DJB Announces 44 Security Holes In *nix Software

Don't just take this lying down, IMO by Skyshadow · 2004-12-15 11:17 · Score: 5, Interesting

Now that's a tough assignment. 44 holes found is an average of less than two a person -- it's possible the *entire* class failed, not just most. At best, probably one person completed the assignment.

As much as I respect profs who are willing to push you to do neat things (finding 44 holes in UNIX and it's standard set of programs is nothing to sneeze at), if you really do fail the class I'd take this straight to the administration. They're letting you down by allowing a professor to fail an entire class, especially since the grades are based on something that doesn't really reflect your understanding of the subject.

I've always had a problem with this sort of behavior in college profs -- it gets away from what I consider to be the basic nature of higher education. As a student, I'm the consumer. I'm paying the professor to teach me what he/she knows and then to rate how well I've absorbed that information at the end of the class. Assignments such as this one or classes which are set up as "cut down classes" just aren't consistant with that.

It works the same way on the other end; I had a few professors in college who would cancel class on a fairly routine basis. Hey, I enjoy the odd day off as much as anyone else, but I'm paying a lot of money based on the assumption that I'm going to be getting something in return -- if I were to subscribe to a magazine and then only get 2/3rds of the issues, do you thing I'd be within my rights to object? Hell, the overly easy classes were bad enough; I actually had a few that graded based mostly on attendance. Yeah, getting the most for my tuition dollar there.

Anyhow, I know there are folks out there who are going to disagree with my view of a University education, and that's fine, but regardless I would really encourage you not to accept this lying down. I know as a student it often seems like you're powerless, but if 25 of you (and your parents -- I know you're an adult, but schools listen to parents) get together and make yourselves heard, you'll probably end up with a satisfactory outcome.

--
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.

Re:Don't just take this lying down, IMO by UberGeeb · 2004-12-15 12:13 · Score: 2, Interesting

Actually, you're both right.
You're not paying for an education. You're paying for the opportunity to be educated. A part of that is the understanding that assessments of your progress (grades) are done fairly. Another part of that is the necessity that the professor actually show up to teach.
Re:Don't just take this lying down, IMO by Fahrenheit+450 · 2004-12-15 12:35 · Score: 2, Interesting

Why are you assuming this is a joke? As the prof in my heuristics class said, "your boss isn't going to give a damn if the problem you need to solve is NP-Complete... you're still going to have to write the code." And of course there's the issue of average case hardness vs. worst case hardness, plus just the size of the problem being worked. A lot of TSP instances don't take that long to solve.

There are plenty of algorithms out there for solving NP-Complete (and harder) problems. It's just that they won't work too fast for large, hard case problems...

--
-30-
Re:Don't just take this lying down, IMO by bwt · 2004-12-15 12:45 · Score: 2, Interesting

I happen to know Dr. Bernstein because I went to grad school with him. It's completely odd to me that people are up in arms over an assignment like this that wasn't achievable. It sounds like these students learned a hell of a lot. Who cares if the initial assignment was unrealistically hard. I think that's actually good -- it makes people try to stretch. In fact, I doubt we would have 44 security vulnerabilities if the goal had been to find 2 each.

I seriously doubt Dr. Bernstein is going to fail all these students. He should give them the grades he thinks they deserve with one letter grade lower for whiners. People who lose sight of the importance of the subject matter because they are obsessed with grades rather disgust me.
Re:Don't just take this lying down, IMO by Froggy · 2004-12-15 15:12 · Score: 2, Interesting

We tend to do this where I work. Part of the reason is that we often can't be certain exactly where the cutoff between pass and fail is going to fall -- this is especially true when we are rolling out new subjects or new assessment. If the assessment ends up being marked harder than advertised, the student body will scream and there will be formal complaints (and justifiably so). If we mark easier than advertised, most people will be OK with that. Therefore we tend to overstate the difficulty at the start of semester, if there's any doubt.

There's also the psychological factor -- most of our students come to our university from schools in which you got plenty of catch-up time and revision. High-school subjects are usually paced slowly enough that most students can get through them. The pace picks up tremendously at university.

The subjects we teach do not usually ease students gently into the course. Students are expected to hit the ground running. Because they are drawn from the more gifted high school students, they are usually used to goofing off; it's a lot harder to get away with that at Uni. Every year we fail a few students, not because they can't keep up with the course, but because they just don't. If we can save some of these students from dropping out by putting the frighteners on at the start of the year, I'm all for it. It's a heck of a lot cheaper than providing instructor-heavy remedial courses.

--
It is a woman's prerogative to change other people's minds.
Re:Don't just take this lying down, IMO by willijar · 2004-12-15 19:35 · Score: 2, Interesting

"As a student, I'm the consumer. "

Well I don't have a problem considering themselves students if they are paying for their education as long as they understand what they are paying for. It is not certificates, or exam passes, or knowledge. It is for the educational process. It seems to me this coursework represents some very good educational process. You always learn better by doing than having someone lecture at you - a bargain in those terms!

On the otherhand, this is the first time it was run and so some pragmatism and adjustments in how the coursework is assessed may be needed. Not an unusual situation to be in if you try something new.
Re:Don't just take this lying down, IMO by edunbar93 · 2004-12-15 20:19 · Score: 4, Interesting

oh lookit me i wrote qmail and its all uber secure

That's cute. His code may not have any bugs in it, but damn, does it ever have some huge logical flaws.

Qmail has the lovely lack of ability to reject e-mail while the SMTP connection is still active. What it does instead is it creates and sends a bounce message itself, instead of leaving that up to the sending server. What happens when you do this is you allow spammers to send e-mail to recipients in the To: line instead of the From: line, just by putting in a bogus To: line and putting the real recipient in the From: line.

There's a patch for this, but it involves setting up a list of e-mail addresses that are allowed to be accepted. Once you have several thousand e-mail addresses all over the place courtesy of Vpopmail, this becomes an impossible task.

So no, this man isn't a perfect programmer.

--
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert

Were any of them *not* buffer overflows? by jcr · 2004-12-15 11:23 · Score: 2, Interesting

I didn't look at all of them, but the ones I did check all seemed to be the usual culprits: str..() functions out of the standard, broken C library.

-jcr

--
The only title of honor that a tyrant can grant is "Enemy of the State."

Students didn't exploit the loophole by fireboy1919 · 2004-12-15 11:29 · Score: 4, Interesting

He pretty much gave them free reign. ANY OSS at all!

Have you seen CPAN? Half of that code is something someone hacked up in a day! And what about all those sourceforge projects that have one developer and less than 10000 lines?

Meanwhile, almost every piece of code that this class is looking at is stuff that's already had a once over - heck, probably even been looked over thousands of times. No wonder they couldn't find any bugs. They were looking in the houses, not the motels.

--
Mod me down and I will become more powerful than you can possibly imagine!

Re:Students didn't exploit the loophole by pdp7 · 2004-12-15 23:17 · Score: 2, Interesting

Credit each student recieved per bug was 1/n where n was the number of collaboraters. So if all 25 or so students got together, we would have had to find far more than 44 bugs to all meet the goal of 10 bugs person.

That said, collaboration was really the key even with the partial credit scenario. From talking to other classmates, those that worked together seemed to do quite well. One team of two classmates had a great system where one would audit code while the other crafted PoC exploits. I realize now that lack of collaboration was my greatest mistake in this class.

Agreed, many profs are abusive by Ars-Fartsica · 2004-12-15 11:33 · Score: 3, Interesting

From time to time you do get a normal human being lecturing you, but often you get an inhuman prick whose real mastery is in manipulating human emotions. I've watched a calculus prof reduce many female students to tears...and I'm thinking, what is it dude, a sexual thing? I mean, come on, show some dignity and respect for the students.

The problem is that many of the profs have no professional experience outside the academic realm. None. Amazing as it sounds, they go from graduate work to post-doc to the faculty lounge, all the while succesfully avoiding any opportunity to deal with people as equals...its always grovelling to someone or getting someone to grovel to you. Its no coincidence many sleep with their students, its often the only way they can get laid.

The dynamics of academic environments are truly absurd, I'm amazed more of them are not murdered.

Re:Agreed, many profs are abusive by bladesjester · 2004-12-15 14:52 · Score: 2, Interesting

That's weird. Most of the CS profs I had classes with were cool (most of them were married, but a couple of them were still dating). However, you have to consider that most of them were less than 35 or 40.

The CS profs were cool enough that I regularly shot pool with 3 of them early friday night (loosing team paid for the beer) before I went uptown to party with my classmates. The looks on the faces of the underclassmen when the chair of our dept walks up to me and asks if I'm shooting pool with them that evening were hilarious.

They even came to most of the "professional" house parties that we threw. It was really weird the first time I was at one of the house parties. I'm chatting with someone and all of a sudden my prof walks in. I nearly choked on my jello shot. He just came over, said hi, and then went over to get a couple of jello shots himself. It was also really weird the first few times I ran into one of them in the bars and they bought me a drink.

Just goes to show you that not all profs lack social skills.

--
Everything I need to know I learned by killing smart people and eating their brains.
Re:Agreed, many profs are abusive by bladesjester · 2004-12-15 15:43 · Score: 2, Interesting

Frighteningly enough, the profs who most closely met the "lock yourself in the room and have no social contact" at my uni tended to be the ones in the history dept. There were a couple of cool ones, but most of them had little in the way of social skills. (The anthro profs were a *whole* other story. They were great fun with senses of humor almost as weird as mine, but then anthro has interested me since I've been a kid.)

Most of the engineering and CS profs I knew were cool (there were exceptions). The language profs were an absolute riot (even if the insane German wiped the floor with me in pool. Yes, I have this thing with pool. I spent several years as a kid living over a game room). The philosophy profs tended to be social creatures, as were most of the profs in the other departments that I dealt with (in academic, social, and professional capacities).

--
Everything I need to know I learned by killing smart people and eating their brains.

Sounds like Fermi at University of Chicago by monopole · 2004-12-15 11:36 · Score: 3, Interesting

Enrico Fermi supposedly failed every single person who ever took his Quantum Mechanics course at the University of Chicago. A special footnote had to be added to transcripts as a result.

The pity is that such a strategy allows for no differentiation between people who are working at their full capacity and goof-offs who sleep though class.

Fuzz testing by ScottMaxwell · 2004-12-15 11:44 · Score: 5, Interesting

If you want a quick and easy way to find potentially exploitable bugs, try fuzz testing. This is as simple as it could be: feed random data (e.g., from /dev/random) into applications until you crash one. That usually means there's a buffer overflow, which you can then exploit. Re-run the test under a debugger to pinpoint the exact cause of the crash, then craft an attack.

The better approach is to create one or more large files of random data and feed that into the apps; this is better because it gives you a reproducible stream. (Or you can use a Perl script with a known srand() seed.)

The term "fuzz testing" comes from a seminal 1990 paper (and followups in 1995 and 2000) by Barton Miller et al., who, incidentally, found much higher quality in GNU tools than in their proprietary counterparts. Before my tendinitis got too bad, I used to run The Bulletproof Penguin a one-man project devoted to stamping out such bugs (my initial goal, easily achieved, was to eliminate all the bugs reported in the original paper). Ben Woodard was doing something very similar for a while, but I don't know whether he still does.

Incidentally, this makes a certain recent Slashdot story more embarrassing: it seems that free Web browsers crash on malformed input, the kind of case that free software normally handles better than its proprietary competition.

--

``Life results from the non-random survival of randomly varying replicators.'' -- Richard Dawkins

Re:Most people will pass by Skybyte · 2004-12-15 11:49 · Score: 1, Interesting

At my university you can fold over part of the exam so that your name is hidden from markers, which prevents people marking your exam harshly because they don't like you. Maybe the University of Victoria should do the same?

Crash.... by oliverthered · 2004-12-15 11:54 · Score: 3, Interesting

I've reported 4 stack/pointer based crashes in Konqueror in the past couple of days and they just came to me without looking.

If I could have crafted an exploit for the crashes then that would be 4 holes.

All the students needed to do was look at the current/recent bugs list for a version of software.

Identify bugs that could possibly be exploited. (say maybe 100)
Run automated buffer/stack exploit
checking software against those bugs.

hope to get 10 criticals.

Khtml's probably a good choice for exploiting at the moment, as it's getting a lot of 'features and fixes' which probably caused the crashed I've reported.

--
thank God the internet isn't a human right.

Assignment was easy. by DarkAurora · 2004-12-15 12:02 · Score: 2, Interesting

Step 1: Read example security exploits.
Step 2: Develop script to detect. (Simple stuff like evil C functions)
Step 3: Develop script to download packages from freshmeat and run previous script.
Step 4: Play videogames for a few hours.
Step 5: Write reports.
Step 6: Profit! (Good grade would be considered profit here)

Re:If the majority of the class failed... by Anonymous Coward · 2004-12-15 12:02 · Score: 2, Interesting

Nah. Try teaching remedial math at a community college. I gave an average of 1.12 my last quarter teaching. Why? Because over 50% of the students did not show for the final. I would have loved to give everyone good grades, but I needed to make sure that these students learned the basics and they did not.

You can not judge anything by the percentage of the class that fails.

Misleading "Exploits" (Was Re:Misleading Title) by kazrak · 2004-12-15 12:07 · Score: 1, Interesting

That's okay, the contents of djb's notification emails are misleading too. I would hardly consider the following a remote exploit:

Somebody emails you a file
You, apparently without ever looking at it, run that file through something like jpeg2avi or nasm
Gasp! You've been 0wned!

This is no more a remote exploit than somebody mailing you an executable that you run. Clearly the fact that the bash shell will let you run an executable that will do unexpected things means that there's a remote exploit in bash!

Re:It's just an assignment - Did you even go to un by SetupWeasel · 2004-12-15 12:18 · Score: 5, Interesting

That kind of stuff usually doesn't work. In an Astronomy class (toward an Astronomy major, not that gen-ed crap) the professor did not tell us we would have to remember constants, and he asked them as questions. They were short questions, and weren't worth a lot.

One of them was: What is the orbital period of Saturn? (2 pts/100)

I started thinking about Bode's law and the posibility I could calculate it from an approximate radius I would get from that law... if I could remember it. But when you expect a 72% to be an A on a test, you have bigger fish to fry.

Then I got it. It was right, it should work, and no one would have to be nailed to anything.

I wrote: One Saturn-Year

I didn't get credit for it. A couple years later a sophmore was telling me about this funny question he had in the same class. He showed it to me. It read:

What is the orbital period of Saturn? (Do not put one Saturn-Year)

I was so right that it had to be guarded against. Yet those were 2 points I would never have.

Re:How to pass this class (females only) by narcc · 2004-12-15 12:19 · Score: 2, Interesting

same analogy, but with 'exploit' instead of 'secure'

--
Required reading for internet skeptics

Re:What's the deal? by retro128 · 2004-12-15 12:22 · Score: 2, Interesting

I know. I saw the emails DJB sent out. And yet, the title of the article says "DJB Announces 44 Security Holes In *nix Software". Press releases, if any, I'm sure will fail to mention any of the students, and DJB will be the point man they always quote.

In this fashion, as is typical with academia, the professors take the credit for their students' grunt work. That is what I was getting at. I should have been more clear.

All the students will get is something to attach to their resume. Or will they? After all, they failed the class.

--
-R

Varying levels of seriousness... by Goonie · 2004-12-15 12:35 · Score: 3, Interesting

Some of these exploits are "real" security holes, in that they are exploitable by things users might actually do - playing a media file, or printing something.

Others are pretty implausible, for instance the jpegtoavi exploit, which requires the user to run the jpegtoavi program on a set of files provided by an attacker.

On my quick perusal, the nastiest holes seem to be the changepassword hole, a local root exploit, and the two holes in cups, particularly the first one, which straightforwardly gets the attacker access to user "lp" where they can monitor everything that gets printed.

One thing that is a bit surprising and disappointing is that so many of these bugs are from well-known bad coding practices. Why the hell is *anyone* still using strcat in distributed software, for instance?

--

Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)

Re:Varying levels of seriousness... by grumbel · 2004-12-15 16:15 · Score: 2, Interesting

### One thing that is a bit surprising and disappointing is that so many of these bugs are from well-known bad coding practices. Why the hell is *anyone* still using strcat in distributed software, for instance?

Because such functions are still in the libc and because C coding books still teach them. To get rid of such things one would simply need to either remove them completly from the library or at least let gcc output a big-fat warning on their use or only allow them when some pragma or gcc-flag is set. Having a better standard way to handle strings, such as libowfat's stralloc would of course also help.

As long as neither the libraries nor the compiler get it right and remove them, JoeProgrammer will continue to use the functions, be it by error, lack of knowledge or for portability reason.

Re:It's just an assignment - Did you even go to un by Marxist+Hacker+42 · 2004-12-15 12:46 · Score: 3, Interesting

Mine was modifying a string constant in Borland's Turbo C by setting a pointer variable to the begining of where the constant was stored and then changing the proper offset. When I got my test back, it said "-5, +5, I tried it it worked!". I was too much of a stupid kid to realize that you shouldn't write self modifying code in the global constants table.....

--
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.

Re:Good idea? by Anonymous Coward · 2004-12-15 12:52 · Score: 1, Interesting

"We're not blaming DJB for our failure."

You should. When 25 out of 25 probed to be intelligent and wanting to work people fail, then its time to look at the teacher's fault.

In those situations, it usually ends up being one of those two cases:
1/ The teacher wasn't able to pass to you the essence of his course, or the level he himself will be asking on the tests. Any way is his fault either for being unable to teach appropiately, or being a smartass which teaches the 101 but then asks for the whole degree
2/ He asks for more or less trivial things, but then asks for a ton of them so there's no physical time to pass the tests. Where he really thinks he is? It's good to press the boys, but is plain stupid to do so beyond what's doable. There's no intellectual nor social benefit in asking someone to dig a one kilometer tunnel... with a teaspoon... in an hour. Except, of course, for the sadistic pleasure of being known as "the hardest teacher this side of the Pecos River".

Having DJB the fame he has, he has probably managed to be a perfect example... of those two points at the same time.

Re:If the majority of the class failed... by Anonymous Coward · 2004-12-15 12:53 · Score: 1, Interesting

Using that logic, here's a roomful of 3-year olds. Go teach them advanced calculus in 1 semester. If most of them fail, you failed as their professor.

Sometimes, most of the class SHOULD fail because they simply don't have the brains or background to learn the material.

There are a lot of undeserving students that get into tough university courses they are not qualified to handle. College entrance exams and high school grades are not enough to weed out students in very specific subjects like software security.

The only remaining way to weed them out is to fail them under these circumstances. Sad but what is the alternative? Grade on a curve so that any moron can receive credit for the course as long as he or she sits in a room full of other idiots?

Re:Mplayer and Xine new security releases by iive · 2004-12-15 13:22 · Score: 4, Interesting

Place mod the parent up.

As one of the mplayer developers, I would like to thank to DJB for giving us (hmm)16 (?) hours before unleashing exploints on wild.

Maybe he is not aware that making right fix, testing it and finally releasing it, is not so simple task. Especially if we have to convice the person that have release (write) permisions, that him girlfriend is not as importan as the security release:)

Not to say, that I still haven't got the mail in my mailbox, despire that gmame shows it have been recived.

Also mplayer-dev-eng@mplayerhq.hu is the more appropriate maillist to send security issues. (MPlayer documentation will be updated accordingly.)

The exploit that is found in MPlayer is not alone. There are at least 2 other places with similar exploitable bahavioud in the same file. I guess the students keep them for next semester.

BTW code originates from Xine, probably it is time to update our version ;)

Re:In all fairness by generationxyu · 2004-12-15 13:24 · Score: 2, Interesting

That's not hard. That would take about a days work for any proficient C hacker.

Really? Then you do it. I'm sick and tired of people telling me that I didn't work hard enough or that I obviously don't understand C, or that "there's TOTALLY that many bugs out there." A day's work? Give me ten by a month from today, January 15, and I'll admit that I should have failed.

I know of 3 (possibly 4) people who are passing this course. One of them, Limin Wang, is DJB's grad student. She didn't take any other courses this semester, and had the entire time to work on this. One is a very knowledgable and hard working student, Ariel Berkman, and he deserves a better grade than he got.

The other two are Tom Palarz, the president of the ACM at UIC, and Kris Kubicki, a senior editor for AnandTech. They've slept about an hour a day the past few weeks, most of that in the CS computer labs.

--
I mod down pyramid schemes in sigs.

DJB Faculty Profile (with Photo) by Anonymous Coward · 2004-12-15 13:57 · Score: 2, Interesting

DJB's UIC Faculty Profile includes a photograph.

Always interesting to put a face with a name.

True, however... by dpilot · 2004-12-15 14:05 · Score: 3, Interesting

>1. Prof says 'I'll fail you if you don't perform a near-impossible test.'
>2. Student says 'OK.'

Nope.

Student weighs factors, realizes that if he takes the test, he'll probably fail the course. FAILING THE COURSE MEANS NO CREDIT HOURS, AND LOSS OF THAT TIME TO TAKE A DIFFERENT COURSE. Therefore, with regret, he takes his second choice for that slot.

Yes, Mr. Recruiter. I got an F in a course in my chosen major, but it was in an *impossible* course. Actually, between the presence of that F in the major field, and what it did to his GPA, he probably won't even get to see the recruiters he most wanted to see. He would have been weeded out before then.

The learning is great, sure. The impossible grade is serving absolutely nobody and nothing except DJB's ego.

--
The living have better things to do than to continue hating the dead.

Re:What? by thogard · 2004-12-15 14:53 · Score: 3, Interesting

Been there, done that, reported it, fix still not in qmail (as far as I know). You don't get the reward if the bug is an interaction between qmail and the os. I don't run qmail because of that issue. I could care less if the core code is secure unless its interactions with its enviroment (what ever that may be) are also locked down.

And I agree with user 820979.

Re:It's just an assignment - Did you even go to un by rawb · 2004-12-15 14:55 · Score: 5, Interesting

Sir Ernest Rutherford, President of the Royal Academy, and recipient of the Nobel Prize in Physics, related the following story.

Some time ago I received a call from a colleague. He was about to give a student a zero for his answer to a physics question, while the student claimed a perfect score. The instructor and the student agreed to an impartial arbiter, and I was selected.

I read the examination question: "Show how it is possible to determine the height of a tall building with the aid of a barometer." The student had answered: "Take the barometer to the top of the building, attach a long rope to it, lower it to the street, and then bring it up, measuring the length of the rope. The length of the rope is the height of the building."

The student really had a strong case for full credit since he had really answered the question completely and correctly! On the other hand, if full credit were given, it could well contribute to a high grade in his physics course and certify competence in physics, but the answer did not confirm this.

I suggested that the student have another try. I gave the student six minutes to answer the question with the warning that the answer should show some knowledge of physics. At the end of five minutes, he hadn't written anything. I asked if he wished to give up, but he said he had many answers to this problem; he was just thinking of the best one. I excused myself for interrupting him and asked him to please go on.

In the next minute, he dashed off his answer, which read: "Take the barometer to the top of the building and lean over the edge of the roof. Drop the barometer, timing its fall with a stopwatch. Then, using the formula x=0.5*a*t^2, calculate the height of the building." At this point, I asked my colleague if he would give up. He conceded, and gave the student almost full credit.

While leaving my colleague's office, I recalled that the student had said that he had other answers to the problem, so I asked him what they were.

"Well," said the student, "there are many ways of getting the height of a tall building with the aid of a barometer.

For example, you could take the barometer out on a sunny day and measure the height of the barometer, the length of its shadow, and the length of the shadow of the building, and by the use of simple proportion, determine the height of the building."

"Fine," I said, "and others?"

"Yes," said the student, "there is a very basic measurement method you will like. In this method, you take the barometer and begin to walk up the stairs. As you climb the stairs, you mark off the length of the barometer along the wall. You then count the number of marks, and this will give you the height of the building in barometer units." "A very direct method."

"Of course. If you want a more sophisticated method, you can tie the barometer to the end of a string, swing it as a pendulum, and determine the value of g [gravity] at the street level and at the top of the building. From the difference between the two values of g, the height of the building, in principle, can be calculated."

"On this same tack, you could take the barometer to the top of the building, attach a long rope to it, lower it to just above the street, and then swing it as a pendulum. You could then calculate the height of the building by the period of the precession".

"Finally," he concluded, "there are many other ways of solving the problem. Probably the best," he said, "is to take the barometer to the basement and knock on the superintendent's door. When the superintendent answers, you speak to him as follows: 'Mr. Superintendent, here is a fine barometer. If you will tell me the height of the building, I will give you this barometer."

At this point, I asked the student if he really did not know the conventional answer to this question. He admitted that he did, but said that he was fed up with high school and college instructors trying to teach him how to think.

The name of the studen

Re:It's just an assignment - Did you even go to un by entropy_uc · 2004-12-15 16:51 · Score: 4, Interesting

The best part of that story:

...all of the methods attributed to Bohr are more accurate than the method the professor considered to be the 'right' solution.

(delta P on the barometer will be so small that error in reading the difference will dominate the result)

This is why you have a drop period for courses by Fudge.Org · 2004-12-15 17:23 · Score: 2, Interesting

Oh for pete's sake... the link to the course includes the course slides. While college was a while ago for me... I recall that the grading and expectations of the prof are clearly stated early in the course so that everyone knows the rules.

If you look at the first slide deck published:

http://cr.yp.to/2004-494/0823.pdf

You can see very clearly on page 7 that grading is very straight forward.

Simply put, you have 60% of your grade that is not related to formal tests.

Surely a 400 level course has adults capable of making an adult choice to drop the course if they cannot live with the grading terms outlined early in the course?

Last day to drop courses:

October 1, Friday

source: http://www.uic.edu/ucat/catalog/CA.html

That's six (6) weeks to realize that "Hey, this might not be an easy way to boost the ole GPA".

What am I missing?

--
http://fudge.org

Re:It's just an assignment - Did you even go to un by Anonymous Coward · 2004-12-15 18:20 · Score: 1, Interesting

Asked the old question "If you have 3 apples and you take one away, how many apples do you have?" there are possibly 4 answers to this:

1) 1 (possesive) You 'have' the one you took away.

2) 2 (mathematical subtraction) which is the 'expected' answer, one was subtracted from 3 leaving 2

3) 3 (existential) there are still 3 apples, 2 that I originally 'had' and the other which I now 'have' somewhere else.

4) 4 (additional) No constraint was given that the new apple belonged to the original set of 3.

Re:How to ace Bernstein's class by generationxyu · 2004-12-15 19:10 · Score: 2, Interesting

I would have told you the same thing three months ago, but frankly, there are plenty of safe uses of strcpy, strcat, sprintf, etc, all the functions everyone assumes mean "overflow me!" gets is a different story... there's no way to protect gets. But I've looked at enough code with enough strcpy's in it:

void suspicious_function(char* previously_mallocd_buffer) {
char buffer[MAX_LEN];
if (strlen(previously_mallocd_buffer) >= MAX_LEN) {
fprintf(stderr, "input too long\n");
exit(1);
}
strcpy(buffer,previously_mallocd_buffer);
}

Is there anything wrong with this? Other than the fact that they could have used a simple strncpy, no... it isn't unsafe, just pointless and time consuming. I think it's the fact that s[canf,scanf,printf,trcpy,trcat] are so ingrained in people's minds that that's what they have to use -- they just know it's unsafe so they jump through hoops to make it safe.

--
I mod down pyramid schemes in sigs.

Re:What's the deal? by piranha(jpl) · 2004-12-15 19:23 · Score: 2, Interesting

I see you were too busy writing emotional rhetoric to check your assumptions. (How does this stuff get modded to 5?)

Here's an excerpt from the first one I viewed, with my emphesis:

Danny Lungstrom, a student in my Fall 2004 UNIX Security Holes course, has discovered that uml_net, when installed setuid root (as is normal), allows any local user to type ./uml_net 4 slip down eth0 to take down the computer's Ethernet connection. The connection stays down until the system administrator manually brings it back up. I'm publishing this notice, but all the discovery credits should be assigned to Lungstrom.

Who's gonna call this guy's other bullshit?

Re:Modern education sunken to a new low by AngelofDeath-02 · 2004-12-15 21:20 · Score: 2, Interesting

Fantastic! So you've spent over a hundred dollars to learn something, and although you've succeeded, you've just destroyed your GPA uneccessarily.

No offense but getting an F on an insanely hard course does not reflect any better than an F on an easier one. Failing your course is utterly unfair if you did infact walk away with a good solid understanding of what this "teacher" was actually teaching you. In your situation I'd have definately approached him ... They have various grading methods that would better suit the level of difficulty such as the Bell curve (as other's have pointed out.) Why? Also as other's have pointed out, If the teacher was unable to successfully teach his students to perform up to his expectations he is infact the one who has failed, and this results in a penalty on you.

Then again, maybe your failure was to allow someone like "DJB" to control your grades. Still challenging his judgement is a good thing. If you feel you deserve a higher grade then fight for it. If not then ... You've already got your F. Besides, the best exploit is the human kind.

--
No, I am not an English major. My posts are subject to typos and incorrect grammar. Do not expect perfection.

Re:Misleading Title by hazem · 2004-12-15 21:48 · Score: 3, Interesting

> NT has roots in VMS.

Someone once told me to increment each letter in VMS to get WNT. Kind of like the IBM --> HAL.

pollics. by leuk_he · 2004-12-15 23:37 · Score: 3, Interesting

Het told you to find 10 vulnarebilties. Then find them. They don't have to be all true buffer overrun errors. How about finding a security vulnarebelity in a "wrong setup" environment. Avoid best practice and run php under root. and so on. Bet you can list your 8 missing vuln's in an hour.

How about "file system becomes damaged if power is unplugged" (DOS atttack when running without UPS).

Slashdot Mirror

DJB Announces 44 Security Holes In *nix Software

42 of 983 comments (clear)