Slashdot Mirror
MIT To End Open-Network Policy In Response To Recent Attacks
An anonymous reader writes "MIT announced that despite a long history of running an open network (so that any student can run a server on any port, without any questions asked), it will now end this policy due to recent denial-of-service attacks and gunman hoax. From a letter sent by Executive Vice President and Treasurer Israel Ruiz: 'I am deeply and personally committed to safeguarding our community, protecting our campus and securing our systems. Together with our colleagues dedicated to campus safety and security, with the support of senior academic leadership and in collaboration with the campus community, we are deploying all necessary resources to this effort. It will require the dedication of all of us to promote safety awareness, complete necessary emergency training, and adhere to reinforced cyber security guidelines. IS&T staff members are working with information technology (IT) leadership and partners across campus in making the changes described above. We continue to explore all opportunities to further strengthen our preparedness, and will communicate additional information as these plans evolve.'"
Terrorists didn't win you say? Consider that the next time you're at the airport.
Apparently, the new policy is just by default:
Those engaged in research, teaching and learning activities will be given the option to opt out of the default network security policy through a self service mechanism.
Basically, it looks like someone in administration finally asked "What if we're actually a target?" and the response was "we're royally screwed". Yes, it's nice to give open access to everything, but I doubt most college students, even at MIT, follow reasonable security procedures. So now, they're going to block everything by default, and if someone wants to open access, they can do it themselves. Best case, there's no problems and nobody notices. Worst case, MIT's network isn't such a help during an attack.
So a university changed its default security policy. Big deal. I don't see how this is newsworthy.
You do not have a moral or legal right to do absolutely anything you want.
Terrorists didn't win you say? Consider that the next time you're at the airport.
We did that of our own free will, which is perhaps more damning. But no terrorist demanded or coerced us into fortifying our airports with questionably useful security. That's my only point: We never gave in to terrorist demands. We may have responded in a less than thrilling and intelligent manner, but we didn't just cave.
#fuckbeta #iamslashdot #dicemustdie
A few assholes can and will ruin a good thing for everyone.
Hail Eris, full of mischief...
E pluribus sanguinem
Bad form to reply to myself, I know, but I did find one noteworthy detail in that memo upon further inspection:
Passwords will also be tested to ensure a minimum level of complexity; existing weak passwords will be required to be changed.
...so MIT stores its passwords in a form that allows complexity testing... Interesting.
They could just be brute-forcing 7 characters and calling it a day, or adding something to a commonly-used login system... but if it's feasible to test how complex an existing password is, I have to wonder about how the passwords are being stored.
You do not have a moral or legal right to do absolutely anything you want.
You ruined your own argument halfway through the rant. It's not about "Fuck the terrorists. We don't negotiate. Ever." It's about reacting knee-jerk to terrorism by altering values, restricting freedoms, and generally making the society more closely resemble the repression of the terrorists' own culture. So actually the "country as a whole" did in fact give into terrorism. We have the Patriot Act (still) and a whole tanker fleet full of other repressive and invasive institutions and programs that either didn't exist at all beforehand or were mere shadows of what they are now.
The terrorists did win, regardless of per capita casualty stats. Our society now looks a bit more like their ideal than it did in 2000, not the other way around.
What MIT has done here is exactly the same behavior.
The "Home of the Brave" is a joke at MIT, and U.S. universities across America. Once the wussy administrators take hold, all is lost without a fight. Wussy administrators will use security and safety as they cudgels, They will hide behind their desks and enact policy that eliminates any freedom that may challenge the status quo.
This is, in fact, what America deserves unless and until we ALL have the courage to fight it everywhere it is. I would say "Shame On You" to MIT, but I would be decades late.
I'm not getting this. The gunman hoax didn't issue an ultimatum that MIT close their network. MIT did that of their own free will*. Just as the hijackers of 9/11 didn't demand that we send travellers through enhanced patdowns at the airport. We did that of our own free will. What's the difference?
*Hell, the demands linked to the DDoS demanded the opposite - a greater commitment to the same spirit that led MIT to create the open network policy in the first place.
MIT students really like the freedom that they have on their nets, and in fact, have come to take it for granted. I forsee massive disobedience to this, along with protests. and I'll be standing there right beside them.
What MIT has done here is exactly the same behavior.
You're saying two wrongs make a right. The government failed, therefore MIT should also follow in their fail-steps, thus leading to The Right Thing.
#fuckbeta #iamslashdot #dicemustdie
I didn't say anything of the sort. I said your argument failed. :-)
I mean, yes, this is Slashdot, so the kneejerk reactions are appropriate, but if you bother to read the article, the changes are just plain common sense. They are going to enforce reasonable passwords, and if you want to have an externally accessible server, you either need to use a VPN, or opt out of the security policy. All this foaming at the mouth about the end of academic freedom sounds a lot like the NRA freaking out when someone proposes limiting how many rounds you can fire off at a time without reloading.
Would we say that because MIT locks some of the doors to some of their rooms some of the time that the thieves and burglars have won long ago? Would we say that MIT "caved" to the thieves and burglars?
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
And since I need to have something in the message body, I think we could all learn from the NRA's mastery of agitprop:
http://tpmmuckraker.talkingpointsmemo.com/2013/04/nra_magazine_covers.php
Hail Eris, full of mischief...
E pluribus sanguinem
slant.. you know like a slanted view? biased? lol. the world we live in.
That's right, you have a choice of the scanner with uncertain radiation emissions or getting blackballed (if the TSA guy squeezes too hard).
We responded by being terrorized (demanding ineffective security).
We caved.
That whole 'he who sacrifices liberty for security achieves neither' quoteish thing? Yea, we did that.
They won. // Captcha: "censor"
We gave into the demands of terrorists. They just happened to be elected into office, and we pretend they serve us.
They don't. They're criminals operating outside the law.
Free will, eh?
But of course. Nobody in the US has ever acted irrationally before.
I have left slashdot and am now on Soylent News. FUCK YOU DICE.
Erm the 9/11 guys didn't want to negotiate at all.
In fact even if the military/politicians were going to negotiate, it had all happened before they noticed anything was wrong.
There was no opportunity at all for negotiations.
Terrorists didn't win you say? Consider that the next time you're at the airport.
Yup, that's what the terrorists REALLY wanted, forget all the religious, ideological, or political crap; annoying airport security procedures. They sure showed us!
Here they admit they don't understand the Internet, by limiting incomming "connections" and acting if there was a difference between a server and a client. It's a testament that freedom and education are now less important than stupidity and the fear of imaginary dangers.
What is the faculty's response to this response?
a commitment to a “free and unfettered internet.”
We had a "free and unfettered internet"...and then the spammers-, virus coders-, and hackers-for-profit moved in.
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
I'm dismayed that MIT, of all places, uses the thoroughly awkward term "cyber security" in its official correspondence. Outside of a few sci-fi novels, "cyber" seems to be the province of clueless congressmen and the reporters who love them. It's a buzzword for media outlets, politicians, and consultants who don't understand the net, want to profit from others' lack of understanding of the net, or both.
Would we say that because MIT locks some of the doors to some of their rooms some of the time that the thieves and burglars have won long ago? Would we say that MIT "caved" to the thieves and burglars?
You're making a strawman argument here. I have thieves and burglars in my neighborhood. It doesn't mean I hide under the couch, stroking my gun, and mumbling "The time of purification is soon..." There is this thing called proportional response: And considering the massive benefits of the open-network policy in terms of the innovations that have come out of MIT versus the uncommon and not terribly harmful issues that have come up because of it, it's a terrible decision. The very start of hacking and humanity's first foray into artificial intelligence got its start because of that open policy.
If you wanna throw that away because of some burglars and thieves, you're a fool.
#fuckbeta #iamslashdot #dicemustdie
We did that of our own free will, which is perhaps more damning. But no terrorist demanded or coerced us into fortifying our airports with questionably useful security. That's my only point: We never gave in to terrorist demands. We may have responded in a less than thrilling and intelligent manner, but we didn't just cave.
Holy Mother of God.
Do you even understand what you are saying?
There was no opportunity at all for negotiations.
There were many years of opportunities to avoid that attack (if it was in fact from outside).
Upward mobility is a slippery slope - the higher you climb the more you show your ass.
Honestly after the whole Swartz case we knew it wasn't a 'free network.' You know, it would have been nice if they "secured it" to their liking before they harassed someone to death for using it.
Okay. Since you want to make this personal. No, you're a fool.
MIT's open policy was simply a convenient exception to most institutions. However, the risk of the open policy interfering with productive use of the network has now, in the judgement of adults, exceeded the value of letting anyone run a child porn service (or similar, including DDOS attacks) on/from MIT's network. Early mass produced automobiles didn't have door locks or ignition locks - do you expect to have a door lock on a new car you buy? Time moves on.
Serious students who want to develop whatever they want to will simply set up N virtual machines on their laptop on a local virtual network to do whatever they need to do. If they want to expose it to the world, they will either apply for the "opt out" option with MIT or just use AWS or something like that to open it up to the broader world and end up launching the next Google or Facebook. It's not 1995 anymore - grow up - automobiles have door locks now.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
Didn't he once, a long time ago, mention something about saving the town by destroying it?
What liberty? MIT owns the network. They can do what they want with it, including setting rules and terms of access and use.
Property rights are the ultimate form of liberty. If it's my property, I can do what I want with it, and control who can access and use it and for what purpose.
CS is not networking not IT / severs and not desktop / help desk work.
Now maybe if you where a programmer then the classes would of helped you more.
If you succeed in fucking up somebody else's life but don't ever get what you want how is that winning?
Why don't they just setup a number of VLANS, one for Faculty Staff, one for Students primary machines, one for research projects and one for open devices. I'm sure they already have a couple in place. Was their I.T. group consulted? Student Government and Faculty? I hope this wasn't an excuse to submit to CALEA http://www.fcc.gov/encyclopedia/communications-assistance-law-enforcement-act . Higher Ed does not have to abide by it but some Universities do it anyways. [quote]"After thorough review, the final court decision appears to allow for most, if not all, campus networks to be exempt from compliance". [/quote] http://www.educause.edu/library/calea
Beware of those who profit off the docile and persecute the unbelievers.
This is really a commentary on how insecure the Internet is.
The Internet was born at MIT and places like it. MIT's forte is technology. Students at MIT can be expected to understand technology better than other people, because even in cases where they don't major in technology, they're still within easy reach of plenty of people who do.
And even with all that, the students can't make things safe enough.
What's really sad is that the IT professionals at MIT aren't going to be that much better at it. What they mostly do is provide a smaller, more tightly regulated target.
...what you're blathering on about?
systemd is Roko's Basilisk.
Whoosh!
Hail Eris, full of mischief...
E pluribus sanguinem
CS students NEED that stuff though before they overuse resources on shared machines/networks. BTW, it's clear you skipped your English classes. "Would of" is not a contraction for "would have", but "would've" is.
The TSA is just the tip of a very large iceberg. It's an indicator that they were pretty successful in subverting our open society. They have caused us to ignore our founding ideals.
This is especially troublesome in Boston.
It's kind of like opening a Boston Baked Beans factor in Mecca.
A Pirate and a Puritan look the same on a balance sheet.
> Do you know ANYTHING about Islamic extremism? Are you serious?
It's very much like Xian extremism really, or even Jewish extremism. The sort of "let's ban everything" approach that the TSA has brought it is actually very similar to any number of extreme religious groups.
A Pirate and a Puritan look the same on a balance sheet.
If you're a student, running your game server (or Net-accessible model railroad controller, or whatever) doesn't have anything to do with what you're paying MIT
You are there to learn, why does it have to be only through classes? What is the point of computer labs and a fast network if not to help you learn? That's part of the REASON you go to a college, so that you have access to facilities you would not otherwise. May as well burn down the library also, or only allow check-out of course approved books!
If you aren't allowed access to resources around you for however you want to learn, then there is REALLY no point in going to college at all. And MIT just lost a distinctive advantage that made them a better technical school. Now there is no way I could justify paying an MIT tuition with them basically treating students like criminals.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
If you feel so strongly about your views, why are you posting A.C.? Should we really not try to analyze why events happen? And while we're at it, let's generalize with statements like "You can't negotiate with these guys"
There was no opportunity at all for negotiations.
There were many years of opportunities to avoid that attack (if it was in fact from outside).
That had nothing to do with negotiating.
While it's no guarantee that 9/11 would have been averted, there had been an attempt to pound the terrorist training camps into the ground during the late '90's. They were derided as an attempt to "wag the dog" and interfere in the more vitally important matter of whether Clinton fooled around on his wife.
The concept of airliner kamikaze wasn't even novel. A similar plot out of the Philippines was headed off circa 1998.
CS is not networking not IT / severs
Part of it very much is (especially networking). How can you design an application to make effective use of a network without at least understanding the basics of how a network works?
It's all intertwined, and any good CS program DOES have some options to help you learn those things. But it's not like additional learning does not help.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What demands? I never heard what the 9/11 terrorists demands actually were and I just got nothing with a "what were the 9/11 hijackers demands?" google search...
It's not 1995 anymore - grow up - automobiles have door locks now.
About once a month I find a car in a parking lot with its lights left on, outside a restaurant or a bar, etc. If the door is unlocked, I simply turn them off and go about my business. If the door is locked, I simply go about my business.
All of these things are a risk/benefit calculation. I leave my car doors unlocked, but I purposely chose to live in a low-crime locale, so some of my bets are hedged.
This is MIT's admission that they can't secure a network without locking it down. Note that those are two different things, just that doing one makes the other simpler. MIT can't make their network a low-crime locale, which is different that the trajectory they were on in the early 90's, where they had people doing the very best work on secure networks.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
No, the terrorists didn't win. We both lost. We lost as you noted above. The terrorists wanted the US out of the Middle East and instead got us even more involved.
Not quite. Among other things, what bin Laden primarily demanded was that the US leave Saudi Arabia.
His demands were met, as the US hastily closed its Saudi bases after 9/11 and moved into Iraq.
Since Iraq was a secular state with no Muslim holy sites of any significance, Al Qaeda never gave a hoot about it. It was only in the aftermath of the US invasion, when it became apparent that the secular nature of the country was up for grabs, that Al Qaeda became involved.
When I worked at MIT (admittedly, years ago), we left things open because to do otherwise was to challenge students to attack. Security through boredom worked - until the outside world caught up to the point where they presented a significant threat.