4 ms·

During the height of COVID, I was exploring the API design of the top-selling COVID tests on Amazon. Several had wildly unsecured APIs—sequential patient IDs bu

During the height of COVID, I was exploring the API design of the top-selling COVID tests on Amazon. Several had wildly unsecured APIs—sequential patient IDs but the results endpoint assumed knowing the “secret” patient ID counted as auth. Or just completely open GraphQL implementations, no different than a password-less db… For anyone considering DIYing a diagnostics program, don’t. But I’m biased (I’m the founder of a YC-backed diagnostics as a service co: https://spotdx.com https://spotdx.com)

dankwizard 3y ago
[flagged]
radicalbyte 3y ago
I was working for the NL government on COVID stuff and the only thing I can say is that it's a shame I'm under NDA. It changed my view of the tech industry and I feel silly for calling colleagues in the past out for what I consider inadequate practices. As all were far above the mean.
- gattilorenz 3y ago
  Weren’t CoronaCheck and CoronaMelder open source? I would have assumed plenty of people would audit them, but I don’t recall seeing any negative news (jokes on their availability aside)
  - radicalbyte 3y ago
    Yeah they're open source and they're great (I worked on both). We put a lot of effort into making them into excellent examples. My original post is referring to other things outside of the Ministry.. My role was deep and broad so I got to see a lot.
- YeBanKo 3y ago
  I am surprised there isn’t some law in NL that would allow you to expose it either to the public or maybe at least to MPs and not be bound by NDA.
  - radicalbyte 3y ago
    Oh our apps were fantastic - an awesome example of what happens when you have top tier technical management combined with skilled technical people. Only during the process you get exposure to a lot of other things (and a lot of that is not government).
    - YeBanKo 3y ago
      Isn’t it almost, like, fiduciary duty to the public to disclose what is broken?
  - weebull 3y ago
    Pretty sure whistleblower protections would trump NDAs, but not in a public forum.
amluto 3y ago
The fact that at-home tests had an API of any sort was already a major screwup IMO.
- stuartjohnson12 3y ago
  It's not necessarily a problem, you just have to be sensible about security practices. To be clear, at-home tests mean you collect the sample at home and then mail them in, not the test is run at home. (disclaimer, I work at Spot)

dankwizard 3y ago

[flagged]

radicalbyte 3y ago

I was working for the NL government on COVID stuff and the only thing I can say is that it's a shame I'm under NDA. It changed my view of the tech industry and I feel silly for calling colleagues in the past out for what I consider inadequate practices. As all were far above the mean.

gattilorenz 3y ago
Weren’t CoronaCheck and CoronaMelder open source? I would have assumed plenty of people would audit them, but I don’t recall seeing any negative news (jokes on their availability aside)
- radicalbyte 3y ago
  Yeah they're open source and they're great (I worked on both). We put a lot of effort into making them into excellent examples. My original post is referring to other things outside of the Ministry.. My role was deep and broad so I got to see a lot.
YeBanKo 3y ago
I am surprised there isn’t some law in NL that would allow you to expose it either to the public or maybe at least to MPs and not be bound by NDA.
- radicalbyte 3y ago
  Oh our apps were fantastic - an awesome example of what happens when you have top tier technical management combined with skilled technical people. Only during the process you get exposure to a lot of other things (and a lot of that is not government).
  - YeBanKo 3y ago
    Isn’t it almost, like, fiduciary duty to the public to disclose what is broken?
- weebull 3y ago
  Pretty sure whistleblower protections would trump NDAs, but not in a public forum.

amluto 3y ago

The fact that at-home tests had an API of any sort was already a major screwup IMO.

stuartjohnson12 3y ago
It's not necessarily a problem, you just have to be sensible about security practices. To be clear, at-home tests mean you collect the sample at home and then mail them in, not the test is run at home. (disclaimer, I work at Spot)