16 ms·
From the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw: > "According to the Post-Dispatch, one of its
by mdek 5y ago
From the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw:
> "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."
- tomrod 5y agoOh that is so bad. It's events and negligence like this that give credence to credentialing requirements for software engineering.
- daviddever23box 5y agoImagine if we had credentialing requirements for elected office…
- solveit 5y agoWe do. It's called an election. What you want is credentialing requirements for voting.
- WkndTriathlete 5y agoI'm pretty sure I want credentialing requirements for anyone running for any public office. I'd settle for automatic exclusion of anyone displaying narcissistic, psychopathic, or sociopathic tendencies and inclusion of rational pragmatists.
- solveit 5y agoI would also "settle" for picking the people I like. Also, pretty sure that you have to be at least somewhat narcissistic to think that you should be president, and somewhat sociopathic to actually succeed.
- deleted 5y ago[deleted]
- A4ET8a8uTh0 5y agoAnd US used to have them too. The basic approach was that if you have land, you have a stake in the future of the republic. It was debated as to whether landless would have the same stake.
- mywittyname 5y agoI don't think the issue is that elected officials are dumb. I think it's the opposite, most are quite intelligent. It's more that they are evil/corrupt/self-serving, and acting dumb is part of how they get away with it.
- dylan604 5y agoWe've always known that using DevTools was a criminal activity. In fact, the sheer number of people using them places this at criminal conspiracy levels. Better start filing those RICO cases against the browser devs. /s
- codegeek 5y agoHow dare you did "View Source", you hacker.
- jakelazaroff 5y agoWhat's "view source", some kind of hacking instructions? Sounds like you're abetting.
- dylan604 5y agoAs long as you're not aiding at the same time. Aiding & abetting is a no-no. Aiding OR abetting is not claimed to be an issue.
- amirhirsch 5y agoyou mean Aiding XOR abetting. consider the forum.
- dylan604 5y agowhy does it have to be exclusive? If both are false, then there's no confusion on making a charge. If only one is true, then someone being lazy might think it matches. along your lines of considering the forum, wouldn't it need to be aiding && abetting? i don't know how to bitwise compare aiding to abetting.
- tombert 5y agoI think "view source" is a hacking tool invented by the notorious hacker group "4chan". I say we start a change.org petition to get Google to remove it from Chrome.
- unyttigfjelltol 5y agoTranslation: search for a certification on the public website, receive an SSN in response. Only 'hacking' by reporter was to then press 'Ctrl+U' in the browser and read the characters.
- ghayes 5y agoImagine if the reporter had used curl…
- BizarroLand 5y agoHe used the basic reading skills that are taught in ever public and private education system in the country to hack us!
- adrr 5y agoLike redacting a public document by making the redacted parts have a black background with black text. If people can't see it, it is secure.
- ollien 5y agoTell me if I'm reading this wrong. I want to be reading this wrong. Is this saying that when you viewed a certain page (which I assume had only one person's SSN visible, or perhaps other teacher information like names), the "invisible" SSNs were just hidden with `display: none` or similar?
- ihumanable 5y agoI think what actually happened is that there was a page where you could get information about a particular educator. In the HTML source the server returned for that page private information about *that educator* was included in non-displaying elements.
- ollien 5y agoMakes sense. Jesus, though.