SimonHooker

Hi there, I'm one of the developers that works on My School Portal. If this still a problem, please could you reach out to support (again?) and hopefully there's something we can do to help. An alternative is to provision the certificate using a trusted authority however that presents other issues typically, such as having to expose the FQDN which typically is internal-only.

Within My School Portal you can schedule the emails ahead of time. If you're looking for an email to be sent on a recurring schedule, I'd suggest raising it through your account manager/support as it sounds like a decent improvement

It might be worth holding out if viable - the 3xxx series are released on September 17th - might be the 2xxx series come down in price a bit ( maybe wishful thinking though )

I'm a developer for a SaaS product which interacts with a lot of the functionality of most MISs, and frankly the idea of making a homemade MIS would be a daunting task. Whilst things like AWS make delivering a reliable service far simpler than it used to be, there's still a lot of complexity that just isn't apparent in every day use. Factor in the fact that schools all seem to want to do things a little bit differently, and you're asking for a headache. It's not impossible, but at the same time it's not trivial. Ultimately it's just cheaper to make use of an existing MIS unless you really have enough IT budget to hire a few developers, a QA team, support team, someone to manage it etc. As already mentioned, I am aware that iSAMS started this way however to get from where it started to where it is today has taken 15 years, and it's still being refined. I'm not envious of the task of making and running an MIS!

As barnabythebear mentioned it looks like a certificate issue in that the CN of the mailserver doesn't match the CN it's provided. The IP specified appears to be a Microsoft IP, so it's odd that it is returning an ip certificate instead of a properly named one. Might there be something intercepting the traffic + issuing its own certificate i.e. a firewall?

I also make use of AWS for most of my hosting now, but the sites I've had to find hosts for lately have been static sites meaning I can just make use of S3 with Cloudfront in front to serve it cheaply. Lightsail can be a bit pricier than some alternatives but it is nice and easy to get started on, takes a lot of the pain out of getting started.

We used to use one of these affected certificates and got reports of this issue from some schools - this is the announcement covering it, https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 In the end I just swapped out the old certificates for Amazon-issued certificates to resolve the issue. In our case we made no changes due to the indication that the old certificates should still function correctly, however that was based on faulty assumptions hence us updating our certificates. Hopefully these other services do likewise as it seems that this being an issue is certainly not isolated.

It wasn't so bad, and would have been easier if I wasn't dealing with a few hundred domains at the same time! I used certbot to automate the process and have a .sh script to update the TXT record for the applicable domain to confirm ownership for the wildcard. This is all done by a CodeBuild plan so I could hook it up to other events to automate, but could be replicated in a simple shell script.

It's possible to have LetsEncrypt provision wildcard certificates, but does require a bit of configuration. I recently moved our SaaS product over to LetsEncrypt to reduce the overhead of renewing the certificates (and of course to remove the cost) and in the end also migrated over our wildcards, which was nice. Ownership of regular domains / subdomains requires proving you own the domain. Typically this can be done by putting a specific file in a specific publicly accessible location, in turn proving you have access to the webserver behind the domain. The other option is to alter the DNS records to add a TXT record again proving ownership. For wildcards, you need to perform the DNS option to prove ownership of the root domain. It's certainly made my life easier when it comes to HTTPS provisioning!

It sounds like they are either moving their email sending to SES, or have misconfigured something. By default SES send through the *.amazonses.com domain unless you have set up a validated Domain that's set up just right. I'm sure that they'll sort it out soon enough though.

Using a VPN is really the simplest option. I recently set up an AWS EC2 instance with OpenVPN installed via https://github.com/angristan/openvpn-install with an Elastic IP to provide a static IP for staff access while working remotely without being tied to the office IP / connection. The limiting factor becomes the member of staffs broadband connection, and the cost is relatively low depending how large an instance you go for. It does require a small client to be installed, however it works and is fast enough. I've even had a decent enough connection to play games when I forget to disconnect it. Also works on any device, be it Windows, OSX, Android, iPhone etc Of course it doesn't need to be an AWS instance - any server will do - but by hosting it on an external/cloud provider you remove the bottleneck you may have if it's hosted on-premise somewhere.

That sounds like an error on the other (Firefly) end Danp - we also run our service on AWS and when I had issues with my httpd layer, I was seeing the same error. Just means that your server isn't able to get a response from the other server.

This sounds like it may be covered in a similar way to AWS services. They published guidance, https://aws.amazon.com/compliance/gdpr-center/brexit/, which indicates that currently their standard contractual clauses are sufficient in any case. The same document also mentions that transferring in/out of the EEA is covered within Standard Contractual Clauses. I would assume that Google has similar clauses which in turn would cover this move. I am not a lawyer though, so it may be there's something I've not been aware of. It does seem odd though, as mentioned having the data further away from the point of use feels inefficient.

At the end of the day it was cheap, simple, but with customisation. Also we found some minor niggles with it and the company was quick to resolve them which was reassuring. Considering that most of the others we checked (off the top of my head these included Bitrix, People HR, can't remember the others) were more expensive, missed the peer review features (which may be less important to you - we were looking to move away from Small Improvements also), etc I have clear overview of my team and can clearly manage their leave, and at the same time my manager can do the same for my peers and I The mobile offering is fully featured also which is nice. The navigation can be a little confusing, but that seems common in a lot of these systems which have so many features in, just takes a little getting used to The most common actions are intuitive enough

Whilst this isn't in a school, we have just looked into the HR systems out there with a view to starting to use one in-house and in the end decided to go with CakeHR due to its ease of use, low cost, and supporting all the features we looked for with regard to absence management, peer reviews, training management, onboarding etc - I'm not sure whether it's at all suitable for your purpose, but it can't hurt to take a look I'm sure https://cake.hr/

What are you trying to achieve? Also just want to be clear that Regex is, by default, case-sensitive though that can be changed. At its simplest, MINOR|Moderate is sufficient - but actually using it depends on what you are trying to achieve, and in which language. I recommend having a look at https://regexr.com/ - it's where I check all my Regex. It has decent documentation and helps explain what is going on as well as illustrating it clearly.

With Progresso, I haven't had any issue using the LearnerRollCallAttendance method within their API to export the Attendance data ( https://progresso.docs.apiary.io/#reference/learner-attendance/learner-roll-call-attendance/retrieve-learner-roll-call-attendance ) There are also Assessment results in the API which I would assume would let you export them. I'm not sure how useful this is though as it would be a bit of a hassle if you're not set up to make use of the exported data.

Just updated Chrome on my work laptop, looks like Edugeek could use an SSL

Cool will have to do that. Just was curious whether you'd actually used Assembly at all - many of the similar products look good on paper but then seem to have shortcomings as mentioned! That's not to say that there will never be one that can do what we would like, and maybe Assembly will be a good fit

Hi @matt40k - we have not. We have previously looked at other similar products though without success. There's always so far a stumbling block, usually in compromises as each attempts to normalise the data. The problem is that we also normalise data and so it's easy for data to be corrupted between MIS -> extractor -> us. If it's just MIS -> us then we are able to debug and fix that. If there's the step in between then we are left debugging whether the issue is between MIS and extractor, extractor and us, and then potentially having to request changes in the extractor as well as the MIS. I'll put a task into our to-do pile to take a look at Assembly though - what is your relationship with Assembly?

I work on a third party product which extracts data from SIMS using direct SQL. I thought I'd just post up our point of view on why we do this instead of "approved" methods. The opinions below are my own and do not reflect that of my employer. Where possible when integrating with a new MIS we always look for an API route. With Progresso we have only ever had API access, likewise Schoolbase. iSAMS started out as being direct SQL only, however following cooperation from iSAMS we have almost completed a full migration to be able to get the same data points via their APIs. This is great. When working with Capita we were asked to pay £thousands and in return we got nothing usable. In short we were told that to access the APIs we would need to pay £thousands more and then maybe we'd get something. This is a simplification, but in short from my position as a developer it felt like a con. As a result, in order to get sufficient data to power our product we require SQL access. We work with schools which are able to provide this access. It does mean that we cannot work with schools where the SIMs database is externally hosted. It also means we have to work to ensure that we do not get data which we should not have. Additionally I always request repeatedly that we are never ever ever given any write-access. We do not need the ability to modify data or structures, so all we ever request is read-only access. We accept that there is the very real likelihood that over time database structures will change as SIMS updates, and that we will get no warning nor support about this. This is fine. We are aware of that and work with that expectation. Additionally we are not a competitor for the SIMS MIS and so our needs to access the data are to help schools get more out of their MIS instead of supplanting it and so cooperation from the MIS would be in everyones interests. Ultimately it means that our integration with some MIS' are better than others due to cooperation from the development teams involved. In an ideal world I would love nothing more than to be able to drop direct SQL access, but whilst Capita have such a high paywall in front of getting any information regarding their API that will be impossible. Without paying £thousands I do not have any way of confirming what APIs exist, how to use them, what data points they return, and what can be done if a specific datapoint which we currently rely on is no longer available. It just feels like Capita trying to prevent anyone without a huge budget to burn being able to help schools. There's not a lot I can do about it, so we do the best we can.

I work for a third party, and the school in question had their Vivo account set up well before we had any involvement. It may well be that it could be changed, but it's not something that - in this instance - I can change, and so I just do the best I can and make sure to store the data securely / prevent its exposure through our system.

If you take a look at the guidance I believe it's covered under section 2.2. There are requirements for the school to retain ownership of the data however it appears to stipulate that the UPN is usable for providers of additional packages supporting the management of a pupils education which should cover most of these third parties. I am not a lawyer though, and so far the only third party I've dealt with which uses UPN is Vivo rewards. Unfortunately this means that, for the 1 school we deal with which uses Vivo, we also need to request the UPN. We do not extract UPN for any other schools though and in an ideal world for Vivo I would prefer to find another way!

As far as I am aware, the following are all identical in PHP due to strings in double quotes being evaluated. Single quotes are not evaluated. Typically I always preferred to single-quote so that variables didn't accidentally get evaluated. This may have changed in the last many years though, haven't really used PHP lately that much! "MON".$i "MON$i" "MON".$i."" 'MON'.$i

The affected certificates were bought via SSLs.com I think, something like that. They refunded the certificates which had not been validated. Existing certificates were able to be reissued however the few we had were up for renewal shortly after and so we decided to simply change to Comodo at that point instead of mess around with Symantec. Some of our sites do use Letsencrypt already, I just need to find a way to integrate it with some other bits before I can make use of it globally