• 0 Posts
  • 140 Comments
Joined 1 year ago
cake
Cake day: June 22nd, 2023

help-circle





  • Gotta rtfa to get the full context.

    Even so, at least three county jails in Florida that sit within mandatory evacuation areas have decided that detainees will ride out the storm. These jails — Pinellas, Manatee, and St. Johns counties — have a combined incarcerated population of more than 4,000 people. Recent analysis from The Appeal found that more than 21,000 people are locked up at facilities in areas with evacuation orders ahead of Milton. An earlier investigation by The Intercept found that across Florida, 52 jails, prisons and detention centers face major to extreme flood risks over the next 30 years as such climate-driven storms intensify, the most among any state.

    Florida has among the largest populations of incarcerated people in the country, more than 84,000, according to federal data — exceeding the jailed populations of entire countries, such as France, Germany, Malaysia, or Venezuela.

    “With that number of inmates it’s not really possible, feasible to evacuate people out of there, and it’s unnecessary because we can go up,” said Pinellas County Sheriff Bob Gualtieri on Wednesday during a press conference. He said the Pinellas County Jail, which has a population of about 3,100 people, is prepared to move people from the first floor cells to the second floor in the event of flooding.

    “We have plenty of staff there, everything’s safe, it’s under control and I’m not concerned about it,” he said, adding that around 800 deputies and jail staff would be on hand. The jail sits within an area deemed Zone A, the most severe tier among evacuation areas, and is located next to a waterway that spills into Tampa Bay.

    There are still systemic problems here, but it’s not like they just locked everyone on the ground floor and peaced-out, as the headline made me think.

    Edit: I just want to add that the rest of the article goes even deeper in, in my opinion, undoing my outrage induced from the headline. It talks about facilities being weather-ready and built on higher ground, it mentions procedures for ones that aren’t, it consults a former FEMA official…













  • Keep in mind, though, so far, we only know it to be a user experience issue.

    “Incomplete paper and online applications will not be accepted,” Evans said in the statement. (Parker’s cancellation request would have lacked a driver’s license number.) The Secretary of State’s Office did not respond to individual questions about what testing the portal underwent before launch, the system’s security procedures, what happened to Parker’s cancellation request…

    It doesn’t matter what the browser says if the end user tampered with the running page to make it say something. It matters if the application might have been processed. They’re claiming it wouldn’t have been processed since it was incomplete (lacking ID number). We’d need to know how this was handled on the back end to know how risky it really was. It could still have been bad, but this isn’t, in itself, proof of an actual problem.

    edit: Just to be clear, I’m not saying it shouldn’t be investigated. It really should be, as the article claims, an all-hands-on-deck moment. I’m just saying that the article makes the case that it should be investigated to ascertain what would have happened to the incomplete application submission to assess the exposure, not that it definitely was a vulnerability at all.


  • “Incomplete paper and online applications will not be accepted,” Evans said in the statement. (Parker’s [demonstration] cancellation request would have lacked a driver’s license number.) The Secretary of State’s Office did not respond to individual questions about what testing the portal underwent before launch, the system’s security procedures, what happened to Parker’s cancellation request…

    Yeah, that tells us we just don’t know if this was a problem after all. Evans’s statement basically claims it wasn’t a vulnerability. If that’s correct, then the worst thing might be if someone’s browser tripped on the validation JS and allowed them down a blind alley execution path. If the claim is correct and if the page’s JS never shits the bed, then in that case the only negative outcome would be someone dicking with the in-browser source could lead themselves down the blind alley, in which case who cares. The only terrible outcome seems like it would be if the claim is incorrect–i.e. if an incomplete application submission would be processed, thus allowing exploit.

    Short of an internal audit, there’s no smoking gun here.