CTO Says Al-Khabaz Expulsion Shows CS Departments Stuck In "Pre-Internet Era"

US Government Announces National Day of Civic Hack by JS_RIDDLER · 2013-01-23 12:37 · Score: 5, Informative

Interesting timing ; not quite the same.
One is Defensive Planning; One is about New ways to use things.
US Government Announces National Day of Civic Hacking
http://yro.slashdot.org/story/13/01/23/1823208/us-government-announces-national-day-of-civic-hacking

--
_JS

I consider that a pretty good analogy... by seebs · 2013-01-23 12:46 · Score: 4, Insightful

And also a very good explanation. How on earth did they produce such a hopelessly stupid system? It was designed by people who are unready for engineering systems to be used.

I am a big fan of not blaming the victim, as a matter of moral principle. That's a great policy. But it's really crappy engineering design; building something that is designed to rely on the assumption that society can reliably provide perfect enforcement is stupid.

There's another layer of difficulty, which is that it is not always obvious whether something is a security hole or a permissive feature...

--
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/

Re:I consider that a pretty good analogy... by Anonymous Coward · 2013-01-23 12:49 · Score: 1

It's the Quebec school system. Everything is, no; has to be, different here.
Re:I consider that a pretty good analogy... by DahGhostfacedFiddlah · 2013-01-23 13:25 · Score: 5, Insightful

You know, we blame civil engineers when their buildings collapse, maybe it's time to start blaming computer "engineers" when their systems do. Now, I know first-hand how hard it is to design secure computer systems, and I'm well aware there's a fine line between "holding to account" and a witchhunt, but we're nowhere near that line as it stands.
In every single one of these stories I hear the mainstream media gasp about the "dangerous hacker". I see /. complain about morons who treat technical curiosity as an attack. But those comments outnumber 10:1 the most important question that you just asked.
How on earth did they produce such a hopelessly stupid system?
Maybe if we could get everyone asking this question, the conversation would shift.

--
Last post!
Re:I consider that a pretty good analogy... by SolitaryMan · 2013-01-23 14:00 · Score: 2

The problem is not just in Software Engineering. Any applied field is faces the problem.
Think about it: in any university or college, NONE of your teachers are actually posess the skill you are trying to acquire. Unless, of course, you want to become a teacher or academia type scientist.
Say, you want to become a Software Engineer and you go to a college. There, general algo's professor teaches you general algorithms. Text processing professor teaches you compilers. The same for operating systems, programming language theory and so on. Every professor gives you some valuable knowledge, but you don't see how they all fit together until you get your first job. I think this is a tragedy of the modern education: it is too fragmented.

--
May Peace Prevail On Earth
Re:I consider that a pretty good analogy... by Stiletto · 2013-01-23 14:08 · Score: 4, Insightful

Get ready to have no free (gratis) software, as it would be ridiculous to donate one's time to write code for free if you could be held liable for mistakes. Get ready for your paid software to cost 10X more to cover the extra development "hardening" time it would all require to be less penetrable, and to cover the insurance policies software companies would have to take out to shield themselves.

You know, we blame civil engineers when their buildings collapse, maybe it's time to start blaming computer "engineers" when their systems do.
But we don't blame civil engineers when their buildings collapse after they get blown up by dynamite. It's not like these computer systems are just falling over from nature. They're under malicious attack.
Re:I consider that a pretty good analogy... by lgw · 2013-01-23 14:21 · Score: 5, Insightful

There is no such thing as a secure system. This applies to both physical and information security. There's always a way in. So that's a bad analogy to life-safety engineering, or at least a subtle one.
When it comes to security, there's no "secure" or "insecure", and the threats are rarely well understood, let alone well described. The important questions are "how much will it cost an attacker to gain access" and "how much will it cost an authorized user to gain access" and "how valuable is this anyway" and "what's the tradeoff in making this more secure". Sure, there are also just stupid, terrible designs when it comes to security, but the mere fact that an attacker gains access means little.
When it comes to life safety, the parameters are thoroughly described. The levee must withstand the winds and storm surge from a class 3 hurricane, this building must survive impact from a 707, whatever. If they fail under far worse conditions than they were specced for, that's not an engineering failure. It's rarely so clear when it comes to security (though, of course, sometimes the password is sent as part of a URL or whatever, and it is quite clear).

--
Socialism: a lie told by totalitarians and believed by fools.
Re:I consider that a pretty good analogy... by Belial6 · 2013-01-23 14:21 · Score: 4, Insightful

We blame civil engineers if their buildings collapse under normal use. We do not blamed them if someone plants a bomb in the building. More actually, we don't blame the architect if someone successfully breaks into your home.
Re:I consider that a pretty good analogy... by LordLimecat · 2013-01-23 14:29 · Score: 4, Insightful

You know, we blame civil engineers when their buildings collapse,

You dont, however, blame them when someone helpfully demonstrates that by taking out support pillar 3A with TNT that the building suffers catostrophic failure. I mean, yea, maybe you blame them a little, but generally you get pissed at the guy holding the detonator.
Re:I consider that a pretty good analogy... by AK+Marc · 2013-01-23 14:36 · Score: 1

You know, we blame civil engineers when their buildings collapse, maybe it's time to start blaming computer "engineers" when their systems do. Now, I know first-hand how hard it is to design secure computer systems, and I'm well aware there's a fine line between "holding to account" and a witchhunt, but we're nowhere near that line as it stands.
The problem is what happens when I design an application that's fine, but it must run over an insecure OS or insecure hardware, and something else with higher permissions compromises my application's data?

Though the real issue is that with a civil engineering failure, something big falls down. With a computer failure, someone sees something they shouldn't have. "no harm, no foul" is uttered way too much, but is how people treat a problem they can't see or understand. At least with the World Trade Center falling, they could see it, even if they couldn't understand it.

--
Learn to love Alaska
Re:I consider that a pretty good analogy... by CohibaVancouver · 2013-01-23 15:48 · Score: 2

NONE of your teachers are actually posess the skill you are trying to acquire
The exceptions, at least here in British Columbia, are Medical and Dental schools.
Re:I consider that a pretty good analogy... by rahvin112 · 2013-01-23 16:03 · Score: 1

We blame civil engineers if their buildings collapse under normal use. We do not blamed them if someone plants a bomb in the building. More actually, we don't blame the architect if someone successfully breaks into your home.
If you are going to use an analogy use the right one. A computer security equivalent in relationship to a building wouldn't be the architect or engineer, it would be the company hired to provide security for the building such as the alarm or security company. And if there was a break-in at a building you most certainly would be blaming the company responsible for that security. Why computer security professionals aren't held to the same standard is beyond me.
If your job is to provide security for a building, a computer or an outhouse and that security is breached you should be held responsible and more importantly if that security is breached and it isn't discovered until a later date there should be even more accountability.
Re:I consider that a pretty good analogy... by Jessified · 2013-01-23 16:13 · Score: 4, Interesting

Well in this case the programming failed under normal use. That is it failed to keep people out.
In the case of buildings, normal use would include extreme weather and earthquakes etc depending on the area.
Normal use on the internet includes keeping intruders out, even when they put some effort to get in.
Nothing is perfect, but you don't punish people who identify flaws, especially not at a so-called place of learning.
Re:I consider that a pretty good analogy... by TheLink · 2013-01-23 16:38 · Score: 1

From what I understand about the case he wasn't expelled for demonstrating the problem by "pressing the detonator". He was expelled for coming back days later without permission to see what else would blow up.
http://news.nationalpost.com/2013/01/20/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data/

Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he and Mija had identified had been corrected.
A bit harsh (and the NDA signing under duress is unfair) perhaps but I think he should learn from that as it applies in the nonacademic world too.
In the outside world if you find a problem, report it, and you're lucky that they don't shoot you the messenger, you certainly shouldn't push your luck by continuing to look for problems without permission especially by running automated scanners like Acunetix!
--
- Too many replies beneath your current threshold
Re:I consider that a pretty good analogy... by HornWumpus · 2013-01-23 16:47 · Score: 1

Go to an actual Engineering school. By old tradition and practice it is basically impossible to get into an Engineering school faculty without years of industry experience.
CS not so much.

--
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Re:I consider that a pretty good analogy... by dkf · 2013-01-23 21:16 · Score: 2

Well in this case the programming failed under normal use. That is it failed to keep people out.
We can easily secure systems such that the bad guys can't ever get in. Really. It's easy to do even. What is much harder is doing this while allowing the authorized users easy access. In the limit case of security, we just disconnect the system from the network and power it down: nobody will hack it then, and it is ever so easy to get right! But this is immensely inconvenient for people who are supposed to use the system. (To be fair, there are systems that have data so valuable that at least keeping them off the net and protected by armed guards makes sense. That's a fairly extreme level of security.)
The natural tension in the security area is with ease of use. Make things too secure and you raise the difficulty of use so much that users find other insecure methods of handling the data that you don't know about (e.g., post-it notes with passwords) and so circumvent you protections. Indeed, reducing the official level of security can actually increase the amount of practical security by encouraging people to do things properly...

In the case of buildings, normal use would include extreme weather and earthquakes etc depending on the area.
Within reason. There's a trade off with how much you want to spend. That's basic economics. Spending lots to protect against extremely rare events is a bad use of resources.

Nothing is perfect, but you don't punish people who identify flaws, especially not at a so-called place of learning.
Grasshopper, you have much to learn. (Also, how much damage was done during the "identifying flaws"? There's a very fine line there.)

--
"Little does he know, but there is no 'I' in 'Idiot'!"
Re:I consider that a pretty good analogy... by Inf0phreak · 2013-01-23 21:52 · Score: 2

That's a fixable problem. For example, you could read this article by phk in ACM: https://queue.acm.org/detail.cfm?id=2030258
In particular note:

Clause 1. If you deliver software with complete and buildable source code and a license that allows disabling any functionality or code by the licensee, then your liability is limited to a refund.

--
________
Entranced by anime since late summer 2001 and loving it ^_^
Re:I consider that a pretty good analogy... by gnasher719 · 2013-01-23 23:58 · Score: 1

You know, we blame civil engineers when their buildings collapse, maybe it's time to start blaming computer "engineers" when their systems do. Now, I know first-hand how hard it is to design secure computer systems, and I'm well aware there's a fine line between "holding to account" and a witchhunt, but we're nowhere near that line as it stands.
That's no problem. Absolutely fine with it. As long as you convince my boss that it's not shipping until I declare that it's fine. And as long as you convince my boss that my productivity will be about one LOC per day.
Re:I consider that a pretty good analogy... by Cassini2 · 2013-01-24 02:30 · Score: 2

The civil engineers do design for resiliency against severe failures and/or attacks. The world trade center was designed to be hit by a B-25 bomber. The terrorists used a 767, and simulations say that the building should have survived. The engineers did not design against a 767 filled with a full fuel load, in the 1960's, when a 767 did not exist yet.
To be fair, the software people in the SCADA software industry have the same safety issues. SCADA systems are designed to fail gracefully in the event of many disruptions. Many of the SCADA software "hacks" are people connecting a "designed to be isolated and secure" network to the internet, against all manufacturers recommendations.
For SCADA, the problems are:
a) Microsoft promised a hardened secure operating system with Windows NT, and this somehow turned into a "needs to be connected to the Internet so the systems stays updated" with Windows XP. Thus, the "designed to be isolated" networks were no longer isolated.
b) Every supplier of the software and hardware involved has a "not to be used in safety-critical, nuclear, or life-support machinery ..." line in the software license. Thus, they are absolved of legal liability.
c) How do you design a software system to resist malicious and/or inadvertent attack? It is actually an unsolved engineering problem. Hit with a big enough plane, the world trade center fell down. Hit with a big enough Tsunami, Fukishima melted down. With sufficient network traffic, I can take out almost any network link to an embedded microcontroller. In engineering, there is always a "big enough fool" with "big enough sledge hammer", to gum up any proposed design.
Re:I consider that a pretty good analogy... by Lazere · 2013-01-24 02:43 · Score: 1

If I'm responsible for the security of your home, and I set up you're system, and you never use it, you don't get to blame shit on me. Period. I could set up the best security system money could buy, but it still takes some effort from the homeowner. You could have twelve locks on your stainless-steel front door, windows that bolt down with military-grade padlocks and a system that literally shoots the intruder on entry, but if you don't lock the door, lock the windows or set the system, anybody can still get in. The problem is, people expect their home security to ultimately fall into their hands. They expect no such thing with computer security...
Re:I consider that a pretty good analogy... by turtle+graphics · 2013-01-24 05:19 · Score: 2

Your distinction between life safety and computer security is good, but I think it's mainly due to the maturity of the two fields.
People have been making buildings for thousands of years, and the first ones fell down for all kinds of reasons. The notion that a building should survive an airplane impact would have been ridiculous twenty years ago, now it sounds desirable. And twenty years from now, some other unforseen hazard will add to the list of design parameters.
Computer security has a lot of threats which are understood and well described (brute force password attacks, man-in-the-middle, SQL injections, etc.) and many that aren't. And it's totally reasonable to blame software engineers if their systems fall to a well known, easily avoidable attack, that they left open by ignorance or incompetence.
Re:I consider that a pretty good analogy... by hazem · 2013-01-24 06:58 · Score: 1

Think about it: in any university or college, NONE of your teachers are actually posess the skill you are trying to acquire. Unless, of course, you want to become a teacher or academia type scientist.
I have to say that for the most part, that has not been my experience. For example, when I was in business school (one of many areas I've explored), most of my professors were consulting on the outside, making more money doing that part-time than they made as professors. My accounting prof had his own accounting business, my marketing prof did "motivational and leadership speaking", my business law prof was a practicing lawyer.
Currently, my prof that teaches computer modeling & simulation has years of industry experience and is leading a student-based consulting group. My Operations Research prof is an EE but also does significant consulting doing OR projects. Even my AI professor from last term is involved in several large OSS efforts and does contracting on the side as well.
When I worked in an engineering school, more than half the profs either came from industry or were still actively involved in work in their fields.
Now, could any of them walk into my job, which is a weird combination of supply chain analyst and application developer and be as effective as I am? Probably not, but several of them could be after time.
But you raise an intersting point. One challenge younger students have is that they have no idea what it's like to work as a professional. So they tend to be somewhat unfocused in their studies. They take classes because they are convenient to their schedule of sleeping in, or whatever, and don't focus on the classes that will get them the skills and knowledge they really need. Internships can help, but I consistently see that students coming to school after working tend to be much more focused and driven - and tend to perform better.
Re:I consider that a pretty good analogy... by DahGhostfacedFiddlah · 2013-01-24 07:25 · Score: 1

From the responses I received, it's clear that I inadvertently wrote some flamebait.
I certainly don't advocate criminal charges for designers of insecure systems, as you might see for a civil engineer. I was trying to suggest that the core of the problem - insecure systems - is lost in the he-said-she-said of hackers vs douchebag-beureaucrats.
Your argument about "no such thing as a secure system" applies just as well to life-safety engineering. Rare, unforeseen events can have huge consequences. You build a bridge to code, and then one day you get wind-gusts at the exact right resonant frequency, and the bridge collapses.
No one gets blamed, but the cause is reviewed and the codes are updated and the next guy who forgets them gets in trouble.
There are a number of well-known attacks for which there is no longer any excuse. SQL injection is one of those. Now, software tends to be more complex than civil engineering, so I don't expect perfection from systems. But I do expect web-connected software to be written as if it's being attacked all the time (it is), and for security holes to be taken as seriously as that warrants.
Other responses have suggested that a civil engineer wouldn't be held accountable if their building collapsed due to sabotage. I argue that they certainly would if all public buildings were being sabotaged all the time, and their particular building collapsed from a molotov cocktail.
==
As an aside, I also take some exception to the claim that there "is no such thing as a secure system". When we see security failures like this one, it's not through social engineering or physical access. It's through a standard HTTP(s) request. It is possible design a secure system given that assumption.
Yes, router or server security issues can open security holes. And for non-trivial software, it's effectively impossible to prove that a system is secure. But provable or not, there are plenty of systems on the web that can be used exactly as permitted, while not exposing a single security flaw when accessed over HTTP(s). Secure.

--
Last post!
Re:I consider that a pretty good analogy... by Nofsck+Ingcloo · 2013-01-24 07:25 · Score: 1

Would you like some cheese with that whine?

It is not necessary for our inability to achieve perfection to get in the way of having good practices. A few commonly accepted things could form the start of a set of best practices. Stuff like handling passwords correctly and preventing buffer overflows. We need some sort of professional organization a-la AMA or the Bar Association or various engineering groups to manage and promulgate a set of best practices. And yes, if we could develop that and then a systems engineer or programmer or their management were to ignore best practices and foist really stupid stuff on the public, especially fo money, I would support a trip to civil court.

We have lived too long with the "not responsible for anything" license and it is time to start moving toward making that disclaimer "against public policy".
Re:I consider that a pretty good analogy... by billDCat · 2013-01-24 09:18 · Score: 1

One challenge younger students have is that they have no idea what it's like to work as a professional. So they tend to be somewhat unfocused in their studies. They take classes because they are convenient to their schedule of sleeping in, or whatever, and don't focus on the classes that will get them the skills and knowledge they really need. Internships can help, but I consistently see that students coming to school after working tend to be much more focused and driven - and tend to perform better.
I went through my university's co-op program, which was the best thing I ever did in my university experience. I highly recommend trying out a job in your field of interest before graduating, it's a great tool to focus the rest of your schooling.
Re:I consider that a pretty good analogy... by lgw · 2013-01-24 09:50 · Score: 1

And it's totally reasonable to blame software engineers if their systems fall to a well known, easily avoidable attack, that they left open by ignorance or incompetence.
No, it's not at all reasonable. What was the importance that managemen gave security? What's the threat model? What's the cost of what's being protected vs the cost of fixing the problem? Sure, if I'm writing something from scratch then there's some basic professionalism in play, but say I'm picking web forum software to use for an online gaming guild - security vs SQL injection attack isn't even going to be on my list of priorities, while maybe spam filtering would be critical. Software needs to be robust against the sort of attacks that actually matter to how it's used, and that's not always so easy to define.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:I consider that a pretty good analogy... by lgw · 2013-01-24 10:01 · Score: 1

Your argument about "no such thing as a secure system" applies just as well to life-safety engineering. Rare, unforeseen events can have huge consequences. You build a bridge to code, and then one day you get wind-gusts at the exact right resonant frequency, and the bridge collapses.
No one gets blamed, but the cause is reviewed and the codes are updated and the next guy who forgets them gets in trouble.
I think you missed my point. In life safety engineering it's well understood that the engineer's job is not to make it "safe", but to be robust vs very specifically defined circstances. When the New Orleans levees failed vs a veyr predictable hurrcane and the city flooded, there's was no design flaw involved, and the levees were rebuilt just as they were before. A political decision was made (twice) about the cost of the levees vs the value of the city, and right or wrong the engineering requirements were clear.
But geeks somehow do expect software to be "Secure" - vs whatever threats we each think happen to be important. That's unfair. There's only an engineering failur of the system doesn't meet its requirements, and very often today there's this big gap between expectations and requirements. It's not an engineering failure when management simply chooses not to fund the security aspects of developement, of otherwise makes them a non-priority, even if tht makes the system insecure vs obvious attacks.
If you actually have requirements that a system be secure vs a very specific list of attacks, that's different - but I've never once seen that in my career. Usually it's the developers asking management to please let us do some security work/testing vs the most obvious stuff, and management grudgingly letting them spend just a little time away from the "important stuff" (the actual committed requirements).

As an aside, I also take some exception to the claim that there "is no such thing as a secure system". When we see security failures like this one, it's not through social engineering or physical access. It's through a standard HTTP(s) request. It is possible design a secure system given that assumption.
Agreed: you can make a system secure vs a specific list of attacks. What you can't do is force the attacker to stick to your list.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:I consider that a pretty good analogy... by DahGhostfacedFiddlah · 2013-01-24 12:48 · Score: 1

Well then. I find myself agreeing with everything you say, so let's leave it at that.

--
Last post!
Re:I consider that a pretty good analogy... by RepliCounts · 2013-01-25 18:40 · Score: 1

This happens often. The negligent or incompetent get upset when their mistakes are exposed, and blame the messenger. If they are big enough in the organization, the messenger takes the fall.
It has become an occupational risk. Computer security professionals should get hazardous-duty pay.

Pffft... "Education" by narcc · 2013-01-23 12:46 · Score: 5, Interesting

When did all the computer science programs turn in to trade schools for programmers?

Meh, why fight it. Lower that bar!

--
Required reading for internet skeptics

Re:Pffft... "Education" by Comrade+Ogilvy · 2013-01-23 13:05 · Score: 4, Insightful

While there are always outstanding mavericks, a lot of engineering departments are primarily staffed by brainy people who would make third tier engineers in the real world. Most people who are passionate about a subject area are itching to go out and DO IT. Yes, there are a few amazing brainy oddballs out there that have to be in academia. Yes, there are 5 or 6 CS departments like Stanford or UC Berkeley or Carnegie Mellon that probably do not fit that mold.
But Dawson College? A top notch computer scientist could be racking up six figures with a BS or MS. Who do you think works there and what are they paid?
Re:Pffft... "Education" by Chemisor · 2013-01-23 13:15 · Score: 2, Interesting

Computer science programs became trade schools for programmers when idiot HR departments made a CS degree a requirement for every coding monkey position. The fact that a computer science degree does not give its holder any knowledge of actual computers or real world programming does not bother HR drones because they do not have that knowledge either.
Re:Pffft... "Education" by Sir_Sri · 2013-01-23 15:43 · Score: 1

They aren't.
But that doesn't mean we need to deliberately hamstring ourselves either. No more than we should be asking people to work on a Wang for everything. We need to keep pace with the technology and culture (and the challenges those pose) like any other field. My first computer networks course was still teaching token ring and FDDI, because they were still relevant as in place technologies at the time. Today, if we talk about them at all, we gloss over them as historical concepts.
Unfortunately CS departments are just that, departments. They're part of a much bigger school, and there isn't the money at most of them for running a dedicated IT system separate from the schools IT system. Assuming they'd be allowed to anyway. And even if they did (and all CS departments end up with some dedicated IT) you can't both grant students access and expect the system to be secure.
Schools that have a lockpicking programme don't let you go around opening labs in the middle of the night - that's the unethical part. We *should* have systems that undergraduates can experiment with hacking as part of learning about security, but not all of us do.
Just because we aren't a tradeschool for programmers doesn't mean some of the students shouldn't have a strong grounding in programming, (and the rest at least a weak grounding in it). You can't really do much in say the theory of programming languages if you've never had to program, or do much in the theory of security if you've never at least been through some basic examples of how encryption and various attacks work. That doesn't mean you should be trying it on in use production systems that the school uses however. No more than fireman should practice on their own building.
Re:Pffft... "Education" by AnonyMouseCowWard · 2013-01-24 04:22 · Score: 1

Well.. I'll repeat a comment I wrote elsewhere. Dawson College is a CEGEP, which in the Quebec education system, serves as both an intermediary between high school and university and as a trade school. Computer Science, at the CEGEP level, _is_ a trade school. He wouldn't have the requirements necessary to enter Computer Science at the university level (for that he would have to go into Science in CEGEP).

Now, bearing in mind Dawson is not a university but a trade school, and that in Montreal they're known for not being very.. rigorous or competent (which I can't judge, but people will scoff and go "oh, so.. you're studying liberal arts/communications?..."), it's not altogether surprising. I know of no computer science program in university (at least in Montreal) that is a trade school.

oh get real... by canistel · 2013-01-23 12:46 · Score: 2, Insightful

All that happened was some young hotshot did something the dept forbids. He paid for that, end of story. How you go from there to "CS depts out of touch with today's world" is beyond me, but then again I'm not some CTO either.

Re:oh get real... by MightyMartian · 2013-01-23 12:50 · Score: 4, Insightful

Because the young hot shot wasn't doing anything nefarious, and when he first reported the vulnerability he was praised. It's only when he determined that no one was doing a fucking thing about the vulnerability that he got kicked out.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.
Re:oh get real... by CurunirAran · 2013-01-23 12:58 · Score: 2, Interesting

The CTO said what he said because the department TRULY is out of touch with the real world if it believes that hacking is an 'extreme example' of 'behavior that is unacceptable in a computing professional'.

Hackathons, which involve unusual solutions to problems, often using hidden, undisovered features of various products, are becoming increasingly popular, and often you'll have BIG companies sponsoring these same competitions.

Moreover, the dept is wrong in its comment because CS as a profession is rather different from software engineering. I don't think formulating more efficient algorithms and solving various mathematical problems (basically CS RESEARCH) has much in common with do with software engineering. In fact, I'd rather that my employee found a problem with my system than an end user doing so.
Re:oh get real... by canistel · 2013-01-23 12:59 · Score: 2, Insightful

Riiiight.... so university's just kick people out randomly when they do nothing wrong. Uh huh.
Re:oh get real... by Guspaz · 2013-01-23 13:11 · Score: 5, Informative

Dawson is not a university. In Quebec, "College" and "University" mean different things. Dawson is a CEGEP, which is a mandatory level of education between highschool and university.
CEGEPs in Quebec has two kinds of programs. 2-year Pre-university programs can be considered to replace the final year of highschool and first year of university (as in, highschool and university are both one year shorter in Quebec). They also have three-year programs (like the computer science program Al-Khabaz is in), which are vocational degrees intended to prepare a student for the job market rather than university. Graduating from either type of program grants you a degree called a DEC ("Diploma of College Studies" in English), which also happens to be required for admission to any university.
Many students, however, do what I did, and get a three-year vocational compsci DEC and then go to university and get their BCompSc. Yeah, it takes you an extra year (as compared to the pre-uni DEC), but CEGEP is the first time as a student that you get to study what YOU want instead of what the government says you must take, and I had a fantastic time.
Re:oh get real... by LordLimecat · 2013-01-23 14:40 · Score: 5, Insightful

From the article:
Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites.....
A few minutes later, the phone rang ......It was Edouard Taza, the president of Skytech. He said that this was the second time they had seen me in their logs, and what I was doing was a cyber attack.
Yea, see, this is why insecure.org has warnings to not run nmap against resources that you do not own: It is generally considered nefarious, ill-advised, and possibly illegal. Yes, pen-testing other people's stuff will land you in trouble. Should he have been expelled? Maybe not, since he was clearly trying to expose a vulnerability, but he should have known better and hopefully now he does.
Probably also should not have signed that NDA and then gone on to break it, but then Im no lawyer. Probably should have just said "yea, I sign nothing till i have representation".
If you do not have a job / contract with someone to pen-test, act as a "tiger team", check for physical security breaches, etc, DONT.
Re:oh get real... by LordLimecat · 2013-01-23 14:42 · Score: 1

Running penetration tests on random companies' resources without prior authorization is a really bad idea, and perhaps this guy is lucky that expulsion is as far as it went.
"Hackathons" refer to coding sessions, which is a completely different usage than how it is being used here.
Re:oh get real... by NicBenjamin · 2013-01-23 16:50 · Score: 1

Unfortunately for Ahmed his method of verifying that the problem had been fixed was de facto a DOS attack:
“The attack made the College portal extremely unresponsive for its thousands of users. Had it not been countered, it would have put the College portal out of order for the entire students and teachers population of Dawson. The attack was traced, and it turns out that it came from one of the students who participated, earlier that week, in the discovery of the security flaw. We therefore decided to be clement, and not to report the attack to the authorities.”
http://www.cbc.ca/news/canada/montreal/story/2013/01/21/montreal-dawson-college-hack-hamed-al-khabaz.html
Re:oh get real... by grcumb · 2013-01-23 17:34 · Score: 2

Unfortunately for Ahmed his method of verifying that the problem had been fixed was de facto a DOS attack: “The attack made the College portal extremely unresponsive for its thousands of users. Had it not been countered, it would have put the College portal out of order for the entire students and teachers population of Dawson...."
I have a real problem with this quote. If I were running a relatively high-volume service (and apparently College Portal's user base is somewhere around 250,000) and a single user were capable of DOSing the entire service, I'd characterise that as a flaw in my service.
I might not thank the kid who brought it to my attention, but I sure wouldn't trumpet the fact that my service is as brittle as all that.
I think the CEGEP's action - the decision to punish the kid for poking his proverbial nose in where it wasn't welcome - really is out of line with the way of the Internet world. If it were up to me, I'd give him a pretty strong tongue-lashing, saying 'Yes, you found an important vulnerability, but for your own sake if no one else's, never ever pen test an online service without permission. Good job, and don't let me catch you doing it again.'
... But that would definitely be the end of it. He's obviously a bright young man who has the ability to earn some solid geek cred, and deserves every opportunity to apply his skills properly.

--
Crumb's Corollary: Never bring a knife to a bun fight.
Re:oh get real... by Guspaz · 2013-01-23 17:51 · Score: 1

You have very little choice as to what courses you take in highschool in Quebec. You get one elective per semester, normally (so you take something like pottery or woodworking), and everything else is decided by the government. About the only selection beyond that is to decide which difficulty of a course you take. For example, do you take science 416 or 436. Same general kind of material, varies in difficulty. There was also that choice for math. How it matters is that different CEGEP programs have different pre-requisites in terms of which one you had to have taken to get into that CEGEP program. CEGEP is the first chance you get to start deciding for yourself what you want to study. There are still a bunch of core requirements everybody has to take, so even though I was in computer science I had to take English, French, Humanities, etc. But even then, you get some choice about that; there are different humanities courses that cover different topics, you could pick. IIRC there wasn't much choice about the English or French courses, though.
By university, you're picking it entirely for yourself; you pick the university program you enter, and there are no common requirements between programs.
In terms of the restrictiveness of highschool, I've always assumed it was the same everywhere else, and that without CEGEP, people outside Quebec only got to decide the course of their own education when they hit university.
Re:oh get real... by NicBenjamin · 2013-01-23 18:18 · Score: 2

According to Dawson College's site they had tried a tongue-lashing:
"He was expelled for other reasons. Despite receiving clear directives not to, he attempted repeatedly to intrude into areas of College information systems that had no relation with student information systems."
So this was not the first time he was testing things he should not have been, and it was not the first time they'd told him to cut it out.
Some kids need to be shown that rules apply to them. Apparently Ahmed Al-Khabaz was one. He'll do fine out of this. Some other CEGAP will let him in, or maybe Skytech will give him a job. And hopefully he'll learn not to test the computer security of live systems he's been specifically told not to mess with.
As for the quote, his test wasn't causing problems for all 250k Omnivox users. It was causing problems for Dawson College, which is only 10,000.
Re:oh get real... by MightyMartian · 2013-01-23 18:24 · Score: 1

An while they create a bit of security theater beating on this kid, the Russian mob is stealing all the personal ino on the system.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.
Re:oh get real... by NicBenjamin · 2013-01-23 18:47 · Score: 2

They're not making any theatre out of this incident. They did not do a big press release announcing that Evil Hacker Ahmed had been apprehended. He used Acunetix to bring their system to a halt, they threw him out, he lost all his appeals, and then he went to the media in an apparent attempt to get another appeal. The "theatre" in this incident is all Ahmed.
I have no idea whether Skytech has fixed the actual bug. I know he's been offered an actual paid job by them, so if he actually wants to fix the bug (as opposed to merely talking about how great he is for finding it) he's got the opportunity.
Re:oh get real... by Alioth · 2013-01-23 22:29 · Score: 2

Apropos of nothing, and not really related: at university, I got into trouble for running a MUD (unauthorized!) out of my home directory. It went undetected until a friend wrote a buggy bit of lpmud code that caused the daemon to write a lot of log messages, and overnight it filled the filesystem where my home directory lived.
The next day (after having my account locked), I was being torn a new asshole by the sysadmin (who certainly did have some bastard operator from hell traits) and got the lecture about "There are 10,000 users on this system" and how I had made it inaccessable to 10,000 users. I already knew that there were actually only 100 or so home directories on the filesystem I filled up, and out of the 10,000 users on that particular system, 9500 had never logged in and probably never would. I was going to say this but in a rare show of good judgement I decided to just let it drop and try to redeem myself somehow.
Which we did, when a friend and I discovered a local root exploit and reported it immediately instead of trying to take advantage of it. We were actually both in trouble, my friend for an earlier attempt to crack the root password - that had earned him a very shouty session with the head of computer services - it was only mitigated to a mere bollocking because another sysadmin of another department had challenged him to do it, saying it was impossible. This was in the days before shadow passwords. My friend used distributed computing to crack the password file and we reckon was probably only a few hours from getting the root password).

--
Oolite: Elite-like game. For Mac, Linux and Windows
Re:oh get real... by pantaril · 2013-01-24 02:48 · Score: 1

He used Acunetix to bring their system to a halt
He brought the system to halt? This is new info for me. I though he just tested for vulnerabilities. If you had your personal data stored in vulnerable school system, you'd just report it and let it go? You wouldn't check if the vulnerability is fixed and your data secured? Personaly i think that what Ahmed did was perfectly rational and right thing to do. Expeling him for it is gross abuse of power of school administration.
Re:oh get real... by NicBenjamin · 2013-01-24 03:26 · Score: 1

To repeat the quote from 3-4 posts up:
“The attack made the College portal extremely unresponsive for its thousands of users. Had it not been countered, it would have put the College portal out of order for the entire students and teachers population of Dawson...."
The "attack" referred to was Ahmed's attempt to test the website using Acutenix.
I really wish Slashdot would actually link to a piece that includes the company and college's side of the story. As is everyone just reads the summary, which quotes the kid, and automatically assumes he's the victim of an evil conspiracy. He's not. He did something really stupid (using Acutenix on a live website without permission from the site's owners). His action hurt the system he was testing. He was specifically told not to try anything like this.
He sounds like a good kid whose very curious and doesn't understand that some rules have to be taken seriously. This is also the description of pretty much every hacker ever sent to prison, hounded to suicide by Ortiz, etc. So if you actually want this kid to have a real life, and not be sent to Sing-Sing for 40 years for pulling this shit on Microsoft...
Re:oh get real... by mjwalshe · 2013-01-24 06:37 · Score: 1

would apply to every Uni in the work as many people have said the politics and back biting at universities is intense as Sayre's law law states "Academic politics is the most vicious and bitter form of politics, because the stakes are so low.".

And I suspect that Mr Al-Khabaz,being a Colored gentleman (to quote Rowen Atkinson on not the nine o clock news) might have something to do with the severity of the punishment.

I am of course referring to the famous Constable Savage sketch http://www.youtube.com/watch?v=y5dy9URkLFI

Blamestorming by girlintraining · 2013-01-23 12:48 · Score: 4, Interesting

'Computer Science is taught in this idealized world separate from reality. They're not dealing with the reality that software has to run in a hostile environment,'

That's because if schools taught people how to properly test security, the government would label them terrorist breeding grounds. Anyone remember Steve Jackson Games? They released a game where one of the roles you could play was a computer hacker. The FBI called it a "handbook for computer crime" and the "anarchist's cookbook of cybercrime". No charges were ever filed. It was a work of fiction. It still nearly bankrupt them and took many years to resolve.

Schools do not want to teach students because they're afraid of government reprisal if they show a generation just how crappy our national infrastructure really is. As one recent net celebrity put it, "Our security posture is like a dog waiting for its belly to be rubbed." They don't wanna teach people how to find these problems, because it'll embarass the crap out of The Powers That Be.

Don't blame professors for this. Look higher.

--
#fuckbeta #iamslashdot #dicemustdie

Re:Blamestorming by fluffy99 · 2013-01-23 13:05 · Score: 2, Funny

They don't wanna teach people how to find these problems, because it'll embarass the crap out of The Powers That Be.
Don't blame professors for this. Look higher
Your explanation sounds a bit too tin-foil-hat. The reality is that the market just wants keyboard jockeys who can code a working product quickly and cheaply. The security (and I'd also say quality) of the product is way down on the priority list of most employers. If you want to fix that, you need to figure out how to demand high-quality software. Not the buggy, security-flawed crap we see from major companies like Adobe, Java and Microsoft.
But I do agree most of the graduating "Computer Engineers" I've interviewed barely knew how to code and had a few canned routines like bubble-sorting memorized. The ones claiming to be Microsoft certified were even more embarrassing.
Re:Blamestorming by Obfuscant · 2013-01-23 13:10 · Score: 2

That's because if schools taught people how to properly test security, the government would label them terrorist breeding grounds.
Not if step one in the process is: 1) get permission from the system operator/administrator/owner. That's where this guy failed.
Many years ago I knew of a problem in a web server I was running. Certain operations would cause it to hang. You know how I found out this issue? By running a script-kiddy scanner. It wasn't in a place I could easily fix, and the chance of it happening was rare. Except for the script kiddies who thought they were doing me a favor by scanning my system without my permission so they could exercise their 'leet hacker chops and show me how smart they were, and hung up the server while doing it.
And, of course, the small detail that some of the content I was generating was dynamic, linked to other dynamic output, and took longer to generate than the delay between testing the links. That filled up the process table rather nicely, keeping anyone else from accessing the system.
Why is it a foreign concept to ask for permission before trying to break into someone's system? Had someone asked me, I could have told him I know about the issue and thanks but no thanks.
Re:Blamestorming by Anonymous Coward · 2013-01-23 13:25 · Score: 1

Not as high as you're referring to but...in this case the immediate higher-up is Dianne Gauvin, The Dean of Social Science and Business Technologies (dgauvin@dawsoncollege.qc.ca). Perhaps even a little higher is Robert Kavanagh, the Academic Dean (rkavanagh@dawsoncollege.qc.ca).
Snippet from the original article:
http://news.nationalpost.com/2013/01/20/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data/
The administration of Dawson College clearly saw things differently, proceeding to expel Mr. Al-Khabaz for a “serious professional conduct issue.”
“I was called into a meeting with the co–ordinator of my program, Ken Fogel, and the dean, Dianne Gauvin,” says Mr. Al-Khabaz. “They asked a lot of questions, mostly about who knew about the problems and who I had told. I got the sense that their primary concern was covering up the problem.”
Following this meeting, the fifteen professors in the computer science department were asked to vote on whether to expel Mr. Al-Khabaz, and fourteen voted in favour. Mr. Al-Khabaz argues that the process was flawed because he was never given a chance to explain his side of the story to the faculty. He appealed his expulsion to the academic dean and even director-general Richard Filion. Both denied the appeal, leaving him in academic limbo.
Re:Blamestorming by fredprado · 2013-01-23 13:27 · Score: 2

Why should I get permission from someone to check if my data is being mishandled by him? It is absurd. A scan, as he did it, is very far from breaking into the system and accessing information you shouldn't have access to.
Re:Blamestorming by docmordin · 2013-01-23 13:32 · Score: 3, Informative

But I do agree most of the graduating "computer engineers" I've interviewed barely knew how to code and had a few canned routines like bubble-sorting memorized. The ones claiming to be Microsoft certified were even more embarrassing.
I'm not sure you're aware, but, depending upon the school, an S.B. in computer engineering can be much more akin to an S.B. in electrical engineering than one in computer science. To elaborate, some computer engineering programs are part a joint department that focus almost entirely on circuit analysis and design, solid-state theory, (non-)linear/stochastic control, architecture design, electromagnetics, and much more, with very little, if any, emphasis on programming.
Re:Blamestorming by Taco+Cowboy · 2013-01-23 13:35 · Score: 2, Interesting

Don't blame professors for this. Look higher.
A professor who cowed down to tptb is a professor with no integrity
The job of a professor is to teach
But "teaching" encompasses more than the particular subject at hand
The character of the teachers (professors for this case) is also an important factor
Students learn much more from professors who have backbones than those from the family of invertebrates.

--
Muchas Gracias, Señor Edward Snowden !
Re:Blamestorming by phantomfive · 2013-01-23 13:48 · Score: 1

Schools do not want to teach students because they're afraid of government reprisal if they show a generation just how crappy our national infrastructure really is.

Seriously? Do you really think this?

--
"First they came for the slanderers and i said nothing."
Re:Blamestorming by eieken · 2013-01-23 14:29 · Score: 1

Would you like to learn more?

--
Meet new people, and kill them.
Re:Blamestorming by AK+Marc · 2013-01-23 14:43 · Score: 1

Computer engineering at Texas A&M (early 1990s) was part of the EE program, and was for EEs who wanted to design chips, rather than design wiring for commercial buildings (the two most popular things EEs do). There was almost nothing on programming, and most of the programming included hardware level (so maybe it was good for firmware writers or people writing device drivers).

--
Learn to love Alaska
Re:Blamestorming by girlintraining · 2013-01-23 14:54 · Score: 4, Funny

Students learn much more from professors who have backbones than those from the family of invertebrates.
Yes, it's totally reasonable to expect someone who has spent close to six figures earning their degrees and certifications, and finally managed to earn tenure, risk it all to satisfy your idea of morality. Dude, that's bullshit. It's bullshit on an epic why-the-hell-did-even-two-other-people-agree-with-you scale.
College professors do have integrity. Well, many of them anyway. It's mean-spirited and flat-out wrong to accuse people who are responsible for ensuring that the next generation is trained at least well enough to know which way to hold the mouse before sending them out into the world... that they lack integrity simply because they don't want to be jailed and have their lives ruined to uphold an arbitrary moral value that I suspect even you yourself only sometimes adhere to.
Don't blame the victim! Put the responsibility on the asshats that created the problem: The government. Oh wait, they're the giant 3000 ton gorilla! Probably easier then to go after the wimpy guy with glasses next to it, huh? That's exactly what you've just done, while demanding others have a backbone. Pathetic.

--
#fuckbeta #iamslashdot #dicemustdie
Re:Blamestorming by Jaime2 · 2013-01-23 14:56 · Score: 1

That's because if schools taught people how to properly test security, the government would label them terrorist breeding grounds.
Not really. My team has a great track record of our products passing security scans. We've never used mock hacking to find security issues in our code. We simply do rigorous code reviews against solid security principals. Some teams around us do the whole code-hack-fix thing, and they have a lot of security fix work every time the pen-testing tool is updated or changed.
I laugh every time I hear a colleague come back from some security class they were sent to and I find out that they spent five days running ten-year-old exploit tools against unpatched servers.
Re:Blamestorming by girlintraining · 2013-01-23 15:06 · Score: 1

Not if step one in the process is: 1) get permission from the system operator/administrator/owner. That's where this guy failed.
I'm not talking about this guy: I'm replying to the comments of the OP talking about how schools today don't teach security, and they don't. They don't because they're afraid -- teaching someone security is like teaching them how to use a firearm. In the process of learning that, you learn how to disarm it safely, etc. Learning is a two-edged sword, but unfortunately our government has demonized learning that could lead to political fallout. Look at how the press reacted to the gun control debate -- by publishing the names of thousands of people who were granted carry and conceal permits, and then putting it on an interactive map with a giant "rape me" sign above each of them. I don't know how that helps foster a sincere and open discussion on the topic.
The moment something becomes political you can't learn about it anymore, not objectively anyway. It becomes very time consuming to sort through the bullshit and get to a good answer... and this is when the government isn't actively looking for your inquiries and adding you to terror watchlists. People can't have an open dialog about computer security right now because it's too political. That doesn't mean you can't learn it, or even teach it... it just means it's a lot riskier.
You shouldn't have to risk your career just to show some kids how to do something that might actually help them and their community, but there it is, and that's what's up.

--
#fuckbeta #iamslashdot #dicemustdie
Re:Blamestorming by Obfuscant · 2013-01-23 16:58 · Score: 3, Insightful

I'm not talking about this guy: I'm replying to the comments of the OP talking about how schools today don't teach security, and they don't. They don't because they're afraid --
And my first sentence dealt with that concern. If they make step one of the process: GET PERMISSION then they don't have an issue. That statement applies to more than just this one case.

People can't have an open dialog about computer security right now because it's too political.
That nonsense. Of course you can have an "open dialog", as long as you aren't doing it as part of breaking into someone else's computer without permission. It happens all the time.

You shouldn't have to risk your career just to show some kids how to do something that might actually help them and their community,
You don't. I've already described the dual course admin series that taught people exactly this without costing anyone any careers or getting them expelled. How did they do this magic? They used systems that they had permission to test. They put the systems together to learn how to do that; they broke into them to learn what was possible and how to prevent it.
There have even been cases of commercial outfits that have made public challenges -- and none of the participants have been hung or shot or had their careers ruined. More magic? No, just the simple part about having permission.
There's even a competition run by the government that deals with cyber security, which involves teaching kids how to break into systems. But then, they aren't doing it without permission.
See the common thread here?
Re:Blamestorming by fluffy99 · 2013-01-23 17:24 · Score: 1

Yes, I am aware that a real Computer Engineer is not a programmer. We've hired a few specifically to do the low level board design and they are really good at it. The problem is that when we advertise for software programmers, we get guys with comp-sci degrees calling themselves computer engineers or software engineers and they are barely functional at programming. Again same problem I suppose since true computer science really has nothing to do with programming, but their focus is often on programming.
Re:Blamestorming by CodeBuster · 2013-01-23 20:47 · Score: 1

Anyone remember Steve Jackson Games? They released a game where one of the roles you could play was a computer hacker. The FBI called it a "handbook for computer crime" and the "anarchist's cookbook of cybercrime". No charges were ever filed. It was a work of fiction.
The game you mention is the pen and paper rpg, GURPS Cyberpunk. The credits page still touts the "unsolicited comments of the United States Secret Service" as a selling point.
Re:Blamestorming by Chris+Mattern · 2013-01-24 01:34 · Score: 1

Of course it does. If life hands you lemons, or in this case, an ass-raping by the Secret Service, you might as well make marketing lemonade out of it. The fact remains that Steve Jackson Games was shut down for some time and very nearly went out of business, for doing absolutely nothing wrong, because a Secret Service manager saw a chance to rack up some political brownie points by smacking "evil hackers" who couldn't defend themselves.
Re:Blamestorming by docmordin · 2013-01-24 12:38 · Score: 1

S.B. is the acronym for a Bachelor of Science, or, rather, Science Bachelor, at institutions like MIT and Harvard.

Hacking 101 by MrEricSir · 2013-01-23 12:50 · Score: 1

Like so many things, you have to learn by doing. The only way to learn how to write secure code is to learn how to hack into stuff. Otherwise, how would you even know it's working?

If we want CS students what's really involved in creating a secure system, how about a mandatory "intro to hacking" course?

--
There's no -1 for "I don't get it."

Re:Hacking 101 by Obfuscant · 2013-01-23 13:14 · Score: 2

If we want CS students what's really involved in creating a secure system, how about a mandatory "intro to hacking" course?
Using systems intended for such purposes and not someone else's production systems, of course.
Many years ago our Uni had such a course, run in two parts. Part 1: Unix system administration 2: How to break into improperly administered Unix systems. Nobody went to jail. Nobody was branded a terrorist. Many (some?) people learned how to be system admins.

Hacking sites you don't own is unprofessional by Anonymous Coward · 2013-01-23 12:53 · Score: 4, Interesting

However, I don't buy that what this student did was hacking (in the cracking sense)

Targeting a system you don't own, or aren't reponsible for and trying to break into it is almost always not a good thing to be doing, and should be considered unprofessional (and unethical) conduct.

Noticing a problem while you are setting something else up, notifying the appropriate people, and checking to see if that problem is gone are very reasonable things to do.

I have been working in Computer Security in Internet Banking for the last 15 years, and while I have had many co-workers who measure their worth by how good they are at breaking in to things, very few of those people have been nearly as good at defending those same things.

Figuring out how to hack a site takes finding one vulnerability.

Figuring out how to defend a site takes thinking about all types of vulnerabilities.

Re:Hacking sites you don't own is unprofessional by MichaelSmith · 2013-01-23 13:16 · Score: 1

I have been working in Computer Security in Internet Banking for the last 15 years, and while I have had many co-workers who measure their worth by how good they are at breaking in to things,
Any reason you post anonomously then?

--
http://michaelsmith.id.au
Re:Hacking sites you don't own is unprofessional by Anonymous Coward · 2013-01-23 16:14 · Score: 1

Yes, I don't bother to create accounts for sites where I don't really need them
David Lang

Teaching them to what? by Obfuscant · 2013-01-23 12:59 · Score: 5, Informative

The computer science department is not teaching their students to write code without consideration of the environment of the Internet. At least nothing in this situation says they are.

What they are teaching is that it is unethical to run penetration testing against a system without permission. This philosophy is embodied in the ACM Code of Ethics, in section 2.8:

2.8 Access computing and communication resources only when authorized to do so.
Theft or destruction of tangible and electronic property is prohibited by imperative 1.2 - "Avoid harm to others." Trespassing and unauthorized use of a computer or communication system is addressed by this imperative. Trespassing includes accessing communication networks and computer systems, or accounts and/or files associated with those systems, without explicit authorization to do so. Individuals and organizations have the right to restrict access to their systems so long as they do not violate the discrimination principle (see 1.4). No one should enter or use another's computer system, software, or data files without permission. One must always have appropriate approval before using system resources, including communication ports, file space, other system peripherals, and computer time.

He got thanked for finding the flaw. He got expelled for pen testing someone else's system. Two different acts, two different issues.

Re:Teaching them to what? by Xenx · 2013-01-23 13:14 · Score: 2

He got thanked for finding the flaw. He got expelled for pen testing someone else's system. Two different acts, two different issues.
It's obvious that the testing was done for the right reasons, he just went about it in the wrong manner. He was smart enough to find the flaw, and morally sound enough to report the flaw. It doesn't fit to make the punishment so extreme in such a case.
Re:Teaching them to what? by Guspaz · 2013-01-23 13:21 · Score: 5, Insightful

He did something wrong, sure. But what he did was not bad enough to justify completely destroying his future from an academic and professional standpoint.
He's lucky that this story has attracted as much international attention as it has (and it certainly is strange to be reading about local news stories on international sites like Slashdot, when I work across the street from Al Khabaz' school). If it hadn't attracted all this attention, he wouldn't have had all these job offers, and would have been screwed.
Dawson tried to leave him in debt, unable to enter any other CEGEP, unable to enter any university (you're required to graduate from CEGEP to get into university in Quebec), and with severely diminished job prospects.
Should he have been punished? Yes. Should Dawson have tried to destroy his life? Certainly not.
Re:Teaching them to what? by mark-t · 2013-01-23 13:28 · Score: 2

Yes, it's true that he was actually testing somebody else's system... however, it's not unreasonable to conclude, given what kind of software he was evidently trying to develop, that it would need to be fixed before he released his application or else the vulnerability might be exploited by anybody who used his app and happened to also discover it, as he originally did.

--
File under 'M' for 'Manic ranting'
Re:Teaching them to what? by countach · 2013-01-23 13:35 · Score: 1

He might have done something wrong, but the real problem is nobody taught him properly it was wrong. They are running a computer science course there, they should have taught him CS ethics. When his CS instincts were wrong, they should have fired themselves for failing to teach.
Re:Teaching them to what? by Kernel+Kurtz · 2013-01-23 14:18 · Score: 1

He got thanked for finding the flaw. He got expelled for pen testing someone else's system. Two different acts, two different issues.
He should have done one of them anonymously. Seems he was technically capable of doing so.
That would have made him more "ethical", but less ethical.
Re:Teaching them to what? by Ichijo · 2013-01-23 14:26 · Score: 1

Trespassing includes accessing communication networks and computer systems, or accounts and/or files associated with those systems, without explicit authorization to do so.

I am accessing this very web page on Slashdot.org without explicit written or verbal authorization from Slashdot's owners. Am I trespassing?

--
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
Re:Teaching them to what? by servognome · 2013-01-23 14:52 · Score: 1

A common method for schools to punish people who commit academic dishonesty is to expel them.
Yup, I had more than one professor state that if they caught you cheating, they would make it their personal mission to have you expelled. Welcome to the real world kids.

--
D6 63 0D 70 89 81 BB 8E 7B 7C 5F 5D 54 EA AB 73
Re:Teaching them to what? by 10101001+10101001 · 2013-01-23 15:22 · Score: 1

He did something wrong, sure. But what he did was not bad enough to justify completely destroying his future from an academic and professional standpoint.
Did something wrong? Destryong his future from a professional standpoint?
Skytech. He said that this was the second time they had seen me in their logs, and what I was doing was a cyber attack. I apologized, repeatedly, and explained that I was one of the people who discovered the vulnerability earlier that week and was just testing to make sure it was fixed. He told me that I could go to jail for six to twelve months for what I had just done and if I didn’t agree to meet with him and sign a non-disclosure agreement he was going to call the RCMP and have me arrested. So I signed the agreement.” -- Youth Expelled from Montreal College... (emphasis mine)

If it hadn't attracted all this attention, he wouldn't have had all these job offers, and would have been screwed.
"In the meantime, Al-Khabaz has received more than one job offer from technology firms, including Skytech, the company that makes Omnivox" -- from the summary (again, emphasis mine)
So, in short, what Al-Khabaz did was so horrible the president of Skytech threatened him with 6-12 months jail time for a "cyber attack" (with a convenient way to get out of jail card to sign a NDA) and *now* Skytech wants to hire him? The whole thing screams out that Skytech's president was overly reactionary and the whole "cyber attack" angle has more to do with Skytech's pants being proverbial down than any real wrong doing on Al-Khabaz's part.
Of course, I'm sure I'd feel a lot differently if I saw a pen tester being run against my site. But, then, if I were in that position I'd as quickly as possible run the same pen tester myself and *fix the bugs* because the next person who comes along is unlikely to be a person well intentioned enough to call me up and tell me about the bugs nor someone I myself could call as someone I can confirm any problems they expose. But then perhaps the only lesson to be learned is that Al-Khabaz should have used a Tor proxy to run the scan and companies really should treat the internet like waves battering against a levee with more concern about building a better levee and a lot less on getting the name and number of every big wave that comes along.

--
Eurohacker European paranoia, gun rights, and h
Re:Teaching them to what? by Obfuscant · 2013-01-23 17:03 · Score: 1

So, in short, what Al-Khabaz did was so horrible the president of Skytech threatened him with 6-12 months jail time for a "cyber attack"
And if you read the original article, you'll see that the person who allegedly made this threat denies it.

But, then, if I were in that position I'd as quickly as possible run the same pen tester myself

Do we know this didn't happen?
Re:Teaching them to what? by marnues · 2013-01-23 19:13 · Score: 1

Just felt like being a contrarian today?
Re:Teaching them to what? by 10101001+10101001 · 2013-01-23 23:45 · Score: 1

So, in short, what Al-Khabaz did was so horrible the president of Skytech threatened him with 6-12 months jail time for a "cyber attack"
And if you read the original article, you'll see that the person who allegedly made this threat denies it.
And? The president of Skytech denies threatening Al-Khabaz, yet again Skytech is now offering Al-Khabaz a job now. If the threat was made, Skytech should not want to hire a seeming criminal and risk the liability. If the threat was not made, Skytech should not want to hire a liar who has created such negative PR and who likely will in the future.

But, then, if I were in that position I'd as quickly as possible run the same pen tester myself
Do we know this didn't happen?
As much as they may have, they didn't follow the rest of my advice. It sounds like their logs could tell Al-Khabaz was running the tester which implies they could have easily (a) banned his or any other IP temporarily that used the tester while they finished fixing the bugs and (b) "immediately fix" the bugs as they promised which should make that ban rather short. Instead, Al-Khabaz was called up and "banned" with a NDA which does nothing about any other person who would use the tester against their site, is a waste of time if the bugs were fixed quickly (as the NDA would be effectively quite moot), and seemingly is just a stalling tactic to try to force "responsible disclosure" on Al-Khabaz which we've seen repeatedly has turned into months or even years from a vulnerability being reported to being fixed by a vendor.
In short, your selective short snip pit of my statement missed the point entirely. It's in the same general area as police who take down a report for stolen goods but do nothing more to actually find the culprit(s). It's an almost meaningless gesture if there's good indication that there is no intention to follow through.

--
Eurohacker European paranoia, gun rights, and h
Re:Teaching them to what? by Obfuscant · 2013-01-24 06:36 · Score: 1

And?
And sometimes there are two sides to a story, and sometimes people hear things that weren't actually said. We have one person saying "I was threatened", the other says "didn't happen". Who to believe? I don't automatically believe either one.

The president of Skytech denies threatening Al-Khabaz, yet again Skytech is now offering Al-Khabaz a job now.
And? You give reasons both ways why they wouldn't hire him. And yet, they did. Maybe the truth is somewhere in the middle? Maybe the president of the company feels bad that what he actually did say was misinterpreted so badly? Or maybe they recognize talent and want to hire it?

As much as they may have, they didn't follow the rest of my advice.
So you don't know that they didn't run the same tests.

It sounds like their logs could tell Al-Khabaz was running the tester which implies they could have easily (a) banned his or any other IP temporarily that used the tester while they finished fixing the bugs and (b) "immediately fix" the bugs as they promised which should make that ban rather short.
You miss the point that running the scan itself was the issue, not whether or not he found anything by running it. When I find someone who is abusing one of my systems, I don't put in place a temporary ban, I put it in and forget about it. I certainly don't say "come back soon!".

In short, your selective short snip pit of my statement missed the point entirely.
No, I pointed out that your point was based on an assumption. You don't know that they didn't run the test themselves. And now we know that your assumption would be that the company would remove a block on his IP after they fixed anything that he might have been scanning for, which is something else that is unlikely. I "selective short snip" what I am replying to, which is specifically your comment saying that they should do something that you don't know that they didn't already.
Re:Teaching them to what? by 10101001+10101001 · 2013-01-24 10:21 · Score: 1

And sometimes there are two sides to a story, and sometimes people hear things that weren't actually said. We have one person saying "I was threatened", the other says "didn't happen". Who to believe? I don't automatically believe either one.
Fine. Feel free to believe neither one. What does that leave you with? Nothing? Great.

And? You give reasons both ways why they wouldn't hire him. And yet, they did. Maybe the truth is somewhere in the middle? Maybe the president of the company feels bad that what he actually did say was misinterpreted so badly? Or maybe they recognize talent and want to hire it?
So the whole NDA didn't happen? Or it did happen but what was stated wasn't a threat but fatherly advice, with a whole NDA that violates the whole concept of fatherly advice? Let's think up a couple hundred other possibles once we allow ourselves to presume there's a "somewhere in the middle" and just get to make up things to try to explain things. However you wish to look at it, I see the whole situation very fishy from Skytech's position. As for talent, more on that point later.

So you don't know that they didn't run the same tests.
I also don't know what color pants Al-Khabaz was wearing at the time. Such is irrelevant given that my original statement didn't presume they did or didn't run the test; it was a statement of what I believed should be the proper course of action, of which they obviously didn't follow the latter parts.

You miss the point that running the scan itself was the issue, not whether or not he found anything by running it. When I find someone who is abusing one of my systems, I don't put in place a temporary ban, I put it in and forget about it. I certainly don't say "come back soon!".
"Except through our HR department!" Seriously, the scan itself *shouldn't* be an issue precisely because it's the sort of thing one would expect black hats, grey hats, and possibly even white hats to be using. And the point of putting in place a temporary ban is to prevent exploitation *at the moment*, nothing more. Once the fixes are in place, all the scans will show is that you're not vulnerable. And given that most black hats are likely to be using bots to run scans, exploits, etc, a ban approach is inappropriate generally anyways. Finally, and again, if the scan was the issue, why the job offer? How can you rationalize what may be a black hat a second chance when they've, AFAIK, not expressed any sort of remorse nor does using a standard scan tool, which is at the same level of a script kiddie, in the category of "talent". Now, finding the original bugs quite probably *was* talent, but then the whole NDA, possible threats, etc so muddle the point, that I can't imagine the effort being more than trying to save face. But, yea, I'm sure you can come up with possible kindhearted or good reasons for it.

No, I pointed out that your point was based on an assumption. You don't know that they didn't run the test themselves. And now we know that your assumption would be that the company would remove a block on his IP after they fixed anything that he might have been scanning for, which is something else that is unlikely. I "selective short snip" what I am replying to, which is specifically your comment saying that they should do something that you don't know that they didn't already.
Of course I said what they *should* do because they, IMNHO, fucked it up and did the wrong thing. If they had done the right thing, I don't think I'd be botthering to comment. It's sort of funny, actually. If you believe Al-Khabaz's intent, he was effectively expelled for “serious professional conduct issue” because "the testing software Mr. Al-Khabaz ran to verify the system was fixed crossed a line", yet Skytech's reaction was to apparently just push a NDA on him which seems like a

--
Eurohacker European paranoia, gun rights, and h

Re:Personal Experience by rbprbp · 2013-01-23 12:59 · Score: 1

At the university I go to, I recall a computer architecture teacher that used handouts/slides from when the Pentium 4 was the highest-end CPU available and some introductory programming classes that used 16-bit Turbo Pascal (so the students that were using a 64-bit OS - most of them, those days - were screwed) or non-.NET Visual Basic. Kinda says something about their CS program.

--
They're there in their room. You're on your own.

It's always been that way. by hawguy · 2013-01-23 13:04 · Score: 1

Well yeah, 'Computer Science is taught in this idealized world separate from reality' has always been the case. Just like Math is taught in an idealized world separate from reality. If you want to learn to be a coder in the real world, don't waste your time with a CompSci degree, get a 2 year programming certificate at a vocational training school. I never really thought of computer science as preparing anyone for a real job as a coder.

Expecting a computer science graduate to know how to be an application developer is like expecting an architect to have carpentry skills -- the architect may know all of the basic theory and design concepts behind how to build a stairway, but it's going to take him 5 times longer than an experienced carpenter to get it right, and he might have to do it more than once.

Re:It's always been that way. by JazzHarper · 2013-01-23 15:15 · Score: 1

"Computer Science is not about computers, any more than astronomy is about telescopes". -- Dijkstra
Re:It's always been that way. by F.+Lynx+Pardinus · 2013-01-23 16:11 · Score: 2

Computer Science is taught in this idealized world separate from reality
Getting unexpectedly in trouble for breaking arbitrary or unclear rules? No, it sounds exactly like the real world.

Security training? by cdrguru · 2013-01-23 13:08 · Score: 2

Maybe there should be a slightly different attitude towards breaking into computer systems, or attempting to break into them. However, it needs to be mentioned that if you are learning to skydive the first lesson isn't "what if you chute doesn't open." Similarly, the first project in a chemistry class isn't making dynamite.

What this case showed was a student with some skills could break into a university system. Great. One problem is that the student had little grounding in what consequences might pile up if this skill was used. Like the chemistry student making dynamite the knowledge might be there but no judgement about what to do with that knowledge.

Unfortunately, I don't think the proper response is for companies to hire people like this. They need a lot more work before they really can be expected to use their skills in a responsible manner - and today's corporate environment is hardly the place where people are going to get that. Would a person with the skill to break into computer systems and zero reasons not to do so willy-nilly (especially at the direction of lower level management with all kinds of reasons of their own) be a quality employee? More importantly, would such skills misused result in a good reference on down the road?

We are setting these people up to be unemployable in the future, right after they are exploited.

Re:Security training? by Morpf · 2013-01-23 13:26 · Score: 1

If you are learning martial arts, you first learn how to fall without hurting yourself. ;) I think it is important to learn how to code robustly. Most of CS students should already know how broken many systems are. As others stated: Don't scan systems without consent but feel free to hack your own boxes and programs.
Re:Security training? by BitterOak · 2013-01-24 12:00 · Score: 1

However, it needs to be mentioned that if you are learning to skydive the first lesson isn't "what if you chute doesn't open."
Actually, it is. Before your first jump, you must be trained in what to do if any number of things go wrong, including a main canopy failure. You don't get to decide when something bad happens, so you need to be prepared from the start.

--
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?

About those professors ... by Taco+Cowboy · 2013-01-23 13:08 · Score: 5, Insightful

Like the saying:

Those who can, do

Those who can't do, teach

--
Muchas Gracias, Señor Edward Snowden !

Re:About those professors ... by Kell+Bengal · 2013-01-23 13:40 · Score: 5, Insightful

That doesn't really hold at the university level, where research is required in conjunction to teaching. In fact, it serves a twin purpose - research forces people who just want to teach to stay current in their discipline. Teaching forces people who just want to research to focus and order their knowledge so it can be understood by novices. High school teachers get out of date pretty quickly, but university professors (certainly in my experience) has to be on the ball.

Perhaps the real question here is "Is the field of academic computer science out of touch?"

Full disclosure: I am a robotics researcher ('lecturer', equiv. to an assistant professor) at a university; I'm on a fellowship, though, so I don't have to teach much!

--
Scientists point out problems, engineers fix them
altslashdot.org: The future of slashdot.
Re:About those professors ... by Anonymous Coward · 2013-01-23 14:31 · Score: 3, Interesting

Like the saying:
Those who can, do
Those who can't do, teach
Those who cannot do either somehow end up making the decisions for those who can.
Re:About those professors ... by Anonymous Coward · 2013-01-23 15:55 · Score: 5, Insightful

I've never found that to be the case with university professors. In fact, most of the ones I ever knew did no research at all. They wrote textbooks and taught classes.
They still weren't useless. They knew the material they were meant to teach. But they were horribly out of touch. I still remember having these bizarre arguments with one professor that was sure open source was a brief fad, that it couldn't catch on in any meaningful way, but that if it did, it would be poison for innovation in the tech industry. I'd like to go back and do an obnoxious, "I told you so."
Shit, I hope he's not dead now... I'd feel pretty bad.
Re:About those professors ... by F.+Lynx+Pardinus · 2013-01-23 16:06 · Score: 3, Informative

High school teachers get out of date pretty quickly
As someone who recently used my knowledge of the 1920's Nyquist limit on a project, I'm pretty skeptical of this claim. I don't think the fundamentals of computer science change nearly as fast as you assume.
Re:About those professors ... by TheTerseOne · 2013-01-23 16:51 · Score: 1

Like the saying:
Those who can, do
Those who can't do, teach
Those who cannot do either somehow end up making the decisions for those who can.
The way I always heard it was:
Those who can, do.
Those who can't, teach.
Those who can't teach, coach.
Those who can't coach, administrate.

--
"Newspapers: A tiny little part of the internet, printed out yesterday, and delivered to your house"
Re:About those professors ... by Dahamma · 2013-01-23 17:57 · Score: 1

I was thinking more along the lines of "when is Computer Science by definition a profession except for Computer Science professors?"
Software engineering, network engineering, systems analysis, DBA, etc are professions, and computer science is a decent major to prepare for them, but a CS department that tries to decide what professions its students are suitable for has become no more than a trade school (not to knock trade schools, just don't pretend you are more than that if you aren't!).
Re:About those professors ... by Dahamma · 2013-01-23 18:22 · Score: 4, Interesting

My experience was the exact opposite... I guess it depends on your university's priorities. I had professors teaching undergraduate courses who were not only doing serious research, but were often leading their field. Off the top of my head (it's been a while, but jeez looking at it in hindsight it is humbling):
http://en.wikipedia.org/wiki/Martin_Hellman
http://en.wikipedia.org/wiki/Mark_Horowitz
http://en.wikipedia.org/wiki/John_McCarthy_(computer_scientist)
http://en.wikipedia.org/wiki/Robert_Sapolsky
http://en.wikipedia.org/wiki/Anne_Fernald
http://en.wikipedia.org/wiki/Philip_Zimbardo
http://en.wikipedia.org/wiki/William_C._Dement
http://en.wikipedia.org/wiki/Paul_R._Ehrlich
http://en.wikipedia.org/wiki/Craig_Heller
http://en.wikipedia.org/wiki/Eric_Knudsen
Re:About those professors ... by Anonymous Coward · 2013-01-23 18:39 · Score: 1

> I'm pretty skeptical of this claim. I don't think the fundamentals of computer science change nearly as fast as you assume.
He wasn't specific about the claim. Even if he was, the "fundamentals" aren't what the topic (and his comment, ostensibly) is about. CS fundamentals are based in rigid mathematical models, so it wouldn't make sense to say they change quickly. Jesus.
Re:About those professors ... by TechyImmigrant · 2013-01-23 19:00 · Score: 1

Indeed. One of my professors invented the tagged delay line and the invisible cache, back when you had to build it out of discrete ECL.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Re:About those professors ... by davester666 · 2013-01-23 19:01 · Score: 1

Most of mine were like that, knew their stuff, made money by writing the textbooks they taught against [with yearly or bi-yearly updates].
One stood out by being very charismatic, enthusiastic about teaching the material to us, would notice if we missed class and harass us about it, and was available outside of class to help.
Naturally, he was turfed after 1 year [I was really lucky and had him for 3 classes over 2 terms].
Another one was a Computing Science professor, and the course was on algorithms. He would literally read from the textbook to us, copy the illustrations to the chalkboard [nevermind that we all had the textbooks]. Then we would ask questions as to the algorithm or two that he had so helpfully read to us. Every single question, he had to write down, then at the start of the next class, he would give the answers. Of course, the context for the question was lost, and followup questions were even more useless.
Naturally, he was kept on, at least for 3 years.
Evidently, the professor evaluations we had to fill out for each course were all taken with a large grain of salt. And a shredder.

--
Sleep your way to a whiter smile...date a dentist!
Re:About those professors ... by Anonymous Coward · 2013-01-23 20:22 · Score: 2

Well of course yours was different. It looks like you went to Stanford or MIT, 1st and 15th finest universities in the world. Good for you. Really.
But for the requisite car analogy, it's a bit like someone asking, "Are today's American cars unremarkable?" and replying, "I don't think so. I had a Saleen S7 and I thought it was pretty neat."
Are typical university CS department professors doing meaningful "research"? And if they are, does that suggest they've got some grip on the real world? I'm not sure it does.
Either way, it doesn't sound like the case in point, Professor Alex Simonelis, possesses anything resembling a clue.
Re:About those professors ... by dkf · 2013-01-23 20:53 · Score: 4, Interesting

Are typical university CS department professors doing meaningful "research"?
Should a "typical university" have a CS department at all? Speaking as someone who works in a CS department where the academic staff have to produce research output as well as teach, it sounds like there are places which just ought to stop the pretense and to actually call themselves "Visual Basic Training Schools" or something. (Disclosure: I mostly don't teach, and instead do software engineering to turn the CS research into practical tools to support other research areas.)

--
"Little does he know, but there is no 'I' in 'Idiot'!"
Re:About those professors ... by Dahamma · 2013-01-23 21:25 · Score: 1

I completely agree if he is making idiotic statements like "he is 'no longer suited for the profession'" he has no grip on the real world (of post-CS jobs). Though I would most definitely NOT generalize this to other professors no matter where they teach. Ford put out a decent American super car for much less than the S7... and it has actually appreciated significantly over MSRP since its release... :)
I posted this in another comment, but the thing that strikes me most is a *computer science* professor trying to call his department a "profession". The CS major is a defined "profession" about as much as "political science" or "history". It's a good background to many computer-related careers, but the only "profession" it really describes is "computer science professor."
Re:About those professors ... by DoctorBonzo · 2013-01-24 00:56 · Score: 1

My take has been:

Those who can, do.

Those who can't, teach.

Those who can't teach run for office.

Not sure about Obama, though...
Re:About those professors ... by Attila+Dimedici · 2013-01-24 01:50 · Score: 1

I had a high school teacher who put it this way:
Those can, do
Those who can't, teach
Those who can't teach, teach teaching.
My experience with those in the education profession is that while there is some truth to it, the line is not quite that clear cut between the first and second lines (there are people who do things successfully for awhile then become teachers, although a lot of teachers have no concept of the real world occupied by most people). However, there are very vanishingly few successful teachers who become education professors.

--
The truth is that all men having power ought to be mistrusted. James Madison
Re:About those professors ... by phoebusQ · 2013-01-24 02:31 · Score: 1

Sounds like you didn't attend a research university, but perhaps a smaller school with a more instruction-focused department (not to be a dick, but what I'm trying to say is that this would be a lower end program). Most large University CS departments, at least in the US, require research work of their faculty. At higher levels it is integrated into some of the courses they teach as well. Also, PhD programs generally require extensive research work, which means the advisors need to be participating.

Re:Personal Experience by Guspaz · 2013-01-23 13:16 · Score: 1

When I was in CEGEP taking compsci as Al-Khabaz is (at John Abbott, though, not Dawson), we were the first year that didn't have a mandatory COBOL course. This was in like 2003, 2004 or so.

He ran a scanner against the site causing a DOS by Anonymous Coward · 2013-01-23 13:17 · Score: 1

He ran a scanner against the site causing a DOS. Twice!

He was asked not to. The expulsion is a little extreme but what he did was definitely not justified.

So I lock my bike at the shop by MichaelSmith · 2013-01-23 13:20 · Score: 1

and this guy is standing near the parked bikes. He comes up to me say and says you know, I could easily open that lock. I ignore him and walk away but I look back and he is standing there right beside my bike not breaking any laws. So I have a few alternatives. I can walk away and hope he doesn't damage it or rip it off. I can call the cops, but no laws have been broken, or I can unlock my bike and go elsewhere.

Though frankly what I want to do is kick him shitless.

--
http://michaelsmith.id.au

Re:So I lock my bike at the shop by Anonymous Coward · 2013-01-23 13:32 · Score: 1

You mean you park your bike at the shop, latch your locking mechanism but completely fail to bolt it in a secure fashion. Some guy comes up to you and says you know, anyone could open that lock. You threaten him and tell him not to tell anyone your bike's unsecured.
He then opens your bike lock, checking to see if you paid attention and bolted it properly... and you kick him shitless.
Re:So I lock my bike at the shop by Whatsisname · 2013-01-23 16:15 · Score: 1

You could also fix your lock.
Re:So I lock my bike at the shop by MichaelSmith · 2013-01-23 16:26 · Score: 1

My point is that the statement I found a security problem with your system can be interpreted in different ways. Lets assume that the recipient of that message gets ten extortion attempts per week. An innocent message about a security hole would just go on the list to be reported to the police.

--
http://michaelsmith.id.au

well we need more hands on training / apprentices by Joe_Dragon · 2013-01-23 13:26 · Score: 1

well we need more hands on training / apprenticeships.

The college system is kind of out of date and comes with the full load of fluff and filler classes. Tech schools are roped into the college system as well.

There is lot's stuff that is poor fit into a 2 year or 4 year plan and other stuff that needs a lot more hands on training that is a poor fit for a collgle class room. When more of a community College setting is better. Yes community College offer classes non degree.

Also the cost of college is getting to high and by cutting down what is now 4-5 years down to say 1-3 years can save alot and make it quicker to learn skills.

ALSO THERE IS lot's of IT / tech work that is not even application development or CS that get lumped into CS as the tech schools get no respect.

Re:Personal Experience by Obfuscant · 2013-01-23 13:29 · Score: 3, Insightful

At the university I go to, I recall a computer architecture teacher that used handouts/slides from when the Pentium 4 was the highest-end CPU available

Basic computer architecture is basic computer architecture. The specifics may change, the number of bits may change, but the basics are still the same. I learned on 8080s and 6502s and PDP-8s and an odd CDC 6500, and they all shared the same concepts. When I pick up a datasheet for a modern processor, I see a lot of the same old stuff.

Once you have the basics, then you can expand. "How can we improve on X? By doing Y...". You don't know why Y is better unless you know what X is. And more important, it is hard to see the potential parallels for future improvement unless you know the past. "If we did A to improve X into Y, maybe we can do A to help this other thing, too..."

a middling computer scientist... by schlachter · 2013-01-23 13:31 · Score: 1

could easily be making six figures as well.

Hopefully some better college will offer him admission in light of him getting the boot from Dawson.

--
My God can beat up your God. Just kidding...don't take offense. I know there's no God.

other CS departments trun out people w skills gaps by Joe_Dragon · 2013-01-23 13:34 · Score: 1

other CS departments trun out people with skills gaps so it's more of a over issues of what is being taught is a world separate from reality with loads of theory.

Re:WTF??? by Anonymous Coward · 2013-01-23 13:39 · Score: 1

I'ts like a dumb guy trying way too hard to come off as insightful.

What a brilliant piece of self-reference! Unfortunately, it was almost certainly unintentional.

Yep... by Darkness404 · 2013-01-23 13:41 · Score: 1

Yep, and the only way to realize just -how- vulnerable your systems are is test them out yourself (or have someone do it for you). I'm afraid that many CS graduates know nothing about how the "bad guys" are going to get into your system. They might have vague ideas about how a DDOS works, but its unlikely they ever have experienced one first hand. To an average person, indeed even an average CS graduate hacking (in the black or grey hat usage) either consists of just pressing a button or involves many crazy steps that no one can possibly do. A half-assed simulation simply doesn't cut it because it isn't modeled on the real world and so the students think that their actual work will be done in a vacuum and not in the real world of script-kiddies, zero day exploits and 4chan.

--
Taxation is legalized theft, no more, no less.

he had a test account and as working on a app by Joe_Dragon · 2013-01-23 13:49 · Score: 2

he had a test account and as working on a app I think the school just was very out of touch with the real world IT.

Let's see he finds a bug while coding his app and then he reports it and say it was fixed and then a few days later he tests the bug it's still in place.

DOS and C64 and AppleII by SparrowOS · 2013-01-23 13:53 · Score: 1

These machines ruined people so they cannot program because they learned GOTO and no secuirety. HGR: HCOLOR=7: HLINE 100,100 to 200,200 That is no way to learn graphics. Qt X-Windows!

Re:DOS and C64 and AppleII by SplashMyBandit · 2013-01-23 21:10 · Score: 1

At least they learned to spell "security". lol. Just ribbing ya.

that is more of IT class then a CS class by Joe_Dragon · 2013-01-23 13:54 · Score: 1

that is more of IT class then a CS class.

people doing application development do need to know about makeing secure code but other parts fall on the sever and web guys who don't real need the full CS load of application development and theory classes. Also is parts of theory that people application development do not really need. Other then at at very high level.

Re:So You Never Got Accepted? by hawguy · 2013-01-23 13:55 · Score: 1

Whoa, sorry I seem to have hit a nerve there.

Here's US Berkeley's CompSci overview... what part of this makes you think that CompSci is preparing graduates to be application developers?

UC Berkeley construes computer science broadly to include the theory of computation, the design and
analysis of algorithms, the architecture and logic design of computers, programming languages, compilers,
operating systems, scientific computation, computer graphics, databases, artificial intelligence and natural lan-
guage processing. The Electrical Engineering and Computer Science Department’s goal is to prepare students
for both a possible research career and long-term technical leadership in industry.

That's not to say that a CompSci student can't become a developer, but the curriculum is not designed to teach that - there are far easier ways to learn application development if that's all you're interested in.

They should beTeaching how to deal with stuff like by Joe_Dragon · 2013-01-23 13:58 · Score: 1

They should be Teaching how to deal with stuff like this but all they did was let him doing it his own and then say you did it wrong and we not just giving a C or even a D. and you are not just getting a F no you are getting a

SUPER F as in F for life.

but he was not breaking into computer systems by Joe_Dragon · 2013-01-23 14:04 · Score: 1

but he was not breaking into computer systems.

He was working on a APP and found a major bug in the system.

That like working some where let's say you adding cameras or new sensors or even upgrading the fire alarm system at bank security system and find there is a very easy way to bypass parts of the system and report it and let's a few days later you are back doing more work and find that no fix has been done.

Re:Hey Look! It's seebs Trying To Be Clever Again! by Anonymous Coward · 2013-01-23 14:06 · Score: 2, Insightful

Give it a rest dumbfuck.

Wow! What a creative comeback. Really, That was SO impressive!! "Dumbfuck!" Such poetry, and you managed an actual two syllabe word. Most impressive, can I use that? Whatever you're paying your writers, double their salary and give them 2 weeks in Hawaii. That was, dare I say, creative genius! Yes, yes it was.

I may never post again, there's no reason to now, for I have read the ultimate in rebuttals. Someone call the Fox channel!

That is Tech needs more trades / apprenticeships by Joe_Dragon · 2013-01-23 14:12 · Score: 1

That is why Tech needs more trades / apprenticeships and not 4+ years CS.

Way to many tech / IT jobs want CS graduates for jobs that need a different skill set.

the NDA likely said don't tell how to get into the by Joe_Dragon · 2013-01-23 14:15 · Score: 1

the NDA likely said don't tell how to get into there system and they seem ok about him talking about what happened and even if it did they are not makeing a big deal about as they did not want him to get kicked out of school.

give them the power to say no the PHB about rushin by Joe_Dragon · 2013-01-23 14:16 · Score: 2

give them the power to say no the PHB about rushing the code out with bugs.

civil engineers have that power.

Very bad assumption by Anonymous Coward · 2013-01-23 14:16 · Score: 3, Insightful

You're making a very bad assumption that only poor professionals work in minor colleges.

There are countless reasons for working at one university rather than another, the simplest being that it's a place you like or where you have family. Another might be that it provides good promotion prospects rather than only dead man's shoes. And another big one is that it's not a place infested with prima donnas where the only option is to play second fiddle.

Academia has a lot of problems, and choosing the best place to work is not anything like as simple as you portray. Not everybody is driven by high salaries and high prestige colleges. Indeed, the kinds of places you seem to rate most highly are often a huge rat race and not pleasant at all.

While I don't know Dawson College, just because it's small and not well known does not say anything about the caliber of its academics.

apprenticeships and more trades like learning is n by Joe_Dragon · 2013-01-23 14:19 · Score: 1

apprenticeships and more trades like learning is need then with people who have done / are doing the real work and not some professor who has not or has been in education all of there life.

Use hacking tools on dedicated network by jfdavis668 · 2013-01-23 14:37 · Score: 1

I obtained a Masters in CS a few years ago. Security was a big topic for the department. We had a dedicated network and set of servers to learn, test and use the type of software that Al-Khabaz used. We do not use it on live networks against production servers. You never do that without knowledge of everyone involved. Same way where I work. Doing what he did would get you fired. If you find a security hole, point it out to the appropriate people. Then let them fix it, don't keep poking it with a stick. If your network and servers have appropriate security monitoring software, this would set off every alarm in the place.

College level CS is not useful anymore. by Lumpy · 2013-01-23 14:44 · Score: 1

I see coding styles that are downright horrid, that are being taught, and every single College course is so out of date, it's doing a dis-service to the students.

Couple that with a Lazy prof that is upstaged by a student..... and you get this exact reaction.

--
Do not look at laser with remaining good eye.

It's the geek who has lost touch with reality, by westlake · 2013-01-23 14:47 · Score: 1

Dawson computer science professor Alex Simonelis said his department forbids hacking as an 'extreme example' of 'behavior that is unacceptable in a computing professional.' And, in a news conference on Tuesday, Dawson's administration stuck to that line, saying that Al-Khabaz's actions show he is 'no longer suited for the profession.'

The geek's encounters with the law --- with society as a whole --- have not been ending well for him. The Internet is not his private playground anymore. Intrusions into other people's systems and software may end in a felony charge.

I've no doubt that the geek can still find shelter and support in his own community when things go south, but the climate outside is not so warm and welcoming anymore.

Re:It's the geek who has lost touch with reality, by segfault_0 · 2013-01-23 15:33 · Score: 1

A felony would almost certainly require real damages to the target, DoS or theft or the like.
Furthermore, the kid already told the school about his find and made no attempt to conceal his identity on his second connection. He had gotten no negative feedback on his first connection. For a website, any connection outside of the provided user interface is outside of the normal terms of service.
Neither of his connections to the site resulted in any action by the actual owner of the site besides perhaps a call to the school in a moment of panic.
All of the evidence supports his claims of innocence in intent, if not in action. Furthermore, he wasn't given any opportunity to give his side of the story -- if he was arrested or sued he would have been able to defend himself.
The kid should retain an attorney and sue the school for the damage to his prospects and reputation, then we will see if a jury of his peers feels he's lost touch with reality.

--

I was crazy back when being crazy really meant something. (Charles Manson)

does no one ever read the article anymore? by MoFoQ · 2013-01-23 14:55 · Score: 4, Interesting

does no one ever read the article anymore?
It was on a test server.....using credentials given by the vendor, Skytech Communications.

...the software vulnerability scan that got him expelled from school was conducted on a test server only, and using credentials provided to him by the company that makes Omnivox: Skytech Communications.

The mere fact that Skytech supposedly gave him a job offer is enough to think that the department has their collective heads up....well..you get the point.

There's a reason why the legendary Weld Pond would be so vocal and would even say "These kind of people right out of college are the kinds of people we want to hire."

Re:Why they call it computer science by JazzHarper · 2013-01-23 15:21 · Score: 1

My friend went to college, I went to work. He could design a CPU from scratch, knew how to do visual recognition. Nothing any employer I ever came across found useful.

I could design a CPU from scratch and my employer _did_ find that useful. I, however, had an engineering degree, not computer science.

Nice strawman but getting very rare now by dbIII · 2013-01-23 15:24 · Score: 2

I think it was some time in the 1980s when there was a very strong push to get academics in applied fields to do some outside consulting or perish. Then there's academics such as the head of R&D at the company I work for - two days a week at university and the other three designing and improving equipment and techniques that are used in a commercial venture.

Oh be honest ... by dbIII · 2013-01-23 15:34 · Score: 1

Running penetration tests on random companies' resources

True, but putting that statement here is very misleading because it actually has nothing to do with the situation. In this case the person was a legal user of the software and was authorised up to a point. It looks like they stepped over that line, but where the line lies comes down to fine print in licence agreements and not in criminal law IMHO. It's very different to "Running penetration tests on random companies' resources without prior authorization".
I'm sure you are aware of all that, so why are you attempting to mislead gullible readers here?

Re:Oh be honest ... by CurunirAran · 2013-01-23 16:38 · Score: 1

Yup. Moreover, he actually had a big stake in this too, since his details were there to be exploited. He was checking how easy it was for someone to access that data
Re:Oh be honest ... by dbIII · 2013-01-23 17:03 · Score: 1

BUT if you come back days later and try to break into the bank, run automated tools on it, then you should go to jail. So what if the bank hasn't fixed the problem yet?
Slighly more on topic than the other person's analogy, but still too much of a hysterically overinflated scale difference to take seriously.
Re:Oh be honest ... by NicBenjamin · 2013-01-23 17:06 · Score: 1

The CBC story has so many helpful details on this issue. It would be very nice if slashdot had chosen to quote it. As is everyone thinks "Oh he just made one unauthorized SQL request and the whole universe is freaking out, poor baby."
But it was a bit worse then that. Al Khabaz attempt to test the vulnerability was not harmless. It was basically a denial of service attack:
“The attack made the College portal extremely unresponsive for its thousands of users. Had it not been countered, it would have put the College portal out of order for the entire students and teachers population of Dawson. The attack was traced, and it turns out that it came from one of the students who participated, earlier that week, in the discovery of the security flaw. We therefore decided to be clement, and not to report the attack to the authorities.”
The College Portal is used by roughly a quarter million students, so this is kind of a big deal. He did this using Acutenix, which is not supposed to be used on a live system for precisely this reason.
Granted he meant well, and he's a kid, so prison was not justified. But, OTOH, he's just a kid so now is the time to teach him lessons. And the lesson here is don't fuck around with high-level testing tools on live sites ever. If you have to do that shit, make sure the people who can punish you for doing so are cool with it or you will be punished. Defintily do not do this if you have been repeatedly warned not to do so. Dawson's front-page claims Al Khabaz was warned not to poke into systems where he wasn't authorized.
Expulsion from a low-level school seems about right (CEGAPs like Dawson grant a degree that's similar to an Associates degree, but somewhat more prestigious because they are required for admission to a University), particularly since he's likely gonna be able to use the publicity to get into a better school.
Re:Oh be honest ... by dbIII · 2013-01-23 20:33 · Score: 1

Yes he created problems, but as a legal user of the system using it in an unattended way it's equivalent to (for example) the head of an electrical engineering department mandating that all staff in his department set their email clients to pop mail every second and thus disabling all email with a large university for three working days. Even that incident amusing in hindsight is an inflated example. Also the "decided to be clement, and not to report the attack to the authorities" is fairly false goodwill since what are the authorities going to do when it's a civil matter about terms of use instead of a clear example of an outside party with malicious intent.
What is misleading with many of the posts here is deliberately and misleadingly framing the situation as a clear example of an outside party with malicious intent. I wonder about the motivations behind oversimplifying the situation and demonising the student. I suspect it's more about personal baggage and trying to distil things down to simple slogans than anything to with the actual situation. Some of it is probably mindless reacting to key words and mindlessly applying absolutes - like those idiots that think even a ping to see if a server is up is "cyberterrorism" and have personal baggage with the people that block their web access or whatever.
Re:Oh be honest ... by LordLimecat · 2013-01-24 02:14 · Score: 1

He was not in the least authorized to run vuln scans. IANAL but most experienced network guys you will talk to (including the nmap guys) will tell you, dont do it without explicit approval.
Unless youre a lawyer, probably best not to post things like you did, lest someone take it as actual advice and end up in a whole heap of trouble.
Re:Oh be honest ... by LordLimecat · 2013-01-24 02:18 · Score: 1

Look, its very simple. Intent matters as you mentioned, and there are mitigating factors, but at the end of the day this guy accessed systems in an unauthorized manner which generally falls into "attack" territory. The above can be used as defenses, but youre already in trouble at that point.
The very simple answer is that this guy made a bad decision, though perhaps he did not know better. Now he does, and hopefully will not repeat the mistake. We could discuss all day whether he should be allowed or could be allowed or whether the laws are right, but in the world we live in scanning a company that does not want to be scanned (as in this case) can very easily land you in trouble and pretending otherwise wont change things.
Re:Oh be honest ... by dbIII · 2013-01-24 14:16 · Score: 1

but at the end of the day this guy accessed systems in an unauthorized manner which generally falls into "attack" territory.
This is where we strongly disagree. Being a legitimate user instead of an outside "attacker" changes things a lot even when the legitimate user does things that are outside of any agreements.

whether the laws are right
That distinction above is a thing that decides if the laws even apply, and changes it from a possible criminal matter to a mere civil matter where people get to argue about what is allowed and not allowed in contracts and service agreements.
To use an analogy, it's the difference between a break and enter or a student in a college building wandering through an open door labelled "authorised personnel only". Law enforcement is going to be very interested in the former but isn't going to give a shit about the latter, and may even give whoever reports it at the college a lecture about wasting police time and getting their own house in order.
In this case I see the threats of reporting the incident as a bluff unless somebody in law enforcement sees it as a political vehicle to put a "hacker" head on a stake and improve their career prospects, gaining promotion before it has time to get thrown out of court.

This sort of petty electronic trespassing has happened a lot for as long as there has been students with computer access, and either a direct or side effect is the security models deployed on *nix. If a web based system is not set up to handle a hostile environment then it is not fit to be deployed where there are students, or as anything other than a small company intranet.
Re:Oh be honest ... by dbIII · 2013-01-25 21:18 · Score: 1

I put it in bold print and you still didn't read it :(

Because it is the fucking law by Sycraft-fu · 2013-01-23 15:43 · Score: 1

Go ahead and go in to a bank, or better yet a government agency. Barge in to the "Employees Only" area, open up a confidential filing cabinet, and start rifling through for your data. See how well you do in court with the "I was just checking to see if my data was being mishandled!"

You learned these rules in Kindergarten: Don't touch what isn't yours, don't break someone else's stuff. You don't get to go and try to bust in to systems you don't own, or have permission from the owner. It isn't just the law, it is common courtesy/sense.

Geeks really need to get it through their skulls that just because you are technically capable of something, doesn't make it ok.

Re:Because it is the fucking law by HornWumpus · 2013-01-23 16:56 · Score: 1

As long as I was dressed appropriately I figure the odds are good I'd walk out with the records I was looking for.
If they stopped me it wouldn't be at the filing cabinet. Once I got to that I'd be golden.
The rules I learned in Kindergarten: It they wanted it they would have nailed it down. If I can pry it up, it isn't nailed down. Never admit to nothing.
Laws are suggestions.

--
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Re:Because it is the fucking law by fredprado · 2013-01-23 17:21 · Score: 1

I can go and walk around the street checking if a bank has holes in its wall, all day if I so want, thank you.
Re:Because it is the fucking law by fredprado · 2013-01-23 17:24 · Score: 1

Oh and no, it is not the fucking law. He didn't do anything illegal. It was just arguably against the ethic code of the school.

A bit more on that by dbIII · 2013-01-23 15:45 · Score: 1

The first person that described to me in detail exactly why the Pentium 4 was crap in comparison to other architectures passed his degree in electrical engineering in 1948.

Re:A bit more on that by Obfuscant · 2013-01-23 17:12 · Score: 1

Yes, we all know that segmented architectures are crap compared to other non-segmented architectures. I mean, dealing with the 68000, VAX et.al. was such a pleasure compared to the hoops that ALL x86 systems have. That doesn't change the fact that the x86 systems have the basic computer architecture components and you really do have to teach things starting somewhere. If you start only with the latest, fastest, best architectures straight out of the research labs, you are cheating the students out of important information. Like, WHY is the P4 such crap?

This is something geeks need to understand by Sycraft-fu · 2013-01-23 15:49 · Score: 3, Insightful

In the physical world, there is NO SUCH THING as perfect security. You can't design a setup that someone else cannot overcome. All you can do it make it so hard that nobody would try, and multi layered so you hopefully catch something if there is a failure at one level. There's no perfect security, no magic bullet.

Likewise there is nothing that is invincible, nothing that can withstand any and all attacks without problems. Everything has failure points, everything can be broken. You have to use things properly or they WILL fail.

We all accept this as part of every day life. However then when it comes to the virtual world, to computers, geeks seem to think things should be perfect. No system should ever have any security flaw, ever. No system should break or fail, even when subjected to deliberate attack. Everything should be built flawlessly.

Nope, sorry, doesn't work that way. While it is a lot easier to make things more resilient than in the physical world, you still have to assume that failure is possible, that flaws are present and not known. That is just life.

Re:This is something geeks need to understand by Anonymous Coward · 2013-01-24 00:33 · Score: 1

In the physical world, there is NO SUCH THING as perfect security. You can't design a setup that someone else cannot overcome. All you can do it make it so hard that nobody would try, and multi layered so you hopefully catch something if there is a failure at one level. There's no perfect security, no magic bullet.
The main difference is that, in the virtual world, the cost of trying to overcome a security system is much, much lower that in the physical world. In the physical world, a key hidden under a doormat, or in a 'rock vault,' (ie, security by obscurity) will defeat most penetration attempts. In the virtual world, it's trivial to examine every virtual rock within 50 virtual miles to see whether it's a key, and it's trivial simply to manufacture and try every possible key. There's no magic bullet, but the standards of virtual security need to be much higher than the standards of physical security for the same level of protection.
Re:This is something geeks need to understand by steelfood · 2013-01-24 10:21 · Score: 1

In the virtual world, things should be perfect. Computer science is a mathematical science. Mathematics is perfect.
Computer science loses its perfection when the virtual world meets the real world. Those electrical signals travelling between my keyboard and my box can be intercepted. The radiation from my monitor can be captured and analyzed.
And don't forget the most imperfect physical system of all: the user.

--
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."

This is about defining/defending "the profession" by Geof · 2013-01-23 15:54 · Score: 3, Insightful

This isn't really about Al-Khabez. It's about policing the boundaries of the profession. The problem - the reason that there is a culture clash - is that despite attempts for over 40 years, no-one has succeeded in transforming computer programming into a profession. To be more precise, whether programmers professionalized remains a serious question for debate.

Look at the quotes from Simonelis, Dawson, and the ACM:

behavior that is unacceptable in a computing professional (Simonelis)

no longer suited for the profession (Dawson)

The Code and its supplemented Guidelines are intended to serve as a basis for ethical decision making in the conduct of professional work. Secondarily, they may serve as a basis for judging the merit of a formal complaint pertaining to violation of professional ethical standards. (ACM code of ethics)

If programming were a profession like medicine or law or engineering, programmers would acquire higher status, as would organizations like the ACM. From the point of view of managers, programmers are often seen as unmanageable crafts people with little respect for standard practices of business. For them, professionalization is about controlling and assessing programmers and theirwork. The rise of computer science, the creation of software engineering, and the creation of the ACM were all driven in large part by efforts to professionalize the field: sometimes more in the interests of programmers, sometimes more in the interests of management

This comes up again and again on Slashdot. Should there be a standard curriculum or test or other criteria that all programmers should meet? Should we have to belong to professional associations? Should programmers be obliged to follow codes or take legal responsibility for flaws in software? How much should formal education and credentials be valued? Should self-taught programmers be excluded?

These are contentious issues. Clearly Dawson College and Mr Simonelis have an interest in defining and policing the boundaries of the profession. This would enhance their status. But as nearly a half century of debate and ongoing discussion here demonstrate, there is no professional consensus for them to uphold. This is real cultural divide. Al-Khabez got caught in the middle, used by Dawson in their efforts to define the profession and their own status. I think that's terribly unfortunate.

For an excellent book on the history of programming and efforts to professionalize it, see The Computer Boys Take Over by Nathan Ensmenger. He argues that programmers are morke like technicians than professionals. Like other technicians, their work is often threatening to the organizations that depend on them. And despite the best attempts of computer science and software engineering, much of it is guided more by craft principles than by rigorous scientific or engineering methods.

was conducted on a test server only, and using cre by Joe_Dragon · 2013-01-23 16:30 · Score: 1

was conducted on a test server only, and using credentials provided to him by the company that makes Omnivox.

So maybe he did the test the wrong way or he may of went to far but he is still in school and should be learning how to do stuff like this not getting kicked out for doing it wrong

also other parts of IT should not be lumped into by Joe_Dragon · 2013-01-23 16:41 · Score: 1

also other parts of IT should not be lumped into CS they should have there own profession.

Re:Personal Experience by HornWumpus · 2013-01-23 16:59 · Score: 1

Holy shit. I will never admit to having taken a COBOL course. I graduated college in the late 80s.

--
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'

So what? by Sycraft-fu · 2013-01-23 17:47 · Score: 1

Well, if you want to see "so what" go read your state's legal code, or the US code. If that is too complex or theoretical for you, go break a law, may I suggest a small one, and get caught. You'll quickly find out "so what."

That's what happened to this guy. He broke the rules, he faced the consequences.

Re:Personal Experience by Guspaz · 2013-01-23 17:54 · Score: 1

Funny, when I was going through CEGEP a bit more than half a decade later, we had moved up to... VB6 :P There were two major revisions of VB.NET out at the time, but of course the school was still running Visual Studio 6, not VS.NET or VS.NET 2002.

Ok by Sycraft-fu · 2013-01-23 18:08 · Score: 5, Informative

Go ahead and show me the home/business alarm you think will stop me. Go ahead. I can more or less guarantee you can't do it. The reason is I know quite a bit about how they work, since my grandpa has been in the business of selling them all his life, and how they can be defeated. Particularly if you are talking something public where you can look around innocuously and find out what is there. Ultimately they are at their core just a circuit board in a box that connects to sensors, sirens, and maybe a phone line. Break the board, they stop working. If you have one in your house open it up and see what's inside. It is simplistic, and not at all attack resistant other than the thin metal box it lives in.

For that matter, defeating an alarm really isn't necessary if taking something, like say physical data (files and so on) is your objective. All they do is make noise and if they are good ones, call a security company who will eventually call the police who will eventually respond (they aren't that fast, false alarms happen often). That doesn't stop people with guns from kicking in your door, grabbing what they want, and leaving.

Same shit with security guards. You ever have a look at the security that public places like office buildings and malls use? They are unarmed, and low paid. Their job is to call the police if shit happens. It doesn't take much to out-class them, you bring a pistol with you, you've already got them hopelessly outgunned. You think they are going to throw their life on the line if someone holds them at gunpoint? Hell no. For that matter there usually aren't very many. The mall near me has one car that patrols their parking lot at night (I overlook the parking lot). That is it for perimeter security. I don't know what they have inside, but you can bet it isn't much more (maybe not even anyone).

Physical security at homes and businesses keeps out the causal crooks, nothing more. Now that's all they really face, people wouldn't bother with a targeted, planned, attack, they just don't have enough of value. They face low level thugs that do vandalism, smash and grabs, that kind of shit. And oh, by the way, it DOES happen. The mall near me gets broken in to at least once a year, usually dumbass teens just causing trouble, and by the fact that they got in, it means security failed to stop them.

They don't get fired, their job isn't to stop everything, it is to report anything they see, and to drive around and look conspicuous (their car is marked, and has a flashing yellow light) so as to scare troublemakers off.

If your house has never been broken in to it isn't because you have amazing security. A burglar alarm and a crap lock do not make great security. It is because nobody has tried. They good news is most of us don't face much in the way of threats to security in the physical world. Nobody tries to break in, or attack us, or the like. It is quite uncommon.

Now that doesn't mean we should just be all lax with computer security, but it does mean that this silly demand of perfection needs to stop. Nothing is perfectly secure.

Re:Ok by Rich0 · 2013-01-24 02:38 · Score: 1

Agreed on all points. The purpose of most physical security is to detect intrusion and limit the scope of any intrusion. Teenagers can break into the mall, but they probably couldn't carry out all the TVs. Safes aren't rated on being uncrackable, they're rated on how long they typically take to crack. Putting intruders under time constraints won't stop them from stealing one high-value item, but they will stop them from carrying out a truckload.
The physical security analogy doesn't really apply cleanly to computer security. If I want to break into a mall I need to go there, and to escape I need to drive away. Being there means having my face and car on security camera footage. Escaping means there is an opportunity to pursue me. Being there also limits my opportunity - unless I'm able to steal so much stuff that I can finance a huge planning operation I can't case out every mall in the country. If I'm stealing some top secret document and have a $50M bankroll that isn't an issue, but if I'm just stealing TVs then I'm only going to be stealing them from local stores, and chances are after one or two hits I'll find the police on high alert.
For an electronic intrusion I can physically reside anywhere. For state-sponsored intrusion I can even reside in a completely friendly jurisdiction (unless the enemy wants to start dropping bombs). There is no need to escape, though there is potentially more opportunity to detect intrusion (attacks must pass through may physical locations). The risk can be very low if you're in a friendly jurisdiction, so that means I can mount attacks against even low-value targets with a positive ROI. If I live in some country that does not prosecute computer crime I can find a random mom-and-pop e-commerce site, break in, steal data, and hold it for ransom. All they can do is call the cops after the fact, and the cops can't really do anything about it. A mom-and-pop store normally has to deal only with local burglary, and now they have to worry about sophisticated hackers a world away. In fact, local attacks are much less of a risk online, because the US is very aggressive against computer crime so most attacks would be unlikely to be mounted domestically.
Re:Ok by steelfood · 2013-01-24 10:28 · Score: 1

Two things:
1) They don't need to break into your home. They just need to wait for you to open your door, and rush in with gun or knife in hand.
2) Most security systems are designed to keep bored teenagers out of trouble, or to capture the offender after the fact.

--
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."

Generally considered? by Anonymous Coward · 2013-01-23 18:57 · Score: 1

Fuck that. What he did exposed the incompetence of Skytech, Edouard Taza, the department that wouldn't protect its student and the administration which, by extapolation, doesn't give a rats ass about and of their students... generally.

Did they refund his tuition? I'll bet not.

Good luck with any lawsuit in the age of paranoia.

Re:Generally considered? by LordLimecat · 2013-01-24 02:11 · Score: 1

Fuck that. What he did exposed the incompetence of Skytech,
In a way thats generally considered illegal, yes.

Pre-internet? by phantomfive · 2013-01-23 20:37 · Score: 1

It is kind of hilarious that he calls it the 'pre-internet' era. As if we didn't worry about security before the internet. Ha.

--
"First they came for the slanderers and i said nothing."

Good teaching... by Peter+(Professor)+Fo · 2013-01-23 22:05 · Score: 1, Offtopic

An ignorant (but wise) man says "I ask a question when I don't know"
A wise man says "I ask a question when I already have an answer"
A teacher says "I ask questions to teach my pupils"
A professor says "I teach my students to ask questions"
A leader says "There is a time for questions and a time for action"
A pupil says "I must know the answers"
A student says "I must know the questions"

Not quite right by rikkards · 2013-01-23 22:57 · Score: 1

My experience when looking for a job found it is more like the fact that schools work on a shoe-string budget when it comes to their infrastructure especially IT. They don't want to (can't) pay industry rates or if they do you end up doing more than just IT work as part of your role. So they end up getting people willing to take their lower pay.

Re:This is about defining/defending "the professio by alexgieg · 2013-01-23 23:03 · Score: 1

And despite the best attempts of computer science and software engineering, much of it is guided more by craft principles than by rigorous scientific or engineering methods.

And the interesting thing about all this is that there's a sizable group of programmers who not only think of programming as a craft, but want it to become even more so, up to the point of resurrecting the old three-level system of professional advancement from apprentice to journeyman then master craftsman. The book that introduced me to the subject was the quite inspiring Apprenticeship Patterns, which I highly recommend for anyone interested. And as usual, Wikipedia offers plenty of references.

--
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.

Where's the Science? by chrism238 · 2013-01-23 23:12 · Score: 1

So, The Security Ledger (is that Sledger, for short?) wants to tar the whole Computer Science education fraternity (no pun intended) because of this single incident - all CS departments and teaching are considered outdated, because of this? Great to see the Sledger applying the best scientific methods to its analysis!

Most amusing... by DoctorBonzo · 2013-01-24 01:04 · Score: 1

Apparently, they've been taking a lot of heat - the front page of their web site has a semi-lengthy explanation that the expulsion was for violation of their "professional conduct code", not hacking.

One of the no-no's is "Continual rudeness". How Canadian. Guess Steve Jobs wouldn't have lasted long there...

proper use of ethics keeps hackers away by amoeba1911 · 2013-01-24 01:22 · Score: 1

“Schools are supposed to teach best practice, which includes ethics and adherence to reasonable laws,” -- yes... in some imaginary world they live in that's much more important than fixing exploits in your software. That's the right attitude for having a very hack-able site.

RE: password is sent as part of a URL by Dareth · 2013-01-24 02:50 · Score: 1

"password is sent as part of a URL"

If you ever see security this bad, close your browser, fdisk your machine, write multiple series of 0 and 1 to the drive, then destroy it with homemade thermite and never never never speak of it again. Anything else is likely to be a felony break of a EULA.

--

I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling

The teaching bubble by PPalmgren · 2013-01-24 03:09 · Score: 1

No, not student loan bubble, the bubble most teachers are enclosed in all their lives. They go to school, they learn to teach in school, then they go back to teach. Finding a teacher who isn't out of touch with reality is rare because their reality relies on teaching and not practical application. It reminds me of my high school world history teacher. We were forced to copy overhead projector notes verbatim and organize our notebooks in exactly the method she described. We'd have a notebook test for 20% of our grade with 10 questions on it, questions like "what is the 5th word of the 11th page in your notebook" with the answer being "the." I should also mention this was 2001 so antiquity isn't an excuse.

All of my best teachers have been people who experienced their craft in the field.

Re:This is about defining/defending "the professio by alexgieg · 2013-01-24 05:13 · Score: 1

Way to straw man the topic, eh?

--
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.

Nah blame the Navies. by mjwalshe · 2013-01-24 06:29 · Score: 1

From experience at a top 5 consulting engineering firm if something went wrong it was normally the contractor who cocked up - one of my more interesting jobs there was reverse engineering a soil density program to prove that a sub contractor was at fault when a bridge fell of its supports :-)

Professors in ivory towers by SoothingMist · 2013-01-24 06:39 · Score: 1

That our colleges are overly staffed by professors who spend their entire lives in the ivory towers of academia should come as no surprise to anyone. Indeed, as others have said, that type lives in the pristine world of theory and never has to face reality. Thus, they do not provide adequate preparation for people who have to apply that theory in practical applications. I'll never forget the professor who could not understand why a computer program that actually worked was better than one that did not. He had assigned us a challenge. I was the only student in the class who succeeded. He laughed at me right in the middle of class since my solution was 300 lines and his was only 6 lines. I copied each of his lines of code exactly. After class I entered them into the computer. His "solution" crashed even on the simplest cases. I printed full diagnostics and brought them to the next class. I present those and he insisted I must have made a mistake. I said I had not erred and offered the printout to him to examine. He still insisted his program was better, even though it did not work. On the other hand, I have had some very good professors who were quite open to discussion. From them I learned a great deal. Their teaching makes all the difference in my professional life.

So I'm a strawman now? by dbIII · 2013-01-24 14:21 · Score: 1

Unless youre a lawyer, probably best not to post things like you did, lest someone take it as actual advice and end up in a whole heap of trouble.

I did not post advice.

Slashdot Mirror

CTO Says Al-Khabaz Expulsion Shows CS Departments Stuck In "Pre-Internet Era"

186 of 248 comments (clear)