Hacker News Reader

Comment by throwaway0a5e | Hacker News Reader

It's 2022. Every web dev knows you don't just spit out PII on your website. But everybody involved kept their mouth shut because they thought to themselves "this is dumb, but I'm not responsible for it and if I try and champion the cause of fixing it I will be" and so they took it to prod. These sorts of "incentive to not rock the boat" or "it will take me months to get clarification on this requirement" type failures are rife in government bureaucracy.

Edit: Clearly I'm wrong and this is all malice from top to bottom /s Use your f-ing brains. You think someone is gonna risk their cushy government job to dox a bunch of gun owners and the managers are gonna risk their jobs signing off on it?

View on HN

I think it is more likely the web devs didn't know or care what they were doing and they were just working on contract and they were told to put a button there so they put a button there. The middle management responsible for it probably fucked it up due to simple negligence and not carefully reading a stack of requirements and just not being at all engaged in the broader issues other than delivery. Someone who actual gave a shit probably got a few sentences into the requirements doc somewhere around access controls and PII concerns, but it was not called out clearly and just missed.

But yeah whatever really happened I'm quite certain that "the government of California just DELIBERATELY and with MALICE doxxed all the judges with carry permit" is the argument which needs to be met with "that's a hilariously large load of speculation".

Thats complete speculation.

I don't think GP had any way to actually know or think the code involved did a "SELECT *", he was just using that as a clever jokey way of saying "looks like they published all the details they had on gun owners?"

Whether they selected * is immaterial. The requirement probably said "publish all", or something along those lines and the person who did it had probably been burned in the past when they had tried to do anything other than implementing requirements like a dumb robot so they rolled their eyes and implemented requirements like a dumb robot while counting down the days to retirement. Somewhere there's probably a closed Jira ticket in which they covered their ass.

OK you've significantly edited your comment since I replied to it, replacing the part I was replying to, my reply is no longer relevant to it.

There was a map with pushpins and if you clicked them, it showed the names and addresses of all the registered gun owners.

It was probably a _lot_ more involved than "SELECT *"

> You think someone is gonna risk their cushy government job to dox a bunch of gun owners

I doubt anybody will lose their jobs for this as long as there is even a modicum of plausible deniability (every unruly child knows the "it was an accident" excuse, but somehow adults seem to conveniently forget about it in cases like this.)

Reply on news.ycombinator.com