undefined | Better HN

0 pointsurvader5y ago0 comments

We did. We have a regex to catch all variants of spellings. But since our code is open they can easily select another variant. We could load our script dynamically but have chosen not to of security reasons. (And transparency).

(I’m the founder of this initiative)

0 comments

utrechtsouth5y ago

urvader,

While there is a technical issue here, there is also a legal issue and a PR issue.

Government institutions have a duty of care and a duty to help to private individuals. Since they are apparently working _against_ people in this case, they are probably in breach of the law.

Description of relevant rules here (in Swedish). https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighe...

I strongly suggest that you file a formal complaint against the government agency. This is easy to do and you can do it here. https://www.jo.se/sv/JO-anmalan/

When you have filed the complaint: MAKE IT PUBLIC (hacker news follow up story, twitter, linkedin, etc). This is because there is a political dimension to this issue and if there is anything politicians care about, it's jobs (their own).

Good luck and keep us updated! I'm sure lots of people will be happy to spread a copy of the complaint around.

urvaderOP5y ago

Thanks! Yes, we are investigating our legal options.

We just recently filed an appeal regarding getting access to the API documentation.

We have gotten a lot of PR in Sweden from the major news papers and tech press. So I think the pressure is building but if it is one thing Swedes are worried about is the appearance internationally. So help us getting this story to Wired, TechCrunch etc - that will make them crazy. We still live on the front page of Newsweek from 2000 - the capital of Internet. That might be true for the tech scene but definitely not the public sector.

We would rather concentrate our limited time and resources on making the product better instead of this crap but we have an amazing community that are helping us with both legal advice, artwork, communication, UX etc so we will continue the fight and will keep you updated here in Hacker News.

Thanks for all support so far!

utrechtsouth5y ago

Sounds great!

Also keep in mind that the legal options and PR options are tightly coupled. Regardless of the outcome of any legal option (e.g. "JO anmälan"), the PR generated around it may itself lead to a change if it gets enough attention (e.g., Anna König Jerlmyr seems to be in charge of Stockholm municipality at the moment). Make it easy for them to get good PR and make it clear the other option is to get bad PR.

These questions are larger than this project. This is about how the government itself builds API:s. That's big.

wizzwizz45y ago

Have you tried letting users extract the token themselves, when your code can't find it?

zdkl5y ago

It's my (uneducated) understanding that legally, this makes you cross a boundary. You're no longer ~"circumventing security measures" on your own, you're inciting and enabling an end user to. One could easily argue it's on the darker side of the grey area.

FDSGSG5y ago

This doesn't make any sense at all.

RupertEisenhart5y ago

Can't you ban the malicious Devs? They keep creating new GitHub accounts or what?

toyg5y ago

Not OP but from what I understand, the problem is that their code has to interoperate with the “private” service run by the “bad guys”; it’s basically a more usable front-end. So the bad guys keep messing with the backend just to break the open client.

tsimionescu5y ago

The government devs are deliberately modifying server code after seeing what the open source code is using to identify their header. Guthub doesn't require an account to view code, so how could they ban government coders from seeing their code?

dromtrund5y ago

I assume they read the code that tries to parse the data, and come up with formats that don't fit. If the code is open, they don't need accounts to see it

developer925y ago

they need one to contribute changes though

3 more replies

j / k navigate · click thread line to collapse

0 comments

utrechtsouth5y ago

urvader,

While there is a technical issue here, there is also a legal issue and a PR issue.

Government institutions have a duty of care and a duty to help to private individuals. Since they are apparently working _against_ people in this case, they are probably in breach of the law.

Description of relevant rules here (in Swedish). https://www.mfd.se/verktyg/lagar-och-regler-om-tillganglighe...

I strongly suggest that you file a formal complaint against the government agency. This is easy to do and you can do it here. https://www.jo.se/sv/JO-anmalan/

Good luck and keep us updated! I'm sure lots of people will be happy to spread a copy of the complaint around.

urvaderOP5y ago

Thanks! Yes, we are investigating our legal options.

We just recently filed an appeal regarding getting access to the API documentation.

Thanks for all support so far!

utrechtsouth5y ago

Sounds great!

These questions are larger than this project. This is about how the government itself builds API:s. That's big.

wizzwizz45y ago

Have you tried letting users extract the token themselves, when your code can't find it?

zdkl5y ago

FDSGSG5y ago

This doesn't make any sense at all.

RupertEisenhart5y ago

Can't you ban the malicious Devs? They keep creating new GitHub accounts or what?

toyg5y ago

tsimionescu5y ago

dromtrund5y ago

I assume they read the code that tries to parse the data, and come up with formats that don't fit. If the code is open, they don't need accounts to see it

developer925y ago

they need one to contribute changes though

3 more replies

j / k navigate · click thread line to collapse