Hacker News Reader

Comment by AndrewJajack | Hacker News Reader

During the height of COVID, I was exploring the API design of the top-selling COVID tests on Amazon. Several had wildly unsecured APIs—sequential patient IDs but the results endpoint assumed knowing the “secret” patient ID counted as auth. Or just completely open GraphQL implementations, no different than a password-less db…

For anyone considering DIYing a diagnostics program, don’t. But I’m biased (I’m the founder of a YC-backed diagnostics as a service co: https://spotdx.com)

View on HN

I was working for the NL government on COVID stuff and the only thing I can say is that it's a shame I'm under NDA. It changed my view of the tech industry and I feel silly for calling colleagues in the past out for what I consider inadequate practices. As all were far above the mean.

Weren’t CoronaCheck and CoronaMelder open source? I would have assumed plenty of people would audit them, but I don’t recall seeing any negative news (jokes on their availability aside)

Yeah they're open source and they're great (I worked on both). We put a lot of effort into making them into excellent examples.

My original post is referring to other things outside of the Ministry.. My role was deep and broad so I got to see a lot.

I am surprised there isn’t some law in NL that would allow you to expose it either to the public or maybe at least to MPs and not be bound by NDA.

Oh our apps were fantastic - an awesome example of what happens when you have top tier technical management combined with skilled technical people.

Only during the process you get exposure to a lot of other things (and a lot of that is not government).

Isn’t it almost, like, fiduciary duty to the public to disclose what is broken?

Pretty sure whistleblower protections would trump NDAs, but not in a public forum.

The fact that at-home tests had an API of any sort was already a major screwup IMO.

It's not necessarily a problem, you just have to be sensible about security practices. To be clear, at-home tests mean you collect the sample at home and then mail them in, not the test is run at home. (disclaimer, I work at Spot)

Reply on news.ycombinator.com