Mixing
![Is it really practically possible to do software assignments without taking anybody's help? [closed]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjbpfN9tAutmK93bJRC3ZoROZzi2TJDms5n8_qJuhgE0a9b52OOHayv3NGT8igAdFL7byXNst-_1DZK5SjrIJ28_6RQPUpBROqMs5s6jo-ZsjX8kjDwfxJufIitH3TaQRXWaGSQKRQib-f/s72-c/1.jpg)
What can I do when I've discovered that my client's app might violate COPPA and they're taking no action
Clash Royale CLAN TAG#URR8PPP
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0;
up vote
8
down vote
favorite
My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.
They make an app for kids, used in classrooms.
I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.
I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.
I'm considering my range of options.
(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)
COPPA FAQ
software-industry security
asked Jun 3 '15 at 23:23
senior-dev
37118
suggest improvements |Â
up vote
8
down vote
favorite
My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.
They make an app for kids, used in classrooms.
I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.
I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.
I'm considering my range of options.
(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)
COPPA FAQ
software-industry security
asked Jun 3 '15 at 23:23
senior-dev
37118
9
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04
suggest improvements |Â
up vote
8
down vote
favorite
up vote
8
down vote
favorite
My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.
They make an app for kids, used in classrooms.
I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.
I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.
I'm considering my range of options.
(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)
COPPA FAQ
software-industry security
asked Jun 3 '15 at 23:23
senior-dev
37118
My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.
They make an app for kids, used in classrooms.
I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.
I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.
I'm considering my range of options.
(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)
COPPA FAQ
software-industry security
asked Jun 3 '15 at 23:23
senior-dev
37118
edited Jun 4 '15 at 21:41
asked Jun 3 '15 at 23:23
senior-dev
37118
asked Jun 3 '15 at 23:23
senior-dev
37118
asked Jun 3 '15 at 23:23
senior-dev
37118
37118
9
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04
suggest improvements |Â
9
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04
9
9
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04
suggest improvements |Â
1 Answer
1
active
oldest
votes
up vote
11
down vote
You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.
According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.
As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
suggest improvements |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
11
down vote
You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.
According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.
As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
suggest improvements |Â
up vote
11
down vote
You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.
According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.
As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
suggest improvements |Â
up vote
11
down vote
up vote
11
down vote
You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.
According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.
As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.
According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.
As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
answered Jun 3 '15 at 23:47
LindaJeanne
1,441912
1,441912
suggest improvements |Â
suggest improvements |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworkplace.stackexchange.com%2fquestions%2f47736%2fwhat-can-i-do-when-ive-discovered-that-my-clients-app-might-violate-coppa-and%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
9
Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
– Jane S♦
Jun 3 '15 at 23:40
@JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
– senior-dev
Jun 4 '15 at 21:04