Slashdot Mirror


Stanford Rejects Business School Hackers

robbarrett writes "The Stanford Report offers the next chapter in a continuing story about business school applicants manipulating URLs on the ApplyYourself system to determine their personal admission status. Harvard immediately rejected the 'hacker' applicants, but Stanford gave 'offenders' the opportunity to defend their actions. However, none of the competitive applicants 'was able to explain his/her actions to our satisfaction,' according to Stanford's dean, so all were rejected. The story mentions the decisions reached by other schools involved in the mess."

406 comments

  1. If they had been Comp Sci students.... by phobos13013 · · Score: 2, Insightful

    They should have been immediately accepted!

    But in this case you get what you deserve. Whats the difference of finding out now or later that you didnt get accepted to Stanford?

    --
    ...and it should be known by now
    1. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 2, Funny

      "Whats the difference of finding out now or later that you didnt get accepted to Stanford?"

      Knowing where, or where not to put your energy in perhaps ?

    2. Re:If they had been Comp Sci students.... by leonmergen · · Score: 5, Insightful

      But in this case you get what you deserve.

      These kids didn't even know they were hacking. All they knew was that they received an url via MSN from their friends where they could look up their status...

      Sure, they should've know it wasn't supposed to go this way, but should they really be punished like this ?

      Personally, I don't think they should be the ones punished, but rather the person in charge of the security of the website...

      --
      - Leon Mergen
      http://www.solatis.com
    3. Re:If they had been Comp Sci students.... by L.Bob.Rife · · Score: 5, Insightful

      What they deserve? They applied to the school, and then somebody told them they could find out if they were admitted by typing in a url.

      How many students were even aware that it was a big secret whether they were admitted, and they werent allowed to actually know. Why was it even a big secret in the first place? Shouldn't they be telling the students as soon as its reasonably possible, and not dangle it over their heads making them waste time if they werent accepted.

      So, Stanford wants to make claims that these students are morally corrupt by typing a couple letters into their browser, when the school itself is keeping secrets about the students futures hidden for no reason at all and punishing them for being curious. Who is morally corrupt in this scenario i ask...

    4. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      They probably want to preserve an image of honesty, fairness and responsibility instead of giving an early impression of the do-what-you-can cut-throat behaviour which many of the graduates will exhibit in their jobs. Also, the only one who really deserves to be applauded is the one who found the url scheme, not the numerous copycats.

    5. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      But in this case you get what you deserve.

      God, I hate this disgusting obedient slave mentality.

    6. Re:If they had been Comp Sci students.... by phobos13013 · · Score: 2, Interesting

      Come On!

      It seems pretty obvious these folks knew what they were doing. Its requires pouring through a sites source code to extract sensitive info and writing down ids to basically get into a system they obviously didnt have official access to.
      As analogy lets assume during the day at a bank the vault is unlocked with access to those who are permitted but with no guard watching the entrace. OK, yes we should assume the bank is very stupid for not guarding it, but if someone walks in and takes off with a bunch of cash are they innocent?
      Dont think so. Instead of stealing cash, these would-be students steal information. They got what they deserved.

      --
      ...and it should be known by now
    7. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      Its requires pouring through a sites source code

      If they've been pouring stuff through the source code then no wonder they were rejected. Did it wash out okay?

    8. Re:If they had been Comp Sci students.... by jacen_sunstrider · · Score: 1

      You have to have time to switch between sending out pwned/dispwned letters to the mode of repelling the hordes of angry parents whose children they know should've been accepted, and there must have been some sort of mistake.

    9. Re:If they had been Comp Sci students.... by pedantic+bore · · Score: 3, Insightful
      These kids didn't even know they were hacking.

      What do you think that they thought they were doing? They didn't get a message from Stanford saying "here's how you check your admission status"; they got a message from their friends saying "here's how you craft a URL that let's you sneak in to the web site and check your admission status before the official date."

      Imagine if the email from their friends had said "Your admission status is kept in the filing cabinet in room 306 of the admissions office, and the guy who works in that office leaves the door unlocked when he eats lunch at noon every day."

      Walking into an unlocked office and looking in the filing cabinet versus cobbling together a URL that obviously circumvents the system. Tell me the difference.

      --
      Am I part of the core demographic for Swedish Fish?
    10. Re:If they had been Comp Sci students.... by cortana · · Score: 3, Informative

      Good grief, tell me you're not a sysadmin for any public webapps so I can breathe a sigh of relief. I don't want to be arrested for cracking into your system the next time I mis-type a URL!

      Also your analogy is crap, because accessing an unsecured resource at a publicly-available URL is not the same as waltzing into an open bank vault and making off with the contents.

    11. Re:If they had been Comp Sci students.... by goonies · · Score: 1

      the difference is, you don't need to log in using your id and password, therefore beeing tracked in the log files ;) i'd rather sneak into that office (wearing gloves, of course)

      --
      .sigh
    12. Re:If they had been Comp Sci students.... by DrSkwid · · Score: 1

      lol,

      how about if they walked inside the unlocked vault and had a look around but took nothing ?

      or are you going to prosecute them for stealing photons & electrons & wear and tear on the carpet!

      --
      There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
    13. Re:If they had been Comp Sci students.... by svanstrom · · Score: 1
      These kids didn't even know they were hacking.


      They were hacking as much as I'm hacking when I'm "guessing" an URL when the idiot webdesigner's used some IE-only javascript, making the whole site useless whenever I'm not using WinIE (which I never use)... or when I get an URL to a file not directly linked to anywhere on the web...
      --
      perl -e'print$_{$_} for sort%_=`lynx -dump svanstrom.com/t`'
    14. Re:If they had been Comp Sci students.... by penix1 · · Score: 1

      WTF....

      The question I got on this goes beyond your lame example. Why was sensitive data in a web accessable area to begin with? Sure, the students shouldn't have done it but they aren't the real guilty party here are they? The real guilty party is the damned administrator. Did they punish the administrator as severely as the student by NOT PAYING HIS DUMB ASS?

      B.

      --
      This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
    15. Re:If they had been Comp Sci students.... by Znork · · Score: 1

      What, they should be accepted into Comp Sci because they can type in an URL?

      I know Comp Sci isnt as popular as it used to be, but isnt that setting the standards a bit low...?

      If you are not denied access when you're trying to access data then you can reasonably assume you're allowed to access that data. It's not like they were presented with a big 'permission denied' or 'access strictly prohibited' which they then tried to crack.

    16. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      Its requires pouring through a sites source code to extract sensitive info and writing down ids to basically get into a system they obviously didnt have official access to.

      Disclaimer: phobos13013 was rejected from Stanford for reasons entirely unrelated to hacking.

    17. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      CS candidates should have been rejected, because it was obvious that their actions could have been traced.

      Remember, the URL fabrication issue was advertised as a "secret hack". Also remember that the system was designed to manage both final decisions AND tentative decisions, and therefore was not actually beneficial to the candidate.

      The only moral corruption was (1) the person who posted the information, and (2) the people who knew that they were doing bad.

      In any case, it is doubtful that those who looked would have been accepted - the percentage of those who get accepted is amazingly low. You have to have friends in high places AND a killer application to get it.

    18. Re:If they had been Comp Sci students.... by Solder+Fumes · · Score: 2, Interesting

      It's because the later you hold off telling students they've been accepted, the less chance a student has of saying "See, I've been accepted to Colleges A, B, and C. Here are the increased aid packages B and C offered me when they heard you accepted me. What can you do to convince me to stay? And what if I get even better offers from the other schools?" I know someone who managed to swing a $40K full scholarship that way.

      Time and knowledge can always be used to advantage. Not only might a school end up bleeding out a little more just to keep enrollment up to par, but the students who peeked might be more able to scrounge up the leverage to get a bigger piece of the pie.

    19. Re:If they had been Comp Sci students.... by TheoMurpse · · Score: 4, Insightful

      Imagine if the email from their friends had said "Your admission status is kept in the filing cabinet in room 306 of the admissions office, and the guy who works in that office leaves the door unlocked when he eats lunch at noon every day."

      No, the correct analogy is
      Imagine if the email from their friends had said "Your admission status is posted in the hall of the Natural Sciences building, indexed by SSN".

    20. Re:If they had been Comp Sci students.... by djdavetrouble · · Score: 2, Insightful

      Thats Trespassing, which people have been killed for.
      Now get off of my property. /wield shotgun

      --
      music lover since 1969
    21. Re:If they had been Comp Sci students.... by Bush+Pig · · Score: 3, Funny

      These people are deliberately trying to get MBAs. I'd say they deserve everything that happens to them, up to and including being boiled in oil. Fuck 'em.

      --
      What a long, strange trip it's been.
    22. Re:If they had been Comp Sci students.... by the+morgawr · · Score: 1

      This is about Business school not undergrad; I doubt there are angry parents at that point....

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    23. Re:If they had been Comp Sci students.... by Anonymous+Brave+Guy · · Score: 1
      These kids didn't even know they were hacking.

      Maybe not, but the situation was at least dubious. If they don't have the wits to check that out, God help any company they ever wind up running.

      Personally, I don't think they should be the ones punished, but rather the person in charge of the security of the website...

      The latter is certainly true; if the educational establishments in question are trying to make a point about how the real world works, then firing someone for gross incompetence is a pretty obvious point to make.

      As for the first part, yes, it does seem harsh to turn them away. On the flip side, you're talking about a limited number of places on very prestigious courses. Other students, probably just as worthy in an ideal world and unlucky not to get offered a place before, will now get to study there and launch their careers instead.

      It's sad for the unlucky ones that this happened, but the harsh reality is that smaller mistakes are enough to let your competitors wipe you out in real business. Perhaps they'll learn something valuable from business school after all.

      --
      If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
    24. Re:If they had been Comp Sci students.... by leonmergen · · Score: 2, Insightful

      It's sad for the unlucky ones that this happened, but the harsh reality is that smaller mistakes are enough to let your competitors wipe you out in real business. Perhaps they'll learn something valuable from business school after all.

      You're treating them a lot like numbers there... sure, there is plenty replacement for them in this case, but a certain number of the ``hacking'' students were accepted, for valid reasons... those reasons are now being completely ignored, solely because they did something which is not more offending than walking into your teacher's room and check out what score you have for your test in advance... sure, it isn't nice, and sure, in certain ways it can be seen as a privacy infrigment, but is it enough to completely ignore the reasons you initially accepted them ?

      Sounds to me the school doesn't know how to handle this situation, and basically are doing this to scare off other potential hacking-attempts, while in fact they should be getting their security straight...

      --
      - Leon Mergen
      http://www.solatis.com
    25. Re:If they had been Comp Sci students.... by ebuck · · Score: 1

      If this was the Comp Sci department's web server, then you'll bet that the Dean of that department would have somebody's azz in a satchel. And that person wouldn't be a student, it would be another member of the faculty, a systems adminstrator, or a software vendor.

      Odds are the poor decisions were made by an administrator who doesn't understand the technologies involved and made public statements which Stanford now believes cannot be retracted without losing face.

      Lose face Stanford, and do it quickly. It's hard to shame a University which admits wrong and then apologizes and admits those who were going to Stanford anyway. You can't argue with a man that's trying to agree with you; however, if Stanford wishes to become the laughing stock of Computer Science, then, by all means, insist that publishing something on a website isn't grounds for having it read.

    26. Re:If they had been Comp Sci students.... by The+Only+Druid · · Score: 1

      While I don't disagree with you that the sysadmin should be punished (I certainly, were I his boss, would be docking him some pay), I think the two issues are seperate.

      You have one bad thing: the sysadmin failing in his duties. The only response to this is to punish the sysadmin.

      You have a second bad thing: students knowingly circumventing security to gain information. The fact is that it doesn't matter whether it was easy or hard to do this, whether they had to hack it themselves or whether they were just told how. All that matters is that they knowingly broke the rules, insofar as their punishment is concerned.

      --
      "Stumble before you crawl"
    27. Re:If they had been Comp Sci students.... by The+Only+Druid · · Score: 0

      "sure, it isn't nice, and sure, in certain ways it can be seen as a privacy infrigment, but is it enough to completely ignore the reasons you initially accepted them ?"

      Yes, dear god yes it is. This is a serious ethical issue: these people felt there was nothing wrong with knowingly violating security measures. Someone who has no problem violating another person's privacy or a system's security methods is - as far as I'm concerned - entirely unwelcome in any insitution I'm involved with. If I were on one of the relevant boards at these schools, I'd have dismissed their applications out of hand.

      Think about it this way: if they'd been arrested for a drug bust, they'd have been excluded also, despite their previously valid acceptances. The difference is only the specific misdeed; there's no question that some misdeeds nullify the entire application.

      --
      "Stumble before you crawl"
    28. Re:If they had been Comp Sci students.... by bl4ckmage · · Score: 2, Interesting

      As analogy lets assume during the day at a bank the vault is unlocked with access to those who are permitted but with no guard watching the entrace. OK, yes we should assume the bank is very stupid for not guarding it, but if someone walks in and takes off with a bunch of cash are they innocent?

      As a more apt analogy, how about this. The same bank vault has a guard positioned at the front, who checks your identification (ie, you enter your login and password). You enter, and open your safety deposit box (ie, access your account). You then read a paper which someone placed in your box, and thus implicitly giving you access to it. This paper is an internal bank memo which they placed in everyone's deposit boxes for whatever reason, and then they still would expect you not to read it. After reading this memo the bank informs you that because of this illicit reading your application for a mortgage has been declined. Now granted, you could get a mortgage from another company, but it might be at a higher interest rate or require you to put down more of a deposit(ie, you end up going to a crappier or more expensive school). Now doesn't that seem a little extreme just for reading a document someone put in your box?

    29. Re:If they had been Comp Sci students.... by LordEd · · Score: 1

      I read a comics website sometimes. Occasionally, their script screws up and doesn't post the next comic link correctly. Sometimes, i'll go to an archive link and rework it to get the missing image.

      Occasionally, i'll use google by doing www.google.com/search?q=test

      Am i hacking yet?

    30. Re:If they had been Comp Sci students.... by The+FooMiester · · Score: 1

      No, more like

      "You can find out the headlines to the paper before they're delivered if you go to the corner of Return Ave and Theodore St at 4am after the Times drops off the bundle and before the paperboy picks them up"

      It's information in a public place that you can pretty much get to if you know where to find it.

      And in reading it, you don't take anything away from anyone.

      --
      The previous has been a secret message to my comrades.
    31. Re:If they had been Comp Sci students.... by leonmergen · · Score: 2, Interesting

      Yes, dear god yes it is. This is a serious ethical issue: these people felt there was nothing wrong with knowingly violating security measures.

      And to what extend did they indeed know they were violating security measures ?

      It could easily be mistaken for something very innocent, like guessing each other's hotmail passwords and such... i know a lot of kids who do that, is that unethical enough to deny them from a school application too ?

      Think about it this way: if they'd been arrested for a drug bust, they'd have been excluded also, despite their previously valid acceptances. The difference is only the specific misdeed; there's no question that some misdeeds nullify the entire application.

      Comparing an url modification with getting busted for drug posession really removed a lot of credibility from your post, I'm sorry...

      --
      - Leon Mergen
      http://www.solatis.com
    32. Re:If they had been Comp Sci students.... by The+Only+Druid · · Score: 0

      "And to what extend did they indeed know they were violating security measures ?"

      Think about it this way: if they thought they could get there legitimately, why would they have needed to alter the account information in the URL? I don't think they could reasonably believe this wasn't a violation of security measures.

      "It could easily be mistaken for something very innocent, like guessing each other's hotmail passwords and such... i know a lot of kids who do that, is that unethical enough to deny them from a school application too ?"

      If I were on the board, yes. Perhaps this is where you and I differ, but I take a hard-line on the ethical issue of breaking security measures for the sole purpose of extracting information that doesn't belong to you. If my friends figured out my password to some account and violated my privacy, I'd seriously reconsider their status as my friend because it is so offensive. You may have different boundaries with your friends.

      "Comparing an url modification with getting busted for drug posession really removed a lot of credibility from your post, I'm sorry..."

      I understand your concern: did I, in comparing a minor ethical infraction which isn't a crime to a minor ethical infraction which is a crime, in fact create a strawman? You apparently think I did, but I disagree. The reason is that you homed in on the wrong aspect of the argument. My comment was in response to the concern that these students were already going to be accepted, and their otherwise acceptable applications were being dismissed out of hand. My reply was that there are plenty of reasons the schools provide that otherwise valid applications may be rejected, one of them being ethical violations, one of them being criminal violations, etc. Perhaps I was too glib and succint, and in doing so invited a misunderstanding such as yours. I hope I clarified it properly.

      --
      "Stumble before you crawl"
    33. Re:If they had been Comp Sci students.... by SA+Stevens · · Score: 1

      Why would the Stanford Business School be worried about becoming the laughingstock of Computer Science?

    34. Re:If they had been Comp Sci students.... by fbjon · · Score: 2, Insightful
      This required more than a mistype...

      You're right though, accesing this url isn't the same as waltzing into the bank vault. That's why they weren't arrested, just merely unwanted.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    35. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      Sorry, that is simply not a correct analogy. That analogy would only be correct if you could get to the admissions status through some obscure, but at some level spiderable from the main URL. The grandfather was correct in this case.

      Why the fuck do people think that just because you can type something into a URL field, that you should? While Stanford's security people do need to be reprimanded, Stanford is perfectly right to not let these people in.

    36. Re:If they had been Comp Sci students.... by trentblase · · Score: 1

      What rules? I doubt their application had some fine print that said "I will not try to access my results page before Stanford sends me a link". Did the web site have a TOS that said "no crafting acceptance queries by hand"? No rules were broken but the admission department's unwritten rules of business ethics. Maybe this is enough for some people, but I don't think people should be punished for doing something that isn't explicitly prohibited by university policy.

    37. Re:If they had been Comp Sci students.... by leonmergen · · Score: 1

      Think about it this way: if they thought they could get there legitimately, why would they have needed to alter the account information in the URL?

      It depends on how you see that... true, it is an action they must do, which might lead them to think it smells fishy. However, they could just as well have reasoned ``if this works, it probably isn't such big a deal for them, since they would've prevented to let it work if it was''... perhaps that is a bit naive, but I think that's what's the core of the problem - how big was the realisation that what they were doing was in fact illegal ?

      I don't think it's much more than downloading mp3's... we all know it's somewhat illegal, but we don't do much harm in doing so.

      Perhaps this is where you and I differ, but I take a hard-line on the ethical issue of breaking security measures for the sole purpose of extracting information that doesn't belong to you.

      At the point that that information is so freely available, I would actually put the blame on the person in charge of making it so freely available, rather than the persons making use of the information (which doesn't harm anyone) ... and yes, probably that's where you and I differ. :)

      My comment was in response to the concern that these students were already going to be accepted, and their otherwise acceptable applications were being dismissed out of hand. My reply was that there are plenty of reasons the schools provide that otherwise valid applications may be rejected, one of them being ethical violations, one of them being criminal violations, etc.

      Ok, I misunderstood that indeed. I'm sorry for my somewhat harsh reply then... :)

      --
      - Leon Mergen
      http://www.solatis.com
    38. Re:If they had been Comp Sci students.... by Anonymous+Luddite · · Score: 1

      >> You have one bad thing: the sysadmin failing in his duties. The only response to this is to punish the sysadmin.

      I think most /. readers will agree with that. Whoever was tasked with implementing the system made a bad choice. Whoever (if anyone) was responsible for risk assesment for the project missed something too. There should be ample blame to pass around.

      The students got hammered, yeah. It's entirely possible some employees also got disciplinary notices/poor quarterly reviews or whatever. We just aren't likely to see details of it in a public forum...

    39. Re:If they had been Comp Sci students.... by orbust · · Score: 1

      quote: "No, the correct analogy is Imagine if the email from their friends had said "Your admission status is posted in the hall of the Natural Sciences building, indexed by SSN". Thats a horrible analogy. For one, your assuming that the University purposely posted this information in a place where it could be found easily. Which they did not. It was a loophole in their system. The correct analogy would be this. Imagine if the student got an email that said, "if you want to know your status, all you have to do is enter the following passcode, ****, into the door lock of the admissions building when no one is looking." These kids knew that what they were doing wasnt the appropriate way to do it, but they figured out how to circumvent the system to gain advantage. Seems to me like the perfect corporate apprentice, and the perfect student for Stanford. If admitted, together the university and the students can continue their efforts to represent the scumbag corporate mentality of the "ME, ME, ME", and further their elitist agenda. Oh yeah thats right, they are supposed to wait untill after they graduate and have a corporate salary to become moral bottom dwellers in their appetite for self advancement.

    40. Re:If they had been Comp Sci students.... by Fulton+Green · · Score: 1

      Watch it, buddy. You just insulted Alan Cox (and me).

    41. Re:If they had been Comp Sci students.... by wkitchen · · Score: 1

      Ah, but the school did them a favor. What better way to start these hatchling PHB's on their way than with a dramatic illustration of how the big boys play CYA.

    42. Re:If they had been Comp Sci students.... by Create+an+Account · · Score: 2, Funny

      All right, now. You two are being entirely too mature and reasonable, here. This is Slashdot, not Sesame Street. I want to hear some personal imprecations, I want to hear some ad hominem, and dammit, I want to hear someone get called an asshat!

      Sheesh.

    43. Re:If they had been Comp Sci students.... by Create+an+Account · · Score: 1

      All right,now. You two are being entirely too mature and reasonable, here. This is Slashdot, not Sesame Street. I want to hear some personal imprecations, I want to hear some ad hominem, and dammit, I want to hear someone get called an asshat! Sheesh.

    44. Re:If they had been Comp Sci students.... by fbjon · · Score: 1

      Not quite. If the memo was in a secret compartment in your box, that would be more correct. However I agree, the punishment is too extreme, that's the problem.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    45. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0
      "You can find out the headlines to the paper before they're delivered if you go to the corner of Return Ave and Theodore St at 4am after the Times drops off the bundle and before the paperboy picks them up"

      And if you found out that your admissions status was put there, would you cry foul if you went there to find out your status, and was subsequently denied admittance?

      And in reading it, you don't take anything away from anyone.

      Perhaps not, but that doesn't change the fact that Stanford is perfectly justified in denying admittance.

    46. Re:If they had been Comp Sci students.... by TheoMurpse · · Score: 1

      Woah, where did that "when no one is looking" part come from? And if you remove that one bit from your analogy, then it is obvious that the guys did nothing wrong. They went to a URL using their username/pass (IIRC from the article a few months back).
      How is the parent's analogy horrible? It meets the criterion that if you know the applicant's vital information, you can access his status. This is the only criterion needed to be matched in an analogy.

      Opening up a file cabinet entails going through someone else's property. However, if you can access something with a URL involving your own name/pass combination, then it is exactly the same as having the data posted in a public place, requiring knowledge of the applicant's data before you can discern their status.

    47. Re:If they had been Comp Sci students.... by winwar · · Score: 1

      Could we please stop the analogies? Not that they can't be useful, it's just that most people suck at them...

      "For one, your assuming that the University purposely posted this information in a place where it could be found easily. Which they did not. It was a loophole in their system."

      Hmm, typing the proper URL into a webpage gets you the desired information. Sounds easy to me. Sounds like it was meant to be accessible to the public. Expecially if there was no password required. And URL's are not passwords.

      It may not have been their intent, but then again, I can't read minds. Tried, but failed. Your loophole sounds like a school screw up and violation of federal law to me....

    48. Re:If they had been Comp Sci students.... by aggies11 · · Score: 1

      Well, analogies are always tricky, and can often confuse the issue more than clarify, but in the spirit of your post, I thought I'd give one of my own :)

      Instead of the filling cabinet room analogy, what if one of the friends said "Your admission status is sitting on the window-sil on the 1st floor corner office of building xxy. Walk on campus, and go look through that window, and you can see it".

      If someone accidentally leaves something out for the public to view, you can't blame the viewers. Or rather, you shouldn't be able to punish them.

      Aggies

    49. Re:If they had been Comp Sci students.... by ScottSCY · · Score: 1

      "What do you think that they thought they were doing? They didn't get a message from Stanford saying "here's how you check your admission status"; they got a message from their friends saying "here's how you craft a URL that let's you sneak in to the web site and check your admission status before the official date."" As someone who just recently went through the online application process, I will say that most of the schools tell you something like "when a decision has been reached on your application, it will be made available to you online through applyweb". Thus, if a student got a url for applyweb from a friend who also applied and that friend said "hey, our decisions are online now" it would be perfectly reasonable for the student to assume this was what was supposed to happen.

    50. Re:If they had been Comp Sci students.... by Alsee · · Score: 1

      accessing an unsecured resource at a publicly-available URL is not the same as waltzing into an open bank vault and making off with the contents.

      You just don't get it... the students waltzed in and made off with property!

      Chuckle.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    51. Re:If they had been Comp Sci students.... by FLEB · · Score: 2, Funny

      Hey, what gives? It's my URL field, I'll type in it if I want to!

      --
      Information wants to be free.
      Entertainment wants to be paid.
      You just want to be cheap.
    52. Re:If they had been Comp Sci students.... by FLEB · · Score: 1

      (And, yes, it's a bullshit argument... it was intended more... humorously?)

      --
      Information wants to be free.
      Entertainment wants to be paid.
      You just want to be cheap.
    53. Re:If they had been Comp Sci students.... by The+Only+Druid · · Score: 1

      Bastard of Subhumani wrote: "But you aren't, are you. Anyone want to take a guess at the reason for that?"

      Ooh, ooh, can I guess? Is it because I'm in law school/grad school, and not currently available for a full-time position? Is it because were I available, I'd apply for jobs in my schools (i.e. law, philosophy, general liberal arts) instead of schools wherein I have no background (i.e. business school)? Is it because I've never applied?

      Your type of ad-hominem attack, which was completely unfounded and unecessary, says more about you and your character than I think you realized.

      --
      "Stumble before you crawl"
    54. Re:If they had been Comp Sci students.... by leonmergen · · Score: 1

      Asshat. ;)

      --
      - Leon Mergen
      http://www.solatis.com
    55. Re:If they had been Comp Sci students.... by Create+an+Account · · Score: 1

      Thanks, LOL.

    56. Re:If they had been Comp Sci students.... by (negative+video) · · Score: 1
      Think about it this way: if they thought they could get there legitimately, why would they have needed to alter the account information in the URL?
      Curiosity. People who understand web technology (as opposed to Suzy Link-Clicker) do this sort of thing all the time. It's utterly standard to make up your own URLs and see how the server responds. You can find all sorts of neat stuff, particularly things whose links have rotted away and therefore disappeared from the search engines. It's also good for vendors with poorly-indexed web stores. (I.e., most vendors.) Here is (scroll halfway down) where somebody hacked together an Amazon image URL that puts the "Search Inside" icon on top of a male underwear picture with the arrow pointing right at the bulge. Amazon surely didn't expect that, but it was neither unethical nor a security violation.
      I don't think they could reasonably believe this wasn't a violation of security measures.
      By definition, the only ways to violate information security are by (1) deceiving a human, (2) trespassing in person, and (3) trying random passwords/keys until one works. What about this case?

      (1) There was no deception. The applicants said exactly who they were, and proved it with obscure information. (Social security number IIRC.) In fact, this is how the "violators" were identified.

      (2) There was no trespass. The applicants were never present on University property.

      (3) There was no random trial of passwords/keys. The applicants simply used plainly-readable information transmitted by the Univerisities, and it worked the first time. If it hadn't worked, they would not have written a program to sweep the key space.

      This is Infosec 101 stuff. If you don't want somebody to have information, you program the computer not to give it to them. Hoping that they don't know how to ask for the information does not constitute security. In the real world of banking regulations and Sarbanes-Oxley, pretending that this sort of trivial obscurity was security would land you in a federal pound-me-in-the-ass prison. In the real world, somebody who can't hack URLs to find juicy info isn't qualified to get an MBA, for in their ignorance they will surely open their organization to espionage.

      If my friends figured out my password to some account and violated my privacy, I'd seriously reconsider their status as my friend because it is so offensive.
      How dense. The whole purpose of this "security" measure was, in fact, to keep people other than the applicant from viewing the applicant's information. That's what the pasted-in session ID proved.
    57. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      Actually this is like saying that all the applications are posted in the crawl space of stanford's heating duct.

      The place is totally public, but obscure. It was on their servers, it was public data. There was no security that prevented it from being read.

      The people that chose security through obscurity should be sent to be retrained or fired.

    58. Re:If they had been Comp Sci students.... by pedantic+bore · · Score: 1
      Opening up a file cabinet entails going through someone else's property.

      The web site is "their property"? I rather think that the applicants are paying guests, not owners, of the web site.

      --
      Am I part of the core demographic for Swedish Fish?
    59. Re:If they had been Comp Sci students.... by (negative+video) · · Score: 1
      Why would the Stanford Business School be worried about becoming the laughingstock of Computer Science?
      Because Stanford and Harvard MBAs want to get in on the ground floor at companies with exponential revenue growth. So the MBAs need to impress the companies' techie founders to get hired. That ain't gonna happen if their first response to espionage is to don their +15 Crimson Ass-Shield of the Ages and start blaming the nearest person who has no social standing to defend themselves. Credibility is all about accepting responsibility for the systems you build, and making them better when problems are found. Somebody who will stand up and say "I screwed up. Here's how. This is how much it cost. This is what we have to do to fix it." is worth their weight in gold.
    60. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 1, Insightful
      Agreed. Also try this analogy:

      Flunkee: "Dude, you know that key they gave you to unlock your locker on the 4th floor of the natural sciences building? Well yesterday I accidentally got off on the fifth floor, but I didn't even notice because everything looked the same."

      A-student: "Does this story have a point?"

      S: "Yeah, well ok so I walked down to what I thought was my locker on the 4th floor and I tried my university-issued key. Guess what? It worked!"

      A: "Woah! That's cool. Whose locker was it then?"

      F: "That's the weird part: it's apparently a faculty locker for storing exams after they're graded but before the mandatory 30 day waiting period has expired."

      A: "So you got to see your test score? Sweeeeeet! How did you do?"

      F: "I got another F, so I think I'm going to drop out of school now instead of waiting 30 days."

      A: "That's too bad, man. Hmm. You said 5th floor, right? I need to go see if I kept my perfect 4.0. My parents will kill me if I got a B, so I could use the time to make up a good excuse."


      p.s. I've noticed a sudden deterioration in the CAPTCHA font legibility. If it gets any worse, I'm not going to be able to pass as a human. :(
    61. Re:If they had been Comp Sci students.... by ottothecow · · Score: 1
      what if somebody knew this was going to happen and knew somebody who they really didnt want to get into a good business school...

      Hey Jimmy, click HERE to see if you got into harvard and HERE to see if you got into stanford!!!

      --
      Bottles.
    62. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0
      These kids didn't even know they were hacking Exactly. We're not talking about malicious intent or sophisitcated expertise here. It's average chumps clicking on a URL and may changing a number here or there.

      SHOCK! HORROR! Terrorists win!

      Aaah, Stanford sucks, sucks, sucks, sucks, sucks. Really. Hackers? These aren't even skript kiddies. Come on folks, you're ruining their lives/careers/futures because of *this*? WTF?

    63. Re:If they had been Comp Sci students.... by SA+Stevens · · Score: 1

      Credibility is about not sneaking in through a backdoor function to get information that you KNOW will be delivered on a schedule that has been cited.

      No, I don't think any of these 'victims' of Stanford will be putting this experience on their resume. No company wants to hire people who take tips off blogs and IMs to do end runs around 'authority.' The one or two civil-libertarians out there who happen to be involved in some HR function are far outnumbered.

      Not sure what you're getting at with the 'I screwed up...' bit. That's certainly not the impression I get from what I hear of the people busted in this whole incident. How many of them withdrew their application to Stanford honorably?

    64. Re:If they had been Comp Sci students.... by (negative+video) · · Score: 1
      Credibility is about not sneaking in through a backdoor function to get information that you KNOW will be delivered on a schedule that has been cited.
      The university was contractually obligated to provide acceptance information at a certain point in time. That does not imply the converse: applicants were not contractually obligated to avoid learning the information before that point in time.

      That's how business works: people keep secrets to hurt you, and you try to find out without breaking the law.

      No company wants to hire people who take tips off blogs and IMs to do end runs around 'authority.'
      Are you insane, dumb, or trolling? Every good corporation wants people who dig up strategic tidbits of information on potential business partners and use it to their advantage. For example, an employee who guesses the right URL to get a draft quarterly report a week early would be worth their weight in gold.
      Not sure what you're getting at with the 'I screwed up...' bit. That's certainly not the impression I get from what I hear of the people busted in this whole incident.
      I'm talking about the university folks who screwed up by confusing the superficial appearance of security with true security. They could have gone to their bosses and owned up to their incompetence, and presented a plan for quietly fixing the problem. Instead they have opened their organisation up to litigation by rejecting otherwise-acceptable applicants who did not violate a single contractual obligation. Far worse is that they publicized to the world the dirty little secret that admissions offices deliberately screw applicants by artifically delaying their acceptance letters. Typical unthinking MBA ass-covering.
    65. Re:If they had been Comp Sci students.... by jfern · · Score: 1

      >It's sad for the unlucky ones that this happened, but the harsh reality is that smaller mistakes are enough to let your competitors wipe you out in real business. Perhaps they'll learn something valuable from business school after all.

      And if they're really really unethical MBA students who make lots of mistakes, all they'll be able to do is become President.

    66. Re:If they had been Comp Sci students.... by Anonymous Coward · · Score: 0

      "someone put in your box"

      Heh-heh. You said "box". Heh-heh.

    67. Re:If they had been Comp Sci students.... by Bush+Pig · · Score: 1

      Who's Alan Cox? (I'm serious, I've never heard of him.)

      --
      What a long, strange trip it's been.
    68. Re:If they had been Comp Sci students.... by Peristarkawan · · Score: 1

      It would be impossible for them to lay down every possible situation or action their applicants might possibly take and note whether it is to be allowed or not. Maybe it seems unfair that they can punish applicants who did something not explicitly prohibited, but it would be unfair to the university if they didn't. Otherwise, it effectively licenses people to manipulate the rules in their favor by bending them as far as they possibly can without breaking them.

      Besides, this is all a part of growing up. Initially you don't know what's right and what's wrong, and nobody ever sits down with you and lists out all the things you're not allowed to do. Thus, you occasionally do something wrong without knowing that it's wrong, you get punished for it, and you learn that it's wrong. Eventually, you just learn a sense of whether something is right or wrong, and nobody needs to spell it out for you any longer.

      Evidently, these students have yet to reach that point in their maturity

    69. Re:If they had been Comp Sci students.... by ciscoguy01 · · Score: 1

      This goes back to a simple principle that has been discussed on /. for eons:

      If your security was broken that just means your security wasn't good enough.

      Why can't people take responsibility for themselves, meaning the universities and their contractors? This would not have happened if they had taken ordinary care.

      --
      .
    70. Re:If they had been Comp Sci students.... by trentblase · · Score: 1

      Likewise, it would be impossible for the government to lay down every possible situation or action that should be illegal. Maybe it's unfair to arrest people for breaking unwritten laws, but otherwise we'd be effectively licensing people to do whatever they want, in effect giving them "rights".

    71. Re:If they had been Comp Sci students.... by Peristarkawan · · Score: 1

      You're right; it would be inacceptable for the government to do this sort of thing. Stanford and Harvard are not governments but, as you pointed out in your earlier post, businesses, and they have financial interests to protect, both their own and those of their other, non-cheating customers. This sort of thing is the reason that companies always reserve the right to terminate consumer contracts in their ToS.

    72. Re:If they had been Comp Sci students.... by trentblase · · Score: 1

      I never pointed out that Stanford and Harvard are businesses. In fact, they are not-for-profit, which in my mind requires the same standards of fair-play that I'd hold the government to. Of course, I'm not saying that they did anything illegal... it's within their rights to deny admission based on any number of criteria. I just disagree with the decision.

    73. Re:If they had been Comp Sci students.... by turbidostato · · Score: 1

      "students knowingly circumventing security to gain information"

      "Circumventing security"!!!??? Now is "circumventing security" accesing public data through a public URL?

      C'mon!

      This the typical case where somebody on a power position punishes the indefense as a means to alleviate his own red-facing because its own stupidity.

    74. Re:If they had been Comp Sci students.... by turbidostato · · Score: 1

      "It's within their rights to deny admission based on any number of criteria"

      Like, uh, being black, jewish, homosexual or something like this?

      Or something more on the lines of being "someone who faces me against my own stupidity"?

    75. Re:If they had been Comp Sci students.... by turbidostato · · Score: 1

      "And, yes, it's a bullshit argument..."

      The question is: sure is it a bullshit argument? It is my URL textbox after all, and it is known I can only access public resources through it (so it is not kind of a "hacking tool" or anything like that).

      Some time ago was published that Google indexed quite a lot "private" files from people that stupidly left it accesable through their badly configured local http daemon (and probably they still do so). Maybe affected people should think about a class auction against Google to alleviate them from the weight of a bunch or two of million US dollars.

    76. Re:If they had been Comp Sci students.... by trentblase · · Score: 1
      "Any number of criteria" != "any criteria"

      It means "Many; also, no particular amount of."

      In other words, there are countless criteria which they can use to deny admission. Totally private universities may, in fact, have the right to discriminate based on ANY criteria. I haven't done the research, but Boy Scouts of America has been successful in disciminating against homosexual applicants.

  2. Comment removed by account_deleted · · Score: 2, Funny

    Comment removed based on user account deletion

  3. CUNTinuing by Anonymous Coward · · Score: 2, Insightful

    Yet more of this mindless usage of the word "hacker." Don't people understand that they can use these analytical type people, the ones who actually want to pursue information, to their advantage?

    ahh, in some ways i guess this is good...

    1. Re:CUNTinuing by Anonymous Coward · · Score: 0

      Con artists and lazy people are analytical far as exploiting the efforts of others to their own good. Might not be good for an entire organization, but it does show the individual is creative in a self serving way.

    2. Re:CUNTinuing by alienw · · Score: 1

      Just give up already. For the last 15 years or so, the mainstream definition of "hacker" has been equivalent to "cracker". Find a different word, like "programmer" or something.

    3. Re:CUNTinuing by the+gnat · · Score: 1

      Don't people understand that they can use these analytical type people, the ones who actually want to pursue information, to their advantage?

      Ahh, I view it another way. These are B-school applicants, remember? The little shits who couldn't wait till the deadline and tried to exploit the system are the ones who'll be under investigation for securities fraud in another couple of decades. Rules are what make the free market work, and protect us from rapacious execs, sleazy traders, and Marxist revolutionaries. Anyone who can't be bothered to follow the rules ought to stay far away from managing any amount of money.

  4. Return of the H@x0r by Anonymous Coward · · Score: 4, Funny

    Episode VI

    RETURN OF THE H@X0R

    Applicant-1337 has returned to
    his home planet of ParentsBasement in
    an attempt to rescue his
    friend University Education from the
    clutches of the vile gangster
    The Big Guy.

    Much does Hax0r know that the
    HARVARD EMPIRE has controversially
    begun construction on a new
    armored hax0r-rejection policy even
    more powerful than the first
    dreaded competitive admission system.

    When completed, this ultimate
    weapon will spell certain doom
    for the small band of hax0rs
    struggling to restore freedom
    to the interweb....

    1. Re:Return of the H@x0r by Anonymous Coward · · Score: 1, Insightful

      Fortunately for us, we have the warm embrace of our parents basement's to return to.

      You may have said that tongue in cheek, but look at it seriously.

      I, for one, would rather have a family that loved me than all the riches in the world.

    2. Re:Return of the H@x0r by Anonymous Coward · · Score: 0

      I, for one, would rather have a family that loved me than all the riches in the world

      Agreed, unless your mom is angry and wants you to move out.

  5. Hackers is a strong word for them by Dancin_Santa · · Score: 5, Insightful

    They hardly ought to be called "hackers". It's like calling arsonists "pyrotechnicians". Sure, the tools may be the same, but the level of expertise is very different.

    1. Re:Hackers is a strong word for them by Anonymous Coward · · Score: 0

      Very true, but it will not be easy for people to escape the names they are given by others, especially when the popular media is involved.

    2. Re:Hackers is a strong word for them by ultranova · · Score: 3, Insightful

      They hardly ought to be called "hackers". It's like calling arsonists "pyrotechnicians". Sure, the tools may be the same, but the level of expertise is very different.

      No, it's like calling the guy who lights candles to read by their light a "pyrotechnician with arsonistic tendencies". The word "hacker" implies skill with computers, and when used in place of the word "cracker", a certain amount of malicious intent. Since this incident implied neither, the word "hacker" is unapprooriate - and drawing any parallels with these people and arsonists is completely absurd.

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    3. Re:Hackers is a strong word for them by nacturation · · Score: 3, Insightful

      But they're not script kiddies either. What if you phoned up the admissions office and sweet talked someone there into letting you know whether or not you got accepted already. Would that be cause for a rejection letter? In effect, they knew what question to ask the webserver in order to get the answer.

      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    4. Re:Hackers is a strong word for them by Frnknstn · · Score: 1

      Looking through all the comments posted so far, all I see is uninformed people who didn't read any of the fucking articles, have no idea what a hacker is, or what a website is.

      Here is an analogy which is significanty less flawed than the others people have been throwing about:

      At each of these universities, there is a big room marked 'Public Access'. It is filled with hundreds of cupboards, with memos, letters, advertising information, application forms and all kinds of documents. People were invited to come, open the cupboards and read the documents they found inside. Some of the documents also told people which cupboards they could look in for more information.

      Now somebody pointed out that if you open up certain ones of less well-marked cupboards, you could see if they had processed the forms you had submitted yet. And so, people went and opened those cupboards.

      The universities then said, "oopsie, we didn't mean for you to see that!" and said that these people are EVIL for seeing things that they shouldn't.

      And that is the long an short of it.

      --
      If it's in you sig, it's in your post.
    5. Re:Hackers is a strong word for them by The+Only+Druid · · Score: 2, Insightful

      No, it's not the same thing at all. The reason is simple: fully conscious and autonomous human agents are intervening causes, ethically speaking.

      These students used non-cognitive systems (the URL parsing system) to illegally acquire information. Your [hypothetical] student used a cognitive system (the person) to illegally acquire information. The difference is that in the former, the student is the only moral agent acting, while in the latter there are two.

      What this means is that the second one is notably less morally culpable. Solicitation of another to commit a morally wrong action cannot possibly be as wrong as the actual commission of that wrong, since to suggest otherwise would mean that one who encourages a wrong action is at least as culpable (which seems counterintuitive).

      In other words, the presence of an intervening cause in the form of an intermediary moral agent must reduce the moral wrongness of whatever the student did.

      --
      "Stumble before you crawl"
    6. Re:Hackers is a strong word for them by siriuskase · · Score: 1

      The complication is that there are three parties involved. If the applicants knew they weren't supposed to see something, but an assistant left it out on the table, clearly the assistant is the one at fault. But, the applicant has a moral obligation not to take advantage of that assistant's mistake. In this case, it appears that no real damage was done to the universities, but the ethics of the applicants were tested and were not up to standards. It is a test.

      Sort of like, if you design a bridge and it's a bad design - Does it make it okay since it's only on paper, no one ever intended to build it, it's only a test? Of course not, that's the point of tests, to determine whether you meet a standard in a setting where no one really gets hurt. If a person doesn't meet the standard, it would be more harmful for them to pass the test, so you can't claim they were truly harmed.

      I do have some sympathy for the applicants, since I doubt that the universities originally meant this to happen. Did the applicants realize this was going to become a test? Were they explicitly told not to nose around the website or otherwise try to find out early? Did the webdesigner get punished? But, from an ethical viewpoint, none of this really matters.

      The business world is full of vague ethical situations and a person is rarely warned. When someone trusts you to do what they think you should do even when they don't make it clear, it can be very tricky. Just because you can CYA, doesn't excuse you from preventing situations if you can, even if someone else actually screwed up.
      In an ethical business, the manager is the guy who gets punished when no one does anything wrong, but bad things happen anyway.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    7. Re:Hackers is a strong word for them by ClosedSource · · Score: 1

      If by "hacker" you mean "cracker" than I don't think expertise is the differentiating factor, it's criminal intent.

    8. Re:Hackers is a strong word for them by Anonymous Coward · · Score: 0

      yeah, like the phreakers used to know what questions to ask the phone system...

  6. What? by AntiPasto · · Score: 1

    They didn't mention the speed at which they typed the new url? I'm *still* asked my WPM on silly web-based forms.

  7. TFM... by Viceice · · Score: 5, Insightful

    "Joss noted that while Stanford was dismayed by the actions of the candidates who tried to gain unauthorized access, it "did not rush to judgment given the limited information available to us initially. By carefully reviewing the file of each applicant involved in these incidents, we upheld the business school's values while treating each applicant fairly. As an educational institution, we hope that the applicants involved in this incident might learn from their experience.""

    Sounds more like an attempt by the PR departments to cover their collective legal asses after their PHBs jumped the gun and block rejected applicants on the grounds that they committed a crime that technically isn't. IMHO, their position on the matter is weak.

    The students didn't steal passwords, spread a virus or trojan. All they did was akin to manually typing in an abiet complicated URL and accessed data on unprotected public servers.

    --
    Sometimes I wish I was a plumber, then I'd know how to deal with other people's shit.
    1. Re:TFM... by nharmon · · Score: 4, Insightful

      Bad analogy...here is a better one: Lets say the University had a toll-free telephone number that allowed applicants to find out whether or not they were accepted. The only steps the University takes to protect this information is to simply not publish the phone number. But, its the same phone number that was used last year.

      Now, why would a student, who was told last year what the correct URL format is to ask for their application status, now be considered an unethical computer hacker because this URL format returned information before the administration wanted it to be released.

      Perhaps we should stop considering URLs to be security devices, and compare them more to telephone numbers.

    2. Re:TFM... by alienw · · Score: 1

      Here's an analogy from the physical world. You walk into an admissions office, see an open door, and find your file in an unlocked file cabinet. Illegal? Maybe, maybe not. Unethical? Definitely. They didn't break any locks, but they went where they weren't supposed to.

      Besides, let's not forget who we are talking about. The Harvard and Stanford business schools are some of the most selective institutions in the country. If they can reject you for having an essay slightly more boring than the next guy or a slightly unenthusiastic letter of reference, or some random factor, this definitely appears to be justified.

    3. Re:TFM... by siriuskase · · Score: 1

      "The students didn't steal passwords, spread a virus or trojan. All they did was akin to manually typing in an abiet complicated URL and accessed data on unprotected public servers."

      No one accused the applicants of committing a crime. The issue is whether typing in the not-so-obscure URL was unethical and whether this breach of ethics can be used to screen out certain applicants.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    4. Re:TFM... by Anonymous Coward · · Score: 0

      All they did was akin to sunbathing nude in their backyard. They forgot that the neighbor might own a telescope and a webcam. If they found naked pictures of themselves posted on the internet, who would be at fault? The sunbather for being ignorant, or the neighbor for taking advantage of the situation?

    5. Re:TFM... by dave1g · · Score: 1

      more like you saw a random filing cabinet marked "stanford" in the middle of the street, with files falling out of it.

  8. Re:Heh by Anonymous Coward · · Score: 0

    The sentence reads 'None of '. The subject is 'none'. 'None' is singular.
    So the correct verb is 'was'.

  9. Re:Heh by Anonymous Coward · · Score: 3, Informative

    Subject verb agreement. The subject is none, not applicants.

    "None" is a special case of the singular. It should have a singular verb applied to it.

  10. Unfair treatment by omega_cubed · · Score: 5, Insightful

    Quote:

    Joss noted that while Stanford was dismayed by the
    actions of the candidates who tried to gain
    unauthorized access, it "did not rush to judgment
    given the limited information available to us
    initially. By carefully reviewing the file of each
    applicant involved in these incidents, we upheld
    the business school's values while treating each
    applicant fairly...

    That's quite a "holier than thou" sneer at Harvard and MIT.

    What I am truly surprised is that none of the schools took actions against ApplyYourSelf as far as I know: rather, the focus has all been on whether the schools took action against the students. I think this plays heavily on the public's fear of "hacking". Just because the applicants peeked using a computer, it suddenly made it such a grave matter.

    First, I think ApplyYourSelf should bear some responsibility for not properly securing their web-app in a way that such an action is possible. For many people (and I'd even venture to say that in public opinion), anything that is accessible by typing a URL into a browser window might as well be published. I don't really think the school has the right to penalize the applicants for accessing information that has been made available to them.

    Secondly, this whole business has been blown out of proportion: the students were only able to look at their admission status, and that even hinges on the fact that the schools have already published those information to the website. It is not as if the students were actually "hacking" in the sense of escalating their privilege and modifying their admission status. I just don't think this incident is an acurate enough illustration of their moral fibers to warrant such decisions (though I generally have no sympathy for business school applicants).

    Thirdly, I think the whole finding out the admission status thing is more akin to being impatient and calling up the admission office with the knowledge that the drunk receptionist would accidentally let the admission status slip out. So why the applicants were treated so harshly and why the ApplyYourself service was not is really troubling me.

    W

    --
    Engineers also speak PDE, only in a different dialect.
    1. Re:Unfair treatment by doofer · · Score: 1
      anything that is accessible by typing a URL into a browser window might as well be published.

      I disagree with this.

      I know that hackers(script kiddies, Urlers, people with no idea, whatever you call them) can get control over some sites using phpnuke, by typing a special URL into their browser window, allowing total control of the sites content.(in my case it was defacement :()

      Being able to get around sites by typing 'hack' URL's is _not_ getting to stuff that 'might as well as' be published. In theory, web devs shouldn't put important things un-encrypted in the url, but that's not the case, and the fact they do doesn't make it public domain, it just means they can't code

      It's like if your car key worked for a guy's similar ignition, would it be illegal to drive off with his car?
    2. Re:Unfair treatment by Anonymous Coward · · Score: 0

      It reminds me of how some webmasters will go crazy over people linking to their site or part of their site "without permission".

      They don't seem to understand that everything is publically accessible by default on the web, and you have to secure it if its not meant for public.

      Changing a filename is not the same as securing it. I'm amazed several ivy league institutions would rely on a system made by such clueless people.

    3. Re:Unfair treatment by krunk4ever · · Score: 1

      It's like if your car key worked for a guy's similar ignition, would it be illegal to drive off with his car?

      your analogy is a bit off. it'd be more like me testing my key in your car door to find that my key can unlock your door. although not the best thing to do, especially if getting caught in the act may make you look like a thief, you personally haven't committed any crime. maybe attempted to, but not yet.

      the students didn't modify anything on the application result, meaning that they did not steal the car in this case. they just basically peeped inside the car and the parent basically said some of the blame should be put on the car maker for issuing a similar enough key so that you can open other people's door.

      this is basically security by obscurity, which is basically not security at all. as the parent also mentioned, the application company (car company in your analogy) should've had more restrictive access.

    4. Re:Unfair treatment by krunk4ever · · Score: 1

      maybe those students should've hired you to write their essay. or maybe the school was looking for students who were willing to take the blame and accept the responsibility of their act they committed. which route would you have taken?

    5. Re:Unfair treatment by smchris · · Score: 2, Interesting

      That's quite a "holier than thou" sneer at Harvard and MIT.

      Exactly. And you'll gotta love Stanford for the playfulness.

      Reminds me of a philosophy professor of mine who would put "extra credit" at the bottom of his tests like, "'If one swallow does not a summer make', how many do?"

    6. Re:Unfair treatment by Jeff+DeMaagd · · Score: 1

      I suspect that they did this to give the appearance of due process. They may have already pre-rejected them but did this formality in the hopes of not looking rash in their judgement. I wonder if these schools could prove a particular person did the act, rather than an overeager parent in the same household or what not, assuming they compared IPs.

    7. Re:Unfair treatment by The+Only+Druid · · Score: 1

      "although not the best thing to do, especially if getting caught in the act may make you look like a thief, you personally haven't committed any crime. maybe attempted to, but not yet."

      Wrong. Wrong for several reasons. (A) "Attempt" of a specific crime is, itself, a crime. (B) Attemptingt to circumvent a lock begins when you first contact the lock with your tool with the expectation that you may be able to unlock it (according to almost every jurisdiction with specific discussion of lockpicking within their breaking-and-entering laws and case law). (C) You've trespassed onto private property. Putting a key into a lock is considered trespassing. It's almost never been an issue except in the very case you suggest: someone trying their key on your lock to attempt to open it illicitly.

      --
      "Stumble before you crawl"
    8. Re:Unfair treatment by Anonymous Coward · · Score: 0

      This business of not telling students that they are accepted until the very last minute is really unacceptable.

      Not that it matters to me anymore, but I'd guess that in some part of the application process/agreegment these schools may have said something to the effect of: "we will endevor to provide your application status in as timely a fashion as possible".

      But, they obviously didn't!

      Stop screwing with young peoples heads!

      err.. oh wait, thats what you're in the business of doing.. sorry.. ignore that.

    9. Re:Unfair treatment by Stealth+Potato · · Score: 2, Funny
      "'If one swallow does not a summer make', how many do?"
      Are they African or European swallows?
    10. Re:Unfair treatment by Alsee · · Score: 1

      web devs shouldn't put important things un-encrypted in the url

      If something needs to be encrypted then it's most likely something that should NEVER be in a URL in the first place.

      If you're trying to "secure" your webserver by puting things in publicly readable paths and simply not announcing that path (such as website.com/dDkPWo4i3/index.html) then don't be supprised if your files wind up on Google. It doesn't matter if *you* consider dDkPWo4i3 to be an "encrypted" version of some word. As far as the webserver and the internet and webbrowsers and search engines are concerned dDkPWo4i3 is *not* a key or a password or an encrypted value, dDkPWo4i3 is just an ordinary folder name.

      If you are using a password or passing some encrypted value or something you DON'T do it in the URL.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    11. Re:Unfair treatment by belg4mit · · Score: 1

      And whence do you do derive the HTT vis a vis MIT?

      http://www-tech.mit.edu/V125/N11/11_sloan.11n.html

      --
      Were that I say, pancakes?
  11. Getting to the goodies... by KingSkippus · · Score: 5, Insightful

    Good grief. I'm guilty of doing this sort of thing all the time.

    I'd never really read about what exactly the applicants did before. If the article is right, all they did was poke around the system with URL munged from information they already had. It's not like they exploited buffer overflows to gain control of the system or anything.

    Like I said, I do this type of thing all the time. If I'm on a Web site with content I like and I see a series of URLs named something1.htm, something2.htm, something4.htm, etc., you'd better believe I'm going to type something3.htm in and see what happens. On my own dinky Web sites I have, if I don't want people browsing around the system, I take steps to prevent it, such as making sure the server doesn't allow one to list directories, always having an index.htm file in every directory in case I forget, naming files randomly instead of in series, etc.

    And, on top of all of that, as the post above states, all these candidates did was find out information that was going to be disclosed to them soon anyway.

    So I gotta ask, what the hell is the big deal here? Why is Stanford being such a hard ass about this? If anyone is to blame here for any significant wrongdoing, it has got to be the company that designed software that so easily gives up unauthorized information. I wonder what Stanford did to seek redress against them. (Probably nothing.)

    1. Re:Getting to the goodies... by MichaelSmith · · Score: 3, Informative
      If the article is right, all they did was poke around the system with URL munged from information they already had.

      About five years ago the Federal Government here in Australia introduced a new goods and services tax. Businesses had to register to use the new system and the ATO (tax office) provided a nifty web interface for them to query their account.

      One enterprising person changed the account number in the URL and accessed the details of other account holders.

      IIRC he called up the ATO and told them he had found a security hole, and exactly how he found it.

      Of course, he was charged with hacking the system.

      So the Stanford experience is not exactly isolated. For me it is a bit like going to a public office, and trying an unmarked door. It is not your fault if the door is not locked and they can't really charge you with breaking and entering as long as you didn't use the opportunity to commit a crime.

    2. Re:Getting to the goodies... by Anonymous Coward · · Score: 0

      "Of course, he was charged with hacking the system."

      Note to self: Next time I find a hole like this, I should exploit it rather than mention it..

      Way to go, idiots. You've just turned me into a threat rather than a helpful customer.

    3. Re:Getting to the goodies... by kwoff · · Score: 1
      If I'm on a Web site with content I like and I see a series of URLs named something1.htm, something2.htm, something4.htm, etc., you'd better believe I'm going to type something3.htm in and see what happens.

      And then use a combination of bash/perl and `wget` to download all the images. Or, I mean content.

    4. Re:Getting to the goodies... by DavidTC · · Score: 1

      It's even sillier than the ATO, because it's not as if they could find out other people's information, just their own.

      --
      If corporations are people, aren't stockholders guilty of slavery?
    5. Re:Getting to the goodies... by ArsenneLupin · · Score: 1
      If I'm on a Web site with content I like and I see a series of URLs named something1.htm, something2.htm, something4.htm, etc.

      Personnally, I'm much worse than that. If I see a URL http://www.site.com/art.asp?id=42, I like to try out what happens if I type http://www.site.com/art.asp?id=42+having+1%3D1-- or something of that ilk. More often than not, something interesting pops out, and ten minutes later the site is much more funny than it used to be...

    6. Re:Getting to the goodies... by Anonymous Coward · · Score: 0

      charged and conviced are different things.

      Did it get laughed out of court on the first day?

  12. Re:Heh by Guido+del+Confuso · · Score: 4, Informative

    "None" is short for "not one" and so it uses the singular verb form. The subject of the sentence is "none", not "applicants", so the usage is correct.

    http://dictionary.reference.com/search?q=none

  13. Only one reply is possible. by jesdynf · · Score: 5, Interesting

    I pledge, the next time I hear of such a possible exploit, to rip as much information from the system as the website gives me permission to retrieve. Every bit of it -- I shall construct scripts, pore over forums, and create a list of possible students whose data I will then attempt to extract.

    Additionally, with these links in hand, I shall paste them to random places on the internet, and specific places such as the most likely forums to find such students. I will also disguise their nature and essence, so that users will not know what they click on until it's too late.

    So the next time Stanford comes calling, you go ahead and /blame me/. I could've been the one to do it, after all. You don't know I didn't. They don't know I didn't.

    Or they could just accept that their own goddamn marketing department creates an illusion of prestige, and that people with a limited amount of time to waste on non-responsive colleges /sitting on/ important information like that are going to want to know who to stop wasting time on, and that if they don't like it they can /fix their fucking permissions/. Do they not know any decent webapp programmers? Who've they been graduating?

    --
    Yahoo! Pipes are awesome. How awesome? http://pipes.yahoo.com/jesdynf/slashdot
    1. Re:Only one reply is possible. by Anonymous Coward · · Score: 0

      Ah, isn't that noble of you.

      Of course, you'll also be pasting other individuals' private information all over the internet in a vain attempt to strike back at such bueraucratic nitwits. Instead of striking at the faceless morons running the system, you're instead fucking over the rest of us by violating our privacy and possibly exposing others to the risk of identity theft.

      Yes, you're quite the hero. Jackass.

  14. Re:Heh by nacturation · · Score: 2, Informative

    In addition to the other posts, it is worthwhile to note that the subject of the sentence is never located within a prepositional phrase. "of the ... applicants" is a prepositional phrase, where a preposition is "of", "on", "in", etc. So this should read "None ... was able to explain", which still sounds rather odd even though it's correct.

    --
    Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
  15. They got what they deserve by Registered+Coward+v2 · · Score: 3, Insightful

    They showed they lack good judgment and a sense of ethics.

    I don't want to work with somebody that cuts corners and refuses to play by the rules - what happens when it's a big contract and they decide to "see if we won?" or decide to see if "x is really going to buy Y?"

    If I can't trust you to do what is right, I don't want to work with you.

    Yes, waiting for B-school admission is a high stress period - but stressful situations is when people's character shows. I can understand HBS and Stanford's stance - they, and their alumni, don't want to be associated with the type of people that will create another Enron.

    Overall, they were probably to dumb to get in - from what I saw, the "hack" was a no-brainier - append some code to the end of the URL to hit a page rather than some smart piece of coding; more importantly - didn't they think that there would be alums of schools on the boards that would see th "hack" and let their schools now? And that these alums would be know who to talk to so that the school could investigate and take whatever action is deemed appropriate? If one of the "hackers" had been smart, they'd email the Dean of Admissions and ask - "Someone posted this as a way to check admissions status - is it OK if I use it?"

    --
    I'm a consultant - I convert gibberish into cash-flow.
    1. Re:They got what they deserve by Anonymous Coward · · Score: 1, Funny

      They showed they lack good judgment and a sense of ethics.

      Exactly. It's right that they should be rejected since they already have the skills that business school would teach them.

    2. Re:They got what they deserve by ultranova · · Score: 5, Insightful

      They showed they lack good judgment and a sense of ethics.

      Lack of good judgement maybe; but how is it unethical to try to get information concerning yourself ? Or are you trying to imply that Stanford is some sort of ethical authority ?

      I don't want to work with somebody that cuts corners and refuses to play by the rules - what happens when it's a big contract and they decide to "see if we won?" or decide to see if "x is really going to buy Y?"

      I'd imagine that they would become successfull and capable businessmen. After all, the ability to get good information is the cornerstone of making good decisions.

      If I can't trust you to do what is right, I don't want to work with you.

      Are you sure you aren't confusing moral right with your own expectations of human behiviour ? Because, to the best of my knowledge, there's absolutely nothing unethical in reading information concerning myself, even if someone else is trying to keep it a secret.

      Yes, waiting for B-school admission is a high stress period - but stressful situations is when people's character shows. I can understand HBS and Stanford's stance - they, and their alumni, don't want to be associated with the type of people that will create another Enron.

      Kindly explain what finding out whether you were admitted to a school has to do with forging accounts ?

      Overall, they were probably to dumb to get in - from what I saw, the "hack" was a no-brainier - append some code to the end of the URL to hit a page rather than some smart piece of coding; more importantly - didn't they think that there would be alums of schools on the boards that would see th "hack" and let their schools now? And that these alums would be know who to talk to so that the school could investigate and take whatever action is deemed appropriate?

      Maybe they made the mistake of assuming that the school would take appropriate action, as opposed to the action it actually took ?

      If one of the "hackers" had been smart, they'd email the Dean of Admissions and ask - "Someone posted this as a way to check admissions status - is it OK if I use it?"

      How would this have been smart ? These people had no obligations towards the Dean; why would they ask his permission to view information concerning them ?

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    3. Re:They got what they deserve by -kertrats- · · Score: 1

      If I can't trust you to do what is right, I don't want to work with you.

      That's assuming that what they did was wrong. I fail to see how it was-the information was there, Stanford had it posted on public pages (granted, the URLs werent listed, but the fact that they were there at all without any encryption or password required shows that they were available to anyone).

      --
      The Braying and Neighing of Barnyard Animals Follows.
    4. Re:They got what they deserve by Khyber · · Score: 1

      They did not get what they deserve. In almost any case, this ia a practical use of entrapment to disenfranchise a person of the money either they, or their supporting relatives/friends, used to gain admittance into the school, after they had to prove their worthiness of entering.

      Now who's more ethical in this case, the students, who believed they were doing th right thing, or the chool, who purposely mislead them as a way of testing "worthiness" for admission?

      I'm sorry, but if I pay to get into a school after I bust my ass, they better accept me and be willing to train me regardless. Either they teach me right from wrong, or they force me to go to the wrong and work against them. Again, it's business sense, and somehow, I have the sinking feeling that not just the school was involved in this little matter.

      --
      Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    5. Re:They got what they deserve by Maestro4k · · Score: 1

      I don't want to work with somebody that cuts corners and refuses to play by the rules - what happens when it's a big contract and they decide to "see if we won?" or decide to see if "x is really going to buy Y?" Sorry, no, you have the wrong idea here. This would be akin to checking to see if the deposit from a contract had come through yet so that it could be used to do more work. This isn't like they were trying to obtain information they weren't entitled to know. It was them just seeing if they had been accepted or not. Most probably didn't realize they were doing anything wrong. Also knowing if this was wrong or not takes someone much more technically oriented than most business school applicants are going to be. They weren't trying to get into the CS or EE program after all. I don't expect managers to have a freaking clue about security unless they're over IT. Even then I don't really expect it, technical knowledge and management seem to be mutually exclusive things.

    6. Re:They got what they deserve by Znork · · Score: 5, Insightful

      "They showed they lack good judgment and a sense of ethics."

      Um, no, they showed curiosity and a certain resourcefulness in finding data. Traits I can certainly appreciate in colleagues.

      Now, HBS and Stanford on the other hand showed a lack of good judgement and a sense of ethics. Their only concern appears to be to save face because they invested in a crap product that apparently doesnt even have proper access control. To blame some applicants to cover up their own incompetence is pretty low.

      "they'd email the Dean of Admissions and ask"

      Where do I send my mail asking if it is ok to access www.harvard.edu? Some guy said you could access their webpage if you typed that into your web browser, but I'm not sure I'm allowed to?

      If you can access it you can assume you're allowed to access it. It is not customary to be required to ask permission for looking at things in plain view.

    7. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      That's assuming that what they did was wrong. I fail to see how it was-the information was there, Stanford had it posted on public pages (granted, the URLs werent listed, but the fact that they were there at all without any encryption or password required shows that they were available to anyone).

      That's like saying beacuse you're connected to the internet, and your security isn't 100%, it's OK to take a look at what's on your machine.

      The schools told the applicants when they would be informed of their decision, and expected them to abide by the the timeline; applying for admission, IMHO, was agreeing to follow the school's timeline and so they should have realized what they did was unethical

      What they did is morally no different than walking through an unlocked door to the admission office, walking unchallenged to a file cabinet and pulling and reading your app. Just because you can do it doesn't make it right.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    8. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1



      They showed they lack good judgment and a sense of ethics.

      Lack of good judgement maybe; but how is it unethical to try to get information concerning yourself ? Or are you trying to imply that Stanford is some sort of ethical authority ?


      What matters is how they got the information - they could have calle dthe school and asked for, for example.

      I don't want to work with somebody that cuts corners and refuses to play by the rules - what happens when it's a big contract and they decide to "see if we won?" or decide to see if "x is really going to buy Y?"

      I'd imagine that they would become successfull and capable businessmen. After all, the ability to get good information is the cornerstone of making good decisions.


      Again, there is a right way and a wrong way to get information - people don't expect nor allow others to walk into their office and read whatever they want, ven if teh door is unlocked.

      If I can't trust you to do what is right, I don't want to work with you.

      Are you sure you aren't confusing moral right with your own expectations of human behiviour ? Because, to the best of my knowledge, there's absolutely nothing unethical in reading information concerning myself, even if someone else is trying to keep it a secret.


      Again, it depends on how you get the information - if someone tells me that you have a file on me in your house, I don't have the right to break in and read it.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    9. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      I don't want to work with somebody that cuts corners and refuses to play by the rules - what happens when it's a big contract and they decide to "see if we won?" or decide to see if "x is really going to buy Y?"

      Sorry, no, you have the wrong idea here. This would be akin to checking to see if the deposit from a contract had come through yet so that it could be used to do more work. This isn't like they were trying to obtain information they weren't entitled to know. It was them just seeing if they had been accepted or not. Most probably didn't realize they were doing anything wrong. Also knowing if this was wrong or not takes someone much more technically oriented than most business school applicants are going to be. They weren't trying to get into the CS or EE program after all. I don't expect managers to have a freaking clue about security unless they're over IT. Even then I don't really expect it, technical knowledge and management seem to be mutually exclusive things.


      Checking a deposit means you look at your account, which you control, what they did would be more akin to walking into the other companies office and pulling the contract, or finding a way into their computer system to see if a payment had been authorized but not yet made.

      My point is how they got the information was wrong - the schools said they'd let them know by a certain date, and they found a back door way to get the information.

      If they didn't know what they were doing was unethical, then they have a more fundemental problem of not being smart enough to know when they may be crossing the line.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    10. Re:They got what they deserve by Anonymous Coward · · Score: 0

      your entire argument that what they did was wrong, is founded on the assumption that what they did was wrong.

    11. Re:They got what they deserve by Anonymous Coward · · Score: 1, Insightful


      Again, there is a right way and a wrong way to get information - people don't expect nor allow others to walk into their office and read whatever they want, ven if teh door is unlocked.


      The information wasn't in your fucking office - it was published on a publically accessible website. It's exactly the same as posting the results on the side of the building, but not telling all the people standing out the front where to go.

    12. Re:They got what they deserve by ultranova · · Score: 2, Insightful

      What matters is how they got the information - they could have calle dthe school and asked for, for example.

      They got the information from a public web server, by typing an URL into the URL bar of their browser. I fail to see any immorality in this.

      Besides, if they had called the school, it's always possible that whoever answered the phone had not been told that the information was supposed to be secret (why was it secret, BTW ?) and would have answered their question. That was exactly what happened, in fact - only the uninformed party was a web server instead of a human being.

      So you can't call and ask, either, without risking immorality ;(.

      Again, there is a right way and a wrong way to get information - people don't expect nor allow others to walk into their office and read whatever they want, ven if teh door is unlocked.

      Maybe not, but the information was not in your office. It was in a public webserver. If you post your secret documents into the company webserver, don't be surprised if they get read.

      Again, it depends on how you get the information - if someone tells me that you have a file on me in your house, I don't have the right to break in and read it.

      Since no such thing or anything like it happened, what is your point ?

      You keep on making the assumption that these people broke into a private machine. They did not. They read a publically available document in a publically available webserver. Absolutely no foul play was involved.

      Stanford fucked up, and is now trying to cover it up by shifting the blame to innocent people. Then again, I suppose that is a good way of teaching todays business practices to them.

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    13. Re:They got what they deserve by the+morgawr · · Score: 1
      You've been working as a consultant too long. The sort of people who think like you do fit in perfectly in the giant beuracracy that is the modern corporation because they follow all of the stupid rules and don't rock the boat. (Incedentally, because Harvard and Stanford target this mega-corporations with their graduates, it is likely that this is the reason for the rejections.)

      The kind of person who thinks out of the box and does rock the boat is the type of person you want running or working at your company (but usually only smaller companies hire them...). I know I wouldn't care one way or the other if I were hiring them at my company. I don't see anything unethical about it (I can't identify a victim), but following some directions is certainly not impressive enough to warrent hiring on the spot.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    14. Re:They got what they deserve by the+morgawr · · Score: 1

      I have really bad news for you, MOST engineers end up in management. Many of the guys applying to business school are engineers who either couldn't hack it and wanted out, or who were tough stuff and wanted to be able to get promoted. The trick is figuring out who is who....

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    15. Re:They got what they deserve by ultranova · · Score: 2, Insightful

      That's like saying beacuse you're connected to the internet, and your security isn't 100%, it's OK to take a look at what's on your machine.

      No. It's like saying that because I'm connected to the Internet and running a publically available webserver, it's OK to take a look at what's available through that webserver. Replace the webserver with a P2P app, newsserver or whatever, and the point still stands.

      If I publish data, and accidentally publish something I didn't want to be known, that's my fault, not the fault of whoever reads it.

      The schools told the applicants when they would be informed of their decision, and expected them to abide by the the timeline;

      You know, just because someone expects someone else to abide by their decision, doesn't in any way oblige that other one to actually do so.

      applying for admission, IMHO, was agreeing to follow the school's timeline and so they should have realized what they did was unethical

      This does seem to come down to opinions, doesn't it ?

      You keep on claiming that the information was in a private place, equivalent to home or office, and others keep on claiming that a publically availabe document in a publically available web server is not private by any definition.

      You also keep on claiming that the students had an obligation to follow the schools timeline, and I keep on claiming that no such obligation exists.

      What they did is morally no different than walking through an unlocked door to the admission office, walking unchallenged to a file cabinet and pulling and reading your app.

      One can reasonably expect that a filing cabinet in an office is not meant for public use (altought, if I can just walk to it and read the contents unchallenged, there is propably grounds for a lawsuit about breaking privacy laws - is that the real reason for the schools behaviour ? Try to label innocent people criminals to destroy their credibility, if they ever decide to go that route ?). However, one can just as reasonably expect that a publically available document in a publically available web server is meant to be public. If one can't, using the Internet is going to become mighty inconvenient, since one must always ask for permission before using any resource.

      Just because you can do it doesn't make it right.

      But if you go out of your way (run a webserver and post the document there) to make it possible for me, it is reasonable to expect that you meant it for my use.

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    16. Re:They got what they deserve by the+morgawr · · Score: 1
      Please tell us what ethical system you are using that feels this is unethical (Kant, Locke, Rousseau, Rand, etc.). If you are using something you made up please explain your reasoning in detail.

      As I said before, and you ignored me, this isn't unethical; you are just too used to the corporate group think to separate ethics from beuracratic bull.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    17. Re:They got what they deserve by SA+Stevens · · Score: 1

      If you can access it you can assume you're allowed to access it. It is not customary to be required to ask permission for looking at things in plain view.

      Try that out next time you see a house with only the screen door closed. It's pretty likely that in at least some instances the screen door isn't locked.

      Then, try explaining your clever approach to ethics to the police officer. If you're not located in a state like Texas, that is.

    18. Re:They got what they deserve by Reality+Master+101 · · Score: 1
      Um, no, they showed curiosity and a certain resourcefulness in finding data. Traits I can certainly appreciate in colleagues.

      Yeah, just like spyware companies are just "showing resourcefulness" in exploiting bugs in Windows to "find data" on your computer. I certainly appreciate those traits from spyware companies.

      (rolls eyes at naive Slashdot ethics)

      --
      Sometimes it's best to just let stupid people be stupid.
    19. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      The kind of person who thinks out of the box and does rock the boat is the type of person you want running or working at your company (but usually only smaller companies hire them...). I know I wouldn't care one way or the other if I were hiring them at my company. I don't see anything unethical about it (I can't identify a victim), but following some directions is certainly not impressive enough to warrent hiring on the spot.

      Let's see - one person discovers how to get to a page, and a bunch of others folow their directions - not much original thought or out of the box thinking there. More like a bunch of drones who read from a script when you call their companies tech support line.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    20. Re:They got what they deserve by DavidTC · · Score: 1
      You fucking retard.

      I'm getting sick of the analogies that are idiotic here. If you compare a public website to a private residence, you're about as stupid as they come.

      Tell me, who gave you authorization to go to slashdot.org? No one? Get the fuck out of here, you trespasser.

      --
      If corporations are people, aren't stockholders guilty of slavery?
    21. Re:They got what they deserve by the+morgawr · · Score: 1
      > Let's see - one person discovers how to get to a page,

      That's the person I was refering to.

      > and a bunch of others folow their directions - not much original thought or out of the box thinking there.

      True, but you claim this behavior is unethical; I don't see why. Please explain.

      > More like a bunch of drones who read from a script when you call their companies tech support line.

      Actually I'd say it's more like a group of engineers who doesn't want to wait to have a computer get moved and instead just moves it themselves so they can get on with their jobs. The reaction from the Universities would be the beuracracy firing them for violating the rules. Everyone knows that the engineers should sit on their butts and let a grunt spend two weeks processing and moving the computer instead of wasting 30 whole minutes moving it themselves. (Yes this has actually happened...)

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    22. Re:They got what they deserve by SA+Stevens · · Score: 1

      Okay, fine.

      Sophmoric profanities aside, you make a certain good point.

      Let's just substitute 'the screen door at the back of a resturant' for the one I originally specified.

      Better hope the cook isn't one of those dudes who has his own knives and keeps them sharp.

    23. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1



      That's like saying because you're connected to the internet, and your security isn't 100%, it's OK to take a look at what's on your machine.

      No. It's like saying that because I'm connected to the Internet and running a publicly available web server, it's OK to take a look at what's available through that web server. Replace the web server with a P2P Lapp, news server or whatever, and the point still stands.

      But if you go out of your way (run a web server and post the document there) to make it possible for me, it is reasonable to expect that you meant it for my use.


      Ok, since a mail server connects to the internet and someone went out of their way to make it available for use, it's ok to spam it?

      After all, the server is readily accessible, many email address re public, and it's possible to guess others via a brute force mass mailing (after all, the original URL required a guess at what to replace to make the individuals info accessible).

      After all, you also point out:

      You know, just because someone expects someone else to abide by their decision, doesn't in any way oblige that other one to actually do so.

      So just because you may not want spam but want email doesn't mean a spammer should respect as long as your email server and address work.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    24. Re:They got what they deserve by fbjon · · Score: 1
      If you say the students have no oblication to follow rules, you can't say the school has any obligation to accept them either.

      just because someone expects someone else to abide by their decision, doesn't in any way oblige that other one to actually do so.

      You're right, it doesn't obligate them. But that still doesn't make it right, does it?

      The big question is, is the information public or not? The answer is: neither. And since it's in a grey area, why take the risk? The uni says that it's not public, and it's their information.

      It's like saying that because I'm connected to the Internet and running a publically available webserver, it's OK to take a look at what's available through that webserver.

      "Sure, look at whatever you want. If you do so however, we wont accept you". That's the position of Stanford uni.

      But if you go out of your way

      Well, it's not like they were throwing the info in the students' faces, now is it? Again, it's a grey area, and they're saying it wasn't public info. Their info, their decision. Notice also that the info did not belong to the students. If I have an opinion or decision about you in my mind, it belongs to me, not you. We may have an agreement that I'll reveal the opinion at a later date, but that's my decision. If you go out of your way to obtain the info, I'll say you did the Wrong Thing (tm).

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    25. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      You know, just because someone expects someone else to abide by their decision, doesn't in any way oblige that other one to actually do so.

      You seem to believe that the mere act of making something accessible via the internet is sufficient to grant anyone access to that information if they can figure out how to get to it.

      By you're reasoning, if someone knows how to remotely access files on your computer, it is not unethical for them to do so since you have made them available via the internet.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    26. Re:They got what they deserve by Anonymous Coward · · Score: 0
      It is not customary to be required to ask permission for looking at things in plain view.

      I've tried that argument before with the ladies, and all it got me was a slap in the face.

    27. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      > and a bunch of others follow their directions - not much original thought or out of the box thinking there.

      True, but you claim this behavior is unethical; I don't see why. Please explain.


      The universities provided them with a timeline for the process, told them when they'd be notified, and did not provide them with a URL to access their information before that date. Instead of waiting, some people decided to try an end run around the system. In this case, I think it was pretty clear that the school didn't want that info publicly available prior to its official release; that coupled with either an explicit or implicit agreement to follow the school's rules (which would include notification timelines) makes what they did unethical.

      Is it a major breach of ethics? No, what they did was minor compared to other things people will do to get into B-school. Still, it was enough to give pause and ask "what else might they do if given the opportunity?" and the schools chose not to take the risk.

      > More like a bunch of drones who read from a script when you call their companies tech support line.

      Actually I'd say it's more like a group of engineers who doesn't want to wait to have a computer get moved and instead just moves it themselves so they can get on with their jobs. The reaction from the Universities would be the beuracracy firing them for violating the rules. Everyone knows that the engineers should sit on their butts and let a grunt spend two weeks processing and moving the computer instead of wasting 30 whole minutes moving it themselves. (Yes this has actually happened...)


      Having dealt with a fair amount of maddening bureaucracies, I'm not surprised. I do think it's different - in your example, some is trying to do what they feel is right and best for the organization; the problem there is the system not necessarily the individuals and management should be smart enough to realize it. (although having had to find the SOB that put a ground on my system because they plugged in an unauthorized device, I admit I took great satisfaction physically separating the electric cord from the device)

      It's more like the same engineers rifling the boss' file cabinet to see if the decision had been made to move it. I happen to think if you should get permission before accessing things to which you obviously haven't been granted access.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    28. Re:They got what they deserve by the+morgawr · · Score: 1

      No, I just don't believe that this particular act can be construed as morally or ethically wrong under any sane system of ethics. I'm asking you to prove me wrong by demonstrating one such system: the one you hold.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    29. Re:They got what they deserve by zwhitley · · Score: 1

      Jeffery Skilling, both COO and then CEO of Enron was awarded an M.B.A from Harvard Buisness School.

    30. Re:They got what they deserve by dracocat · · Score: 1

      what happens when it's a big contract and they decide to "see if we won?"

      Yeah, I think you want to see if you won a contract.

      "x is really going to buy Y?"

      And yes, you should check to see if x is going to buy y.

      I think you were trying to make a point but left out a few details.

      Getting information is an important part of business. While I will agree there are morals invovled, and certain lines that should not be crossed, I dont see any of those in your arguments.

    31. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      I'd put it under the "do unto others..." category.

      So tell me, do you believe all ethical or moral systems allow you to access any information, anywhere, for any reason, simply because you can, even if the person who creates that information clearly did not want it accessed?

      --
      I'm a consultant - I convert gibberish into cash-flow.
    32. Re:They got what they deserve by the+morgawr · · Score: 1
      > it was pretty clear that the school didn't want that info publicly available prior to its official release

      I do not see it as clear. For all I know, the date could mearly be something like a final deadline for internal processing purposes.

      Furthermore even positing that it is true, desire does not translate into morality. You may desire to have a consulting monopoly so that you can gouge prices, for example, but that doesn't make it wrong for me to prevent you from doing so.

      that coupled with either an explicit or implicit agreement to follow the school's rules

      No such implicit agreement exists until the applicant has accepted. Until then it is mearly an agreement for the applicant to provide information free of charge in exchange for consideration.

      you obviously haven't been granted access.

      This is a corporate mentality: If it's there in plain site you should ignore it unless you have permission. That is a compleately unjustified attitude. Publicly available information is by it's nature public, and information available to someone logged in on a server is by it's nature theirs to see.

      This insn't like they used a buffer overflow or cracked a password, this is a page that the server admin had either granted them permission to see or had not denied them the ability to see. So by every rule of netique they were to assume that they had permission. Stanford, unlike Harvard, wisely chose to not post the information until closer to the deadline, so no students really learned anything, but even if they had, to claim these kids are unethical for looking at a web page is a far strech.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    33. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      what happens when it's a big contract and they decide to "see if we won?"

      Yeah, I think you want to see if you won a contract.

      "x is really going to buy Y?"

      And yes, you should check to see if x is going to buy y.

      I think you were trying to make a point but left out a few details.

      Getting information is an important part of business. While I will agree there are morals invovled, and certain lines that should not be crossed, I dont see any of those in your arguments.


      What I did not explicity state was would they consider it ok to access a customer or comepitor's computer without permission to get that information; if they knew how to get the info.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    34. Re:They got what they deserve by the+morgawr · · Score: 1
      I accept the general rules of netiquette, which includes the assumption that information posted in a manner that can be read by someone by simply going to a URL is intended to be read by that someone. This doesn't let you crack passwords or break apps but these guys followed a link and were presented with a page. There is no sane reason what-so-ever to assume they shouldn't view it, because if someone felt that they shouldn't, they could have easily changed the file permisions to deny them the ability to do so.

      Secondly, I assert that for something to be wrong there has to be a rational reason; to do otherwise is to invite insanity. As far as I currently know, there is no conceivable, rational basis for such a claim reguarding this situation.

      P.S. Since you seem to think that reading something on the internet requires explicit permission:

      I hearby grant permission to everyone everywhere to read this post.

      Doesn't that just sound stupid?

      P.P.S. In answer to you question, information is a mental abstration that is used in communication. It does not have physical properties, so for example it cannot be "accessed". Furtheremore for me to obtain information that only you have, you must give it to me. Either you give it to me freely ( by posting it on the web, or by telling me, by you leaving it written down and lying around were I might find it, etc.) or I force it out of you (by coercion, by fraud, etc.). The first is acceptable, the second is not.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    35. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      This is a corporate mentality: If it's there in plain site you should ignore it unless you have permission. That is a compleately unjustified attitude. Publicly available information is by it's nature public, and information available to someone logged in on a server is by it's nature theirs to see.

      The information was not public nor in plain sight - you had to modify a URL in order to reach it; it wasn't something you could reach via a click here link - which is what I would consider to be public or in plain sight.

      How is what they did different from someone accessing info on your machine if you fail to adequately protect it?

      As a side note, they'd be in viloation of Stanford's and reason enough not to admit someone who seems willingto violate it even before admission, and soemthing Stanford probably includes for signature on an application:

      The "Fundamental Standard" Code of Conduct:
      The Fundamental Standard has set the standard of conduct for students at Stanford since 1896. It states: Students at Stanford are expected to show both within and without the University such respect for order, morality, personal honor and the rights of others as is demanded of good citizens. Failure to do this will be sufficient cause for removal from the University. Over the years, the Fundamental Standard has been applied to a great variety of situations. Actions that have been found to be in violation of it include:

      Misuse of University computer equipment or e-mail

      There is no standard penalty which applies to violations of the Fundamental Standard. Infractions have led to penalties ranging from formal warning and community service to expulsion. In each case, the nature and seriousness of the offense, the motivation underlying the offense and precedent in similar cases are considered.

      Above from Stanford's web site.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    36. Re:They got what they deserve by Hognoxious · · Score: 1
      In this case, you're comparing a public webserver to private business premises. Not really much of an improvement, to be honest.

      P.S. What's with all the vigilante fantasies? Are you overcompensating for something?

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    37. Re:They got what they deserve by Anonymous Coward · · Score: 0

      Judging by your spelling, you haven't been within 5 miles of a "chool".

    38. Re:They got what they deserve by Kymermosst · · Score: 1

      (rolls eyes at naive Slashdot ethics)

      Allow me to amend that to: ...naive and selectively applied...

      --
      "Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
    39. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      I accept the general rules of netiquette, which includes the assumption that information posted in a manner that can be read by someone by simply going to a URL is intended to be read by that someone. This doesn't let you crack passwords or break apps but these guys followed a link and were presented with a page. There is no sane reason what-so-ever to assume they shouldn't view it, because if someone felt that they shouldn't, they could have easily changed the file permisions to deny them the ability to do so.

      Secondly, I assert that for something to be wrong there has to be a rational reason; to do otherwise is to invite insanity. As far as I currently know, there is no conceivable, rational basis for such a claim reguarding this situation.


      Your read of netiquette would be ok but for one fundemental flaw - you ignore the original poster of teh URL posted instructions on how to modify it so as to gain access to pages not yet released. That's what makes it different from simply going to a public link. They attempted to access information they new Stanford et al did not want them to hev yet, and they paid a price for that.

      And while Stanford does not have to provide a rational reason, it's quite possible that decisons change at the last minute and they do not want soemone to get the wrong one before they finalize the acceptances.

      And Stanford didn't leave(ing) it written down and lying around were I might find it, the applicants went looking behind clsoed but unlocked doors.

      Your view means spam is ok because you make your email account accessable to the web, all I have to do is fiqure out an address.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    40. Re:They got what they deserve by the+morgawr · · Score: 1
      You keep trying to avoid my question by indirection. Why is manipulating a URL to access something on a webserver that the server has granted them permission to access wrong? As I stated if they didn't want them to access it, they could have changed the permissions, or done what Stanford did, not posted it.

      Quoting Stanford's Code of conduct doesn't add anything to this discussion. Because there is nothing there that can reasonably constitute a reasoned definition of ethics and morality.

      You seem to believe that I'm saying what these students did was somehow "right". I'm not saying that. I'm just saying that this isn't, as you claim, morally wrong behavior. Of course Stanford has the right to reject anyone for any reason, no matter how petty, stupid, and short sited. They could reject all of the candidates that wore blue shirts to the interview, or all of the black candidates, or all of the white upper-middle class protestants. Instead they rejected everyone who followed a URL (by typing it in) to a dead end page with no information. Suddenly everyone wants to assert some sort of moral imperative one way or the other. All of the above scenarios are equally stupid and irrational; none of them can be justified morally.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    41. Re:They got what they deserve by the+morgawr · · Score: 1
      > pages not yet released

      But they were released because people could get to them.

      > Stanford et al did not want them to hev yet

      As I have stated, desires to not translate into morality. Standford's wants, desires, and intentions, are compleately irrelevent to a discussion on the morality of accessing a web page.

      > And while Stanford does not have to provide a rational reason, it's quite possible that decisons change at the last minute and they do not want soemone to get the wrong one before they finalize the acceptances.

      That's a perfectly acceptable reason for not wanting to give the information out early, but it doesn't make the students accessing it wrong. It just means that they might get bad information.

      > Your view means spam is ok because you make your email account accessable to the web, all I have to do is fiqure out an address.

      No it doesn't, you can't take one conclusion and apply it to a situation with different premises. That would be irrational. The premise for why accessing a website is OK is because web sites exist for transmitting information to someone and the technology itself has the means to deny permission to individuals or groups. Therefore, if you can acess it, you can assume you are intended to.

      Email OTOH, has no such mechanism, therefore, sending email to an address, unsolicited can be considered tresspass.

      All of this is dancing around the core question though: What is the reasoning behind your assertion that the actions of the students are wrong?

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    42. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      No it doesn't, you can't take one conclusion and apply it to a situation with different premises. That would be irrational. The premise for why accessing a website is OK is because web sites exist for transmitting information to someone and the technology itself has the means to deny permission to individuals or groups. Therefore, if you can acess it, you can assume you are intended to.

      Email OTOH, has no such mechanism, therefore, sending email to an address, unsolicited can be considered tresspass.


      Sure email does - I can bounce any mail from a trusted sender, employ challege response, use a spam filter / blacklists etc - most people simply prefer not tu use the technolgy available to deny access to email. Email also eists to transfer information. Therefore, based on your assertion for why accessing the web pages was acceptable, if some can send you email, the sender can ssume you intended them to and it's ok to send whatever you want. Sure, blocking sneders makes admining email harder, but so does putting up firewalls and adding password access to other data. If you take the abscence of using available tech to deny access to services accessible via the internet, then you if you say what they did was acceptable so is spam.

      My reasoning is simply that Stanford did not provide them the URL and told them when they would get a decision - they chose to take another URL, redo it and attempt to access information Stanford clearly did not yet want released.

      Had it simply been a button "Click here for decison" and Stanford put up the reults and they clicked the button, then I'd say they did nothing unethical. But that's not what happened.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    43. Re:They got what they deserve by the+morgawr · · Score: 1
      > Sure email does No, it does not. Those technologies are things that arn't part of email, but can be used with it. That arn't part of the purpose of email. A web server exists for the purpose of distributing information to groups people efficently. Those people can assume that information it distributes to them is for them since by default it won't send the information unless the sender has told it to. This is completely different from email, which is why different social conventions apply.

      > Stanford did not provide them the URL and told them when they would get a decision - they chose to take another URL, redo it and attempt to access information Stanford clearly did not yet want released.

      We keep going over this, ok I follow you this far. Now please tell me why it is that you see this as being morally wrong. Who was hurt? Does your moral system not require a victim? If so how does it separate right from wrong? Is you system even rationally based, or is it just something you hobbled together from junk lying around?

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    44. Re:They got what they deserve by Thomas+A.+Anderson · · Score: 1

      Sorry, you are both wrong.

      You are comparing public websites with private computers. No one claims that a private computer becomes non-private the moment it's connected to the net (ie, no one claims it's ok to walk into a house because the door is open).

      But a public website is exactly that - public.

      This logic is neither selective nor naive.

      --
      Personally its not God I dislike, its his fan club I cant stand (bash.org)
    45. Re:They got what they deserve by Thomas+A.+Anderson · · Score: 1

      Again, it depends on how you get the information - if someone tells me that you have a file on me in your house, I don't have the right to break in and read it.

      True, but in this case nothing was broken into. The information was out there for anybody to view who had a login/password. No attempt was made to make the information secure other than obscurity, which most would agree is not a valid attempt.

      --
      Personally its not God I dislike, its his fan club I cant stand (bash.org)
    46. Re:They got what they deserve by Anonymous Coward · · Score: 0

      This isn't Enron, which was a vast web of lies for personal financial gain.

      Morally, I see this as tresspassing with benign intent. The applicants did do something wrong. They deliberately entered a part of the web site that Stanford had intended to protect. Stanford's (or the software vendor's) stupidity does not grant moral license to snoop around on their web site.

      Use the appropriate physical world analogy -- they opened an unlocked door that they knew they were not supposed to open. They peeked in the medicine cabinet, etc. They didn't exactly break in, but they did go snooping on someone else's property when they knew they weren't supposed to.

      That's not stellar judgment, but I can't say that this incident impeaches the students' integrity. Tresspassing isn't lying, cheating, or stealing. Considering the completely benign intention here, I think that this episode is about as relevant as a speeding ticket.

    47. Re:They got what they deserve by siriuskase · · Score: 1

      Jeffery Skilling, both COO and then CEO of Enron was awarded an M.B.A from Harvard Buisness School.

      What's your point? That since Mr. Skilling was awarded an M.B.A. from HBS that other bad boys have an equal right? HBS isn't allowed to make mistakes? If they make even one mistake, they must relax their standards for future applicants?

      What does this have to do with the ethics of URL munging anyway?

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    48. Re:They got what they deserve by Kymermosst · · Score: 1

      The average Slashdotter's ethics are still naive and selectively applied.

      Here's the exaple that will get me modded as a troll:

      It is okay for people to download and listen to copyrighted music 24/7, benefitting from someone's labor without paying for it. The violator's excuse? "I wouldn't have bought it anyway, so no sale was lost. They didn't lose anything."

      It is not okay for people to download copyrighted GPL software and make use of it in their own product, benefitting from someone's labor without paying for it. The violator's excuse? "They weren't charging for it anyway. They didn't lose anything."

      Now, on the original topic, from what I understand, the applicants knew when the information would be available to them. Therefore, by knowing this, they also should have know that gaining the information earlier could be considered ethically questionable. (I won't go so far as to say "wrong" because the information was poorly secured). Almost all the analogies that have been given to state why it is wrong have failed.

      A better analogy might be: I distribute a stack of photocopies of a business report or some other thing I intend to be public. I accidentally include one page of something that I did not intend to distribute... something I may have eventually released, but did not intend to at this time.

      Now, suppose you are a recipient of these materials, and got the page in question... you notice this unintentional information has been accidentally made available to you, and you are aware of the original intent. Is reading it in its entirety wrong, right, or questionable? Is telling other people the information right?

      The reason I stated that the ethical standards were naive and selectively applied is because the average person cannot put themselves into the other's position.

      Think about it this way: Many have stated that gaining the information (that was not intended to be released yet) was ethical. Yet, if those same people had accidentally released confidential information on a web site (though not through any clickable link), and had it been discovered and disseminated against their original intent, you could bet that they might not apply the same standard of ethics.

      Though the big violator is the web site operator, of course.

      Another analogy: I tell you something, and I say "please don't tell anyone else until June 18th."

      I tell person X that I told you some information that you are going to release on June 18th, and to ask you about it then.

      If you run off and accidentally give the information to person Y before June 18th, you definitely screwed up. Now Y offers to tell person X before that date.

      Since person X knew he/she wasn't supposed to receive the information before that time, if X accepts the offer and gets the information, it would seem to me that X has done something unethical.

      Putting it all together: I am Stanford, you are the web site operator, person Y is the discoverer of the URL hack, and person X is an applicant to Stanford.

      I guess it looks fairly obvious from my point of view, and perhaps my analogies are also flawed, but I can see why Stanford might have reason to believe that the actions of the people gaining the information before they were intended to have it were unethical.

      --
      "Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
    49. Re:They got what they deserve by flosofl · · Score: 1

      I'd been following the different threads in this and in just about every one, you take a conversation about simple ethics and introduce the concepts of "wrong" and "morality". What does that have to do with ethics? Morality is not the same as ethics.

      Is you[r] system even rationally based, or is it just something you hobbled together from junk lying around?

      Ad hominems like that just make me tend to disregard anything someone says. It indicitive of sloppy thinking and really harms rather than bolsters any argument you may make.

      --
      "This calls for a very special blend of psychology and extreme violence" - Vyvyan "The Young Ones"
    50. Re:They got what they deserve by Anonymous Coward · · Score: 0

      The purpose of a code of ethics is to prevent immoral abuse of authority. Ethical rules that prevent actions that aren't immoral are mistakes that serve only to obstruct liberty.

    51. Re:They got what they deserve by the+morgawr · · Score: 1
      Ad hominems

      It's not an ad hominem. I'm serious. If you have a rational basis for what you are saying, you certainly arn't communicating it. Therefore it seems that your system is arbitrary, as further evidenced by your failure to acknoledge the relation between morality and ethics.

      However, to please you, I'll rephrase: Please illustrate for everyone reading the logic behind the conclusion that the actions of these students were unethical. Please start from presupitions we can agree on.

      I think however we might have found the real reason for the divergence of conclusions here. You seem to want to equate ethics with some abstract social standard based on implied consent. Whereas I see ethics as the rules used to ensure moral behavior. You seem to beleive that these rules are inherently obvious or otherwise need no rational justification. Whereas, I see that if we are to avoid chaos, any code of human conduct must obey reason. Is my interpretation of our dispute (that it lies at a deeper, metaphysical level) correct?

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    52. Re:They got what they deserve by Reality+Master+101 · · Score: 1
      But a public website is exactly that - public.

      The information was not intended to be public. Period. I don't care how easy it was to get -- they still had to manipulate the system to access the data.

      Or are you saying that if a computer has a public web server, then anything you can gain from the computer is fair game, including by running root kits?

      What is astounding to me is that people seem to think that how easy it was to break the security is relevent to anything. They weren't intended to see that information, they knew they weren't intended, but they did it anyway.

      --
      Sometimes it's best to just let stupid people be stupid.
    53. Re:They got what they deserve by Anonymous Coward · · Score: 0

      They weren't intended to see that information, they knew they weren't intended, but they did it anyway.

      A bit psychic are we?

    54. Re:They got what they deserve by Anonymous Coward · · Score: 0

      It is okay for people to download and listen to copyrighted music 24/7, benefitting from someone's labor without paying for it. The violator's excuse? "I wouldn't have bought it anyway, so no sale was lost. They didn't lose anything."

      It is not okay for people to download copyrighted GPL software and make use of it in their own product, benefitting from someone's labor without paying for it. The violator's excuse? "They weren't charging for it anyway. They didn't lose anything."


      The difference isn't really all that hard to see, not only are they not losing money, they are not making money either, whereas in the case of gpled code they are, you don't hear to many people on slashdot defending the pirates who sell the copyright works.

    55. Re:They got what they deserve by SA+Stevens · · Score: 1

      No, in fact I am comparing a 'private entrance on a public entity' to a 'private entrance on a public entity.'

      Unless you're going to pretend that the web server in question was going to just throw up a public list of who had been accepted for everyone to read.

    56. Re:They got what they deserve by Kymermosst · · Score: 1

      The difference isn't really all that hard to see

      Funny, I don't find it hard to see them both as wrong.

      --
      "Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
    57. Re:They got what they deserve by standards · · Score: 1

      I'd agree in the general case. Except in this particular case, the schools know something we don't - namely, the candidates.

      And therefore, it's hard to know, on a case-by-case basis, if their judgement was well-founded. In the end, it likely didn't matter because you need both a kick-ass application and kick-ass connections to make it into these programs.

    58. Re:They got what they deserve by Anonymous Coward · · Score: 0

      Learning from and improving our tools is what makes us human. Proprietary software is a blatant attempt to prevent users from doing anything other than what the vendor approved of. That's immoral to a degree that not funding the music cartel simply can't match.

    59. Re:They got what they deserve by boneshintai · · Score: 1

      I was actually strongly tempted to Foe you over this, but instead I'll argue with you.

      From reading your various comments on this discussion, it appears that your premise is "the students are morally in the wrong because Stanford et al hadn't authorized the release of admissions data." I disagree, obviously.

      Stanford released their admissions data to the site, presumably on the grounds that (a) the site not release it and (b) the university reserves the privilege of changing that data up until it is released.

      A flaw in the site's code allowed unauthorized users to view the data. This is a failure of the web site; were I in any of the affected universities' legal departments I would be looking Very Hard at suing the site for what happened, as it displays a disregard for security and incompetence in the face of web technologies. As far as I'm concerned, that's the end of it: the site failed to properly secure data, and as a result that data was accessed by "unauthorized" parties.

      However, from the students' point of view as users of a web application, the only authoritative reference for what information is 'allowed' is what information is reachable. It has never been true that "not releasing a URL" is sufficient to prevent access to the corresponding resource, and modifying URLs is a fairly normal thing for even slightly advanced users to do for no other reason than simple curiousity. Well-written web software must as a matter of course expect arbitrary URLs to be fed to it and should react consistently and appropriately; thus, it is normal to expect that information you can reach is information you're allowed to reach.

      That's the crux of the matter. Stanford expected (perfectly rationally) the site to secure their "unreleased" data, while the site's users expected (perfectly rationally) that information reachable was information they should get. The only party that's morally in the wrong is the party that failed to uphold either of those expectations, as they have a contract with the universities to control access to information and an informal but well-documented set of expectations to satisfy for their users.

      Stanford is free to reject applicants over this; they'll have to deal with the consequences of that action, including potential lawsuits and probable bad publicity. Describing the students as "morally wrong" for their actions is intellectually wrong.

    60. Re:They got what they deserve by Hognoxious · · Score: 1
      Unless you're going to pretend that the web server in question was going to just throw up a public list of who had been accepted for everyone to read.
      I don't have to pretend. That's exactly what it did do, on entering the correct URL. That's what webservers do, apparently.

      Still you managed a reply without threatening anyone are mentioning weapons, maybe there's hope for you yet.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    61. Re:They got what they deserve by SA+Stevens · · Score: 1

      'the correct URL' translates similar to 'the correct combination to the mailbox at the Post Office.' That someone came up with and publicly announced a means of 'cracking the combination' does not change that.

      But there's no 'hope' for me. I'm not even applying to get an MBA. And I think I'll go sharpen my swiss army knife...

    62. Re:They got what they deserve by edb · · Score: 1

      I wish everyone would please knock it off with all the poor analogies comparing this situation to entering an office, or looking through a file cabinet, or trying a key on a door, or opening a screen door on a house, or whatever. Those flawed analogies all include a reasonable expectation of privacy. This situation falls short because of incompetence on the part of the web site contractor.

      The information was posted on a system that was intended to be accessible, although it was not intended to be accessed as soon as it was. Essentially, it was posted on a bulletin board in a hallway, but no one was told which hallway it was. Yet. The announcement of which hallway was scheduled for a month in the future.

      Someone figured out which hallway had the bulletin board on the wall, and they told how to find it. The announcement of the location had not been made, but the information was already tacked up on the board for anyone who happened by to see.

      The fact remains that it was a bulletin board, not a file cabinet either locked or unlocked. And never mind that the hallway on the 3rd floor of Building 4 doesn't get much foot traffic, compared to the Infinite Corridor -- it's still a bulletin board if you go there to look.

      --
      In theory, practice and theory are the same. In practice, they rarely are.
    63. Re:They got what they deserve by Registered+Coward+v2 · · Score: 1

      The fact remains that it was a bulletin board, not a file cabinet either locked or unlocked. And never mind that the hallway on the 3rd floor of Building 4 doesn't get much foot traffic, compared to the Infinite Corridor -- it's still a bulletin board if you go there to look.

      You left out one detail in the analogy - there was a door to the hallway with a lock, someone determined how to open that lock using infromation from other locks to which they have been given the combo, and went and opend that lock to try to get infromation before they had been given the combo to that lock.

      That it was the same as other locks may not be good security practices, but it was still a lock; just as the URL they modified was the weak security the schools used to maintain information secure until they wanted it made public.

      But even to use your hallway anolgy - the school said - "here are hallways we have granted you access to; others exist and we will let you go into them at these future dates." If you go wandering on your own, don't be surprised if someone gets upset - just because you can get access to soemthing doesn't mean you have the absolute right to do so; especially in this case where teh schools made it clear when the information was to become available.

      What I find humorous is the people who tried to find out their status early generally got blamk screens - so they screwed themselves for nothing.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    64. Re:They got what they deserve by Znork · · Score: 1

      "The information was not intended to be public."

      Well, then maybe it should be protected by access control, eh?

      "I don't care how easy it was to get -- they still had to manipulate the system to access the data."

      No they didnt. They had to enter an URL, nothing more, nothing less.

      "Or are you saying that if a computer has a public web server, then anything you can gain from the computer is fair game, including by running root kits?"

      Anything available to you without bypassing security measures is fair game.

      "What is astounding to me is that people seem to think that how easy it was to break the security is relevent to anything. "

      If there is no security you cannot be expected to assume there should have been security. There was nothing to break, there was no security.

    65. Re:They got what they deserve by Znork · · Score: 1

      "It is okay for people to download and listen to copyrighted music 24/7, benefitting from someone's labor without paying for it."

      There are some people like this.

      "It is not okay for people to download copyrighted GPL software and make use of it in their own product, benefitting from someone's labor without paying for it. The violator's excuse?"

      There are some people like this too.

      You may get an 'average slashdotter' if you mix them together, but they're not necessarily the same people. I'd agree it's easy to confuse, especially since you have an issue where the actual legal situation diverges from what many consider the ethical situation. The GPL is merely a framework for creating a certain result within the current legal situation, and would be unecessary should the legal situation be changed to achieve consistency with the actual ethics.

      As such you get a strange situation. I think you find the ethics naive and selectively applied because you're a bit of selecting and applying yourself.

      "you could bet that they might not apply the same standard of ethics."

      Yes, well, blaming other people for ones own mistakes is a pretty common human pasttime. That doesnt change the actual situation tho.

      "I guess it looks fairly obvious from my point of view, and perhaps my analogies are also flawed"

      I'd combine person X and person Y, as the 'you' is making the information accessible to everyone by mistake. It's as if they sent it out in the mail a day early, expecting the mail to take a day extra. Would you assign blame to someone for opening the letter, even tho they were not told not to expect the results until the next day? Would you assign blame to someone for going home early to check their mail because a friend home sick called you and told you the letter came early?

    66. Re:They got what they deserve by Anonymous Coward · · Score: 0

      Lock combinations are supposed to be secret. URLs are not--they're prominently displayed and logged with no protection in many user agents.

    67. Re:They got what they deserve by SA+Stevens · · Score: 1

      I think you'll find that some URLs are mean to be 'private' in the sense that the site admin hasn't come up with a more sensible means of securing an area. It's bad practice, but it happens. I used to know of some 'pay' chat sites where the subscriber's password was embedded in the URL. Capture somebody's history and you could trivially masquerade as them.

      It's horrible security design, but it _is_ intended as a key to a lock.

  16. Business Ethics 0.99? by Nipok+Nek · · Score: 1

    Don't Harvard and Stanford have Business Ethics classes? Presumably, you teach a class to educate people on a subject. But apparantly, for these students, the test was administered before the lessons were given. Hurray for Higher Education.

    --
    Why choose white shoes?
    1. Re:Business Ethics 0.99? by rah1420 · · Score: 1

      Isn't that an oxymoron?

      --
      Mit der Dummheit kämpfen Götter selbst vergebens.
    2. Re:Business Ethics 0.99? by Anonymous Coward · · Score: 0

      Isn't that an oxymoron?

      No. Business ethics are very important.

      Principle 1: Don't get caught (they failed it).

      Principle 2: if you do get caught, have a bullet proof excuse ready (they failed it again).

    3. Re:Business Ethics 0.99? by Samedi1971 · · Score: 1
      The lesson learned is Thou shalt not get caught.

      Consider it a free course in practical business ethics. And from such a prestigious institution!

    4. Re:Business Ethics 0.99? by the+morgawr · · Score: 2, Funny

      While we are on the subject, I'd like to point out that as a busness owner I'm deeply offended and concerned by the implication made by Harvard and Stanford that a separate and different set of ethics applies in business than in the rest of human relations.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    5. Re:Business Ethics 0.99? by snarkh · · Score: 1


      Exactly. They should be grateful for a practical lesson like that.

    6. Re:Business Ethics 0.99? by Create+an+Account · · Score: 1

      Dammit, that was pretty insightful.

    7. Re:Business Ethics 0.99? by winwar · · Score: 1

      No, I don't think they are implying that a different set applies. After all, if the students hadn't gotten caught, they wouldn't have been punished. Seems to be the norm in ethics for business and the rest of human relations :)

    8. Re:Business Ethics 0.99? by the+morgawr · · Score: 1
      I think you misunderstand my quip, I'm refering to the teaching of a "Business Ethics" course. The very name implies that "business ethics" are somehow different from say "moral ethics" or "social ethics" and that there isn't just ethics. Furthermore the PR surrounding these classes makes it pretty clear that these Universities feel that there is something different about being ethical while running a bussiness and about being ethical in general.

      My theory is that the Universities are so over run by progressives, anti-moderns, and Marxists that running a business is generally considered unethical by the Liberal Arts faculty. As a result of internal politics, the Business program had to concede that business ethics is different from traditional ethics so that the LA faculty could go on their merry way preaching that business is by its very nature, unethical.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    9. Re:Business Ethics 0.99? by Anonymous Coward · · Score: 0

      Morality describes right and wrong, as defined by either harm or religion. Ethics describes rules of conduct that apply to particular positions of power and authority. (Ideally ethics prevent immoral use of authority, but it depends on how well written the code of conduct is.) For instance, corporate officers must warn investors of a major lawsuit they might lose, while that's not expected of doctors and their patients.

  17. culture of zero tolerance by Anonymous Coward · · Score: 5, Insightful

    the applicants, for the most part, are still 'just kids' and even as a woefully too well aged adult, I can still relate to the idea that taking a peek at 'hidde' information on a web site is not evil

    the proble is not the kids. i's this culture of zero tolerance which the otherwise liberal educational community has latched onto with a fervor one would normally expect from religous fanatics.

    back when i was attending college the attitudes were different. administration had a 'boys will be boys' attitude and was more concerned with helping us understand why certain activites were not acceptable, rather than striking us down like Zeus on the maountain.

    Based on the information I've encountered regarding this mess, there seems to be an extreme level of self righteous bigotry on the part of the 'adults'.

    Or perhaps they are just too lazy to do their job of education.

    1. Re:culture of zero tolerance by Anonymous Coward · · Score: 0

      apologies for missing characters. i'm afraid it's time for a new keyboard.

    2. Re:culture of zero tolerance by Anonymous Coward · · Score: 0

      apologies for missing characters. i'm afraid it's time for a new keyboard.

      Sorry, that's just unacceptible.

  18. Re:Heh by FEEBLE*BMX · · Score: 1

    Shhhhhhhhhhhh!

    Somebody mod this nitpicker down.

  19. URL "hacking" court case by Anonymous Coward · · Score: 2, Interesting

    Reuters were accused of hacking when they guessed the URL of an upcoming interim report from Swedish IT consulting firm Intentia. There's a Wired article about the incident.

  20. Admit Them by FEEBLE*BMX · · Score: 1

    Isn't the school looking for students who are smart enough to work their way around a problem? They should admit everyone who was able to find their way into the system. I guess they'd rather have students who just blindly do whatever they've been told.

    1. Re:Admit Them by Anonymous Coward · · Score: 0

      "I guess they'd rather have students who just blindly do whatever they've been told."

      Yes; They will be prepared for american society :)

      No need for people who can actually think.

    2. Re:Admit Them by mick_S3 · · Score: 1

      Their first assignment: Fix the piss poor implementaion that exposed sensitive information to unauthorized users.

      --
      A gin in the hand is worth two in the bottle.
    3. Re:Admit Them by mirqry · · Score: 1

      If one of these friends sent them a link and they blindly clicked on, which I'm sure is the explaination alot of them gave, thats pretty much just doing something random they were told without thinking it through. Maybe the kid that figured it out gets to stay, and the rest are out... That would be funny.

  21. Come on, this is stanfords own fault by donscarletti · · Score: 4, Insightful
    It is sad that most decision makers don't understand what "hacking" actually is. A security breech that allows information to be extracted is simply a process of asking for information in the right way. Whether they like it or not, their own computer told these applicants what they wanted to know because of a simple trick of asking the right question. Their computers were not told to protect the information and so it blabbed to these students as soon as it was cued. This particular hack is analogous to walking to a front desk and asking the receptionist the hypothetical question: "imagine for a second that today was the Sunday two weeks from now, now in that situation, what would you tell me about my Stanford acceptance?" and getting a reply. In that situation the result would be the receptionist that was fired, not the questioner getting punished, I don't see why it should be any different for its electronic analogue.

    Of cause no institution should be forced to accept students it doesn't want to, but morally speaking, these students have done nothing wrong. There are many immoral things one can do on a computer: sabotaging other people's systems, destroying other people's data among others. But finding out personal information by asking a gullible computer the right question is perfectly understandable. If Stanford want this data safe, they should fix their computers so it protects the data. Computers are remote controlled and pretty much do what their asked to do. One wouldn't leave a priceless Monet strapped to a remote control truck that every kid with a toy car can control, so why do people complain about their loose lipped computer squealing numbers to some kid who knows how to use a URL bar? The sooner people see computers for what they are: devices that are told what to do by more people than they should and forget about the whole trespass on private land metaphors, the sooner people might take some responsibility about dumb machines being given too much information. They probably will end up a lot safer in the long term. It really makes me mad when people blame others for exploiting their own gullibility.

    --
    When Argumentum ad Hominem falls short, try Argumentum ad Matrem
    1. Re:Come on, this is stanfords own fault by Otter · · Score: 1
      They understand your notion of ethics -- they're simply saying that they don't want students who hold that notion.

      I've been somewhat sympathetic to the students, who didn't do anything that was that blatantly inappropriate. But seeing the reasoning people deploy in their defense is making it clear why the universities decided that they offenders were facing a test and failed it.

      For example, let's say (and this happens constantly) a vendor mistakenly faxes sensitive information to us instead of to the correct client, one of our competitors. According to your logic, this is even more legitimately obtained information than the acceptance information, right? We didn't do anything -- it just appeared in the machine. We don't want people with that attitude working here because 1) they put the company at legal risk and 2) if they can rationalize crewing other people, they'll rationalize screwing us.

    2. Re:Come on, this is stanfords own fault by Xugumad · · Score: 2, Insightful

      Actually, if they had got the same information from the secretary, I would expect them to be punished. It's reasonably obvious they shouldn't have the information, and getting it through trickery is wrong. If they'd simply asked the secretary "Have I been accepted?", and they'd mistakenly told them, that would be different, of course.

      I hate this idea of "It wasn't protected enough, so it's okay". Yes, the website screwed up, but that doesn't mean it's right for the students to have accessed a page they were not meant to.

      Having said that, Stanford really need to make sure the people managing the website realise what went wrong, and why, and never make the same mistake again. There are too many coders out there who don't get simple ideas like verifying user input (let alone the input of hidden fields), and that needs to change.

    3. Re:Come on, this is stanfords own fault by fermion · · Score: 1
      This self serving rationalization is rampant, and though it has elements of truth, it ignores the commonly accepted notions of right and wrong. Leaving a valuable article out in the open and then having it stolen does not make the person who stole it any less a criminal. If a test is left on a desk, and some student takes it, the professor might be negligent, but the student is still violating ethics. And if the whole set of student files were left in an open office in an open file cabinet, the school might be negligent in protecting student data, but the person who looks at the data, or takes a copy, has still done wrong.

      And there are legal issues. Misrepresentation is illegal. When one puts a number on that URL, one is in fact representing oneself as that student. Now, again, the software should establish a protocol to insure security, and also that enough evidence so that action can be taken against the criminal, but that makes it no less wrong to misrepresent.

      But the crux of the mater is this. School is supposed to be about education., not about getting a sheet of paper. The problem with high School is that even among students who are mature enough to understand what education is, most are there to get a sheet of paper using whatever trickery is necessary. Therefore teachers have to waste time countering the tricks in the hopes that the student might learn something useful and not just go out into the world expecting to use more tricks to survive, i.e. phishing, spamming, or good old extortion.

      But as one gets into higher education, the tolerance for such tricks wanes. The requirement for universal education relaxes. if a student does not want to learn, the student just get failed and eventually goes away. Some students may be amoral and smart enough to continue the tricks, and thereby get through college and waste more of everyone else's time.

      And some of these might make it to graduate school, where the stakes are high and no one really wants these players around. Though most may still only be there for a sheet of paper, at leas three is understanding that the paper is given in exchange for hones work. And so the administration has evidence that some students are there only to play, only to get a sheet of paper, and will use whatever tricks to graduate, and may continue to use tricks in their work life to, for instance, inflate stock values, run competitors out of business, or the like. Are these the type of people that a good school, who is not desperate for students, want as their alumni. Of course not. These students are clearly going to be a waste of everyones time. They can go to some other school that have lower academic standards.

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    4. Re:Come on, this is stanfords own fault by the+morgawr · · Score: 1

      RTFA: The students didn't get the information because Stanford didn't post it (presumably, they were waiting until d-day). All they got was a screen that said that the information wasn't available yet. What upset Stanford is that the students tried to get the information, not that they succeeded.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    5. Re:Come on, this is stanfords own fault by DavidTC · · Score: 1
      When one puts a number on that URL, one is in fact representing oneself as that student.

      Did you not read the article? To do that, they already had to be logged in as that student, and the assertation is that they accessed their own records. They didn't misrepresent themselves, and there was no security failure that let them see other people's.

      The failure was the concept 'On date X, we will put a link within the system to this web page that already exists, so they can see their status', which is a fucking stupid form of security. And is trivially breakable by anyone who was paying attention last year.

      --
      If corporations are people, aren't stockholders guilty of slavery?
    6. Re:Come on, this is stanfords own fault by An+Onerous+Coward · · Score: 1

      "Not meant to" is the critical phrase here. Just because the administration really didn't want the kids to have access to the information doesn't mean the kids were aware that the rules were being violated. All they knew for sure was that the information could be accessed by simply sending the right URL. If I can access something by typing a URL, without any sort of authentication, I feel it's perfectly fair to work under the assumption that the site administrator doesn't care if I see it.

      Now, if the prior correspondence made it clear that the students shouldn't be trying to confirm their status early, and that drastic consequences could result, then they should accept the consequences. But it seems like that isn't the case.

      --

      You want the truthiness? You can't handle the truthiness!

    7. Re:Come on, this is stanfords own fault by winwar · · Score: 1

      "For example, let's say (and this happens constantly) a vendor mistakenly faxes sensitive information to us instead of to the correct client, one of our competitors. According to your logic, this is even more legitimately obtained information than the acceptance information, right?"

      As far as I know, it is legitimely obtained information. They sent it to you willingly. Now whether this is the LEGAL opinion, I'm not sure. And most people would probably not use it-I would sure hope they wouldn't in a business without running it by a lawyer. Of course, any intelligent person could use it and no one would ever be the wiser (or really prove it).... Hard to get the info out of your head once you have seen it. Now the person who faxed that info would probably be fired.

      However, that is not the case here. The students looked for their own info. If they looked up others, sure, I have no problem with the outcome. Otherwise, in the absence of an explicit agreement/understanding NOT to look for the information, I see no ethical/moral problem here.

      Let's face it, the students are probably suffering because they made the schools look bad. Leaving educational records lying about for anyone to access isn't legal. So it's CYA time.... Talk about ethics and morals.

    8. Re:Come on, this is stanfords own fault by donscarletti · · Score: 1
      Leaving a valuable secret out in the open and it is no longer a secret. This was no article, this was simply the information about whether someone had been accepted or not. That is a DUMB analogy and one of the many real world metaphors that obscure people's understandings of how the Internet really works.

      Secondly, these students had not set out to cheat the system, rather to find out something early. I remember what it was like when I was waiting to find out what university I was accepted into. My skin tingled with anticipation, fear and hope for a whole month while my family was trying to have it's last holiday together. After my experience (and the experiences of most students after high school) I think early resolution would be a temptation so strong for most students that it could not reflect poorly on their moral character to reach out and take it. Connecting this behavior to bad scholastic attitudes fits into the category of being a "self serving rationalization".

      --
      When Argumentum ad Hominem falls short, try Argumentum ad Matrem
    9. Re:Come on, this is stanfords own fault by Anonymous Coward · · Score: 0

      It wasn't just "Not protected enough" it was "Specifically available to the general public".

  22. User agreement? by l33td00d42 · · Score: 1

    These folks had to be logged in to access the info. Did they agree to a user agreement that said something about attempts to access information they aren't intended to have access to? If not, I say all bets are off and the students exhibited no dishonesty--especially since nothing was "stolen" except innocuous information. If they did accept such an agreement, I would say their actions were dishonest.

    1. Re:User agreement? by Khyber · · Score: 1

      Fully agreed. If it's not listed in the TOS, it's not applicable by law. Therefore, the university has no legal right/obligation to deny these students admission into the program, regardless of whether it was a setup or not.

      The only question remains, will these students file a lawsuit for unlawful discrimination, when technically nothing has been done wrong?

      --
      Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    2. Re:User agreement? by The+Only+Druid · · Score: 1

      "Therefore, the university has no legal right/obligation to deny these students admission into the program, regardless of whether it was a setup or not."

      Completely wrong. Universities have no legal obligation to accept anyone, so long as their reason for refusing entry isn't unconstitutionally discriminatory (remember, some discrimination is by definition constitutional). In fact, a university could easily (although this would be an immensely dumb thing to do) announce one year that it was just going to accept a randomly selected group from its pool as opposed to making any qualitative decisions. The only legal obligation the school has is to - having given an acceptance - to honor the acceptance so long as the student abides by the conditions of the acceptance.

      --
      "Stumble before you crawl"
    3. Re:User agreement? by The+Only+Druid · · Score: 1

      I forgot this last line:

      "So, since these schools by definition hadn't yet given the acceptance to these students (since, if they'd already received the acceptance, they wouldn't have checked out this site), there cant have been any obligation on the school's part. While it's true that once you mail an offer, you're obligated to honor that offer, it has never been interpreted that the posting of an offer without notifying the receiving party of the posting qualifies."

      --
      "Stumble before you crawl"
  23. Ridiculous by raxxerax · · Score: 1

    These students did nothing wrong. Typing in a URL and reading the web page returned is equivalent to calling ApplyYourself on the phone, asking for the results and listening to the answer. If they weren't supposed to have the results, it was ApplyYourself's responsibility to make sure that answer was "Sorry, you can't have that information."

    -Raxxerax

    1. Re:Ridiculous by fbjon · · Score: 2, Insightful
      Stop right there.

      Ask yourself, did the students do the Right Thing (tm)? Whether or not the admin, the company or whoever did a bad job of securing the information is a separate matter, which should be dealt with separately. The fact is that the students did the Wrong Thing ®, and the university don't want people like that. They don't want people who don't seem to have any moral spine, even though they might be good and intelligent students otherwise.

      A lot of people here seem to have this idea: "If it isn't encrypted, I'm allowed to read it. If it isn't secured, locked down, and guarded by the army, I'm allowed to break in." Or that it's the admin's fault for "letting me break in".

      Wrong, wrong, wrong. The admin may be at fault for not doing his job fully, but that has nothing whatsoever to do with the fact that the hacker has hacked. There are two faults involved, not one.

      Conclusion: if you hack into a system, you have hacked into a system. Don't make irrelevant excuses.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    2. Re:Ridiculous by FidelCatsro · · Score: 1

      But are they hacking into a system if the webpage is open to the public , though the url may not be published ,it was on the internet?
      Did they know the info was ment to be hidden ?
      Are they entitled to view personal info about themselves stored on a computer?
      Was it the wrong thing ?
      Honestly does harvard really have these standards or is it trying to cover its own back , it has often been accused of taking pay offs and inflating grades.
      And it has alot of graduates who wouldn't know the meaning of the word ethical if it slaped them in the face and tattooed it on there hand
      like Steve Ballmer , George W Bush (of WAR ON TERROR , and Enron fame) , Benazir Bhutto Exiled pakastani prim minister (corruption), Matt Damon(ok that one may be a joke) , Bill gates (world renowned for his ethical bussines dealings) ,Jeffrey Skilling(CEO of Enron) ,Yamamoto Isoroku(Perl harbour , though him being dodgy is subjective)..
      And several others

      --
      The only things certain in war are Propaganda and Death. You can never be sure which is which though
    3. Re:Ridiculous by ebuck · · Score: 3, Insightful

      Funny, some would indicate that if you place your information on a server DESIGNED to publish it through the internet, you have already published that information.

      Hence, even if you fail to adequately advertise that the information is available till a later date, the information is published and available to anyone who does enough diligence in the researching of it.

      By the same reasoning as Stanford would like you to believe, you cannot "find" a book and start reading it, you must first be given the book by it's publisher. Basically Stanford is indicating that if there's not a URL on thier web page pointing to another web page their server is offering, then the server isn't really offering the unreferenced web page. It's a non-sequiter, and Stanford will likely get sued over it, which is why it is so important to demonize the students and mold public opinion before they have a few hundered lawsuits on thier hand.

      And if you don't think it won't go to court, consider this. Stanford ACCEPTED these students, which is part of a contract that indicates should the students decide to pay Stanford and perform well in classes, Stanford will provide them with an education at their facilities. Now Stanford is claiming that viewing certain web pages they publish violates this contract. And instead of a person making this blunder on Stanford's part privately (where it is unlikely to cause big problems) he made the statement in the media.

      Stanford is in for some hard education, but I hope that there's not too much Alma Mater out there in the legal field to prevent it from being properly spanked on this one.

      You read this article, did you "Do the right thing?" How do you know that it isn't meant to be public knowledge? Read your argument more carefully, if you concede that "I'm allowed to read it.", then you're allowed. Period. End of story. It's not breaking in if your allowed. If someone made the mistaked of allowing it, they can't call you a criminal afterwards for doing what you were allowed to do.

    4. Re:Ridiculous by the+morgawr · · Score: 1
      > The fact is that the students did the Wrong Thing ®

      How did they do the wrong thing? Be specific and reasonable. Everyone who is claiming this keeps making some vague remarks, show me your reasoning explicitly. I'm willing to consider your point, but only if you posit a full arguement to that affect.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    5. Re:Ridiculous by fbjon · · Score: 1
      Looking at information you're not supposed to look at is doing the wrong thing. Since you have to jump through hoops in order to get an URL that will lead to this info, the students surely must have considered, "am I supposed to do this?", but wen through with it. Saying that "the students didn't know" is possible for sure, but I don't think it's realistic, they knew what they were doing, and that it's probably not a good idea.

      However, un-accepting already accepted students is overkill punishment in my opinion, but that's their choice. Would you propose that the students should get no punishment at all?

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    6. Re:Ridiculous by fbjon · · Score: 1
      But one can safely assume that the information wasn't supposed to be public. Even if the university has shady tactics and whatnot, it doesn't mean the students did the right and honorable thing. Also, the information isn't exactly private information.. or rather, not just private information. It's also internal information for the university, and they can do what they wish with the info until they decide to make it public.

      In this case, someone gained access to info they shouldn't have access to, and copied it without permission. (like warez, whoa!)

      Consider this: there's a government file lying about on the street with the words: "Top secret, for your eyes only, destroy after reading" printed on it. No matter that the information happens to be publicly acessible, you are still not allowed to read it, and it's not the right thing to do. Sure, someone should be flogged with a 9-tail and fired for dropping it there, but that's another matter.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    7. Re:Ridiculous by the+morgawr · · Score: 1
      > Looking at information you're not supposed to look at is doing the wrong thing.

      This pretext is not obvious. I can equally say, and some cultures do assert, that hiding information from the community is doing the wrong thing and therefor it is heroic to free it. Simply stating it will not make it so. Why is your statement true? What is your reasoning?

      > Would you propose that the students should get no punishment at all?

      The information seems irrelevent to the task of an admissions officer, and "punishment" assumes both wrong doing and responsibility or need to correct it. I don't buy any of the assumptions required to even ask that question.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    8. Re:Ridiculous by FidelCatsro · · Score: 1

      I think there is a strong case for the info being extremly important to these people as soon as its avaliable , IE: they are pinning their future hopes and dreams on going to the uni , if they are accepted or not could be very vital information.
      Speaking as myself here , I don't know what I would have done and I consider myself an extremly ethical person.The ammount of stress people can be under during the waiting period makes for a very uncomfertable situation...
      Its a rather gray area and this is the embodiment of temptation, I will say this as a definant though.
      Harvard is being very very petty about all of this ,Sure ban the ring leader or the person who did it first but i think throwing some slack the way of the rest of the folks is the only decent thing to do.

      --
      The only things certain in war are Propaganda and Death. You can never be sure which is which though
    9. Re:Ridiculous by fbjon · · Score: 1
      Isn't the decision whether or not the information is relevant with the officer who has the info? Why would it be right for a random student to decide on his own that the information should be his? Is it ok only because he was looking at info about someone else's decision pertaining to himself?

      Apparently, the uni feels a need to discourage this kind of hacking, thus the punishment. Security was lacking, but hindsight is 20/20.

      I also don't think that overly hackerish behaviour is good to encourage. Suppose they would have been readily accepted instead, with the comment: "Wow you guys are good, come on in!". Next thing you would have hordes of people trying to hack into the system, with varying intentions of trying to prove they are of the right stuff.

      I'm not saying that hacking in to a system should be severely punished like in this case, but they can't very well encourage it either. They way I see it, hackers are often made into martyrs on here on /., disregarding that the hacker might not actually have been doing exactly "heroic" stuff. I think the issue is that they were de-admissioned. I don't there would be much to discuss had the punisment been less severe.

      >"punishment" assumes both wrong doing and responsibility or need to correct it.

      Well, I'm saying they were wrong, and I'd wager that's the majority opinion of society. Saying that something is right doesn't make it right. Saying that "information wants to be free" in order to read through your kid sister's diary is just a bad excuse, and I think the same applies here.

      Consider: if you were applying for a job, and you hacked into their application system in order to get info quicker, would you complain if they didn't hire you after all, even if it said in the system that they would?


      Now, I just read another comment that said that the students were not accepted because they were caught. While it's kind of obvious, it does pose the possibility that the uni wanted better students, who wouldn't get caught in such a simple thing. Food for thought...

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    10. Re:Ridiculous by SA+Stevens · · Score: 1


      Stanford is in for some hard education,

      I doubt it. A pack of contrarians and information-libbertardians on a few web logs will sputter and fume. And life will go on.

    11. Re:Ridiculous by the+morgawr · · Score: 1
      All well and good. The University is a private institution and technically can do just about anything it wants to. That doesn't make them an authority on right and wrong, which is what we are talking about. > Well, I'm saying they were wrong, and I'd wager that's the majority opinion of society.

      You keep asserting this without any reasoning to back it up. I want to understand your reasoning, I couldn't care less about your opinion or your conclusion.

      Why is it that you feel it is wrong? An appeal to public sentiment isn't going to get you anywhere; it is easy to show that public opinion can be very wrong.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    12. Re:Ridiculous by fbjon · · Score: 1
      So on the contrary, do you say it's right? Why?

      I would say that if the students feel they have no obligation to follow Stanfords rules about knowing information, Stanford has no obligation to accept them either. You can say that Stanford is wrong in not accepting the students. I can agree with that, the punishment is unnecessarily severe. But just because Stanford is wrong doesn't make the students right.

      Now really, no-one's life is depending on this info, so saying that the students are absolutely wrong is incorrect, in my opinion. What I want to say is that they weren't right either. Since they entered into a grey zone, Stanford decided to screw them.

      Thus my conclusion is: the punishment was too severe. That's it. The students might have done the right thing from their perspective (althought I don't think they thought that way), but the uni disagreed.

      Ok, my reasoning about right/wrong: I have some info, but you can't know it. I'm not telling you the reason why, just that you can't. I'm writing the information on this paper here, and if you read it, I won't like it. If you go ahead and read it anyway because you feel it's not wrong, ok, that's your opinion. But my opinion is that it is wrong, so you ain't my friend.

      In this case, I think a better way to put it is this way:

      Stanford: wrong.
      Students: !right.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    13. Re:Ridiculous by the+morgawr · · Score: 1
      What you are effectively saying is that your definition of right and wrong has no basis what so ever other than your gut feeling. My $.02 since you asked: Stanford: Perfectly acceptable reaction in a moral sense. They can accept or reject whomever they wish for any reason. On the other hand, their reaction has no rational basis and is most likely very stupid in the long run.

      Students: Perfectly acceptable behavior in a moral sense. The information was presumed available, and of immediate and pertinant interest to them. However they were twarted, because Stanford hadn't posted the information yet. I cannot think of any reasonable arguement that can be made that this behavior was wrong.

      Additionally I find your assertion that what is right and wrong is simply a matter of opinion or perspective apalling. If your assertion were true nothing would be right simply because nothing could be wrong. That's taking subjective morality a little far...

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    14. Re:Ridiculous by fbjon · · Score: 1
      Hm, we seem to agree somewhat.

      I do think that 'right' and 'wrong' are a matter of perspecive, and that there aren't any absolute truths or wrongs. (heh, don't we all)

      As of your $.02: If Stanford wants to be this extreme, well it's their loss. I'd say that their reaction is acceptable, but extreme, and thus wrong. Wrong in the sense 'stupid', and from the students' perspective (probably), morally as well.

      I can't say that the students were wrong. They didn't crack any encryption or use force, the information was lying in a place were it shouldn't have been, and they took their chances. However, I can't say they were right either.

      Essentially, both were between right and wrong, on average. My whole point (I think), was that people were saying that the students did the right thing. This is something said about a lot of other cases, essentially arguing that "it's the sysadmins fault", and making it so that it's no-one elses fault.

      Although, the most irritating thing about this, is that the whole thing is so goddamned petty. It barely qualifies as "hacking"! I think that's also why it's hard to argument about 'right' or 'wrong', it strikes me as mostly ridiculous.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    15. Re:Ridiculous by the+morgawr · · Score: 1
      >it strikes me as mostly ridiculous

      Agreed

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    16. Re:Ridiculous by Anonymous Coward · · Score: 0
      Since you have to jump through hoops in order to get an URL that will lead to this info, the students surely must have considered, "am I supposed to do this?"
      Jump thropugh hoops? No more than when some tard misspells a URL in a link.
    17. Re:Ridiculous by raxxerax · · Score: 1

      If you hack, if you break in, then you should be punished, but is that was happened here?

      Information was published by an agent of the university on a publically accessible web server, and these students read that published information. If that's hacking, if that's breaking in, then arrest me now because I've done the equivalent at least a thousand times, and I'll do so again.

      There was no hacking here. There was no break in here. The information was published on the web, and understandably curious students read it.

      What's really going on here is blame deflection. This is admittedly an incident that should not have occurred. If the students are not to blame then where does the blame belong? On ApplyYourself, and in turn on those university administrators who trusted the application process to them. But of course, those are the very people who are now being asked where the blame belongs, so is it any wonder the blame is deflected to the students?

      -Raxxerax

  24. White/Grey/Black Hats..... by Khyber · · Score: 1, Interesting

    So.. these universities' reasns for not accepting/training potential white hats is because of what they did in the first place to prove a point?

    Not only does this sound idiotic, but this gives the potential "good guys" more reasons to be "bad guys" (AKA Black Hats.)

    The best course of action would be to accept these students, train them in the ways of ethical hacking, then give them a degree and place them in a field where they would be useful (There are many subdivisions of White Hats/Grey Hats/Black Hats, depends on the subject matter/programming language.)

    By not accepting these bright minds, and giving them the education/tools they need for a decent and "acceptable" life, not only are they throwing away the security of the next generation, but IMHO, they're encouraging the proliferation of a more negative generation of problems. While, to some point, this may be economically sound (Can't have good hackers without bad hackers, right?) I fail to see how in the short term (our current generation's economy) where this will be beneficial. These people will to some degree inherently cause problems for us if they don't have the ethical presence of mind to know what's "Good" hacking and "Bad" hacking.

    Again, I cannot stress how much Stephen Levy's "Hackers" should be a guiding book for these pupils. They'll learn exactly the original and "true" reasons for hacking. Information must remain public, asides that which is detrimental to any or many members of our society. Were this book a piece of core curriculum for college students, we'd have less problems as it is now, notwithstanding other unethical hackers from the USSR or China, or the Phillippines.... (No, I'm not just listing those out of spite, they're the proven most common occurances of unethical hacking recorded as far as countries go.)

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    1. Re:White/Grey/Black Hats..... by fbjon · · Score: 1

      Yes, but hacking into a banking system "just because it's possible" shows a lack of moral spine and respect for what's good, and what's not. This isn't a banking system of course, but the uni doesn't want people on that line of thought. Since, as you say, they don't have the ethical presence of mind to know Good hacking from "Bad", they chose not to deal with them, thus punishing them in a way. Their choice.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    2. Re:White/Grey/Black Hats..... by Bush+Pig · · Score: 1

      > By not accepting these bright minds ...

      Now come on, they're not bright minds, they're business students.

      --
      What a long, strange trip it's been.
    3. Re:White/Grey/Black Hats..... by nilecirb · · Score: 1
      The best course of action would be to accept these students, train them in the ways of ethical hacking, then give them a degree and place them in a field where they would be useful (There are many subdivisions of White Hats/Grey Hats/Black Hats, depends on the subject matter/programming language.)
      This might be a wise path to follow, assuming that 1) What they were doing could be considered hacking, and 2) That these students were even interested in pursuing a computer-related career.
  25. Poor Judgement or Hacking? by lord_lyrabas · · Score: 1

    Poor Judgement is a possibility here for sure. However, "hacking" is just plain crazy. They didn't hack anything and I agree with most of the postings that say that if anything, the schools should be going after the web people for creating such an insecure system. Did the schools prove beyond a reasonable doubt that the students were the ones that actually looked at the admissions status? Maybe it was someone else. If the students wanted to, I think they each may have a good case for going after the schools for libel and defamation of character lawsuits. Forcing the school to either "put up or shut up." Sounds like they were made examples of in the harshest of ways. And that just isn't right. The way the school handled the situation makes me wonder about it's own ethics.

  26. Well.... by Anonymous Coward · · Score: 0

    They did access information that the university decided to make public. If they went to the admissions office 5 minutes before it was set to open some morning, and walked in because the door was unlocked and the university appeared ready to do business, would they have expected a different reaction. Hey wait, did I just shoot the point I was trying to make in the head?

  27. Re:Heh by jwdb · · Score: 2, Insightful

    Are you sure? "Not one was accepted" I can see, but "None was accepted" just doesn't sound right.

    None may very well be singular (and even that is disputed - see your own link), but it refers to a group - can you therefore not use it in conjunction with a plural verb? I'd put it in the class of words like 'they', which aren't singular or plural themselves but get their number from the concept they embody.
    It may be the contraction of 'not one', where singular is definitely used, but none is a fully independent word nowadays and, in my opinion, should be viewed separately from its origins.

    On the other hand, the 'was' is part of a quote, a situation where normal grammar rules can become warped.

    Jw

  28. In a litigious society... by longword · · Score: 1

    How long before a rejected student takes legal action against a school, ApplyYourself or both?

    1. Re:In a litigious society... by Anonymous Coward · · Score: 0

      should happen even in a non litigious society, these potential students have been falsely accused of a crime they did not commit that has potentially cost them a place at the university of their choice. defimation of character, simple as that.

  29. If the 80's have taught us anything..... by Anonymous Coward · · Score: 0

    It's that "a sense of ethics" is indicative of a lack of good judgement.

  30. Re:Heh by bersl2 · · Score: 1
    The indefinite pronouns (http://englishplus.com/grammar/00000027.htm):

    Singular: another, anybody, anyone, anything, each, either, everybody, everyone, everything, little, much, neither, nobody, no one, nothing, one, other, somebody, someone, something

    Plural: both, few, many, others, several

    Singular or Plural: all, any, more, most, none, some

    For indefinite pronouns that can be singular or plural, it depends on what the indefinite pronoun refers to.

    Correct: All of the people clapped their hands.
    (All refers to people, which is plural.)

    Correct: All of the newspaper was soaked.
    (Here all refers to newspaper, which is singular.)


    Well, that example still doesn't explain this.

    I love English! :D
  31. "Morality" and the great academic monolith... by mosel-saar-ruwer · · Score: 4, Insightful

    Who is morally corrupt in this scenario i ask...

    Your modern-day University autocrat has about as much use for morality as a fish has for a bicycle.

    This is all about the elites that govern these institutions - they were embarrassed* by the applicants, and now it's payback time.

    ----------

    *Although, for the life of me, I don't see how this** sort of thing would embarrass a normal person, but that just goes to show you how introverted, self-obsessed, narcissistic, and arrogant these monomaniacal little twits really are.

    ----------

    ** i.e. typing a URL into a browser with the hope of finding out information ABOUT YOURSELF - information that, in theory, BELONGS TO YOU. Reminds me of hospital administrators who try to ban patients from reading THEIR OWN CHARTS, as if the medical records belonged to the hospital, rather than to THE PATIENTS THEMSELVES.

    Just thinking about these kinds of people makes my skin crawl.

    1. Re:"Morality" and the great academic monolith... by Anonymous Coward · · Score: 0
      Your modern-day University autocrat has about as much use for morality as a fish has for a bicycle.

      This is all about the elites that govern these institutions - they were embarrassed* by the applicants, and now it's payback time.

      If it weren't for the faggot format of your post, I'd totally mod you up. I guess petty requirements extend outside of academia.

    2. Re:"Morality" and the great academic monolith... by The+Only+Druid · · Score: 2, Insightful

      "** i.e. typing a URL into a browser with the hope of finding out information ABOUT YOURSELF - information that, in theory, BELONGS TO YOU. Reminds me of hospital administrators who try to ban patients from reading THEIR OWN CHARTS, as if the medical records belonged to the hospital, rather than to THE PATIENTS THEMSELVES."

      Here's the thing: not all information about you belongs to you. Think abouut it like this: suppose I know you, and I form an opinion about you. Does my opinion about you belong to you? Do you have some right to demand that I inform you of my opinion? Of course not. These decisions by admissions committees are the same thing: they are opinions about the applicant formed by a private group of individuals. While you certainly have the right to be informed of that opinion within the schedule of the application process, you have no right to demand access to the opinion prior to the contracted release date. What these people did was break into a system to extract private information about them that didn't belong to them.

      The analogy to the medical records is specious at best, and arguably a straw-man (since the anlogy fails so much that it may be viewed as an intentional effort on your part to deflect proper attention).

      --
      "Stumble before you crawl"
    3. Re:"Morality" and the great academic monolith... by mantako · · Score: 1

      "extract private information"

      Private information should not be located at a public url. Anyhow, IMO, Stanford did this to draw attention to the students instead of the fact that there was a mistake on their part.

    4. Re:"Morality" and the great academic monolith... by The+Only+Druid · · Score: 1

      I posted nearby that I fully agree that the company these schools contracted with (not Stanford, HBS etc. themselves) did indeed make mistakes, and should indeed be punished. Their wrongdoing however does nothing to eliminate the students' wrongdoing (although, also as I noted elsewhere, it does reduce it to some degree albeit not enough to merit permitting their acceptance).

      --
      "Stumble before you crawl"
    5. Re:"Morality" and the great academic monolith... by Anonymous Coward · · Score: 0

      Actually most doctors believe that patient data is their property and not the property of the patients. It's their "ip".

    6. Re:"Morality" and the great academic monolith... by quarkscat · · Score: 1

      The parent poster is "spot-on-target".

      It is, however, refreshing to see some (albeit small)
      improvement in addressing ethics and morality at
      American business schools. After all the corporate
      financial shenannigans of AOL, Adelphia, Enron,
      Global Crossing, Wachovia, and Worldcom, I was
      beginning to believe that Break-the-Law 101 was
      part of business school curriculum. (Okay, so
      they actually changed it to Ethics 101, right?)

      American corporations have all the rights of the
      individual, but none of the legal liabilities.
      Until that changes, it will be "business" as usual.

    7. Re:"Morality" and the great academic monolith... by turbidostato · · Score: 1

      " I was beginning to believe that Break-the-Law 101 was part of business school curriculum"

      Oh, of course it is!

      The question here is they are not going to teach not even Break-the-Law 101 to people so naive to give themselves trapped by such an obvious evidence (they used their own login/pass!). It is a matter of choincing only "best quality" for their Bussiness School.

  32. Re:Heh by Tim+C · · Score: 1

    Does none refer to a group, or to each individual member of the group?

    In either case, I think you'll find that "none of the applicants was" and "none of the applicants were" are both acceptable, but the former is definitely correct, even if the latter is.

  33. I wouldn't want to employ those people by samael · · Score: 1

    "All they did was akin to walking up to an unlocked filing cabinet and rifling through it."

    If you can't trust staff to not go rifling through the filing cabinets, you don't have much trust around the office...

    1. Re:I wouldn't want to employ those people by ConceptJunkie · · Score: 2, Insightful

      A better analogy would be if the filing cabinets were left out in the parking lot.

      If I spray paint my salary on my front door, I can't complain when my neighbors know how much money I make. Even if I do something like "I make $100^2" instead of $10000.

      Was it unethical? I'd have to say yes, but who hasn't hacked URL's if for no other reason than to navigate a poorly designed site.

      I found an online vendor who put the price in the URL, I was able to put items in by shopping basket for any price I wanted. I didn't try to buy them like that, and I notified both the vendor and the maker of the web commerce package.

      Ironically, the vendor did not seem concerned. They figured if someone tried that they would notice.

      --
      You are in a maze of twisty little passages, all alike.
    2. Re:I wouldn't want to employ those people by grazzy · · Score: 1

      Having tried the above (but only by changing the price slightly), I can say it works just fine ;)

    3. Re:I wouldn't want to employ those people by tomhudson · · Score: 1
      the most minor change you can make would be to change from a positive to a negative amount :-)

      Get your merchandise AND a "refund" of the amount you never paid.

    4. Re:I wouldn't want to employ those people by Cylix · · Score: 1

      There was an article about this some time ago.

      High volume sites were simply not able to check every transaction and with these types of coding failures... bad things can happen.

      I was surprised by just how many vendors that did work on. In the end, all they could really do is go back over their transaction logs and look for grievious errors.

      --
      "You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
    5. Re:I wouldn't want to employ those people by caino59 · · Score: 1

      If anyone should be in hot water - it should be the people responsible for securing the information and results in this situation.

      The means to view the info was/is extremely trivial and requires no 'hacking' experience.

      Shame to see so many denied just because curiosity got the best of them.

      Seriously, I bet that if say..the administrators were able to have access to a report on their health condition online,prior to hearing the news from their doc, through a simple change in a URL - they'd probably be all over it.

      Wouldn't you want to find out as soon as humanly possible for something that is regarded as a life changing experience?

      That's what college is after all...

    6. Re:I wouldn't want to employ those people by ArsenneLupin · · Score: 1

      Care to post an URL? I'm in dire need of cheap goodies!

    7. Re:I wouldn't want to employ those people by Alsee · · Score: 1

      but who hasn't hacked URL's if for no other reason than to navigate a poorly designed site.

      What a classic "Only on Slashdot..." comment. Grin.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    8. Re:I wouldn't want to employ those people by ConceptJunkie · · Score: 1

      Yeah, well, the university can just invoke DCMA and everyone goes to jail.

      And even though that really isn't true, it probably will be soon.

      --
      You are in a maze of twisty little passages, all alike.
  34. Stanford's liability? by Sam+Nitzberg · · Score: 2, Insightful

    Although the prospective students have been penalized by Stanford, there is something that I don't quite understand.

    It seems that Stanford made this information (acceptance status) available by entering a (guessable) address.

    Until this information was issued formally to the student, Stanford apparently considered this information confidential.

    By not utilizing an effective password / security system, Stanford then effectively made this information publicly available.

    One could argue that any student would have a right / entitlement to know what information on himself / herself was being made publicly available - especially if the information were supposed to have been confidential.

    It is arguable that Stanford effectively violated the privacy of the students, but is prepared to punish the (prospective) students for obtaining the information it made publiclay available.

    1. Re:Stanford's liability? by t_allardyce · · Score: 1

      In the US you don't have that right.

      --
      This comment does not represent the views or opinions of the user.
  35. Re:Heh by Guido+del+Confuso · · Score: 2, Insightful

    None may very well be singular (and even that is disputed - see your own link), but it refers to a group - can you therefore not use it in conjunction with a plural verb?

    You can if you want--it's an accepted usage as well. I normally wouldn't though. "None was" sounds perfectly fine to me. A lot of things that are correct may not sound right at first--"the data are" for example.

    By the way, it's not disputed that "none" is singular. If you read the link carefully, you'll see that both the singular and the plural are accepted usages. My point was that the original poster was trying to nitpick a grammar point that was actually the correct (and, in fact, is generally considered the "more correct") usage.

  36. Re:Heh by jwdb · · Score: 1

    I'd tend to disagree that the 'was' usage is correct.

    If you look at the links provided by other posters, it's claimed that 'none' is an indefinite pronoun, both singular and plural. The exact number therefore relies on with which word it is used.
    Now, look at the complete subject of the sentence you gave - "none of the applicants". None is used to define a subset of applicants (an empty set, but a set nontheless) and is therefore clearly plural in this case. This is a side effect of the construction "___ of the ___", which will always produce a plural subject.

    As for other constructions; I'm no english teacher, but I cannot for the life of me remember another way to use none in the subject, excluding by itself where the "of the" is implied. If you look at the parent phrase "not one", it can be used in a singular subject of the form "Not one [singular noun]", but 'none' cannot be used in this way.

    If the 'was' usage is acceptable, it is clearly only due to past usage and is an exception in the english language.

    Of course, if you can find a usage of none as part of a singular subject (as indefinite pronoun, not as proper noun naming the word itself), I'll admit that this is all a load of hogwash.

    Jw

  37. Sort out the mediocre ones by mnmn · · Score: 1

    So only the 'best' hackers are allowed into Stanford, ones who werent caught?

    --
    "Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
  38. Their choice? by t_allardyce · · Score: 1

    The issue is that Stanford regards this as the equivalent of being asked to wait at an office while someone is away and quickly taking a peek at the list of results lying on their desk. They clearly expected reasonable privacy and you knowingly violated that privacy, now imagine if that list was turned over face-down, or if it it was in a folder or a draw, the violation would be even clearer. Translating this to the Internet is hard and debatable: the user was 'logged in' (aka invited into the admissions office), the information should have been secured, but then the piece of paper should at least have been turned face down or put in a draw. If they hadn't been logged on it would have made a slight difference, at the end of the day, both parties are in the wrong - Stanford failed to use basic security and the students took advantage of that failure. Typing a URL should never be illegal, but the actions you choose to make in front of people who will decide your admission to a university will obviously affect their decision, if you told them to fuck themselves would you expect to be accepted?

    --
    This comment does not represent the views or opinions of the user.
    1. Re:Their choice? by An+Onerous+Coward · · Score: 1

      In your analogy, what is the functional equivalent of the person sitting at the desk? What was guarding the information, and telling the students, "You're not allowed to see this"?

      For that matter, what is the functional equivalent of the desk itself? In real life, when I put something on my desk, it implies that it's mine, or at least that I'm using it right now and you shouldn't go snooping. What functioned as the demarcation between the information on the server which the students were allowed to access and the information they were forbidden from accessing?

      On any decent system, that function is served by authentication. If they'd had to type in a stolen username and password to get to the information, that would be an obvious violation. But if I had been waiting for months to find out if I'd been accepted, and then a friend sent me a URL I could use to find out, I'd probably have clicked through before I'd even considered that there might be an issue.

      --

      You want the truthiness? You can't handle the truthiness!

    2. Re:Their choice? by t_allardyce · · Score: 1

      I'm assuming that students knew they would have to wait for the results, reasonable expectation of privacy would be expected and if you figured out that you could change the URL to get this information which was not otherwise posted or linked then you would be snooping. But this isn't a legal issue, if you snooped around someone's desk you probably wouldn't be breaking the law, but you could expect them to be pissed off and its the same in this case - they certainly weren't breaking the law, but they should have given it a few seconds thought. Even the people who looked after the URL was posted knew that this was a mistake and shouldn't be available to them.

      The problem is that on the Internet your desk is basically a reception desk that anyone can walk past. If you leave something on the counter you can't expect privacy, but if you leave it under the counter or in a draw, you have reasonable expectation that no-one will lean over the counter while you're away. However if someone does, then you are both in trouble because it's your incompetence for not locking it away. If you have a private office you can expect the people you invite in to be more trust worthy, but the principle still applies if someone leans over your desk - if you don't want people to see it, keep it secure.

      --
      This comment does not represent the views or opinions of the user.
  39. Re:Heh by jwdb · · Score: 1

    Good point about the original poster, and you're correct about the accepted usage, but for me anything that is supposedly correct but just sounds wrong sets off alarm bells.

    I just posted another comment to this thread about how I believe that 'none' cannot be used in a singular manner and thus the was usage is an irregularity in the language left over from 'not one'.
    http://slashdot.org/comments.pl?sid=151031&cid=126 69287

    As for 'data are', isn't that a special case where the singular and plural are the same? "The data is" is correct when referring to a single data set, "The data are" correct when referring to multiple datas. I'd also note that "The data are" is rarely used, mostly replace by "The datasets are" or some similar word to indicate multiple blocks or sources.

    Aah, the irregularities of the English language... Makes life interesting

    Jw

  40. Look by MotorMachineMercenar · · Score: 2, Insightful

    I know cheating is something of a sport these days, often performed almost competitively and without second thought to ethics. But when all the highest rated replies to this story are people defending the actions of those students who gained unauthorized access to that information, that's too much.

    What these (prospective) students did was wrong. Period. They willingly and knowingly gained unauthorized access to information that was not theirs to access. I generally hate analogies but here goes: if these students found a key to their professor's room and snuck in to check on their exam results, do you think there'd be a furor as to whether they are guilty of cheatin or not?

    Now, whether that access gives them an unfair edge like cheating in exams does is irrelevant. Also, whether these students knew they were "hacking" or not is irrelevant. I am positive every single one of them knew of how the status of their application was to be informed to them, and I'm positive that didn't include manipulating the URL or getting instant messages from friends about how to do it. Just the act of getting access to these records is the offense.

    The conclusion is that these students deserved the punishment they got. I am also very happy to learn that there are other schools than my alma mater which take honor of their students (and faculty) seriously.

    I'm afraid the reaction to this story on /. is a reflection of the corrupted morals of western nations (and increasingly elsewhere). For many of you cheating through life is an easy way out and a deliberate choice, but I know I will be a better man if I go through my life honorably.

    --
    "We have an A-Bomb...what more do you want, mermaids?" --I.I. Rabi, speaking in defense of Robert Oppenheimer
    1. Re:Look by Anonymous Coward · · Score: 0
      I'm afraid the reaction to this story on /. is a reflection of the corrupted morals of western nations.

      50% saying "Who the fuck cares?" and making retarded non-sequitur justifications for this behavior, and 50% preening like self-righteous twats, making grand proclamations about business ethics and morality.

      Sounds about right...

    2. Re:Look by Detritus · · Score: 1
      What if the exam results were mistakenly posted on a public bulletin board. Would it be "cheating" to look at them?

      If you get drunk, and brag about killing your spouse, is it immoral for a bystander to pass that information on to the police?

      --
      Mea navis aericumbens anguillis abundat
    3. Re:Look by Anonymous Coward · · Score: 0

      Your analogy is off. It should have been: if these students found a their professor's room wide open with the exam results visible on the desk, in an open organizer, would the professor even dare to complain to the dean? Would he not just get the response that he should've left his room locked, or taken the organizer with him?
      You should also take into account that the students have all lived outdoor for their entire lives, and don't really understand the value of privacy that western culture attaches to rooms.

      I admit, the students probably knew that the professor didn't want them to go into the room and that may still make their actions morally wrong, but the fault on Stanford's part is so much greater that the attitude they have taken here makes my skin crawl. This is a tiny immorality comparable to looking at the woman living across from you when she's undressing in a brightly lit window. It may be wrong conceptually, but only because you should first assume that she doesn't want people to see her, which is far from obvious, and then consciously avoid your eyes from the window as you go on with your business.

      As a reply to your sudden and completely irrelevant jump to the morality of western states. If you go through life never testing your beliefs, never questioning your assumptions, just constantly applying some moral code with feverish rigidity, never allowing it to bend or judging a situation on itself, It don't think that makes you a good person. In fact that kind of thinking inhibits your own development and forcing your way of life on others (passively, though it may be) inhibits the development of mankind. You sir, are holding humanity back.

    4. Re:Look by Legion303 · · Score: 1

      "if these students found a key to their professor's room and snuck in to check on their exam results, do you think there'd be a furor as to whether they are guilty of cheatin or not?"

      Probably not. If they had snuck into a locked room to look at the answer key before the test, there probably would be. From what I understand, their knowledge of their admission status had no impact on that status until the colleges decided to bar all of the students involved from admission. It's kind of ironic, really.

    5. Re:Look by alienw · · Score: 1

      Trust me: if someone catches you going somewhere you are not supposed to, there will be repercussions. At the very least, this is trespassing. However, this is also known as breaking and entering and burglary.

    6. Re:Look by Anonymous Coward · · Score: 0
      What if the exam results were mistakenly posted on a public bulletin board. Would it be "cheating" to look at them?

      It wasn't a public bulletin board; to access the status required URL crafting/forging. The analogy would only be appropriate if you replace "public bulletin board" with "unlocked file cabinet"

      If you get drunk, and brag about killing your spouse, is it immoral for a bystander to pass that information on to the police?

      Not at all, but how does crafting a URL compare in the slightest to listening to a drunk guy talk about committing crimes?

    7. Re:Look by AK+Marc · · Score: 2, Insightful

      I know cheating is something of a sport these days, often performed almost competitively and without second thought to ethics. But when all the highest rated replies to this story are people defending the actions of those students who gained unauthorized access to that information, that's too much.

      What is "cheating?" You equate "unauthorized access" (which is quite funny because to get to their page, they had to enter their username and password, no other username/password from a student or anonymous access was allowed, so they were explicitly "authorized" to see that page) with "cheating." Cheating is manipulating your grade or outcome. If you steal the test before given to gain knowledge of the questions, that is cheating. If you take in notes to aid you while taking the test, that is cheating. If you alter your grade after the test, that is cheating.

      What isn't cheating is seeing your test on the professor's desk, then taking a peek at your test to see what you got before it is handed back.

      They willingly and knowingly gained unauthorized access to information that was not theirs to access.

      It was information that only they (and presumably administrators) could access. They had to be authenticated. The information was information put up on the web site explicitly for them to view. So, I'm curious how it was "unauthorized access" and not information they were supposed to know?

      The best analogy I can come up with out of all this is if a professor left the results of a test out where everyone looking through his window could see them. The first person walking past noticed that he could see his grade, so he let others know that there grades were done and available and you didn't have to wait until they were posted to see them.

      Is it cheating to see your grade on the desk before it is posted? Is it wrong to know something they presented in the final form for your consumption, just that they were careless and left it where everyone could check their own grade early?

      I'm afraid the reaction to this story on /. is a reflection of the corrupted morals of western nations (and increasingly elsewhere). For many of you cheating through life is an easy way out and a deliberate choice, but I know I will be a better man if I go through my life honorably.

      So I guess it was "cheating" when I asked my boss what was going to be in my performance review before HR officially gave it to me. I guess it was "cheating" when I extrapolated this weeks movie times to next week to plan activities. After all, learning something that people want you to know is obviously "cheating" if you don't learn of it in some specific arbitrary manner. The real tradegy is the outporing of moral absolutism. Well, that and the gross misuse of the word "cheating." But that is standard on Slashdot, to misuse a word in order to conjure up more negative images than what really happened. It seems that the schools are over reacting to cover up the fact that they used a service that failed to deliver what they promised. The service used posted the informatino before it was intended to be viewed. If that is what the schools are upset about, then they need to drop their service, not punish the people that accessed the published information they were supposed to see.

      Just to make it clear:
      They were given access to a site.
      They authenticate to the site.
      They access information that was posted with the intention of them seeing it.
      They are banned because of the timing of seeing the information that was posted for them to see.

    8. Re:Look by IIH · · Score: 1
      What these (prospective) students did was wrong. Period. They willingly and knowingly gained unauthorized access to information that was not theirs to access.

      Why was it unauthorized? They asked the college web server for information, and it gave it to them. They didn't "hack" into it, changing the URL's just asked the websever for different information. Plus the infomration was theirs, they were going to get it in a day or two anyway.

      I generally hate analogies but here goes: if these students found a key to their professor's room and snuck in to check on their exam results, do you think there'd be a furor as to whether they are guilty of cheatin or not?

      Bad anologoy, IMO, that comes across as if they hacked in with a stolen password, or similar.

      For an anology, try this: someone found out that the Prof's secretary had the results early and would tell you if you asked. Someone leaked this fact, and some students went and asked the secretary. Should they be punished for finding out their results, just because the Professor didn't tell his secretary not to release the results yet?

      How is getting information by asking the right question from the right person any different by getting information from the right server by sending the right request, and how is that wrong?

      --
      Exigo spamos et dona ferentes
    9. Re:Look by redzebra · · Score: 1
      They willingly and knowingly gained unauthorized access to information that was not theirs to access. I generally hate analogies but here goes: if these students found a key to their professor's room and snuck in to check on their exam results, do you think there'd be a furor as to whether they are guilty of cheatin or not?

      Like you say most analogies fail completly. As does yours. Web servers are generaly considered more as publishing things like newspapers then as file lockers. It's not because you put something out on page 3 without putting a big header on the front page that people won't read it.

      I couldn't care less for the students but any corporation being so stupid to put their new designs onto a webserver iso into a safe most likely will go out of business and deserves it too.

      Ethics have nothing to do with all of this, nor honor. In contrary. This does only show that Stanford does the same as many bussiness today. In stead of admitting they made a mistake putting info on public places, they make meaningfull words as ethics and honor sound hollow and try hide behind it. Maybe that's at least part of the reason why people here show their suppport.

      red.

    10. Re:Look by burdalane · · Score: 1

      I'm not sure if what those students did was wrong, but I do know that if I were in their situation, I would have done exactly the same thing. I love playing with URLs to obtain information that I shouldn't have, ethics be damned. I find it ironic that people spout on about ethics when they continue committing the most unethical act of all, continuing to produce lifeforms with the intent of forcing them to live, work, and die. Compared to that, getting unauthorized information through the Internet seems extremely honorable.

    11. Re:Look by Anonymous Coward · · Score: 0

      I generally hate analogies but here goes: if these students found a key to their professor's room and snuck in to check on their exam results, do you think there'd be a furor as to whether they are guilty of cheatin or not?

      That's a bad analogy. Imagine that there is a bulletin board in a public place they could check to see the results after a certain date. Now, imagine if some of the students went over to it early, and found that the results were already posted, just another piece of paper had been taped over it. So they took a peek under the paper.

  41. From ApplyYourself's website... by Anonymous Coward · · Score: 0

    Our team is skilled in the integration of technology and business processes that help maximize both effectiveness and ROI, resulting in a better applicant experience, higher quality applicants, more applicants, quicker decision making, and accurate timely reporting.

    The ApplyYourself i-Class decision toolkit satisfies your most anxious applicants and saves your staff time and effort by allowing applicants access to acceptance decisions, through their secure online application account.

    Sure sounds like it to me!

  42. They're obviously MBA material! by Anonymous Coward · · Score: 0

    MBA applicants. Unethical behaviour. Don't admit them, just hand them diplomas!

  43. Wow... by Anonymous Coward · · Score: 0

    "I'm not a lawyer, but I certainly know right from wrong."

    As an employee of the Office of Admissions at a public university, I know that students love our status check system. Of course, it usually only takes about 2 days to approve undergrads, so we only have the status check for graduates and international undergraduates.

    I cannot imagine how it could be "right" to reject students for this, unless the intention is to weed out the one "hacker" who originally figured it out. If that was the case, ban the first one to do it. I'm also a little concerned why they haven't immediately canceled service with "ApplyYourself", though I imagine they have a contract and it'll be up at the end of the year.

    Stanford just annouced to the world, with this action, that they don't wish to employ the very best Knowledge Workers that are currently available. Congratulations and thanks, Stanford, you're making us other universities look great!

  44. What they did by Anonymous Coward · · Score: 0

    Was to ask "did I pass" and then listen to the response.

    OK, technically, the webbrowser did. The idea is identical. The site didn't *have* to tell them.

  45. learned something? I hope so by portwojc · · Score: 1

    As an educational institution, we hope that the applicants involved in this incident might learn from their experience.

    I hope the educational institution might have learned something too. Like have a secure system.

    Sure temptation is there and control should have been exercised. However it is really stupid just to brush everyone or any of them aside. It's just like the rules now days where the punishment is the punishment because you don't have to think.

    No one gains a thing out of it. Well except Berkely. They gain some more people cheering for them when they play Stanford.

  46. bad precedent by cahiha · · Score: 1

    The applicants were evidently viewing publicly accessible pages, protected only because the applicants didn't actually have a link to them yet. Furthermore, the URL wasn't something obscure, it was a plain-text reference using the same applicant ID as all the other pages, just a different page.

    If viewing those kinds of pages violates anybody's rules, then that's a bad precedent. The intent of the applicants may have been bad, but punishing them for this sort of innocuous URL manipulation sets a bad precedent for the entire WWW.

    The people who should get "rejected" are the people who created the web site: obviously, ApplyYourself.com is incapable of creating a minimally secure web site. Is a site with such poor security acceptable to Stanford, Harvard, and other universities to handle sensitive personal data? What does that say about the integrity and ethics of those universities?

    (We are actually looking for an outsourced service like ApplyYourself--does anybody know of more reputable alternatives?)

    1. Re:bad precedent by fbjon · · Score: 2, Insightful

      I don't think it sets a precedent to anything. Anyone's free to type in any URL they want, but that doesn't mean you should. Just because it's easy to do wrong doesn't justify it. Lack of moral integrity is lack of moral integrity.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    2. Re:bad precedent by Anonymous Coward · · Score: 0
      I don't think it sets a precedent to anything. Anyone's free to type in any URL they want, but that doesn't mean you should. Just because it's easy to do wrong doesn't justify it. Lack of moral integrity is lack of moral integrity
      Wow! This is so deep that it's scary. Likewise, anyone is free to call an unlisted phone number, but that doesn't mean you should. Ethical and morally upstanding citizens should call only the numbers that are listed in the white pages.
    3. Re:bad precedent by fbjon · · Score: 1
      Wow! This is so deep that it's scary. Likewise, anyone is free to call an unlisted phone number, but that doesn't mean you should. Ethical and morally upstanding citizens should call only the numbers that are listed in the white pages.

      Good point, but this is not a random phone number/url, it's an url with the specific intention of getting at information that the uni doesn't want them to have. And the uni didn't like that.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    4. Re:bad precedent by cahiha · · Score: 1

      Forget about the students. The problem is that the university put highly personal information on a public site without protection and that they aren't even admitting wrongdoing--they are trying to cover it up by pretending this was a group of "hackers". That is by far the greater problem here; that kind of ignorance and negligence is at the heart of the rampant security and identity theft problems we are having.

  47. Re:Heh by Anonymous Coward · · Score: 0

    As for 'data are', isn't that a special case where the singular and plural are the same?

    No, the singular is datum.

  48. Advice to Stanford alums by l00sr · · Score: 2, Insightful

    If you wish to register your disgust with Stanford's actions here, you might want to hit them where it hurts. Write other alums, perhaps circulate a petition, and threaten to withhold donations (or maybe just earmark donations specifically NOT to be used for the business school) until it changes its stance. Better yet, tell them you'll give them an opportunity to explain their actions, and that you might reconsider based on how satisfactory their explanation is :).

  49. Re:Heh by Bush+Pig · · Score: 1

    The datum is - the data are. It's Latin for "what is given".

    --
    What a long, strange trip it's been.
  50. Re:Heh by NemosomeN · · Score: 1

    Wrong. "None" is a special case either way pronoun. None of the cake was eaten, and none of the students were eaten. "All" is the same way. Nobody is singular always (As with everybody).

    --
    I hate grammar Nazi's.
  51. Agreed. by mosel-saar-ruwer · · Score: 1

    the faggot format of your post

    Yeah, but the more I thought about it, the angrier I got.

    That's why it was kind long winded. With footnotes, no less.

    PS: Since when do ACs get mod points?

    1. Re:Agreed. by Anonymous Coward · · Score: 0

      PS: Since when do ACs get mod points?

      Since always. Slashdot is actually run by a secret cabal of ACs. Taco is just a figurehead.

    2. Re:Agreed. by Anonymous Coward · · Score: 0

      Some of us are even rock stars. Go do a search if you don't already know.

      You need to learn to preview your post, even AC's know to do that.

    3. Re:Agreed. by Anonymous Coward · · Score: 0

      He doesn't need to do anything you try and tell him to do. And, no, you're not a rock star. You're just a wanker AC here on Slashdot. Just like me.

    4. Re:Agreed. by Anonymous Coward · · Score: 0

      I always post anonymously (my name doesn't make my ideas any more or less valuable) and I have mod points right now.

  52. Let's ask the man on the street by blair1q · · Score: 2, Funny

    "We're shocked - SHOCKED! to find that b-school applicants have no integrity."
    --American Business

    1. Re:Let's ask the man on the street by Anonymous Coward · · Score: 0

      Play it again blair1q...

  53. Re:Heh by jwdb · · Score: 2, Interesting

    Not in the common usage of the word. 'Data' as I understand it has come to represent a collection of information, the collection being a thing itself. In this sense, 'data' is singular. Datums is no longer in common use, as far as I know.

    Of course, common usage isn't everything, but it is what eventually defines a language.

    Jw

  54. Re:Heh by jwdb · · Score: 1

    Quite possibly, but that is not the meaning that is in use today. I can clearly see where it's coming from, but as far as I know datum is no longer used seeing as data is usually not considered divisible. A single data point is rarely useful, and thus the word data seems to have evolved to represent a block of datums instead of being the plural of datum.

    Of course I'm no english language professor, but isn't it common use that defines a language?

    Jw

  55. Only 4 by Anonymous Coward · · Score: 1, Funny

    Let's say SBS has an acceptance rate of 10%.
    So of those 41, only 4 would have gotten in anyway.
    What's the big deal?

    Stanford decided to sacrifice 4 people to make
    themselves look good and ethical and get some PR.

    Do I get accepted now?

  56. Simple: Stanford failed the tech cluefulness test by Anonymous Coward · · Score: 0

    The issue here is dead simple: Stanford placed certain records on a public server in a manner that is trivially accessible to anyone who is even moderately technical -- ie. all that's needed is the ability to type in a URL.

    The applicants passed the technical cluefulness test.

    Stanford sysadmins did not, since (we assume) the records were not supposed to have been made publicly accessible.

    Stanford PHBs are of course clueless just like any other PHBs, so they're making all kind of fudges about it. But what it comes down to is, Stanford staff failed the cluefulness test.

  57. Don't Forget That... by Anonymous Coward · · Score: 1, Insightful

    Stanford has absolutely no obligation to accept anybody to their B-school. It is a privilige, not a right. The school has absolutely no reason to accept these applicants who, by their actions, called their own integrity into question when (especially in the case of Stanford) there are hundreds of other extremely qualified applicants.

  58. Re:Heh by The+Only+Druid · · Score: 1

    "Of course I'm no english language professor, but isn't it common use that defines a language?"

    Depends what language you're talking about. Some languages - like formal Spanish - are actually defined by a committee. Other languages - like American English - are largely codified in dictionaries but have no central defining body.

    There is a tendancy within American and European English to limit "correct" English to what is currently in dictionaries (and corresponding grammatical texts), but that has one obvious issue: during the yearlong gap between editions, words/usages will appear that will by definition be incorrect that year but will (the next year) retroactively be deemed correct. How should those be handled?

    In the data/datum case, I'd say that since almost no Americans (or Europeans, for that matter) are aware of the word "datum", no one would reasonably fault you for using data as both plural/singular.

    --
    "Stumble before you crawl"
  59. Why is ApplyYourself not being blamed? by miradu2000 · · Score: 1

    I just finished a round of college admissions (luckily for me I didn't hear about this "hack" until after it hit the news, or else I probably what have done it).. BUT

    Why are people not blaming ApplyYourself? The first thing any of these colleges should have done is canceled their contract with this vendor for screwing up. It's not hte kids fault the data was public. ApplyYourself is the worst college application system of all the ones I encountered. Terrible interface, ugly forms, confusing system, security holes such as these. The number one thing these schools could do to improve the admissions process, is to drop apply yourself.

    If anyone wants a free business opportunity - create and sell an admissions package that kicks applyYourself security holed riddled self - I promise you, it wouldn't be hard.

  60. Re:Heh by jwdb · · Score: 1

    It's not so much that I see it as being both singular and plural (although that is what I said *sheepish*) but that I believe that 'data' has taken on a new meaning, specifically as a synonym for 'dataset' and other similar terms.

    What's your opinion on this? Would this be a valid evolution of a language? If there was an English council, would they allow this evolution or would they stick to datum, the technically correct and historically accurate term?

    I can definitely see the point in keeping the word datum and using dataset instead of data, but is it wrong to define (redefine) a word for the convenience of the langauge's users (assuming it doesn't lead to exception rules)?

    Jw

  61. More analogies... by siriuskase · · Score: 1
    "The gods presented her with a box into which each had put something harmful, and forbade her ever to open it. ... For Pandora, like all women, was possessed of a lively curiosity. She had to know what was in the box. One day she lifted the lid and out flew plagues innumerable, sorrow and mischief for mankind. In terror Pandora clapped the lid down, but too late."

    In this case, Stanford did not put plagues, etc, in the box. They simply said, "don't peek". Ethical people play by the rules, even if they see no harm in getting an early peek. It's as though your professor had next week's quiz on his desk when you stopped by his office. Just because he forgot to hide it doesn't mean it's ethical for you to look. Taking advantage of someone else's mistake is not ethical business. The ethical thing is to inform them of the situation, while noticably looking away.
    --
    If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    1. Re:More analogies... by Hawkxor · · Score: 1

      Knowledge of test questions is something that will help you cheat.

      Knowledge of admission status is just information, which is seeked as a result of curiosity; it's not like applicants could change their decisions online.

    2. Re:More analogies... by siriuskase · · Score: 1

      They were told not to look. Stanford is not obligated to tell them why. Sure, security through obscurity is stupid, and it certainly makes Stanford look stupid, but disobeying their request without a good reason is crossing an ethical line.

      Sometimes, you must suppress your natural curiosity and wait until the other guy wants you to look, even if he has forgotten to close his drapes.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    3. Re:More analogies... by edb · · Score: 1


      In this case, Stanford did not put plagues, etc, in the box. They simply said, "don't peek".


      Did they really? I have looked and looked, and I have not seen any mention of any such thing, let alone that applicants had agreed to it, even if merely by applying (shades of click-wrap licensing...)

      From what I can determine, Stanford never said "don't peek". They said "we'll let you know on xx date, and here's how you can find out at that time".

      As far as I can tell, they did not say anything remotely like "don't look until that date". And they did not say "don't peek".

      I welcome a citation to support a claim that Stanford told the applicants not to look for results ahead of schedule, and that agreeing not to look was a condition of applying.

      --
      In theory, practice and theory are the same. In practice, they rarely are.
    4. Re:More analogies... by siriuskase · · Score: 1

      Yes, it would be nice to know the actual instructions, since it seems possible that this is simply a test of how well applicants follow instructions, even when they know an alternative that hasn't been explicitely prohibited.

      While Stanford has the right to evaluate an applicant by any criteria it chooses, if this criteria simply weeds out the technologically astute in favor of the sheep, it isn't a good test.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
  62. One issue... by vegaspctech · · Score: 1

    What do you think that they thought they were doing?

    Who are they? Putting aside whether or not they were hacking, and whether or not they should be punished for it, how would one know just who they were? How would one know that the person who tried to check an applicant's status was actually the applicant and not his friend, or his neighbor, or his enemy, or just someone who pulled a name out of a hat because he wanted to see how it worked?

    --

    Making the world a better place, one psychotic episode at a time.

    1. Re:One issue... by M.+Baranczak · · Score: 1

      The "hidden" documents weren't publicly accessible to everyone: they were inside a password-protected area, where the applicants could log in and check various kinds of information. So theoretically, for every one of the "hidden" documents there was only one person who had access to it.

      But given that the site administrators clearly don't know how to keep their shit secure, it's entirely conceivable that someone else had stolen the passwords.

  63. Re:Heh by The+Only+Druid · · Score: 1

    I'm not a linguist, but I have a limited background in historical linguistics so take this with an appropriate grain of salt. My study of language is primarily rooted in my philosophical work (philosophy of language, by the way, is insanely esoteric...please never ever study it if you're not sure about being a philosophy major...).

    My feeling is that there's no such thing as an "invalid" evolution of language, any more than there is an invalid evolution of a species (sorry, Creationists). Language is a living thing, in the sense that it simply cannot remain static without a strictly controlling body. Consider the emergence of a word like "bad" as meaning "good" (yes, I know I'm dating myself a bit here). Arguably it perhaps first arose as an extension of sarcasm, but it certainly seperated itself enough that when people said "Man, that's bad!" they didn't think of themselves as being sarcastic. Were they wrong to consider the word as having seperated from its original use? I can't believe they were wrong.

    As to data/datum/dataset specifically, I think the point is that until the last ten, twenty years or so, no living speaker used data, datum or dataset excent in the most jargonistic fashion. It was a peice of argot, with an extremely narrowly defined meaning. I think it is arguable that as data grew into common use, it appropriated the former meanings of datum and dataset, so that the current English word (as opposed to the Latin word) has fully subsumed those other meanings.

    --
    "Stumble before you crawl"
  64. You are not describing reality by Anonymous Coward · · Score: 0

    Just because he forgot to hide it doesn't mean it's ethical for you to look. Taking advantage of someone else's mistake is not ethical business

    You don't live on this planet.

    Without being cynical in the slightest, what you describe has absolutely zero relevance to how real world business operates.

    Ethics? That's not even funny. Business ethics is a platitude, part of the normal M.O. of companies for adornment of public image, and has absolutely nothing to do with their actual operation. Quite simply, a company that operates under the constraints of ethics is a company that operates under a disadvantage in the free market, simply because ethics-based intangibles account for no more than 10% on the balance of competitive advantages, and often much less.

    What you describe might apply in some utopian free market where everyone upholds the rule of ethics. It certainly does not apply in the real world.

    1. Re:You are not describing reality by siriuskase · · Score: 1

      Sure, it might seem utopian, but business school is the place to select for and teach ethical values if anywhere is. It is a choke point where it makes sense to weed out less ethical people. Being selective in this matter can only help the school's reputation. They don't need any scandelous alumni, even if the school itself technically isn't at fault.

      Applicants who don't already have a higher standard of right and wrong than that enforced by the legal system are less likely to acquire one than someone who is honest from the start. Besides, these top tier schools have plenty of applicants and need any reason they can find to reject the excess.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
    2. Re:You are not describing reality by (negative+video) · · Score: 1
      Sure, it might seem utopian, but business school is the place to select for and teach ethical values if anywhere is.
      Hardly. Stanford was deliberately keeping applicants in the dark until the last possible moment. That way they didn't have to compete with other schools for tuition waivers, stipends, scholarships, and so forth. The hotter the applicant, the longer they wait to find out. An admission officer's wet dream would be a web site that told the applicant their acceptance status and then gave them five minutes to accept or decline.
      Being selective in this matter can only help the school's reputation.
      If by "selective" you mean "not getting caught humping the applicant's leg", then I agree.
      Applicants who don't already have a higher standard of right and wrong than that enforced by the legal system are less likely to acquire one than someone who is honest from the start.
      This wasn't some cloisted retreat of moral purity. It was a competitive arena were the applicants and the university are fighting tooth and nail for millions of dollars. The applicants were able to gain a strategic information advantage due to the laziness of the perfumed princes of the business schools. The schools learned of it and broke the contract, knowning that few of the applicants can afford to sue, and fewer still will get a judge with the technical mojo to understand the web server had its pants around its ankles.
  65. poor security doesn't justify by yagu · · Score: 2, Insightful

    Poor security doesn't justify the means. From a referenced slashdot article:

    The Graduate School of Business has rejected all 41 applicants who tried to gain unauthorized access to their application files after an unidentified hacker posted instructions on BusinessWeek's website March 2 about how to access the confidential information..

    This, in my opinion, is really the heart of the issue. I jumped into this discussion a little late, so I haven't had time to read all 150 posts, but what I've read so far I find a little disturbing. There seems to be a common theme that The school had bad security and the hackers were merely (in the words of one comment) asking the right question. I disagree.

    I don't think poorly obfuscated information intended to be kept confidential justifies hackers taking or accessing it, much less publicizing for others how to do the same. It seems unethical to me. And, I know I'm risking big time going down the chute of flamebait and troll modding hell for saying so, but I just think the pervasive "justification" of this hacking many of "us" perpetuates the stereotype of "in your face" behavior just because we know the technology and you (rhetorical) don't.

    The school blew it only in the sense they didn't have much of a mechanism to prevent access, but would we still be saying it was okay if the school had some huge encryption in place to hide data and someone had hacked that? It really isn't that much different. The fact that the school "hid" the information sets the bar high enough to define the standard as to what the hackers did as inappropriate hacking. Just my $.02

    1. Re:poor security doesn't justify by The+Cydonian · · Score: 1
      I'd say it would be "hacking" only if the applicants were specifically told not to access the information on the website, either through a stated policy thing or in some other way. This, as I understand it, wasn't the case; all they were told was that the information would be available at a particular URL after a certain date, not "there might, or might not, be information at a certain site, but in either case, you are not to access that information after mm/dd/yyyy".

      Your point is rather well-taken in the sense that there are many here who seem to be arguing that ethics is a function of computer security, but I doubt if it was that simple.

  66. Re:Heh by Jurph · · Score: 1
    The closest things we have to an English council are the Chicago and Oxford manuals of style, and on your points about both "data" and "none ... was", they each rule against your initial impression. Chicago is more lax, but still insists that the word data is plural, and that the word none is an indefinite pronoun which is most correctly singular.

    The debate you're trying to frame -- "should the rules of grammar follow usage or vice versa" -- is the difference between descriptive and prescriptive grammar, and is fought by first-year English students in every college in America (and probably the UK as well). Descriptive grammar seeks to describe how language is used commonly, and must evolve; prescriptive seeks to codify how language ought to be used, and tends to hold its ground against the incursions of slang forms.

    A quick summary of how the fight usually goes:

    Prescriptive Grammarian: Abcde.
    Descriptive Grammarian: You mean 'ABC' don't you?
    PG: No; it turns out that the Latin form of "de" is more correct here.
    DG: But nobody says it that way.
    PG: Everybody else being wrong does not affect whether I'm right.
    DG: With so many different things that can sound right, is there really any right or wrong?
    PG: If there is only one correct way to say it, then it was the way I said it initiall, and so I was right. If there are several ways to say it that vary with usage, then consider my last statement a bit of "Prescriptive Grammarian" slang... and behold, I'm still right.
    DG: You're a jerk and a pedant.
    PG: Yes, but I'm still right. Neener neener neener.
  67. The evolution of language by jwdb · · Score: 1

    Well, you have more experience in it than me - as an engineering major I can only rely on my intution.

    My feeling is that there's no such thing as an "invalid" evolution of language

    I'm completely in agreement with you here, and it's something I've discussed with many people over the years. For me it's particularly relevant, as I am Belgian and we have at least a good dozen dialects which, if I'm not mistaken, were mutually unintelligible until modern times. You still see some elderly on TV talking in dialects that are supposedly dutch, but have to be subtitled to be understandable.

    The point that I'm often confronted with is that there IS an official language and that's the right one, common usage and mannerisms be damned. It's a valid point of view and was definitely necessary to create a unified language here, but that mentality also holds the evolution of the language back. Personally I enjoy playing with language and am of the opinion that the communication of meaning is more important than the form, but...

    It's the idea that "there's correct way to speak a language, and that's that!" that I've always disliked. A correct way to write I can see (and even then only for non-fiction), but speech should be causual and can definitely be entertaining.

    Jw

    1. Re:The evolution of language by The+Only+Druid · · Score: 1

      Well, I know very little about Dutch (besides the fact that it's Germanic, and a little bit of the sound shifts it reflects from PIE), but I understand what you're saying about English.

      The problem is that you need at least some restrictions on language. While it's fine for an artist to play with the language a bit (one of my author friends once wrote a line something like "He went sidewalking down the street...", etc.), we need a minimum level of commonality to engage in reasonable conversation. If you say every rule is completely variable, you're left in Babel.

      To extend the biological analogy: if every individual in a species born in a given generation was so mutated as to prevent interbreeding, what happens to the species? It dies (strictly speaking, it dies creating an incredibly large number of mules, but still...), and leaves no one the better. Evolution must be slow (or, at worst, Punctuated) in order to preserve a semblance of continuity of discourse.

      It's because of this fear of Babel that we need to require a certain stringency of langauge. Things like the data/datum or viruses/virii debate are healthy: they're words where the confusion causes no serious difficulty, and eventually common usage will win out. More dangerous are situations where people play loosely with core grammatical structures (coughleetspeakcough) or core phonetical structures (coughebonicscough). In those situations, the language runs a dangerous risk of becoming a full dialect, and eventually its own language-esque object. When such things are allowed to happen, entire groups - typically geographical or ethinc groups - can find themselves constructively excluded from the society. This can have terrifying implications: ask the poor working-class teenager who honestly doesn't know that "ask" isn't pronounce "axe" in educated society why he isn't getting the same respect as his suburbanite peers from adults? Ask the heavily-accented technician at a dentist's office why she is viewed as less intelligent than her better spoken peers? Better yet, ask President Bush why he's regarded as less intelligent by most than President Clinton? (okay, maybe that last one was a bit unfair...but his vocab is extremely low...).

      --
      "Stumble before you crawl"
    2. Re:The evolution of language by jwdb · · Score: 1

      A good point - I suppose we'd descend into the linguistic equivalent of anarchy if everybody spoke slang.

      I think the healthiest would be a bit of both. Keep the evolving language for speech and use the more formalized structure for the written word and more official situations. It's like a dress code - you wear a suit to work and jeans to a party, and occasionally there's a casual friday situation.

      You could also say that you need exposure to the formal language and it's history before you can begin to improvise on it. Even the greatest jazz improv artist probably started with sheet music or the like.

      Jw

  68. Slashdot doesn't know the definition of hacking? by Anonymous Coward · · Score: 1, Interesting

    Acording to wikipedia, cracking is "the act of compromising the security of a system without permission from an authorized party". They were obviously not authorized

    Acording to dictionary.com, hacking is "To gain access to (a computer file or network) illegally or without authorization: "

    Just type "What is hacking" in google, and you get all kinds of definitions

    "Unauthorized access to or use of data"
    "Unauthorized use, or attempts to circumvent or bypass the security mechanisms of an information system or network"
    "The unauthorized access to a computer system."

    Doesn't take a rocket scientist to figure what what it means to hack into a computer. From everything I can tell, they got access to this data and knew it wasn't unauthorized. Yea Stanford was being a dick by kicking them out for something that "we" in the computer biz would blaim the site for, and yea lost of "us" look much lighter upon "hacking" than "cracking", but there is no question in my mind the students accessed data that stanford had not authorized them to access.

    Just because it's easy to do doesn't make it ok.

  69. Re:Heh by jwdb · · Score: 1

    Thanks for clearing that up - it makes me wonder what I've missed by choosing to stay strictly in engineering.

    In any case, I must say I'm a zealous descriptive in my speech (formal writing is something else alltogether) and enjoy being able to tinker and play with a language. It's truly beautiful in how many ways the human mind can express an idea.

    Of course, I understand the need for prescriptives as a balanceing force. I enjoy twisting the language, but I do realize that if that was the norm we'd lose the ability to understand each other. Slang is fun and entertaining, but an elegant, finely crafted sentence can be stunning in its layers of meaning and subtext.

    Jw

  70. I didn't peak by Besjon · · Score: 3, Interesting

    I'm a geek and after many years of making fun of those MBA-types had a change of fate and applied to several business schools. I was waiting for my acceptance notification when the news about the "hack" broke.

    Due to the staggered and overlapping notification dates, it would have been extremely helpful to know results in advance. Imagine the scenario of being accepted to one school with your deposit deadline due before being notified if you got into your preferred, but more difficult to get into school. Do you pass on sure thing behind door #1 or skip it for a chance at door #2? When you're facing relocation and close to $100,000 of expenses (with no income) over the next two years you want to make as informed a choice as possible. So I understand the desire to get the extra information.

    HOWEVER, these are business schools. They all have a huge emphasis on ethics and take it very seriously (especially over the past several years due to high profile scandals). As soon as I saw the news I knew it would end badly for peakers. No matter if you believe it was acceptable or not to peak - as a business school candidate you should have realized peaking could get you into trouble.

    I found it amusing that the b-school(s) gave the accused an opportunity to defend their actions. It almost implies the ethics violation would have been tolerated had the candidate been persuasive enough to talk their way out of it.

    1. Re:I didn't peak by Anonymous Coward · · Score: 0

      I didn't peak ... I knew it would end badly for peakers. No matter if you believe it was acceptable or not to peak - as a business school candidate you should have realized peaking could get you into trouble.

      Aaaaaaaarrrrrrrrrrgggggggghhhhhhhhh!

      It's "peek"... with two 'e's. Peak means the maximum point, such as the top of a mountain. Peek means to take a look at something (usually implying some sort of stealth).

      You'd think that someone who applied to business school would know this. You peek into your boss' office. You try to make your profits peak.

    2. Re:I didn't peak by Besjon · · Score: 1

      Ok, I've been caught: I now admit I'm guilty of "peak"ing. My spell-checker didn't flag it as wrong and I would never have realized the mistake. Thanks for the correction and I understand your pain: the whole to/too your/you're mix-up in posts drives me crazy. Hopefully I'll have an assistant one day to catch my mistakes before I make a further fool of myself :)

    3. Re:I didn't peak by Anonymous Coward · · Score: 0
      > Hopefully I'll have an assistant one day ...

      I know you're trying to be funny, but think a bit about how arrogant that sounds. It's a typical attitude in business school: I don't have to know how to do anything, I just have to be in charge.

      Even sadder is how often it works ...

  71. If the emperor wears no clothes, who is by MichaelPenne · · Score: 3, Insightful

    at fault?

    If a human admissions officer put the info. on their door, and then hung a sheet of paper over it to 'secure it', would the students be 'hackers' if they lifted the paper up? Now in this case, perhaps the admissions folks really thought the paper was a form of security, it seems like an 'emperor wears no clothes' kind of thing: is the tailor at fault for telling the emperor he was wearing a suit? Is the emperor for not checking it out? In this case we are blaming the people who looked at the emperor and saw him naked!

    Anything that is accessble by an unsecured url is publicly published (it's a 'uniform resource LOCATOR', after all). There was a cognitive choice made at some point to call this system 'secure', --or someone didn't read the manual--and that person is the one who published the information at a public URL.

    The applicants just found the place it had been publically published before they were told to look there, which hardly seems a 'crime', really it seems more like initiative than anything else.

    1. Re:If the emperor wears no clothes, who is by siriuskase · · Score: 2, Insightful

      Your sheet-of-paper-as-security example is the best analogy I've seen yet, except that if it ever happened, I doubt it would be an accident, it would be a test. Any applicant who peeked would deserve to be rejected out of sheer stupidity.

      My speculation is that the security-by-not-so-obscure-URL was actually a mistake, not by the universities, but by the "experts" they hired. If the university administrators thought they needed to hire experts, they can't be blamed for selecting this method of security, they can only be blamed for picking stupid experts, and they can't turn back time and undo someone's mistake. But, they can choose to turn this into an ethics test. I hope that they have also taken recourse against the worthless experts they hired. It wouldn't be fair to the rejected applicants if anyone was allowed to get away with this.

      --
      If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
  72. Stanford Bombs by Doc+Ruby · · Score: 1

    Stanford owes all their applicants, indeed their entire business and academic communities, an explanation for their gaping secuity hole. They "protected" applicants personal info by making a visible URL select applicant data by applicant ID code in plaintext in the URL. Like protecting a vault with a screen door. That kind of insecurity is unacceptable from one of America's top institues of business and technical training. What other insecurity will students' and clients' private data face in their hands? They get billions in government contracts, much of it secret, much of it liable to arm an enemy. They produce many powerful executives and their professionals, many of whom, if blackmailed, could threaten the economy, politics, or other national security. Sure, this is a little project, in a smalll department, not itself involved in any such sensitive projects. But how far does the insecurity go? How many other departments use the technique? Stanford's reputation, and the huge profits and privileges that go with it, depend on the notion that they're good at this kind of thing. They need to clear their name, and define the scope of the problem, immediately. Or lose it all, sooner than later.

    --

    --
    make install -not war

  73. Re:Heh by danrees · · Score: 1

    Wow, a grammar Nazi who gets it wrong!

  74. I think the real issue is being overlooked. by orbust · · Score: 1

    I think its alarming how many people feel that since the Univerity allowed the loophole to exist, the students did nothing wrong. Its this very mentality that is pevasive amoung young people that to me is the real issue. Did you know that if you find a wallet with identification in it, and you keep the money and the wallet you have committed a crime? Picking it up is legal, looking through it is legal, contacting the owner is legal, giving it to the police is legal, but keeping the money and items in the wallet is illegal. I am not using this as an analogy for someone geek figuring out a URL gives admission info, but rather an analogy of moral issues. The point I am making is that regardless of what you decided to do with the wallet, you didnt have to be told that keeping the money was wrong, you KNEW it would be WRONG before you did take it (if you chose to take it). I think that less and less this is true, people dont know when to KNOW its wrong. How many kids have said that they cheat in school because everyone else does it and they would be at a disadvantage if they didnt do it. The real problem here is that personal advancement takes priority over moral values and highground more often than not. I severly dislike Stanford University, yet I applaud there unwavering strictness in setting an example that dishonesty and ethical deviation will not be tolerated. Hopefully, Once this blows over they can get back to churning out corporate moral deviants like Condaleza Rice capable of lying to the faces of millions of people at a time. Good going stanford.

    1. Re:I think the real issue is being overlooked. by Anonymous Coward · · Score: 0

      I mostly agree with the statements you have made except for the "orporate moral deviants like Condaleza Rice". Unless you consider the US government a corporation (and that's a whole other topic), you blow your whole arguement as some zealot. I suggest that you should have used some other examples such as Kenneth Leah, Martha Stewart . Bill Gates.

      Yes, what the students did was trivial and it's human nature to want to peek before it's time, but these are future business leaders. Is this the behavior we want from them?

  75. Will the real correct analogy please stand up by Anonymous Coward · · Score: 0

    It's not a passcode. Nothing is checked against a stored number or key.

    The correct analogy is:
    There's two folders one on the outside of the door of the Deans office and one on the inside. The records were on the coffeee table of the reception room of the dean's office.

    Just because it's complicated doesn't mean it's a hack. Getting to the deans office requires you go to the elevator, up two floors, take the third hallway on the left then turn a right past the second bathroom after the teacher's lounge afer the second janitor's closet on the left.

    THE DEAN HAS TO GO THAT ROUTE EVERYDAY. Granted he has a nice tour guide (the database) to take him there.

    Now if they had knocked out the tour guide (attacked the db) so they could go everywhere then it would be called CRACKING. But they did not they just asked a few questions.

    It's not the ME, ME, ME that is the problem it's the everyone else is your enemy that is the problem.

  76. Freedom of Information by vorstyles · · Score: 1

    Though this is a private school, most aren't. I wonder if any students have ever tried submitting a FOIA request about their status after their application. Would be interresting to see how a school responds.

  77. again? by m85476585 · · Score: 1

    Didn't the exact same thing happen last year? Wouldn't people realize this? -- These CAPTCHAs keep getting harder to read! "xdbrzcc"

  78. punished for being too intelligent by Anonymous Coward · · Score: 0

    I can't believe those schools are punishing prospective students for being too intelligent. On the other hand those schools are not as great anymore as they've been once. Those students can do better than wasting a couple years of their lives learning stupid stuff and afterwards paying off hundreds of thousands in student loans.

  79. Students should seek legal action by Anonymous Coward · · Score: 1, Interesting

    The students should purse legal action against the ApplyYourSelf website for releasing their names to the Universities. If this was truly "illegal" (which is was not) then ApplyYourSelf should have contacted the authorities. Instead, they released names of students who supposedly violated some URL-typing ethics.

    from the ApplyYourSelf legal notice.

    "If you do choose to provide us personally identifiable information, you can be assured that its sole purpose will be to support your customer and/or potential employee relationship(s) with ApplyYourself."

  80. Re:Petty and ridiculous by kernelpanicked · · Score: 0

    How is this a troll? Why don't you go mod yourself -2 DIPSHIT

    --
    Ubuntu: If at first you don't succeed, blindly slap a sudo in front of it
  81. Re:Heh by nacturation · · Score: 1

    Cool, thanks.

    --
    Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
  82. Well... by Shads · · Score: 1

    ... they should look at it as a learning experience. They just "learned" what we all knew years ago, it's all good so long as you don't get caught. Getting caught getting information that others deem as secret generally has consequences. They just got theirs.

    It's a valuable life lesson... yah.

    (As a side note, I do really think it was a bit harsh since they left their shit all over the place like that... maybe one of the students should sue them for leaving their private data publically accessable without their consent?)

    *yawn* next story, move along.

    --
    Shadus
  83. Perception by Cliff.Braun · · Score: 1

    The problem here is perception. The colleges are thinking of it as someone going into an admissions office and looking in a file cabinet(possibly even a locked one) to find their results. Whereas people on Slashdot, who know what the internet is, have no expectation of privacy and know that if you post something online it cannot be protected by just not publishing where it is located. What this is more like is Stanford buying a lot somewhere and placing a giant grid of billboards with admissions status on them, and the students being told, if you go here and look at the billboard with your SSN on the side, it'll tell you if you got in or not. This is a big problem, and probably a big reason why we keep hearing about information getting out from where it shouldn't. People are treating webservers like locked file cabinets, putting anything and everything in there. While in actuality the information is open to anyone. The strange thing is that people seem to be even more careless with information they put on the internet putting up information that they wouldn't even leave on their desks. I sympathise with the students because I do this sort of thing all the time, looking at URL's and trying to get to other content, and it's never malicious. Do you have a reasonable expectation of privacy when you put something in a public place? How about if you don't tell people it's there?

  84. Why smart people defend bad ideas by BioHobbes · · Score: 1

    Perhaps they need to read that article[1] that was posted the other day. [1]http://science.slashdot.org/article.pl?sid=05/0 5/28/2058251&from=rss

  85. Re:Simple: Stanford failed the tech cluefulness te by siriuskase · · Score: 1

    So they screwed up. Admissions people aren't necessarily technical. So they hired someone who was. Apparently, they hired the wrong "experts". They weren't even alone, plenty of other reputable schools hired these same "experts". How do they get out of a bad situation? Hopefully, they fire the so-called "experts" and tell the applicants to apply again next year.

    Do you know a better way to handle it? One that would be equally fair to the students who could successfully resist their curiousity? Turning back time is not an option.

    --
    If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
  86. You are (almost) all wrong by Thomas+A.+Anderson · · Score: 2, Insightful

    Let me see if I have this straight....

    1) No hacking or cracking was involved - the information was available to anybody who had a login/password by adding freely available information (again, if one has a login/password) to the url.

    2) No one is claiming that someone viewed admission status for anyone but themselves (except for the sister but that's another story).

    3) No information on the server was changed by the students, simply viewed (ie, admission status was not changed not could it be via this process).

    4) Some posters are claiming that the students were told they shouldn't do this, but I have yet to read anything supporting this.

    5) In some cases, this act was the sole basis for a denial from the school.

    Simply put, the schools will and should get sued by the students who had their admissions taken away. No law was broken, and no attempt at cheating was made.

    If you put information on the web, it will be viewed. Period. You can bitch and moan all you want about it, but if the information is not protected, it's your own damn fault. Blaming the students is a sad attempt at diverting the focus from the real issue - security by obscurity does not work.

    --
    Personally its not God I dislike, its his fan club I cant stand (bash.org)
    1. Re:You are (almost) all wrong by aCC · · Score: 1

      I disagree. This thing is not about legal or illegal or hacking. It is about ethics.

      Not everything that is legal is also ethically correct as we know. You can take this as an ethical test for applicants. Those who cheated to get an (information) advantage might also use questionable methods to get advantages in their future business life.

      I prefer the honest types and personally try to never work with people if they use dirty tricks. Glad to know that the b-schools seem to start and think along similar lines.

  87. Being boiled in oil is too good for them! by HornWumpus · · Score: 1
    Burning's too good for them!


    Skinning alive is too good for them!


    I say we do the chinese death by inches thing. Wrap them in wire so it forms a grid, then start cutting off one or two squares per day of skin.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  88. Enron? by Razzak · · Score: 1

    "they, and their alumni, don't want to be associated with the type of people that will create another Enron."

    I'm sorry, but did you just equate figuring out your own admission status from a URL to embezzling, lying to the public, and squandering countless people's pensions and lifelong investments?

  89. Bah by Greyfox · · Score: 1

    The posted the information publicly. If the information was not supposed to be accessed they shouldn't have posted it. What I've learned from this is that the Stanford Computer Science department probably isn't the one to enroll in if you want a good education in CS, especially in the area of security.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    1. Re:Bah by Anonymous Coward · · Score: 0
      Today ApplyYourself serves more than 300 academic, non-profit and government clients

      The Stanford b-school decided to use some startup's broken web app. The CS department wasn't even involved.

  90. Social Ethics by nullreference · · Score: 1
    This would make for a great case study in a social ethics class.

    Personally if I had to make a call on this, I would agree with the schools and reject the applicants. However I'm glad I don't have to make that decision because it's not a easy one, you can make a good case for either side.

    To play's devil's advocate, the arguments for the students are:

    1. It's almost (but not quite) the same as entrapment. Most people in the same situation would be tempted to check.

    2. There was no harm done. The students are checking their own information.

    The arguments against the students are:

    1. It was still wrong no matter how easy it was. The physical world equivalent would be the admissions office left the list inside a folder on their front desk. The folder is marked confidential/private... (The students were aware this was a 'hack')

    2. These are tomorrow's leaders and they should be held to a higher standard. I'm sure there would numerous occasions where similar temptations come into play... and someone can always justify it won't hurt anyone.

    3. Wrong is wrong.

    1. Re:Social Ethics by epee1221 · · Score: 1

      1. It's almost (but not quite) the same as entrapment. Most people in the same situation would be tempted to check.
      What people are inclined to do is not important unless morals are relative. If they are, this argument is rather pointless.

      1. It was still wrong no matter how easy it was.
      This is not support of that view, it is restating that view.

      The physical world equivalent would be the admissions office left the list inside a folder on their front desk.
      Since the extent of their security was just not telling people that the information was publicly availble, I question this analogy. They did not hide the information; they just didn't tell people how to get it.

      The students were aware this was a 'hack'
      Source for this information?

      2. These are tomorrow's leaders and they should be held to a higher standard.
      Again, unless morals are relative, they apply equally to all.

      3. Wrong is wrong.
      You will be hard pressed to come up with anything that follows logically from this statement.

      --
      "The use-mention distinction" is not "enforced here."
  91. Re:Simple: Stanford failed the tech cluefulness te by Anonymous Coward · · Score: 0

    Anyone who resists their own curiosity has no business being a student. They should go get a McJob and leave that university seat for the next Adam Smith.

  92. And Bullshit is Bullshit by Anonymous Coward · · Score: 0

    Type a URL did they. What a load of rubbish

  93. Many things in life are backward.... by grolschie · · Score: 1

    Dude, to get into law/med/art/etc school you first gotta prove that you already know the course material and are already an expert in the field. To get a bank loan, you first gotta prove that you don't need one. Why is this any different? ;-)

  94. Stupid question: Have they got proof? by grolschie · · Score: 1

    Can they prove that these students actually looked up their status? I mean there exists multiple possiblities of other users accessing the same info. One example is a random ID generating script (not likely). Or leaving computer logged in, and pesky young brother or friend does the "hack". Can they prove that the students in question were the ones who actually accessed this info?

    Even if these student applicants were the only ones that could've possibly accessed the data, what kind of proof is still needed? Or do they not require proof - i.e. they can just refuse anyone they like without any justification?

  95. Successful MBA candidates... by russotto · · Score: 1

    ...would have blamed it on a roommate, parent, sibling, or other person who might have plausibly had access to the machine the inquiry was made on.

    Extra points if the person it was blamed on died of an accident or "natural causes" in the interim -- then the candidate is not only a good MBA candidate, but likely headed into politics after that.

  96. A fellow /.er! by Sangbin · · Score: 1

    "It's pretty obvious...[...]" Gray said. "I'm not a lawyer, but I certainly know right from wrong."

    Greetings my fellow /.er!

    1. Re:A fellow /.er! by vorstyles · · Score: 1

      I would think that should say "I'm not a lawyer, so i know right from wrong."

  97. Re:Heh by The+Only+Druid · · Score: 1

    "DG: You're a jerk and a pedant. PG: Yes, but I'm still right. Neener neener neener."

    Honestly, this gave me a great laugh. Not so much because of the "neener" part, but rather the fact that I actually heard someone [in a philosophy class about group ethics] call someone else, literally, 'a pedantic jerk' in class once for basically the same reason (the philosophical analogue was a debate about whether or not to use the author's given explanation or a third-party's interpretation).

    --
    "Stumble before you crawl"
  98. Please RTFA and keep this in mind by Anonymous Coward · · Score: 0

    The students were not actually able to access their own material, it was not currently up. However, they are being rejected anyway for so much as attempting to.

    This may or may not change the arguments people are making here. It's worth pointing out however because few people seem to be taking this into account.

  99. Re:Slashdot doesn't know the definition of hacking by Creepy+Crawler · · Score: 1

    "Unauthorized access to or use of data"
    "Unauthorized use, or attempts to circumvent or bypass the security mechanisms of an information system or network"
    "The unauthorized access to a computer system."

    Hmmm.. Did you receive WRITTEN PERMISSION to use Slashdot's service?

    Sounds like hacking to me.

    Or the word 'access' is defined by whomever.

    --
  100. Stanford's problem by saikou · · Score: 1

    Well, they decided they did not want any of the (minimally) resourceful and curious students to be admitted. Great.
    If I have an opportunity to hire people, I will go for those kids rather than Stanford graduates. Innovative and curious minds are always better than slowpokes that truly believe it's ethical for higher education entity NOT to tell them whether they're admitted even though decision has been already made, and only reason for that is they wouldn't be able to say "Yes" to another college in case they were not.

  101. In a Word : FEAR by Anonymous Coward · · Score: 0

    Fear of those they can not control,

    Fear of those with l337 sKiLz that can lay waste to their systems.

    Fear of Actually having to bring their computer security up to date for 2005 - not 1975.

    Like an Honorary PhD - they have done these people a favor -
    the degree is Useless trash - good for kitty boxes and bird cages.

    If they want something to hang on a wall - go to a state school night classes.

    If they want more skilz - start their own business and learn from the University of Real Life.

    -p.s.
    (Scripts know better than to waste their cycles on /. - that's a human weakness!)

  102. dam you kids for being intelligent! by Anonymous Coward · · Score: 0

    UNI:

    Dam you kids for being intelligent!

    No more edumacation for you!

  103. Re:Heh by The+Madd+Rapper · · Score: 1

    I didn't know that until now, either. For more info: http://webster.commnet.edu/grammar/sv_agr.htm

    --
    That's the shit that feds me up
  104. Doing something inofficial is not wrong or bad by Rudd-O · · Score: 1

    And you do all you're told to do, right? You probably never had any independent idea.

    The notion that they did wrong by using an unadvertised resource that Stanford did not give out is dangerous. It implies that doing anything out of what's officially sanctioned is bad for society. Which is a very wrong idea to entertain and evangelize.

    --
    Rudd-O - http://rudd-o.com/
  105. Do You Live In An Ethical Black Hole? by Anonymous Coward · · Score: 0

    It all comes down to ethics. Until grades are formally released, you are NOT authorised to view them. Stanford is not interested in people who are acting unethically before they even make it in the door.

  106. Poor Students by Anonymous Coward · · Score: 0

    On a different note, I hope all these students had backup plans in place so that they don't suffer too much from this problem.

    I think part of the problem is that HTTP is viewed in different ways by different people. There are some people who view non-linked portions of a webserver as private. However, HTTP is a medium of publishing. It takes a explicit act to add a file to the server and given a publically accessable name.

    So the file that was accessed was published explitily by the company contracted to provide services. There was no unauthorized access because of this (nor is it tresspass in any form).

    So I add to the massive list of annologies with the following: You have a tv programmed to view the first 10 channels of the spectrum with the channel up buttons, though you can access any channel using the direct number buttons. The content providor tests content on channel 15 before showing it on one of the first 10 channels. That is the access case.

    When looked at it from this perspective, there is nothing to suggest morality from the access case.

    However, more important is the agreement between the school and the students and the students and the website.

    For example, if the web site has a terms of service that explicitly denies authorization for access to non-linked pages by user accounts, then there is an exsisting agreement.

    Further the university makes clear its expected conduct during the process. They clearly thought the information was private and would not be published. As has been mentioned, it is entirely within their rights to determine admission in anyway they choose. If they feel that this decision allows them to achieve thier goals, then they were right in their actions.

    However, had I been in the situation, I would have checked the form. With the knowledge of the schools reaction, I would not have. I do not concider it wrong for the student (reading published but not relased information is not unethical without outside factors) to look at the information.

    Stanford was correct to ask for reasoning, though I find it difficult that not one of the applicants met their standards. A good faith belief that the information was explicitly published justifies the actions, as does a host of other reasons. Misunderstandings are not ethic dilemas.

    As to the issue of punishing the web developer: everyone makes mistakes. Sometimes other's notice. I would just expect them to fix the problem as soon as possible. If there are contract segments relating to these sorts of issues, they should be followed. Otherwise, it was a good faith problem that simply needs to be corrected.

    I wonder if anyone reads this.

  107. Re:Heh by dkalley · · Score: 1

    historically none will default singular, as linked, an conveys a number or adjective, adding the ne prefix creates a pronoun. the link fails to mention aelfred's biblical use much earlier, and plural use is much less common.

    none can also be a singular plural in a group reference from our french influence with on, third person singular. the use in english is in what is inferred, most often a single group entity, including the individual members of the group.

    --
    on y va

  108. Re:Heh by Anonymous Coward · · Score: 0

    This is a side effect of the construction "___ of the ___", which will always produce a plural subject.

    This post provides a singular counter-example ("All of the newspaper was soaked.").

  109. Re: None: Singular or Plural? by Anonymous Coward · · Score: 0

    The mnemonic that I use to determine whether "none" is singular or plural is: if "none" can be replaced with "zero" ("naught" (or "nought"? I don't know the spelling) for the UKers) without changing the meaning of the sentence, then it's plural (in the broad sense that "plural" means "not one" instead of "more than one"); if it can be replaced with "no part of" without changing the meaning, then it's singular. In your two examples, "No part of the cake was eaten." means that "none" is singular in that case, and "Zero of the students were eaten." means that "none" is plural in that case.

  110. Re:Heh by jwdb · · Score: 1

    My bad. I should have said that "None of the ___" always produces plural. You cannot say "none of the newspaper"...

    Jw

  111. Re:Heh by Bush+Pig · · Score: 1

    "Datum" _is_ still used. Talk to a geodecist sometime. They have the concept of a geodetic datum as a figure of the earth (and there a quite a few of them in common use). Of course, with the plural of "datum" being "data", they have a tough time when discussing several of them ...

    --
    What a long, strange trip it's been.
  112. Re:Heh by jwdb · · Score: 1

    The impression I get from a quick google search is that a geodetic datum is a particular model of the shape of the Earth - please correct me if I'm wrong. If this is the case, they are not using datum's original meaning - a single unit of information - but have redefined it to mean model for their own use, just like the rest of the world redefined 'data' as a synonym for dataset.

    And by the way, I was referring to common use. Say 'data' to someone on the street, they'll know what you mean. Say 'datum' and you'll probably get funny looks.

    Jw

  113. Re:Heh by Bush+Pig · · Score: 1

    They are using it in its original meaning, as they are talking about one bunch of numbers. Each datum is defined by its semimajor axis, flattening, and assumed centre (which may, as in the case of the old Australian Geodetic Datum, be defined implicitly by reference to a point on the earth's surface where the geoidal separation is believed - incorrectly as it happened - to be zero). A geodetic datum is then taken as a given thing on which all subsequent surveying calculations are based. Although I'm mot a geodecist, I've done number-crunching for them.

    I'm not a big fan of equating "common usage" with "correct", by the way. That way lies madness (incorrect usage of apostrophes, using "different than" when you mean "different from", misspelling "received", etc.). I used to have arguments with my ex-wife, a kind of closet postmodernist, about this very point.

    --
    What a long, strange trip it's been.
  114. Morality issue or competitive advantage issue? by digital+photo · · Score: 1

    These are not hackers or computer science students. These are prospective business school students. Their aim is to be successful through whatever means is available to them. Competition is mind numbingly high to get into a prestigious school.

    To know whether you got in or not, before other applications is priceless. It lets you know if you should be calling ahead and making arrangements and being setup and ready before your other competition. Likewise, if you were rejected, you will know that you shouldn't waste any more time/money/effort on that particular school. I mean... if you know you're not accepted, by bother trying to make folks happy there. Ie, why be lead on when you know the outcome?

    To call this a hacking issue is like saying someone who finds the key hidden under the flowerpot is skilled at picking locks.

    More than anything else, this is probably a stunt to do one or more of several things:

    • Give the big name schools yet another reason to reject potential applications.
    • Put some scare into candidates who are a little "too competitive", like those who are actually sabotaging their competition's projects/reports/etc.
    • Put the blame on individuals when the security issue was with the company all of these schools make use of and to take the heat off of the business schools for not properly auditing the application process.

    The applicants sought to learn their status early. The process did not let them change their status, change or view other peoples' status, or access personal information which they did not already have access to.

    This is the equivelent of guessing the correct URL on a website to view content not originally meant to be viewed. Or, it can be considered the equivelent of going through your instructor's gradebook to see how you are doing.

    As for the students who tried to view the information, well, curiosity has its price. The only question is whether their names will be entered into a kind of "ethical" blacklist between the schools.

    It would be nice, and naive, to think that business leaders don't push the ethical envelope to get the results they want. If you get the info before your competition, that's an advantage you have over them. You don't give a hand to your competiting business if they have a hard year. You probably would like to know the contacts they have, that you don't. What are the ethics of befriending them to learn their contacts and using those contacts to your personal advantage? Would it be naive to think that people and companies don't do that?

    Guess what I'm saying is that these 119 people who wanted to succeed so bad, were willing to step over that ethical line. Are they the exception or the rule of the highly desired schools? If they are the rule, what are these schools doing to change the culture that breeds such behaviour?

    1. Re:Morality issue or competitive advantage issue? by Anonymous Coward · · Score: 0

      Curiosity having a price? The environment you're describing is the opposite of a school!

  115. Re:Heh by jwdb · · Score: 1

    My mistake - checked the dictionary, and apparently a reference surface can also be called a valid datum. Just seems strange, as doesn't look like a unit of information at first glance.

    I don't neccessarily equate common usage with correct, but I do believe that people should have the freedom to play with the language freely in casual communication and that people who try to hold everyone to the strict rules are holding back the evolution of the language. On the other hand, formal writing per definition must stick to the formalized and codified set of rules that make up the language.
    I have the same discussions with my mother about Dutch and its dialects, as I enjoy playing with the sound of the language whereas her mother was a Dutch language teacher. I consider myself able to see both sides, but am of the common usage camp myself.

    Jw

  116. Re:Slashdot doesn't know the definition of hacking by epee1221 · · Score: 1

    Or the word 'access' is defined by whomever.
    Their accounts were given read access to that information. That sure sounds like authorization to read it.

    --
    "The use-mention distinction" is not "enforced here."
  117. Is Wharton Ruining American Business? by daridenus · · Score: 1

    To continue this discussion about MBA, here is an interesting article about the value of Wharton MBA In the wake of Enron and other corporate scandals, America's best-known business school- Wharton, the place that produced Michael Milken and Frank Quattrone, is under siege. Maureen Tkacik spent a year there figuring out what's going on. You'll develop lifelong connections and leadership skills to engage the world and transform your career in ways that extend far beyond your return on investment, ROI for short, on their degrees. Excepting the preambulatory niceties, what Wharton is really telling prospective students is that they'll get a return on investment, ROI for short, on their degrees. -- To read the full version, click here http://www.phillymag.com/ArticleDisplay.php?id=569