Recent Posts

4201

General Software Discussion / Re: The Best Of: text editors

« Last post by 40hz on January 24, 2013, 08:55 AM »

that's for lifetime updates also.

-wraith808 (January 24, 2013, 08:21 AM)

At the risk of sounding cynical: Warning! Warning! Warning!

I've pretty much given up on believing in "lifetime" licenses. Not that it matters all that much in my case. If I see something I want in an upgrade, I usually have no objection to paying for it - as long as it's not just to get a bug fixed.

4202

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 24, 2013, 08:47 AM »

^^ StoicJoker - It's always wonderful to hear you call a spade a spade.   You do it with style!

-Renegade (January 24, 2013, 08:10 AM)

@Ren -

"Admiration -- our polite recognition of another's resemblance to ourselves."  - Ambrose Bierce

 

4203

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 23, 2013, 12:32 PM »

^Up to a point, yes. Doing a scan from an unauthorized point of access may very well have made him subject to expulsion. I know students who have been expelled for doing similar things.

But in those situations the procedure was to suspend the student and have him go before the school's judicial review board for an expulsion hearing. Once that was done, if the determination was to expel, the student was out - and that was the end of it.

I've never seen a school fail a students grades, pressure him into signing an NDA, and start a process to recover all his grant or scholarship money.

And threatening him with prosecution (unless he refused to attend his school hearing) is unheard of since anything he said at such a hearing could be used in evidence against him at a real trial. So with disciplinary boards it's usually one or the other: (a) sign an agreement you'll stand before the school and accept their decision without further legal recourse on your part, or further action from the school - or (b) refuse, in which the case the school will call in the police - and summarily suspend you until that gets resolved in some court a year or three later.

From what I've seen, expulsion is still enough of a big deal that schools need to be very careful about it. Much like employers have to be when they terminate an employee. My sister terminated one of her employees for stealing. Six months later she got sued for wrongful discharge and was ultimately made to settle with the girl for all her back wages because the girl claimed she hadn't. The thing that lost the case for my sister was the fact she did not call the police and have the girl arrested. Because of that, it was considered her word against the girl's that a crime had been committed.

But maybe the laws are different up in Canada?

4204

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 23, 2013, 12:05 PM »

So by that information to me it appears he broke the "protocol" agreement that he signed...thoughts on that?

-hamradio (January 23, 2013, 11:47 AM)

He did. Definitely in the wrong on that point. But as most of us (including we sysadmins) seem to be leaning, the school's response was way out of proportion to the offense that was committed. So much so that it doesn't make sense...

I can't help thinking there's still something more behind this incident than what is being acknowledged. I'm guessing this student got caught up in something else that was going on at Dawson (perhaps an ongoing investigation into an earlier or much more serious network breech?) and those behind it thought they had finally "got their man." Or at least "somebody involved" who they thought they could lean on hard to get to the people they were really after.

If so, some of the rabidness on the part of Dawson starts to make a bit more sense. As does their insinuation that there's more going on than they can publicly discuss. Which would certainly be the case if there was a police investigation currently in progress over something that had happened on Dawson's network.

Oh well...as time passes, more will come out.

4205

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 23, 2013, 09:59 AM »

I'm missing what the domain has to do with anything.

Could one of the sysadmins here explain how DNS resolution compromises a server? (Well, other than MTM and all that - which seems to me like a different issue.)

-Renegade (January 23, 2013, 09:25 AM)

I really doesn't AFAIK except by a stretch as you noted. I suppose you could somehow compromise or poison the internal DNS cache, or bugger with HOSTS and do some voodoo rerouting - but again that's a pretty big stretch - and easily detected.

I think he's speaking of somehow compromising a Windows server (where DNS/AD and the whole domain model are completely intertwined) and is either leaving something out of the point he thinks he's making, or is just a little confused. Which is understandable. The Windows implementation of DNS as it relates to AD can get confusing at times.

assume the attack has successfully rooted the operating system and bleach the server outright

I'm much more interested in how you could "bleach" a server. That's a new one for me. Unless the writer is from China?    (Sorry. that wasn't very PC on my part, was it?)

4206

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 23, 2013, 09:46 AM »

Wow... if that's the real series of events, I withdraw my statement that he did anything wrong.  This timeline is pretty damning.

-wraith808 (January 22, 2013, 11:11 PM)

Ditto. And that's from my own sysadmin perspective.

The faculty will agree in retrospect (if only to escape from scrutiny) the kid should not have been expelled.. at that point, the college will not be able to defend the expulsion and the college will find a way to say "we made the right decision and did nothing wrong and we're not going to argue the point any further.. but,  on review we've decided to give him another chance anyway -- he can come back to school with all complaints dropped.  now please leave us alone"

-mouser (January 23, 2013, 02:07 AM)

Right now I think Dawson is desperately seeking for a way to disengage without admitting any wrongdoing. Something that has always worked well for major corporations when they're caught up to no good.

Now that more information is available, it does appear that some significant administrative "wilding" has taken place. Likely at the behest of some "fusty-musty" admin/faculty types. (Those of you who 'served time' in any college or university will know the tribe - they have first names like Sterling or Cornelius, wear tweed suits all year long, and favor paisley or yellow bow ties.)



I think the utterly vindictive (and likely illegal) act of failing him in all his courses in addition to expelling him is a very clear indication of the mindset of those who made the decision. (And I somehow can't help but think that having a name like Ahmed Al-Kahbaz figured significantly into how this incident got handled by the school.)

I think Mouser has called it. The school will probably offer this guy a deal where they'll reinstate his student status, grades, and grant(s) in exchange for a written admission of some sort of wrongdoing on his part; an agreement to waive his right to seek future legal remedies; and most likely some sort of 'gag agreement' not to criticize or say anything that would put Dawson in a bad light.

This is a sad state of affairs in that it would be in this student's best interest to accept such an arrangement, and then leave the school, rather than go out under a cloud that would likely take years of expensive litigation to resolve.

Oh well...right now this kid has some flex room in that he could always threaten to break that NDA (and likely get it invalidated in the process since it was obtained under 'extreme duress' assuming Canada has such a law) and go public with the whole story in detail - something Dawson seems extremely anxious to avoid.

I'm sure he'll settle with Dawson. I just hope he receives competent legal advice and gets enough back before he does so.

4207

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 22, 2013, 06:52 AM »

but i think we cannot let big organizations get away with this weasel behavior of saying: "trust us, if we explained to you the real reasons behind our actions you would understand, but we've decided we are not going to tell you the real reasons because [insert bullshit lie here]".

-mouser (January 22, 2013, 02:57 AM)

THAT! Yes! That! 

+1

-Renegade (January 22, 2013, 06:14 AM)

All too true.

But that's been the historic response whenever arbitrary acts of authority get challenged.

4208

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 22, 2013, 06:03 AM »

@Mouser - FWIW I am on record a few posts back for saying I thought the response seemed unusually harsh and possibly excessive based on the facts made public so far. 

I get no joy out of punishing people. Even those who might actually "deserve it."  It's just not my 'thing' personally. I find the act of punishing somebody a depressing experience more than it is anything else.

4209

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 22, 2013, 01:53 AM »

I'm so sick of this cowardly lying legal bullshit.

So basically they are saying: You only know half the story, and if we could tell you the other half you'd understand why we did what we did.  But we're not going to tell you because we want to protect the rights of the person we expelled.

-mouser (January 22, 2013, 12:37 AM)

I'm not a believer when it comes to secret tribunals or Star Chamber judgments.

But I could easily imagine a dozen different scenarios where something might have happened = or been said - where the administration felt expulsion was appropriate and then refused to talk about it afterwards.

You could have had a hypothetical situation where:

   - some attempt was being made to mollify a local prosecutor who became aware of the case and wanted to pursue criminal charges, possibly against the university's desire to handle it in house. Being "sent down" is bad enough - but getting "sent up" would be far worse....

   - when confronted with the possibility of suspension or expulsion, the student made a threat to do something stupid like extract physical/cyber revenge on the school as a whole - or the employee who turned him in...or had threatened to anonymously divulge additional vulnerabilities he had since discovered...

   - made mention of fellow students, university employees, or outside associates who were accomplices - and then refused to name them during the investigation...

   - was guilty of having been caught doing something not allowed a  previous time (or times) and had been warned of the consequences if it happened again...

   - had been caught doing something totally unrelated that was also not allowed, such as running an illegal file sharing server on a PC connected to the university's network...

   - ran afoul of some contract provision (usually government) the university was under that had something in it that makes it required (or "understood") that anybody caught doing certain things while on the network either be expelled or have their employment terminated...

   - was made to understand that the school had previously expelled someone else earlier for similar actions - and now felt compelled (for legal reasons) to be consistent with their previous decision...

   - ran into the agenda of an influential individual (or individuals) at the university who were "fed up" for whatever reason and felt "a strong message needs be delivered"...

I could go on...but it's all hypothetical so why bother?

The point is we don't have the entire story...yet.

But in cases like this, the truth eventually comes out. Schools don't keep secrets very well. It will only be a matter of time.

-----

Regarding the average sysadmin's viewpoint regarding curious children, the best I can offer is that I've personally seen more true grief caused by people screwing around with things they've been told they shouldn't than I ever had (knock wood) caused by people specifically out to punk the system.

Kids play with matches too. Most times nothing happens. Sometimes, the worst that happens is they get a minor burn. Most outgrow it before any real damage gets done. But some have also caused major property damage or deaths while experimenting. So "simple curiosity" is no defense or justification as far as I'm concerned. There are limits - and as long as those limits are clearly communicated, I don't bend over backwards to excuse people who choose to disregard them. But that's because I do respect people enough that I feel most are capable of making their own informed decisions. And it's important that we do. Because if we don't, then the argument for the need for more and more ludicrous and restrictive laws to protect ourselves from ourselves - because none of us can really be trusted - starts to gain traction.

Like the John Hammond character said in Jurassic Park: "I don't blame people for their mistakes. But I do ask that they pay for them."

I think that's both respectful and fair.

4210

General Software Discussion / Re: The indelicate subject....... money

« Last post by 40hz on January 21, 2013, 10:33 PM »

You mentioned Userland - do you go back that far?? :-)

-himagain (January 21, 2013, 08:51 PM)

I do. I go back to the pre-personal computer days. Even before the Altair and Kim-1. I wrote what was probably my first "real program" in APL running on a Honeywell mainframe back when the "big iron" dinosaurs freely roamed our data centers. But I was using userland in this context rather than this one when I said it.

Had to stop, was threatened by Steve's "attack dogs" so switched to G.E. who didn't care.....   :-)

-himagain (January 21, 2013, 08:51 PM)

Years ago GE Corporate was a client of mine and I was very involved with their software licensing program as a contract employee. You probably talked to Mr. P.C. then. He was their resident ogre for that. He had little use for any software company.  

4211

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 10:10 PM »

And yeah, I know keeping large systems up and running smoothly isn't an easy job. I do have sympathy for sysadmins - they seem to have one of those jobs where when the SHTF, it really hits the fan and splatters everywhere.

-Renegade (January 21, 2013, 09:21 PM)

You run a kinder and gentler shop than most if that's the case. Most of my experience has taught me when the poo really hits the fan it's shortly followed by a few sysadmins being thrown through those same blades.

"You're only golden until your first major FU!" was never truer than it is in the systems administration world. Most times, having your plant go down on you (if there was even the slightest chance of doing something that might have prevented it) is definitely a career-limiting event for most sysadmins. Especially if there's no incompetent junior operator or summer intern handy to sacrifice to the angry management gods.

 
 

4212

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 09:29 PM »

I believe all agree the given punishment is not the right thing to do.

-cmpm (January 21, 2013, 08:51 PM)

It does seem more than a touch harsh from what I've heard so far about what supposedly happened.

Although all this may also be nothing more than choreography and puppet theater. Much like when the TV industry fires an exec (with full benefit of the entertainment press) and then hires him back (without fanfare) a month or two later. If that's whats really going down, having that NDA is going to be more of a blessing for this student since he can hang tough and unrepentant without being called to task for refusing to discuss whatever deal I'm pretty sure Dawson (or another school) will ultimately cut him.

But the punishment part is totally separate IMO from what he did do. Something that I still see as unarguably wrong. Whether the punishment fits is a separate topic AFAIC.

Here's the problem.. many judicial systems don't allow for "discretionary leniency" since to do so flies in the face of a theory of "equal justice for all" - which is a fancy way of saying a totally impersonal form of justice that completely ignores the individual or their motivations when it comes to sentencing. So in order not to have the judicial system perpetuate an injustice, many  times we're faced with logical disconnect of pronouncing somebody "not guilty" (even though they are) because it's the only way we can get away with not punishing somebody for breaking a law.

I always wished that any judicial action (private, board, or court) be conducted in two phases. Phase one is a simple determination to establish if the individual did - or didn't - do what they've been accused of doing. Leave out motives completely. Did they or didn't they? If you can't prove they actually did - end of case. Everybody gets to go home.

However, if it turns out there's incontrovertible proof they did in fact do the deed, then you then go on to phase two: What, if anything, should we do about it?

This is where I think the real examination of the bigger issues (beyond legal technicalities) should occur. So for this student, I think it would make more sense if somebody could just say (and the student admit) an important access & use rule had been broken - and that there was a solid reason for having such a rule in the first place.

Then we could all get into a good philosophical discussion of personal motives, setting up the future farm team, issues of shared culpability, etc. etc. etc. and what would be an appropriate response in this case.

But please remember - that's not arguing for justice. Most of us think we want justice. But we don't. It's the last thing most of us will ever want if we're in trouble.

Real justice is by nature cruel, cold, dispassionate and impersonal. It negates the individual in exchange for a higher truth. So when we go before somebody to receive judgment, we don't want to be treated in such an impersonal manner. This is us afterall! We want those in authority to see that the case before them (us) is totally unique - a case that is absolutely nothing like anything that ever came before them previously - or ever will again.

In short, we don't really want justice from those who judge us. We want love.

So lets get beyond whether or not what this kid did was wrong. It was.

Once that's out of the way, let's move on and decide how much 'love' we're willing to extend him.
 

-----------------

Addendum: in this particular case I'd probably let it go with a few dope-smacks across the back of the head while the school glee club chanted "Dude! What were you thinking?" in 4-part harmony with the coloraturas screaming "Stupid! Stupid! Stupid!" up around high C or C# just to add some computer symbolism. But since corporal punishment is unconstitutional where I live (and I'm not really into hitting people to begin with) I'd probably just let it go with him saying he was sorry and admitting he wasn't thinking clearly.

If he's truly sorry, he won't repeat. If he does...well...we still have a whole pile of nasty responses (and a reduced supply of love) available for next time should that occur.

4213

Living Room / Re: Recommend some music videos to me!

« Last post by 40hz on January 21, 2013, 08:55 PM »

This is Angelface/Headcase.

My daughter is dating the guitarist/lead singer/song writer. When he's not making music, he's a technical writer.

The entire album is available on Amazon as a digital download.

-app103 (January 17, 2013, 07:42 PM)

Nice track. Good mix of psychedelic, electro, and techno. Lady's playin' what looks like a Warwick Corvette fretless too! Awesome. How cool is that?

4214

Living Room / Re: Recommend some music videos to me!

« Last post by 40hz on January 21, 2013, 08:44 PM »

Now there is one long ass intro I wish I wrote: the beginning of "Long Way There" by the Little River Band.  They milked that one real good.

-superboyac (January 21, 2013, 08:35 PM)

Ted Nugent got them all beat. He wrote Cat Scratch Fever in '77 and milked that song for the rest of his career.

4215

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 08:37 PM »

Audio interview with the sudent:
http://www.cbc.ca/pl...treal/ID/2327525012/

-mouser (January 21, 2013, 02:58 PM)

If anyone listened to that... the student was GIVEN A TESTING ACCOUNT. What do you do with test accounts? Errr... test maybe?

-Renegade (January 21, 2013, 08:19 PM)

Close...so very close...

Um Ren? You need to get out of the coder's chair and spend a little more time down in the system operations center...it might make some of "our" terminology and mindset a little clearer.

(Sorry. Couldn't resist. And up till now I've been sooooo good too!)

4216

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 08:34 PM »

Nothing better than BBQing a Good Samaritan though! They're not all that common, so when ya find 'em, better cook 'em up real quick!

-Renegade (January 21, 2013, 08:19 PM)

Again. He wasn't punished for identifying and communicating his discovery of an exploit. If he let it go at that, there wouldn't have been a problem.

He was expelled afterwards for running hack-type scan software on a system in direct violation of the system's access and use policy.

Why couldn't he have just collected his kudos and walked away? Seriously?

4217

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 08:27 PM »

I did not add 'therefore more qualified than they are.
They should be more responsible though.
'Beat the ones with the degrees' was not meant as a contest.
More of a lack of the right words I suppose.

-cmpm (January 21, 2013, 07:30 PM)

Understood. I think my point (which I didn't make that well) is that you need to draw the line somewhere. All limits and rules, by nature, are arbitrary. But to open the gates to any activity on a system (or to disregard blatant system hacking activities) - with the justification that every so often it yields something of unexpected benefit - is not a good way to operate a network. And the people that do operate most professional networks are usually a lot better at it than they're given credit for. Especially by the press who automatically label any successful exploit an act of "technical" brilliance - even though most genuinely successful exploits are heavily dependent on additional non-tech factors such as "inside men," dishonest administrators, and "social engineering" mindgames.

Just saying.

4218

General Software Discussion / Re: On data storage and applications going cloud (Surfulater, Mindjet et al.)

« Last post by 40hz on January 21, 2013, 08:14 PM »

I was just a little bit disappointed that Aaron Swartz' premature death didn't give rise to any obituary here, before mine, and which didn't trigger any thought about that guy and his mission expressed here.

-helmut85 (January 21, 2013, 05:32 PM)

There has been some debate here about political and related topics. And many at DC (including our host) feel this is not really an appropriate venue for it.

So if the membership doesn't more quickly jump on some of the topics you find interesting and important, please consider that some of us here (who do have very strong social consciences and often outspoken and highly political opinions on many tech related issues) have been making a conscious effort not to get into as much of this sort of thing as we have in the past.

Considering there are numerous other web venues where political discussions are both welcome and encouraged, it's not particularly burdensome for most of us to take much of it elsewhere.

With apologies for the silly graphic posted by an adult man up above.

4219

Living Room / Re: Kaspersky - Clandestine State Sponsored Hacking

« Last post by 40hz on January 21, 2013, 07:49 PM »

^Makes sense they would. Now that it's been "painted" it would only be a matter of time before it ultimately got analyzed and tracked back home to mother. Especially the longer it stayed up.

Like they said in the movie The Sting: If Lonigan puts the finger on you we gotta fold the con.

Yup. Fold the tent and get the hell outta there. "Cover your tracks as best you may - and thus live to fight another day."

These people have the tools and the talent. This isn't the last we'll be seeing of whoever was behind it.

4220

General Software Discussion / Re: The indelicate subject....... money

« Last post by 40hz on January 21, 2013, 07:35 PM »

Um...FWIW, the entire FOSS concept was never intended to be viewed as a business model. It's a philosophy. Those who believe in it do it. Those who don't simply don't. Unless they're the sort who are constantly looking for ways to "monetize" things and somehow do an end run around the social contract by availing themselves of what FOSS has to offer without honoring the requirement they give back to the community. It doesn't work. And you usually don't get away with it for long - as many discovered who tried.

Also, Apple's OSX has nothing (as in nada) to do with Linux. Nor did Jobs "rename" Unix. Both are common misconceptions. He had his engineers base OSX on NextStep (which was based on the Mach kernal and BSD) because he did not want to open Apple's source code to any who wanted it. He preferred to keep what Apple brought to the equation (i.e. the userland experience and other code - which was substantial btw) completely proprietary - something Apple was legally allowed to do under the terms of the license BSD/Mach/NextStep shipped under.

Apple "got it" and sidestepped Linux completely. Very smart. Saved themselves and us a boatload of grief.

Apple understood that if you want to do software as a business, do it as a business. If you want to do FOSS, do FOSS. Many people in software seem to be unable to grasp that simple realization.

Like the Zen master said:

     When sitting, just sit.
     While walking, just walk.
     Above all, try not to wobble.

4221

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 07:10 PM »

I don't think it's about forgiveness and understanding.
A student of computer science beat the ones with the bachelors and masters at what they are supposed to be teaching.
The student is expelled?

-cmpm (January 21, 2013, 04:29 PM)

I'd characterize it more as a smart student identified a security hole in a university system. Period.

There's a big gap between doing that and us taking the ball and running with it by saying "he beat the ones" with degrees and is therefor more qualified than they are. Something which also ignores the fact that, putting all those old sayings (about how those who can't do it go on to teach it) aside, it's important to remember teaching something is a separate skill from the doing of something. There are many brilliant specialists and experts that can't teach what they do to save their lives. And vice-versa.

Also...he was not expelled for who he is, what his dreams are, or by the envious for being the romantic 'lone misunderstood hero.' He was expelled (so the less emotional reports seem to say) because he ran an unauthorized network scanning program on a system he was specifically not allowed to run it on. And further, it was a scan that had nothing to do with the original discovery of the exploit. It was done after the fact.

So all the "yeah buts" aside, he did something he knew he wasn't supposed to do.

And FWIW, unless you are a professional cracker, finding security holes is more about luck and being observant than anything else from what I've seen. So lets not automatically flip the 'genius-flag' on this student until we see a little more of what he can do.

I had a martial arts instructor who used to compliment us every time we did something unusually well - or got some technique 100% correct for the first time. He'd walk over and bow, clap you on the shoulder, and then say: "Well done!!! Not do it five more times just so we both know it wasn't luck."

4222

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 04:59 PM »

I think part of what has really gotten under my skin about this story is.. It's the professors in this department who should have known better.  *THEY* should have been standing up *against* the college bureaucrats who wanted to expel him.. defending his curiosity and spirit and going to bat for him and fighting for a more proportional response.  Shame on these professors -- shame on them.  The only thing for them to do now is come forward and explain themselves and explain themselves -- or recant and come to his defense.

-mouser (January 21, 2013, 03:41 PM)

At the risk of sounding cynical, I haven't seen university faculties buck university administrations much over anything in something like the last twenty years - unless it was over their compensation packages - or the firing of one of their own.

True they'll wade into the public arena with opinions on hot-button social issues whenever there's a possibility of securing some government work (gun control being the most recent area that needed "expert" academic input) or exposure on TV at a hearing. But most times, they seem to keep their heads down pretty low.

As a group, most academics are remarkably risk adverse and status conscious.

I don't expect too manyof Dawson's own  to come forward - although faculty members outside Dawson may have a bit to say once there's enough Reddit and Slashdot chatter posted to safely gauge which way the "big wind" is going to blow on this one.

Unfortunately for this student, right now we have the Aaron Schwartz and Kim Dotcomm debacles to deal with. So when it comes to Dawson, the tech press has much bigger (and IMHO more important) fish to fry.

4223

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 04:17 PM »

I get the feeling that many people who don't deal with large system administration issues tend to be more "forgiving" and "understanding" (whatever that means in this context) then do those of us who deal with it for a living.
 

----/

Out of curiosity...does anybody know what the school's official written policy is on this? The schools I'm familiar with all require signed agreements before granting access to the university's data centers and their network. IIRC the two I dealt with both had unambiguous policies regarding the unauthorized use of scanning and related tools, along with severe penalties for doing so.

4224

Living Room / Re: Computer science student expelled for testing university software security

« Last post by 40hz on January 21, 2013, 02:10 PM »

Just because it's predictable (true), doesn't make it right.

I'm with Mouser & Ren - They should have just counted coo on the kid...not take him out and shoot him - this is crap.

-Stoic Joker (January 21, 2013, 12:03 PM)

Here's the thing...a university's computer is *NOT* just sitting there for purely educational purposes - or for the students. Most universities these days are also hosting critical and sensitive research projects; running important internal programs (accounting & payroll); and frequently leasing out computer resources on contract to local businesses and government agencies along with the expertise to maintain such systems.

So when some undergrad decides that such a system is his personal playground where everything that happens on it should be purely for his own personal education and experience....well...I have a little trouble dealing with that level of hubris and selfishness.

Running a penetration test (even a white-hat one) sets off alarms, gets the sysadmins steppin' & fetchin' - and sometimes puts outside contracts or internal operations in jeopardy. Especially if the DoD or financial institutions are involved. Disclosure statements to be filed, audits to be performed, re-certifications needed in some cases, and occasionally data or contracts lost, plus a hit to your reputation and a signal to potential hackers that this is a facility worth targeting...all of these things come at a price. And to just say "Well...I'm just a student and I was trying to learn something." doesn't cut it in this context.

One unfortnate thing I'm seeing more and more with the upcoming generation is how many have consciously or subconsciously embraced the notion that "it's easier to ask for forgiveness than to get permission." Almost like life comes with a reset or "new game" button. Well guess what? It doesn't. It's called reality. Welcome to Life-101.

And one of the first lessons learned in Life-101 is that just because you say "you're sorry" and "didn't mean anything by it" doesn't automatically absolve you of the consequences of your actions.

In this day of virtual machines and lab setups there are safer and better ways to become educated in network intrusion than to perform an unauthorized 'run' on a live production system. Doing that is just flat out unacceptable.

In this particular student's case, it was great that he discovered and reported a security problem. And I see he received kudos and full props for it. But going back in after the fact to "verify" the fix had been made? I'd be suspicious too.

I have very little sympathy for this particular kid's self-caused problems even if I do think the school's response borders on being capricious and excessive. However, please note that the headlines are somewhat misleading too. He wasn't expelled for identifying a security issue. He was expelled for going back afterwards and running an unauthorized scan using Acunetix. That's a very different thing than implying that he merely identified a security hole - and then got promptly expelled from his college by way of a thank-you as some news sources are seeming to say.

4225

Living Room / Re: PowerPwn: Power strip by day, Hacking device by night!

« Last post by 40hz on January 21, 2013, 01:28 PM »

Sysadmins! Welcome to HELL~!

-Renegade (January 21, 2013, 12:07 AM)

What do you mean "welcome"???

We've been paying on our overpriced condos in Hades for the last 25 years. We're in an old well-established neighborhood down here.