5 ms·

One thing that reads a bit weird are passages like "We hid state messages […] from our client" or "We also hid the option to create groups". So if I grab the t

by liftm 5y ago

One thing that reads a bit weird are passages like "We hid state messages […] from our client" or "We also hid the option to create groups". So if I grab the token from the client (or extract the implementation for decrypting their QR codes), I can still do it through the API? Hmm…

slightwinder 5y ago
I'd say a dedicated hacker could walk through their system like a laser through butter anyway. After all, it's just a random school, lacking expertise as also manpower for proper quality. Their long term goal should be to get the same experience from a proper managed project. The problem is that official projects have just started to move into that space. German Public IT is insanely far behind in that regard.
ThePadawan 5y ago
...a honeypot to discover technically minded students?
- johannes1234321 5y ago
  As it is an elementary school it is unlikely that a pupil will "hack" it, however some parents or big brothers might. But I wondered the same, especially as they state they also want to block parents from talking to anybody, except the teachers. But maybe that can be augmented by serverside configuration and the change in the client is about taking away the options, which would be blocked by the server anyways.
thisisnacho 5y ago
State messages like "x has entered/left the room" or "x has changed his/her avatar" reveal identities present in a room, which we wanted to keep private. That information is sent by the server, but not displayed by the client. Quite probably there might be a better solution for this, but we looked for a (quick) solution that worked for us, since the combination client-server is supposed to be a closed ecosystem. We were (and are still) in the middle of a pandemic, and just wanted to get it to work in an acceptable manner. You probably will be able to rip the app appart and get the keys, but why would you, we are just a little primary school. It's up to real experts to find an elegant solution for all of this, if there is demand for it on a bigger scale.
usrusr 5y ago
That's what "hide" usually means. It's not like all hell would break loose if someone ever found a way to start an unscheduled group, it's just UX streamlining, don't distract people work options they don't need.

by liftm 5y ago

slightwinder 5y ago

I'd say a dedicated hacker could walk through their system like a laser through butter anyway. After all, it's just a random school, lacking expertise as also manpower for proper quality. Their long term goal should be to get the same experience from a proper managed project. The problem is that official projects have just started to move into that space. German Public IT is insanely far behind in that regard.

ThePadawan 5y ago

...a honeypot to discover technically minded students?

johannes1234321 5y ago
As it is an elementary school it is unlikely that a pupil will "hack" it, however some parents or big brothers might. But I wondered the same, especially as they state they also want to block parents from talking to anybody, except the teachers. But maybe that can be augmented by serverside configuration and the change in the client is about taking away the options, which would be blocked by the server anyways.

thisisnacho 5y ago

State messages like "x has entered/left the room" or "x has changed his/her avatar" reveal identities present in a room, which we wanted to keep private. That information is sent by the server, but not displayed by the client. Quite probably there might be a better solution for this, but we looked for a (quick) solution that worked for us, since the combination client-server is supposed to be a closed ecosystem. We were (and are still) in the middle of a pandemic, and just wanted to get it to work in an acceptable manner. You probably will be able to rip the app appart and get the keys, but why would you, we are just a little primary school. It's up to real experts to find an elegant solution for all of this, if there is demand for it on a bigger scale.

usrusr 5y ago

That's what "hide" usually means. It's not like all hell would break loose if someone ever found a way to start an unscheduled group, it's just UX streamlining, don't distract people work options they don't need.