4 ms·

We did. We have a regex to catch all variants of spellings. But since our code is open they can easily select another variant. We could load our script dynamica

We did. We have a regex to catch all variants of spellings. But since our code is open they can easily select another variant. We could load our script dynamically but have chosen not to of security reasons. (And transparency). (I’m the founder of this initiative)

RupertEisenhart 6y ago
Can't you ban the malicious Devs? They keep creating new GitHub accounts or what?
- toyg 6y ago
  Not OP but from what I understand, the problem is that their code has to interoperate with the “private” service run by the “bad guys”; it’s basically a more usable front-end. So the bad guys keep messing with the backend just to break the open client.
- dromtrund 6y ago
  I assume they read the code that tries to parse the data, and come up with formats that don't fit. If the code is open, they don't need accounts to see it
  - developer92 6y ago
    they need one to contribute changes though
    - LocalH 6y ago
      They're changing their own code, not the public code in question. They're not submitting pull requests.
    - ZWoz 6y ago
      They don't contribute changes. Server and official client is maintained by Stockholmsstad contractors. Open source project is alternative client, not full solution.
    - rad_gruchalski 6y ago
      The system that implements breaking changes is not the open source system. The open source system attempts to be compatible with the proprietary system. That is what it sounds like.
- tsimionescu 6y ago
  The government devs are deliberately modifying server code after seeing what the open source code is using to identify their header. Guthub doesn't require an account to view code, so how could they ban government coders from seeing their code?
utrechtsouth 6y ago
urvader, While there is a technical issue here, there is also a legal issue and a PR issue. Government institutions have a duty of care and a duty to help to private individuals. Since they are apparently working _against_ people in this case, they are probably in breach of the law. Description of relevant rules here (in Swedish). https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighet/verksamhetsrelaterade-krav/myndigheters-serviceskyldighet/ https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighe... I strongly suggest that you file a formal complaint against the government agency. This is easy to do and you can do it here. https://www.jo.se/sv/JO-anmalan/ https://www.jo.se/sv/JO-anmalan/ When you have filed the complaint: MAKE IT PUBLIC (hacker news follow up story, twitter, linkedin, etc). This is because there is a political dimension to this issue and if there is anything politicians care about, it's jobs (their own). Good luck and keep us updated! I'm sure lots of people will be happy to spread a copy of the complaint around.
- urvader 6y ago
  Thanks! Yes, we are investigating our legal options. We just recently filed an appeal regarding getting access to the API documentation. We have gotten a lot of PR in Sweden from the major news papers and tech press. So I think the pressure is building but if it is one thing Swedes are worried about is the appearance internationally. So help us getting this story to Wired, TechCrunch etc - that will make them crazy. We still live on the front page of Newsweek from 2000 - the capital of Internet. That might be true for the tech scene but definitely not the public sector. We would rather concentrate our limited time and resources on making the product better instead of this crap but we have an amazing community that are helping us with both legal advice, artwork, communication, UX etc so we will continue the fight and will keep you updated here in Hacker News. Thanks for all support so far!
  - utrechtsouth 6y ago
    Sounds great! Also keep in mind that the legal options and PR options are tightly coupled. Regardless of the outcome of any legal option (e.g. "JO anmälan"), the PR generated around it may itself lead to a change if it gets enough attention (e.g., Anna König Jerlmyr seems to be in charge of Stockholm municipality at the moment). Make it easy for them to get good PR and make it clear the other option is to get bad PR. These questions are larger than this project. This is about how the government itself builds API:s. That's big.
wizzwizz4 6y ago
Have you tried letting users extract the token themselves, when your code can't find it?
- zdkl 6y ago
  It's my (uneducated) understanding that legally, this makes you cross a boundary. You're no longer ~"circumventing security measures" on your own, you're inciting and enabling an end user to. One could easily argue it's on the darker side of the grey area.
  - FDSGSG 6y ago
    This doesn't make any sense at all.

RupertEisenhart 6y ago

Can't you ban the malicious Devs? They keep creating new GitHub accounts or what?

toyg 6y ago
Not OP but from what I understand, the problem is that their code has to interoperate with the “private” service run by the “bad guys”; it’s basically a more usable front-end. So the bad guys keep messing with the backend just to break the open client.
dromtrund 6y ago
I assume they read the code that tries to parse the data, and come up with formats that don't fit. If the code is open, they don't need accounts to see it
- developer92 6y ago
  they need one to contribute changes though
  - LocalH 6y ago
    They're changing their own code, not the public code in question. They're not submitting pull requests.
  - ZWoz 6y ago
    They don't contribute changes. Server and official client is maintained by Stockholmsstad contractors. Open source project is alternative client, not full solution.
  - rad_gruchalski 6y ago
    The system that implements breaking changes is not the open source system. The open source system attempts to be compatible with the proprietary system. That is what it sounds like.
tsimionescu 6y ago
The government devs are deliberately modifying server code after seeing what the open source code is using to identify their header. Guthub doesn't require an account to view code, so how could they ban government coders from seeing their code?

utrechtsouth 6y ago

urvader, While there is a technical issue here, there is also a legal issue and a PR issue. Government institutions have a duty of care and a duty to help to private individuals. Since they are apparently working _against_ people in this case, they are probably in breach of the law. Description of relevant rules here (in Swedish). https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighet/verksamhetsrelaterade-krav/myndigheters-serviceskyldighet/ https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighe... I strongly suggest that you file a formal complaint against the government agency. This is easy to do and you can do it here. https://www.jo.se/sv/JO-anmalan/ https://www.jo.se/sv/JO-anmalan/ When you have filed the complaint: MAKE IT PUBLIC (hacker news follow up story, twitter, linkedin, etc). This is because there is a political dimension to this issue and if there is anything politicians care about, it's jobs (their own). Good luck and keep us updated! I'm sure lots of people will be happy to spread a copy of the complaint around.

urvader 6y ago
Thanks! Yes, we are investigating our legal options. We just recently filed an appeal regarding getting access to the API documentation. We have gotten a lot of PR in Sweden from the major news papers and tech press. So I think the pressure is building but if it is one thing Swedes are worried about is the appearance internationally. So help us getting this story to Wired, TechCrunch etc - that will make them crazy. We still live on the front page of Newsweek from 2000 - the capital of Internet. That might be true for the tech scene but definitely not the public sector. We would rather concentrate our limited time and resources on making the product better instead of this crap but we have an amazing community that are helping us with both legal advice, artwork, communication, UX etc so we will continue the fight and will keep you updated here in Hacker News. Thanks for all support so far!
- utrechtsouth 6y ago
  Sounds great! Also keep in mind that the legal options and PR options are tightly coupled. Regardless of the outcome of any legal option (e.g. "JO anmälan"), the PR generated around it may itself lead to a change if it gets enough attention (e.g., Anna König Jerlmyr seems to be in charge of Stockholm municipality at the moment). Make it easy for them to get good PR and make it clear the other option is to get bad PR. These questions are larger than this project. This is about how the government itself builds API:s. That's big.

wizzwizz4 6y ago

Have you tried letting users extract the token themselves, when your code can't find it?

zdkl 6y ago
It's my (uneducated) understanding that legally, this makes you cross a boundary. You're no longer ~"circumventing security measures" on your own, you're inciting and enabling an end user to. One could easily argue it's on the darker side of the grey area.
- FDSGSG 6y ago
  This doesn't make any sense at all.