3 ms·

I commented days ago about a state website that was returning all kinds of nicely formatted NPI in JSON from an API response, but the NPI was not displayed. I d

I commented days ago about a state website that was returning all kinds of nicely formatted NPI in JSON from an API response, but the NPI was not displayed. I donned my black hat and other hacker attire and pressed F12 to open the browser's developers tools (a tool created by a shifty company named Google most people have never heard of), and there it was, plain as day, SSNs, addresses, etc. I closed the page and never touched it again. I knew what's happening in this story could happen to me. I knew my side of the story would rarely be told and that my fate would lie in the hands of a judge who views the F12 key with distrust and fear and a jury of my "peers" who are not actually my peers in any skill or know-how related to the case.

onychomys 5y ago
At least make a throwaway email account somewhere and email the state's IT department to let them know. I doubt it'd ever get fixed (given state budgets), but still.
- dragonwriter 5y ago
  In states that have state-level IT departments (usually, in addition to opposed to agency-internal ones), the state-level one mostly does IT project and contracting policy and oversight (often limited to large projects for active overisght), and maybe executes enterprise contracts for infrastructure that is used across agencies. For an in-production system, there is a good chance that they have no responsibility for ongoing maintenance, and no special information beyond what is on the website as to who is responsible for maintenance. You are better off contacting (anonymously or otherwise) the responsible agency. But, sadly, probably the most effective way to get it changed (after the flurry of butt covering) is to anonymously notify the media.
- Buttons840 5y ago
  Other comments are talking about how Missouri will spend millions investigating this "hack". I don't know how to reliable mask my identity against a million dollars worth of criminal investigators. This was many years ago, a few years after it first happened I looked again and it had been fixed.

onychomys 5y ago

At least make a throwaway email account somewhere and email the state's IT department to let them know. I doubt it'd ever get fixed (given state budgets), but still.

dragonwriter 5y ago
In states that have state-level IT departments (usually, in addition to opposed to agency-internal ones), the state-level one mostly does IT project and contracting policy and oversight (often limited to large projects for active overisght), and maybe executes enterprise contracts for infrastructure that is used across agencies. For an in-production system, there is a good chance that they have no responsibility for ongoing maintenance, and no special information beyond what is on the website as to who is responsible for maintenance. You are better off contacting (anonymously or otherwise) the responsible agency. But, sadly, probably the most effective way to get it changed (after the flurry of butt covering) is to anonymously notify the media.
Buttons840 5y ago
Other comments are talking about how Missouri will spend millions investigating this "hack". I don't know how to reliable mask my identity against a million dollars worth of criminal investigators. This was many years ago, a few years after it first happened I looked again and it had been fixed.