Slashdot Mirror
Slashback: Texasocial, Networking, Attacks
Why meet people in real life? Roland Piquepaille writes "I wrote [Saturday] a column about social-network mapping tools mentioned by Slashdot. Slashdot readers sent me many comments and e-mails about other visualization tools. Here are these new tools, in no particular order: email constellations, Apache Agora, NetVis Module, EtherApe, inGridX, NameBase's Proximity Search, Surf3D Pro and the dazzling KartOO. Finally, a reader talked about another kind of tools, the Visual Thesaurus. This web tool is not about social mapping, but it shows graphical connections between words. In this previous column, "The Visual Thesaurus: What Does it Show About Thanksgiving?," I already explored this very funny tool. Check this new story for more the details about all these tools."
Update: 03/19 00:34 GMT by T : Directly related: Josh Tyler writes "Related to a recent Slashdot posting on social networks is this paper on automatically discovering communities based on email data, just published by our group at HP Labs. We find that simple communication data is enough to identify communities, both formal and informal, and possibly even to identify the leaders of these groups."
Speaking of online community ... TGK writes "Audioscrobbler (which many of us visited the first time it was posted here) has a new site up, and most importantly, new plugins for XMMS and Winamp 3."
From the site, a capsule description of what Audioscrobbler does: "It grows to know what music you like by monitoring what songs you play on your computer. From this information you can discover other users that share some or all of your taste in music."
Feedback is always cool. An anonymous reader writes: "Sudhakar Govindavajhala, co-author of the paper referenced by the Saturday Slashdot article 'Using Memory Errors to Attack a Virtual Machine,' has responded to many of your [Slashdot readers'] questions and comments. His commentary is located at his Princeton CS website."
Another reason that Social Security isn't. GregAllen writes "Remember the recent case of SSN data theft at The University of Texas? A student has turned himself in. In his confession he says that he acted alone, and had no intention to disseminate the information. Maybe this will convince them to stop using SSNs for student IDs." Bonker also points out that "Salon is carrying an AP article that's a followup to the story a few days ago about the mass of Social Security Numbers stolen from University of Texas. Christopher Andrew Phillips is described as a 'fine young man who has never before been in trouble with the law'. Apparently he wrote a program 'to access a university Web site that tracks employees who attend training classes'. Whether or not this was done for illegitimate purposes remains to be seen. As a former UTA student, I'm glad my SSN is no longer in danger!"
What's the state of the device? An anonymous reader writes "N-Philes.com did another State of the GBA Industry Article and Roundtable. Here is the Industry Article, and here is the Roundtable"
Update: 03/19 00:34 GMT by T : And one more presroi writes "Just one week after even slashdot has noticed the new 2.2.24 linux kernel, Alan Cox has announced a new version due to a security issue found in 2.2 as well as in the 2.4 branch. I hope that we all were to lazy to upgrade from 2.2.X to .24 until now :)"
what steps are being taken to protect the data and users privacy ? hypothetically if a large company offers say a million dollars to use the data how protected are the users who contribute or are they for sale to the highest bidder ?
or is it a case of when they hand over the cash the project leaders will be rich so who cares
I thought about this for a moment (just one, just one moment) and came to the conclusion that I actually have no idea why an instition would use SSNs (or SINs) to internally identify their members. The university I go to has their own student numbering system and we seem to do fine. It's not difficult at all to remember a 7 digit code that you find you have to write down at least 5 times a week. *shrug*
So basically, it's OK to use SSN because students aren't smart enough or are too lazy to learn a new PIN. While the PIN seems pretty long, I still see no reason for an SSN. Between phone #, address, etc, you should be able to identify your Michael John Smiths. Being that the identifier given is relatively the same length as an SIN (at least ones around here) - why couldn't anyone who memorizes their SIN memorize the ID.
For those that can't... put it in your damn wallet on a card or something, because with the SIN they're probably referencing their card anyhow.
In the school system I used to attend (I won't name it, but it's a K-12 district), studends were assigned student ID numbers which were recycled when the student left. Faculty members, however, didn't get such a priveledge, and instead were tracked by their SSNs. Although this information was not supposed to be available, I was able to gain access without much work (and I suspect I could still do so). In fact, I have a file on my computer right now (encrypted of course) containing the names and SSNs of every faculty member of the entire district as of when I left. This includes janitors, teachers, principals, district administrators - anyone with an account on their system.
:)
The problem seems to stem from the lack of knowledge of the people in charge of running the system. The "technology admin" at my school looked to me like he was chosen as the teacher who knew the most about computers- certainly not hired as a professional.
This district has no idea I have this data, and I don't intend to tell them. Most of the faculty there didn't like me much anyway, and I'm not putting myself at risk for those bastards. They're just lucky I have too much integrity to use it for evil
Seriously, what law was broken here? If the university left a list of student/faculty names and SSNs on the sidewalk and someone picked it up, with no intent to commit fraud etc., would that be crime?
Suppose someone from the school administration had memorized everyone's SSN and sat in the student union and would answer questions of the form, "do you know who has xxx-xx-xxxx as their SSN?" If students (or others) asked questions of this form and eventually learned a list of SSNs, would this be a crime? And who would be guilty, the questioners, or the idiot that was giving out confidential information without the owner's consent?
In this case the moron who created the web site was answering this question indirectly over the Internet. Who's at fault? The guy who took the time to ask the questions, or the dork who made it possible to get the answers?
In going through some old papers from my grad school days, I found my carbon copy of a grade report which lists student names and SSNs (along with their grades in the class I taught). Am I guilty of a crime for possessing that list? Clearly, I was trusted with that information because I was hired to teach a class, so isn't it my responsibility to keep that information confidential? It seems to me the web author has the same responsibility.
Obviously, it's a very different situation if someone does something illegal with the list, but just building the list from publicly available information doesn't seem like a crime to me. Making the list easy to publicly deduce seems like the real crime in this case.
I am a student at the University of Texas and I think there a couple of things that need to be clarified here. First of all, the SSNs that were accessed are, for the most part, not student SSNs, they are SSNs of employees of the University (some of whom are also students). Read the article again, you will notice that he accessed a web site that tracks employees who signed up for training classes. This means that the SSNs are from tax forms and not student IDs. Secondly, UT Austin no longer uses SSNs as student IDs. I am a recent addition to the student body so I don't know how long this has been true, but the ID cards have a 16 digit number printed on them that you would use whenever that is necessary and that the Electronic ID (EID) is a user-assigned login and password combination and that the social security number is no longer part of the information available electronically even to the student. That was a change that happened just last semester. Students interact with the university electronically with the EID not with an SSN. The only time a student needs to use the SSN is when trying to change the EID (which they have to do in person, with photo ID). So, in the end it is ironic that most of the complaints about the use of SSNs as Student ID numbers, good discussion that it is, has nothing to do with the UT hack!