post #8

> In some cases, people’s personal information could be accessed from Google searches. SEO providers should take a note here. > It warned parents to stop using the app and alleged that it might be illegally accessing people’s personal information If your API allows data extraction, it probably isn't a fault of any client. Perhaps they meant that creators could steal credentials. A problem with any software. I think t…

"I think this digital child managing system sounds moderately dystopian to be honest" I disagree, I have 2 kids in elementary school and it is very useful to be able to look up what the kids have scheduled for the day to determine what to dress them in, see what's for lunch and if I need to pack them something if they won't like the available option. Most importantly though its very helpful to look up what homework /…

I'd also say that a school denying access to this information should rightly expect pointy and sharp questions coming at them. Parents being part of the education system shouldn't come as a surprise to a school. It would be like hiding the school timetable.

Usual common sense caveats still apply: Privacy and authentication are still valid aspects but not to block those who could reasonably expect to successfully authenticate, eg a parent of a kid in school.

Re: Stockholm parents built their own school app, then the city called the cops

#285

Post by yoavm »

kiklion wrote: post #190
taylodl wrote: post #22

The first thing that jumps out is Sweden has a national identity system, BankID. The APIs appear to be protected using those credentials. With that in mind I have two questions: 1. Who owns the data? 2. Should public funds be used for the creation of private APIs that manage the data? The answer to (1) has consequences for (2). I think many HN readers, including myself, and certainly these parents would argue that th…

I feel like focusing on who owns the data is unnecessary. If there is an API that grants access to data by passing in a valid auth token, then it doesn’t matter if it’s called from a SPA app or postman or curl. As long as you are using the public API and haven’t forged an auth token then it doesn’t matter how you call the public API.

Agree. Who cares about the client implementation?! You sent me the data, I decide how to process and render it. Otherwise we can sue people for having a black and white screen, using a text-only browser, a custom stylesheet or even for closing their eyes when the TV commercials are on.

Re: Stockholm parents built their own school app, then the city called the cops

#286

Post by losvedir »

Diggsey wrote: post #83
wonderwonder wrote: post #50

Earlier quoted context omitted.

I don't know if you have kids, I am guessing not, if I am wrong, my apologies. Knowing what your kids have due for school is not micromanaging its a core part of being a good parent. I know if my kid has a math test so it lets me sit down with him and review for his test, it allows me to ensure he knows the basis for whatever comes next in his curriculum. Terribly overbearing parents are not good but I think people a…

That's absolutely micromanaging and negative. The goal of school isn't just to pass the tests. If a kid fails to revise for a test, but it doesn't matter because their parent will just look up the schedule and force them to revise, then they learn nothing beyond what's in the test. If they fail to revise and as a result do badly at the test, then next time they might actually take the initiative and revise through th…

FYI in English "revise" means something like "edit". You probably meant "review". I know in Spanish "revisar" can mean to review, so that caught my eye, and thought you might be tricked by a false cognate.

Re: Stockholm parents built their own school app, then the city called the cops

#287

Post by zmmmmm »

infogulch wrote: post #191
titusjohnson wrote: post #145

Earlier quoted context omitted.

There is clearly an API in play here. The article mentions it numerous times. The client app has to use an API to get its data, that's a downside of deploying a SPA. You need to make an API for it to get data from. If you don't want to make an API that exposes raw data just write a SSR app. If you want to deploy a SPA, well, you have to deploy an API as well and you need to plan around the fact that when you throw an…

Using SPA vs SSR as the sole factor in determining "published" status rings hollow for me, because it completely excludes any analysis based on intent, and intent usually matters in law! (Though I admit I'm not familiar in this case and this country.) Also it's easy to poke holes: does this mean that scraping data from html is always hacking, regardless of the expressed intent? (See recent Missouri case for what that…

> drawing the line based on which kind of technology is used to deliver the content is a good method

Apart from other reasons, it would almost certainly result in providers obfuscating data or reverting to SSR which is a perverse outcome.

Re: Stockholm parents built their own school app, then the city called the cops

#288

Post by zmmmmm »

urvader wrote: post #273
munk-a wrote: post #187

Earlier quoted context omitted.

It might technically look like an API - but it could still not count as an API legally (for the constitutional trick) if the interface was not intended to be public. If you want to stretch the terms, everything on and off the web that does communication is basically an API - it's just that some of those APIs use JSON to encode their data and make it really easy to access... and some of them bury it in mountains of HT…

The law is not specific at all in regards to the format of the document. So to talk about an “API legally” has no meaning. In a private scenario it makes sense but what we are talking about here is public documents which are sent through an API. The city has responsibility to only send information I have (as a parent) legally right to see. How I parse it and present it is up to me as citizen (through an app or save i…

> How I parse it and present it is up to me as citizen

I know technologists like to think that way but very often the law doesn't work like that. They will think about intent - was the intent to give you the raw data or was the intent to convey a specific representation of it that may omit some parts or further transform or presentation layer changes to achieve a different final result to what the raw data would have conveyed?

If it is the latter then that is the "public document" you have access to, not the raw data from the API.

Re: Stockholm parents built their own school app, then the city called the cops

#289

Post by 908B64B197 »

urvader wrote: post #73
taylodl wrote: post #22

The first thing that jumps out is Sweden has a national identity system, BankID. The APIs appear to be protected using those credentials. With that in mind I have two questions: 1. Who owns the data? 2. Should public funds be used for the creation of private APIs that manage the data? The answer to (1) has consequences for (2). I think many HN readers, including myself, and certainly these parents would argue that th…

(I am Christian Landgren, cofounder of the project) You are right, the city believes they have ownership of the data, mainly because they fail to understand that they aren’t showing data in an app, but rather publishing data in an API. In Swedish law, once you have released data from a government, the receiver have the right to do whatever they want with the that data (as long as it isn’t violating any other laws). T…

> You are right, the city believes they have ownership of the data, mainly because they fail to understand that they aren’t showing data in an app, but rather publishing data in an API.

Christian, it's not about the data and has never been. The data is a legal tool they are using.

The municipal administration is trying to save face. It's layers and layers of non-technical bureaucrats who have to justify their salaries.

A few talented software engineers running in circles around some multi-million dollar contract they gave to a large offshored operations with probably close to a hundred individual programmers doesn't look good for them at all.

Re: Stockholm parents built their own school app, then the city called the cops

#290

Post by KajMagnus »

urvader wrote: post #274
scoot wrote: post #95

Earlier quoted context omitted.

Hi, congrats on the app. I was curious about one thing in the article - why would the city pay to license the app when it is open source? Do you anticipate that this would be cheaper for them than them paying one of their overpriced contractors to build and publish an "official" version, given how much they spent on a CRUD app?

Thanks! Well we have already made the source code open and free and also encouraged the city to release an app with our source code as base. They weren’t interested in that. They would rather license the app, support and maintenance to us. We have quoted a fixed sum per month for that service and we plan to use that money to reimburse everyone sending PR:s we merge.

> We have quoted a fixed sum per month for that service and we plan to use that money to reimburse everyone sending PR:s we merge

How interesting :- ) I wonder how you'll distribute the thanks-for-the-feature (PR) money — e.g. per PR, or per lines (hmm I guess not) or maybe some impact / "severity" system like for bug bounties? (but this time "feature bounties")

(From Sweden me too. How nice that you built the app and that apparently things seem to end in a good way :- ) I felt a bit upset when reading the article)

Post reply on HN