Why We Need To Teach Hacking In High School

An anonymous reader writes "Following one of the best descriptions ever of a hacker I've ever seen, Pete Herzog, creator of the 'security testing' (professional hacking) manual OSSTMM outlines compelling reasons why the traits of the hacker should be taught in school to make better students and better people. It starts out with 'Whatever you may have heard about hackers, the truth is they do something really, really well: discover.' and it covers open education, teaching kids to think for themselves, and promoting hacking as a tool for progress." A good read, despite confusing hacker and hacker a bit. I remember getting to set up Debian on a scrap machine in high school, only to have county IT kill the project because of the horrible danger experimentation could have proven to the network...

Comments

Yes another thing to teach highschool students

[Anonymous Coward]

Every industry wants their industry taught in high school, maybe we should teach things that are useful in general instead of SQL injection or writing Haskell.

Re:Yes another thing to teach highschool students

[nucrash]

I think the biggest thing is that we need to focus on how to make the students learn rather than trying to initiate them into a bunch of subjects they may or may not be interested in. I know students who will never love math, English, history, or science, but if we can pique their curiosity in such a way that they begin to dig for information outside of school, then we have done more for a student than shoving a curriculum down their throat ever will. This is fundamentally what good teachers are for. They take an existing curriculum and try to drive the student to find information out rather than provide the students with answers to questions on a test.

Hacking is a great skill to have. Is it a life skill? Not really. Having the desire to hack is far more important because the students will seek the knowledge.

Re:Yes another thing to teach highschool students

[Soulskill]

It's not the particular language that's important -- once you get beyond the basic syntax of a language, it's really about analyzing a problem and being able to break it down into logically ordered steps, and then manipulating algorithms to do what you want. Those skills are very broadly applicable, and useful whatever a kid's profession ends up being.

Re:Yes another thing to teach highschool students

[CastrTroy]

Kids started to apprentice really young back in the old days. Now students have to wait until university/college until they are allowed to specialize, at least as far as school is concerned. Perhaps we should give high school students more freedom to specialize at a younger age. If some kid knows he wants to be a carpenter, why not let him have a wood shop class every semester.

Re:Yes another thing to teach highschool students

[i kan reed]

And the trick, good soulskill, is that not everyone is an INTJ for whom this is the natural way to attack a problem.

Re:Yes another thing to teach highschool students

[datavirtue]

Indeed....an high school is too late. If they aren't able to take command of a ship at age twelve I believe the kid is already spoiled beyond repair.

Re:Yes another thing to teach highschool students

[kwbauer]

add compounding interest as part of some basic consumer math

I don't think so

[TheRealMindChild]

The school admins already have a hard enough time dealing with kids destroying things, both logically and physically. Now you expect them to be on the level enough to be able to stave away actually taught hackers? How much are you willing to pay for this little experiment (both in the admins pay, and the cost of cleaning up the disasters)?

Re:I don't think so

[BobMcD]

This, because, as alluded to in TFS, it always creates more work for them. Observe:

I remember getting to set up Debian on a scrap machine in high school, only to have county IT kill the project because of the horrible danger experimentation could have proven to the network...

I'm here to tell you that an uncontrolled machine ran by amateurs is a prime example of 'danger to the network'. I still recall the day the new guy named his Ubuntu box the same thing as our domain suffix. Only because I knew what was supposed to be on the network and what wasn't was I able to get things back up and running again. The same thing can happen with a simple IP address conflict.

In short, to do this with any educational value, IT would have to segregate the network to prevent accidental student damage. From what I know of most educational IT, they lack the time, money, and (sorry to say) skills/training to do this for their production networks, let alone standing up test labs for hackers to play with.

Maybe in an IT-centric school, sure. But primary education? Puhlease.

Re:I don't think so

[Khopesh]

When I went off to college, many of my most IT-savvy freshman colleagues were versed in networks and system administration because they had run the computer labs of their high schools. Some of them had been caught cracking or otherwise mucking about in ways that the school staff lacked the ability to revert and been forced to clean up after themselves, others saw messes and volunteered to help out. They got paid and had responsibilities. From this new perspective, they learned the "damage" students could deal and then had the hands-on task of cleaning it up. I wish I had had that opportunity.

In this sort of environment, especially given the ubiquity of virtual machines and virtual networks, a well-facilitated capture the flag (CTF) event should be easy enough to facilitate. Even without virtualization (or even any lab at all), any school could reach out to a local hacker group and ask them to host a CTF event. The cost of scrounging up a bunch of computers and networking equipment for a one-shot event should be decently low given the spare parts in your typical hacker group or Linux users group. Maybe the school or city could even provide a budget for the event.

Re:I don't think so

[ray-auch]

This, because, as alluded to in TFS, it always creates more work for them. Observe:

I remember getting to set up Debian on a scrap machine in high school, only to have county IT kill the project because of the horrible danger experimentation could have proven to the network...

I'm here to tell you that an uncontrolled machine ran by amateurs is a prime example of 'danger to the network'.

Some of us can still recall when any Linux box could (and did) cause a packet storm if the subnet mask was not on a byte boundary.

From what I know of most educational IT, they lack the time, money, and (sorry to say) skills/training to do this for their production networks, let alone standing up test labs for hackers to play with.

Yes, but these days you can set up your test lab virtual and isolated (on pretty much and desktop or even laptop) - let the students do that themselves to learn. Not too many settings you'd have to check/lock to ensure network isolation. I haven't seen a physical test lab (for software testing) in years.

Re:Ever work in a high school?

[litehacksaur111]

I agree. If anything schools here should be more like schools in Germany where they have strong vocational training programs for people who are not suitable for university education. Also it would be nice if schools worked with students and their parents to steer them towards careers they find interesting instead of trying to force a generic curriculum on everyone.

A supportive high school environment helps a lot

[langelgjm]

I went to a private high school. It was small and didn't have many resources. Still, I was fortunate to have a very supportive environment for my exploration and learning related to computing.

The teacher who taught programming had actually managed IT/network stuff in Micronesia, so she was not in the habit of throwing old tech out. We received a lot of donated equipment from various businesses, and she saved most of it in a storage room. When she found out how interested I was in technology, she basically gave me the run of the place - allowed me to take home equipment to play with, just hang out in there during lunch and after school, put together new machines for the lab, etc. This was where I first learned about other architectures - got my hands on an old DEC Alpha.

When she saw that I had already self-taught some programming, she allowed me to skip directly to an advanced programming course, and teach myself as an independent study.

Later, she let me set up an NT server with roving profiles and network home directories for the lab, so that students in the general office suite classes could save their work on the network, keep it backed up, and their teacher would have centralized access to it. Prior to this, they were all using floppy disks.

Without that environment I'd still have been interested and involved with tech, but it sure made it easier and more interesting, and I learned a lot. I suspect that many teachers might not have been willing to allow a student so much freedom, or that policies might have forbidden it.

You do know that they're struggling with algebra..

[Karmashock]

... right? We really need to stop treating all high school students as equals because it hurts all of them.

The students that are having a hard time mastering literacy need a lot of remedial help. The ones that are doing very well need access to accelerated programs and additional subjects.

Do NOT group these kids together. You will make sure the kids that are behind learn NOTHING and the kids that are ahead will achieve less.

hacker vs hacker

[BlueMonk]

A good read, despite confusing hacker and hacker a bit

I can sure see the confusion. I can't see any difference between "hacker" and "hacker" myself. What am I missing?

Re:hacker vs hacker

[ZouPrime]

See the provided link for the "definitions".

I really like how the very last one (8. "A malicious meddler who tries to discover sensitive information by poking around") is said to be deprecated, when it is by FAR the most commonly used, among infosec professionals, in the litterature, the media and well, pretty much everybody, for the last decade or so... The only exception being that tiny minority who still cling to the old-school definition...

But yeah... "Deprecated."

Re:No

[gnick]

I'm educated in Math FAR beyond the point that I think I'll ever need to be. In fact, far beyond the point that anyone outside academia needs to be. And I enjoyed very little of it, but was exceptionally good at it. As far as I'm concerned, studying it wasn't to gain knowledge or mathematical skills, it was more of an exercise in mental flexibility. And, despite what I thought at the time, I don't think that studying literature, history, or religious ed., were complete wastes either.

the word "hacking" has become polymorphic...

[Connie_Lingus]

i grow tired of the never ending reframing of the word "hacker"..almost to the point of it becoming meaningless.

what TFA article is really saying is that "we want people to be motivated to use the technology to really LEARN the technology, and to do so during free time and out of the pure joy of learning how this crazy tech shit works"...kinda like learning to play a musical instrument (well, exactly like learning to play a musical instrument).

no one "teaches" someone how to play guitar...you may be shown some notes and simple phrases, but only by spending hours and hours of finger-cramping playing will one learn to play guitar. the frustration and struggle IS THE POINT.

let me say that again...THE FRUSTRATION AND STRUGGLE IS THE POINT.

that's what "hacker" should really mean...someone who endures FRUSTRATION and STRUGGLE and turns that experience into knowhow...it is really the basis of ALL LEARNING.

those that never "hack", never really learn *anything*.

Re:the word "hacking" has become polymorphic...

[anmre]

I've always liked the comparison to musicians. As a guitarist myself, throughout my life I've "inspired" others to want to play, and so I'd set them up with everything they need to get started on the right foot. They always quit somewhere between "damn, my fingers hurt!" and "why can't I play like you, yet?"

It puzzled me until I realized that such people aren't actually interested in playing the guitar, so much as they want to prove to themselves that what they thought was easy actually is easy. In short, their childood schooling, and probably their religious beliefs, have led them to the erroneous conclusion that they can be great at anything they put their hands on.

On topic, to "hack" is to recognize one's own ignorance. Schools aren't prepared for the PTA fallout of letting kids ponder what it means to be stupid.

Re:the word "hacking" has become polymorphic...

[Bite The Pillow]

You apparently don't know anything about musical pedagogy. That's fine, you just need to realize that you are ignorant.

Learning to play an instrument the hacker way is exactly like being a hacker in other ways. Learning to play an instrument the non-hacker way is exactly unlike being a hacker in other ways.

The people who are really good at playing, regardless of how they were taught, have at least a little of the hacker experimentalist attitude, and try things different ways to see if it makes things easier. That doesn't mean their whole approach is based on the hacker ethic, and does not equate to hacker.

The frustration and struggle doesn't have to be the point - an elder can certainly guide you past that, steer you away from a clear dead end, and show you several options to solve a problem rather than having you invent a solution. You can put in hard work without the frustration and struggle, and still turn that experience into know-how.

And no, frustration and struggle is not the basis of all learning. Your experiences have told you this is how the world works, but your experience is not the only one people have ever had. Someone being told how to find an answer and it just makes sense the first time - they just learned, and there was no struggle nor frustration. Sitting in a room with a master and being shown simple things, you can learn an awful lot in a short time, without the frustration or struggle.

I have never seen a "hack" that was a work of art, but I have seen a great many performances that were a work of art. The pinnacle of musical ability comes after doing the same thing over and over, even if it's just a live show where you run straight through everything. A hacker will rarely do the same thing twice. Extend and extrapolate, sure, but would a hacker play the same Hayden concerto until it was perfect, then perform it repeatedly? That does not sound like the hacker ethic to me, at all. The subset of musicians who play jazz might qualify as hackers, but there are many who stick to pre-Bop Swing style solos and never do any true hacking, even if it is improvisation.

As a result of that last paragraph, I'm inclined to think that even among people who learn the hacker way, musicians would generally not meet the definition of the hacker ethic. There are exceptions, especially among guitar players, but I would wager they are enough in the minority that it would invalidate your argument.

I do agree with your first sentence and half of the next one. I most heartily disagree with everything else, pretty much more vehemently the longer you typed.

It can be done, but not in the current environment

[carp3_noct3m]

Before I tell my anecdotal story, I want to touch on the fact that the current educational environment is not conducive to this kind of think for yourself learning. We could have a lengthy debate about why this is, and I would mostly refer you to the Reece Committee and Norman Dodd's investigation into tax-exempt foundations. Suffice to say, the fact of the matter is that TPTB don't want a mass influx of independent self-taught thinkers, they want people just smart enough to push the buttons and papers they want them to but not smart enough to go above that (unless they are part of the aristocratic oligarchic class). This is the result of the purposeful introduction of the Prussian education system as a tool of class warfare, but I digress.

I happened to be very lucky in this regard, my highschool was a middle of no-where Mormon-area HS full of hicks and religious people, but a local had been in industry and decided to come back and head the technology department of the school, and brought with him his industry contacts. It was one of the first high-schools to have the cisco networking academy, and I had my CCNA by the age of 17. Besides all that, it was the attitude of this man, who I called my mentor, (Barry Williams of Apache County, if anyone cares to look it up) which really encouraged this kind of thinking. He would encourage us to solve problems on our own, and mostly left us to our own devices. I will never forget the first year I was there, where he organized a wargame, and each of us hooked up our issued cisco routers to a network and the challenge was to be the first to take down everyone elses network. After a few minutes I had taken out two other guys, but then he told all of us to stop, walked over to all our boxen, and simply unplugged the cables.

For a 16 year old that really had an impact on me about thinking "outside the box" of given parameters. Of course this kind of teaching did have it's downsides. I was only a fringe member of the group that did it, but I will never forget the day that people in suits showed up and talked to everyone around the high-tech center but us, and then the FBI held an assembly for this school of hicks and religious people about hacking (of which maybe 15 of us knew what that even was), because, apparently "A" (a senior while I was a sophomore) wasn't joking when he told us he got into the FBI servers. (in his defense, he said he only changed a spreadsheet and then changed it right back just to see if he could). Last I heard "A" was still on the run from the FBI for crimes committed after HS, and I know I definitely was tempted a few times to do naughty blackhat things but resisted the urge. The point is that while teaching critical thinking and hacking is good for the thinking abilities of the student, there can indeed be farther reaching consequences especially if they are of a lower socioeconomic status.

Note: Wow, I haven't logged into /. in ages. Not sure how I feel about it these days, was just bored at work and saw this story.

Re:Ever work in a high school?

[Hognoxious]

They have magnet schools here in many states

Trouble is, nobody knows how they fucking work.