Live data from Hacker News

Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

sh1mmer.me

121–130 of 203 posts

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#121
post #111
post #54

This is hilarious, and quite impressive given the presumed age of the kids that'd be interested in doing this. I'm sure some K-12 tech staff are stressing over the exploit right now.

They're K-12 IT staff... they've got 900 other things to worry about. If someone is smart enough to find this and unenroll their device, they're probably smart enough to be left to their own devices. (Literally)

Except then they're going to spread the exploit. Kids don't keep their mouths shut. Then word goes around Jimmy knows how to kill the lock and get Roblox again on his Chromebook and suddenly there's a problem because now the flash drives and instructions are pared down and now half your class's Chromebooks just went unmanaged. They won't think or understand the repercussions (like not being able to suddenly start a managed test), just that they got their games back, and now it becomes the teacher's problem to troubleshoot again...

Trust me, I know. I was one of those kids. Except back in my time I was running my own RDP server to get around the proxy servers while also hosting a Web server that had Ultrasurf on it for the others.

The one thing I didn't share or open my mouth about? My exploit to kill Faronics Insight. Sure, my machine would suddenly show 'offline', but the lab monitors inherently trusted me in general ;)

(And to Mrs. Remington, if you're out there on HN somehow, I'm sorry I was your little IT nightmare!)

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#122
post #59
post #7

Earlier quoted context omitted.

Why? As a student, giving me access to a laptop improved my ability to get things done by orders of magnitude. I always struggled with messy writing, and being distracted easily. Having a laptop let me pay better attention, because I could work on something and passively listen to the class. My notes were also legible, meaning I could take meaningful notes for the first time ever. I could also combine photos of the c…

Not everyone benefits, the computer is just a huge source of distractions and it can really set people back.

That's why I'm not saying to it for everyone. Reverse that logic, and apply it to the regular teaching style. It cuts both ways.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#123
post #84

Earlier quoted context omitted.

False dichotomy. Nice try.

The introduction of the roller ball pen over the traditional quill almost certainly was met with the same "wont somebody think of the children"

Quill pens were replaced in the early to mid 19th century by dip pens with a manufactured metal nib. The much reduced cost compared to quills gave a huge boost to literacy.

Fountain pens were an older invention, but poor reliability and cost kept them out of common use before the early 20th century.

I doubt either progression was controversial. Basic penmanship is similar with all of these.

Ballpoint pens gained popularity around the 1960s. That was (and is) controversial -- ballpoint pens require much more pressure, so they are less comfortable for lengthy writing, and it's more difficult to write neatly.

Children in some countries are therefore still required to use fountain pens at school.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#124
post #81

Earlier quoted context omitted.

> I had a specific teacher who'd assume I was not paying attention, and ask me to answer often. Much to his surprise, I was fully engaged and able to respond In school I spent many (un)happy hours gazing out of the windows of the class due to sheer boredom. Q: Are you able to comment on how the pace of learning is for you? Too slow / just right / too fast? Once I got to University my learning style quickly evolved in…

> Hard to tune out of a lecture when you are literally writing everything down, at speed. Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time.

> Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time

I would postulate that for the majority of people, in the majority of learning situations, writing out notes could (should?) be an integral part of consuming the contents of a lecture.

There's a 2021 paper from the University of Tokyo entitled "Paper Notebooks vs. Mobile Devices: Brain Activation Differences During Memory Retrieval"[0] which is worth reading.

NB: this obviously won't (can't) work for everyone.

[0] https://doi.org/10.3389/fnbeh.2021.634158

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#125
post #81

Earlier quoted context omitted.

> Hard to tune out of a lecture when you are literally writing everything down, at speed. Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time.

> Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time I would postulate that for the majority of people, in the majority of learning situations, writing out notes could (should?) be an integral part of consuming the contents of a lecture. There's a 2021 paper from the University of Tokyo entitled "Pape…

I think an important addendum here is that the environment of a lab, and the environment of an uncontrolled classroom are different. So it's entirely possible that the actual real-world effects might be even more different than what we see here. While I agree that the effect of writing is well documented, I still find that the external factors around the act of writing get in the way of properly tapping into that added benefit.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#126

I hope I don't sound like a Luddite, but I don't think kids should have chrome books, or any type of laptops in school...

Getting Chromebooks to schools is the single most horrific act we could have done to our education system. This act undermines the very future of our nations. A big proportion of all the classwork and homework is now done on the screen. There is plenty of evidence that handwriting boosts cognitive processes - thinking on paper is something that the next generation will mostly lack. Rich and powerful are all aware of…

>Not only that. We are promoting to our kids a fully proprietary system that increasingly becomes a walled garden, run by an aggressive imperialist company with abysmal technical support, with a complete failure in parental control practices.

Yeah, we really exchanged one for the other. Previously it was all Microsoft Windows and Office, as a lonely IT enthusiast in a smaller city, I haven't even known about Linux or any other alternatives right until university. I wish free software was the standard, in education and government alike.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#127

I hope I don't sound like a Luddite, but I don't think kids should have chrome books, or any type of laptops in school...

Where I went to college, certain math and science classes were taught on NeXT workstations. I'll admit that staying focused on class was a challenge for my 17-year-old self, but having in-class access to tools like Mathematica and being able to manipulate equations and simulations with the teacher really made understanding how the math/physics worked so much easier.

I started taking meeting notes on a succession of Palm and then Compaq handhelds before I bought my first Tablet PC with OneNote in 2005. It was a tremendously valuable tool both professionally and academically. For example, this is a page of notes from a Tandberg certification class I took in 2006:

https://imgur.com/a/1XgNOoi

Sharing my notes was trivial. I could print to PDF and email to the rest of my team in a minute. Organizing my notes was equally simple. It's been nearly two decades, and I was able to locate these notes in seconds. Even though they're handwritten, OneNote can index my notes. It's pretty amazing.

Around the same time, I took an ITIL certification class. The teacher was someone like you, and he demanded we put away our computers for class. I'd love to share with you the detailed notes I took, but they're buried somewhere in a drawer full of paper notebooks. It'd probably take me an hour or two to locate those notes, scan them, and upload them somewhere. My employer spent thousands on that class, but if I have ITIL questions in my various IT operations roles, I have to google reference material instead of using what I created for myself. It's such a ridiculous waste of time and effort that it still frustrates me, ~15 years later.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#128
post #119

I stand with everyone on Hacker News in admiration for young’uns sticking it to the man and learning about command-line secret power. _However_, I’m a little more ambivalent knowing that most of them do that to look at naked ladies, presumably. Maybe create pictures of naked ladies (again: very impressed by Generative AI, with the caveat that it’s widely used for pr0n) That doesn’t feel ideal for the emotional matura…

The kids will figure it out like you did. Maybe the terrain has changed, but there was noone to tell you whats what back in the day anyway, so why worry? Or rather, emotional maturity can go both ways here: jumping to a paternalistic mindset will rob you the wisdom the kids themselves can give. I think its natural and probably right to feel concern, but don't overcorrect it into presumption or into a false idea that you can just give to kids what you had to learn/discover yourself.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#129
post #116

I wouldn't have a career in IT if I hadn't spent many hours at ages 11 to 15 trying to get round my schools network security. My logon was frequently disabled for misuse and I was even suspended for a couple of days once but I learnt more that way than in any class I've ever taken.

I relate to this. As someone currently in high school, messing around with web proxies and code deployment sights, and web-based IDE's trying to run Dwarf Fortress in my school browser has taught me more about computers and networks then just about anything else. It is painfully easy to get around school filters these days. I've never really messed with unenrollment because you do need enrollment to access the testin…

Chromebooks don't even have a Terminal for the kids. Vim's great, but VScode with Jupyter Notebook support would make the computers we bought for them into great offline calculators, too.

VSCode on a Chromebook requires VMs and Containers which require "Developer Tools" and "Powerwash"; or the APK repack of VSCodium that you can't even sideload and manually update sometimes (because it's not on the 15-30% cut, and must use their payment solution, app store with static analysis and code signing at upload).

AFAIU, Chromebooks with Family Link and Chromebooks for Education do not have a Terminal, bash, git, VMs (KVM), Containers (Docker/Podman/LXC/LXD/gvisor), third-party repos with regular security updates, or even Python; which isn't really Linux (and Windows, Mac, and Linux do already at present support such STEM for Education use cases).

From https://news.ycombinator.com/item?id=30168491 :

> Is WebVM a potential solution to "JupyterLite doesn't have a bash/zsh shell"? The current pyodide CPython Jupyter kernel takes like ~25s to start at present, and can load Python packages precompiled to WASM or unmodified Python packages with micropip: https://pyodide.org/en/latest/usage/loading-packages.html#lo...

There's also MambaLite, which is part of the emscripten-forge project; along with BinderLite. https://github.com/emscripten-forge/recipes (Edit: Micropip or Mambalite or picomamba or Zig. : "A 116kb WASM of Blink that lets you run x86_64 Linux binaries in the browser" https://news.ycombinator.com/item?id=34376094 )

It looks like there are now tests for VScode in the default Power washable 'penguin' Debian VM that you get with Chromebook Developer Tools; but still the kids are denied VMs and Containers or local accounts (with kid-safe DoH/DoT at lesat) and so they can't run VScode locally on the Chromebooks that we bought for them.

Why do I need "Developer Tools" access to run VScode and containers on a Chromebook; but not on a Windows, Mac or Linux computer? If containers are good enough for our workloads hosted in the cloud, they should be good enough for local coding and calculating in e.g. Python. https://github.com/quobit/awesome-python-in-education#jupyte...

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#130
post #119

I stand with everyone on Hacker News in admiration for young’uns sticking it to the man and learning about command-line secret power. _However_, I’m a little more ambivalent knowing that most of them do that to look at naked ladies, presumably. Maybe create pictures of naked ladies (again: very impressed by Generative AI, with the caveat that it’s widely used for pr0n) That doesn’t feel ideal for the emotional matura…

>hacking the school network meant you risk exposing yourself to people with strong opinions about plot points in Buffy The Vampire Slayer

Not really, porn and gore were integral parts of the internet even "back then". Rotten.com launched in 1996 for example, Ogrish at 2000. Eating disorders are also fluorishing in the current era, on TikTok for one, but I remember the pro-ana websites from my youth as well, distributed on private websites, because creating a website or blog was easy. It was also very easy to find porn, even if specific websites were banned on your network, because it was just everywhere. Peer to peer networks also happily distrubuted whatever, let that be gore, hardcore porn, or any illegal thing you can think of, including abuse material.

I do agree about your conclusion though. Emotional maturation, strong connection to people matter a lot, and a lot of the horrors are created specifically when these are missing from one's life.

Post reply on HN