3 ms·

So drop the "can change name and licence number after booking" feature and kill this, done.

master_crab 3y ago
I thought the same thing when I read it. The funny thing in the article is that that tidbit almost reads like a throwaway line.
- lotsofpulp 3y ago
  Pretty soon, everything will require a proof of identity, either administered by Apple/Google via their mobile device or, ideally, a government provided API that is baked into law as an inalienable right.
  - michaelt 3y ago
    In the specific case of booking a UK driving test, you must already have a photocard 'provisional driving license' and you must be willing to provide it, for it to be exchanged for a full driving license. So although mandatory proof of identity is problematic in many contexts, it's not a problem here.
    - lotsofpulp 3y ago
      Then of course the solution is to simply limit it to 1 appointment per person (or license number) at any given time. And not allow name changes. Seems like a fix that can be done in a couple hours at most. > A provisional licence number and candidate name is required to book a test but this can be changed once the slot is sold at a profit. Some of the brokers use business accounts that are intended for instructors to book multiple slots for students.
      - behringer 3y ago
        Yes. That fact that it isn't is pretty clear evidence that somebody's getting paid to allow this.
    - dfawcus 3y ago
      "must already have a photocard 'provisional driving license' " No, one can also use a paper (green) provisional license, and then you have to take a passport to the practical test. These are the only non-photocard licenses which are still valid (in provisional or full variants). After passing, one would end up with a photocard full license.
zo1 3y ago
It's lazy requirements gathering and taking shortcuts that gave them this. Or: and I will use bad language here, some idiot developer stores this in a document DB and has a field for name & license number. Or: GDPR doesn't allow devs or makes them too scared to capture PII information on account sign-up. We had this exact same crap in South Africa when the government went out on a tender and awarded a DEI company the project to do a license renewal booking system.
Jedd 3y ago
That seems like an incredibly easy resolution, and one wonders why it wasn't part of the functional spec up front. Weirdly, and I hope this was paraphrased poorly, TFA includes: "Driving instructors are calling for a ban on excessive profits from the reselling of tests." It's the 'excessive' bit that gives me the chills. I feel the default position should be no profits from, and in fact no reselling of, driving tests.
- igetspam 3y ago
  Because most people don't think about how systems can be abused and if you're interfacing with public agencies, you do it less. If it's not explicitly in the requirements, it's not worked on. It's wild how often simple things get overlooked because "nobody asked."
  - pixl97 3y ago
    Kinda like SMTP in the early internet. No one had really thought about spam and bad actors. Pretty much no one had IP restrictions and relay rules. Then eternal September happened. This said, abuse production generally comes with pretty heavy costs and sometimes systems are never stressed in a way they get abused, so there are trade offs.
  - postmodest 3y ago
    We really need to start taking a game-theory[?] attitude to any public service that involves money exchange, to prevent "viral capitalism" from piggybacking on the underlying necessity.
  - Obscurity4340 3y ago
    Not to mention the fact its not dealt with in high school as a compulsory credit (where all the knowledge, physical, and beaureaucratic resources are provided rather than the private hell the system has become) is suggestive of how big a scam and an intentionally weaponized social determinant it is. It is actually quite difficult and hard to ensure one can successfully move through it once you have to pay for everything and you're "on your own" procedurally. You may never actually get yourself out of that infinite loop and it severely limits consequent job and economic outcomes that feeds right back in to that compunding the stickiness of the entire state.
AndrewOMartin 3y ago
Excellent work. Now ask yourself this question. If it's that easy to solve why hasn't it been solved? I'll get you started, it's either not that easy to solve or it's not an easy change to implement. Just because your can imagine what a code patch might look like doesn't mean it's an easy fix. For a start, the release process for a public body can be a little clunky.
- adammarples 3y ago
  It would be trivially easy to remove the field from the website, but it is probably there for a reason, people do change their names, and may in some cases have a changed licence number so they are covering some edge cases.

I thought the same thing when I read it. The funny thing in the article is that that tidbit almost reads like a throwaway line.

lotsofpulp 3y ago
Pretty soon, everything will require a proof of identity, either administered by Apple/Google via their mobile device or, ideally, a government provided API that is baked into law as an inalienable right.
- michaelt 3y ago
  In the specific case of booking a UK driving test, you must already have a photocard 'provisional driving license' and you must be willing to provide it, for it to be exchanged for a full driving license. So although mandatory proof of identity is problematic in many contexts, it's not a problem here.
  - lotsofpulp 3y ago
    Then of course the solution is to simply limit it to 1 appointment per person (or license number) at any given time. And not allow name changes. Seems like a fix that can be done in a couple hours at most. > A provisional licence number and candidate name is required to book a test but this can be changed once the slot is sold at a profit. Some of the brokers use business accounts that are intended for instructors to book multiple slots for students.
    - behringer 3y ago
      Yes. That fact that it isn't is pretty clear evidence that somebody's getting paid to allow this.
  - dfawcus 3y ago
    "must already have a photocard 'provisional driving license' " No, one can also use a paper (green) provisional license, and then you have to take a passport to the practical test. These are the only non-photocard licenses which are still valid (in provisional or full variants). After passing, one would end up with a photocard full license.

zo1 3y ago

It's lazy requirements gathering and taking shortcuts that gave them this. Or: and I will use bad language here, some idiot developer stores this in a document DB and has a field for name & license number. Or: GDPR doesn't allow devs or makes them too scared to capture PII information on account sign-up. We had this exact same crap in South Africa when the government went out on a tender and awarded a DEI company the project to do a license renewal booking system.

Jedd 3y ago

That seems like an incredibly easy resolution, and one wonders why it wasn't part of the functional spec up front. Weirdly, and I hope this was paraphrased poorly, TFA includes: "Driving instructors are calling for a ban on excessive profits from the reselling of tests." It's the 'excessive' bit that gives me the chills. I feel the default position should be no profits from, and in fact no reselling of, driving tests.

igetspam 3y ago
Because most people don't think about how systems can be abused and if you're interfacing with public agencies, you do it less. If it's not explicitly in the requirements, it's not worked on. It's wild how often simple things get overlooked because "nobody asked."
- pixl97 3y ago
  Kinda like SMTP in the early internet. No one had really thought about spam and bad actors. Pretty much no one had IP restrictions and relay rules. Then eternal September happened. This said, abuse production generally comes with pretty heavy costs and sometimes systems are never stressed in a way they get abused, so there are trade offs.
- postmodest 3y ago
  We really need to start taking a game-theory[?] attitude to any public service that involves money exchange, to prevent "viral capitalism" from piggybacking on the underlying necessity.
- Obscurity4340 3y ago
  Not to mention the fact its not dealt with in high school as a compulsory credit (where all the knowledge, physical, and beaureaucratic resources are provided rather than the private hell the system has become) is suggestive of how big a scam and an intentionally weaponized social determinant it is. It is actually quite difficult and hard to ensure one can successfully move through it once you have to pay for everything and you're "on your own" procedurally. You may never actually get yourself out of that infinite loop and it severely limits consequent job and economic outcomes that feeds right back in to that compunding the stickiness of the entire state.

AndrewOMartin 3y ago

Excellent work. Now ask yourself this question. If it's that easy to solve why hasn't it been solved? I'll get you started, it's either not that easy to solve or it's not an easy change to implement. Just because your can imagine what a code patch might look like doesn't mean it's an easy fix. For a start, the release process for a public body can be a little clunky.

adammarples 3y ago
It would be trivially easy to remove the field from the website, but it is probably there for a reason, people do change their names, and may in some cases have a changed licence number so they are covering some edge cases.