Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#21

Post by jacquesm »

kajecounterhack wrote: post #15
jacquesm wrote: post #9

Earlier quoted context omitted.

Up/down up/down, if you disagree say so. Do you take offense at my suggestion this kid did nothing wrong ? Why is that ? Enlighten me, for all I have read above the sysadmin is the person in the wrong, if a 13 year old can walk all over your system you ought to be looking for a job (and one that does not include system administration).

He didn't do any major damage What do you mean he didn't do anything wrong? If all he did was find a way into their systems and report his findings of insecurity or something, certainly there would be nothing wrong with that (as long as he's following his terms of use for the school computers, also -- he's held to the rules of the school as a student). But it appears as if he's done something, maybe he didn't report…

If the kid was properly instructed beforehand on what was acceptable and what was not then you have a point, but the story does not relate that, hence my question.

I'm assuming that this kid is just as curious as any other kid at that age, and the systems should be set up accordingly.

This is trying to close the gate after the horse has bolted, ok, so he looked, big deal. Now catch up on the educational bit about privacy and minding your own business, case closed.

No need to make an issue out of it. The overreaction in these cases does more damage than the event itself.

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#23

Post by jacquesm »

bmj wrote: post #18
jacquesm wrote: post #9

Earlier quoted context omitted.

Up/down up/down, if you disagree say so. Do you take offense at my suggestion this kid did nothing wrong ? Why is that ? Enlighten me, for all I have read above the sysadmin is the person in the wrong, if a 13 year old can walk all over your system you ought to be looking for a job (and one that does not include system administration).

So does this mean that if I accidentally forget to lock my front door that it is legal for you to walk around inside my house?

That argument has been beaten to death so many times it really loses it's shine.

So, no that does not make it legal.

BUT We're talking about a kid that is according to the OP 13 years old, at that age you are not considered to be able to make these judgement calls.

Forbidden fruit and all that...

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#24

Post by thomasswift »

Tell him to stop before he gets caught. Even though he didn't do any damage, a school's administration will not take kindly to the potential threat that he is.

here's one example, a quick google search - 69 felonies for stealing tests and changing grades http://www.tgdaily.com/content/view/38012/118/

Also, even though he got in, I wouldn't attempt to notify them of their breach, because again the school will probably go ballistic on him, I think there was a news story about this, but what happened escapes me.

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#25

Post by jacquesm »

sounddust wrote: post #12

When I was in high school, I guessed the administrator password of our computer lab (it was the administrator's daughter's first name) and basically maintained the computer lab for the rest of the semester. I never did any harm in the process. The administrator, upon finding out what I had done, recognized that I knew what I was doing, and supported my work. I fixed permissions that repaired apps that had been myster…

Spot on. And I sympathize with what you went through at school, times sure have changed. The overreaction to this sort of thing is something that never ceases to amaze me, anybody that is half decent with a computer gets looked at as some kind of force of evil.

I see this as a response to some kind of inner fear that there are kids out there that are more competent with this stuff than the adults. Invariably it's the clueless that start these witch-hunts.

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#26

Post by unalone »

jacquesm wrote: post #14
xenophanes wrote: post #10

Earlier quoted context omitted.

I knew a 13 year old, diagnosed with ADHD for not sitting quietly in class, who could concentrate on a chess game for 4+ hours straight. And then play another one after a short break. I could do the same. I also read SICP when I was 13.

I have a son like that. He's great at the stuff that he is interested in, anything else and he's bored instantly. ADHD to me is just a convenient label for kids that are different than that norm, so we trot out the medicine cabinet to make them conform instead of helping them to cope with the world around them we make it easier for the 'rest' to cope with them.

When I was in high school, a friend told me he had been diagnosed with ADD. His parents had him tested because his grades were suffering.

My friend and I have similar personalities, and my grades were similarly hit-and-miss. I went home and asked my mother if I had ADD. Her response: "Probably."

I'm grateful that I had parents who accepted my quirks as a part of my personality and not as problems to be fixed.

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#27

Post by kirse »

Tell your cousin he gets about 3 more years of goofing around like that where he should use the "stupid kid" or "I dunno" defense and get off scott-free or with a slap on the wrist. Once he's an adult though, the kiddy stuff has to stop.

If he's messing with financial systems or other serious stuff, give him a thwock on the skull and remind him that it would be unfair and immoral to screw with the systems more than the CEOs and bankers already have. =)

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#28

Post by tptacek »

r11t wrote: post #4

The best reference I can recommend would be Eric Raymond's "How To Become A Hacker" : http://www.catb.org/~esr/faqs/hacker-howto.html The key point the article points out is that "The basic difference is this: hackers build things, crackers break them." The teenage thrill of breaking into computer systems is certainly exciting but perhaps he will be even more enthusiastic about learning to be curious about how things…

Like most of ESR's aphorisms, this "building vs. breaking" thing misses the mark entirely, reflecting more about how ESR thinks about the world than how the world actually works.

There is lots of productive work to be done in "breaking" systems. Nobody thinks Arjen Lenstra or Paul Kocher are doing work of a lesser caliber than Alan Cox; it is (I think obviously) harder to break RSA than it is to build a new Linux virtual filesystem layer. It is only because people like ESR don't know about people like Paul Kocher that this "build vs. break" meme spreads. Let's try to kill it when it appears.

What teenagers need to have is a sense of ethics. This has nothing to do with whether you spend your time finding holes in things, and everything to do with respecting property, with not assuming that you know the impact of every action you take that invades someone else's property, and hopefully with having a productive goal.

Here's what you need to tell your cousin: nobody in the real world gives a shit about your ability to break into one computer system. Per-host network penetration testing is close to the bottom rung of the computer security career ladder. If he likes breaking things, what he should do is start picking up open source software, researching how it works, finding vulnerabilities, and reporting them.

He's going to find really quickly that knowing you could --- if you were a criminal and a moron --- break into tens of thousands of computer systems is a lot more fun than breaking into one badly-configured school computer. He's also going to learn real computer science, because really breaking systems involves really reading and understanding code, runtimes, layering, information modeling and representation, and any of a zillion other things.

Computer security is a really awesome tour of a lot of the fun stuff in a CS curricula. I've worked on compilers, crypto math, distributed commit protocols, filesystems, and language runtimes in just the last 12 months. If he likes this stuff, get him to stay with it.

You asked for books. How about:

* The Web Application Hacker's Handbook (bad title, great book).

* Eldad Eilam's "Reversing"

* The Art Of Software Security Assessment (our industry's bible)

* The Shellcoder's Handbook

* The last 10 years of Black Hat Briefings talks, which are all available online.

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#29

Post by jacquesm »

unalone wrote: post #26
jacquesm wrote: post #14

Earlier quoted context omitted.

I have a son like that. He's great at the stuff that he is interested in, anything else and he's bored instantly. ADHD to me is just a convenient label for kids that are different than that norm, so we trot out the medicine cabinet to make them conform instead of helping them to cope with the world around them we make it easier for the 'rest' to cope with them.

When I was in high school, a friend told me he had been diagnosed with ADD. His parents had him tested because his grades were suffering. My friend and I have similar personalities, and my grades were similarly hit-and-miss. I went home and asked my mother if I had ADD. Her response: "Probably." I'm grateful that I had parents who accepted my quirks as a part of my personality and not as problems to be fixed.

I guess I got lucky, or I would have been on ritalin or some other fashionable (or profitable) drug for sure.

I'm 43 now, 44 in March, when I was a kid ADD did not yet 'exist', and from my experience with my sons teachers the teachers in the schools that I went to were of a better grade than the teachers he has to content with (and that have to contend with him) today.

I think the latter is the biggest factor in the diagnosis of all these 'children that we can't handle', it is striking that the %age of these kids seems to go up with every generation. Hopefully soon there will be generation of teachers that is as fast and as smart as the kids they are trying to teach.

To some extent I think it is the influence of our media rich world, and next to that probably the enormous amount of technology and information available to kids from a very young age onwards that causes kids to be so tremendously fast at the stuff that these teachers can barely cope with.

Boredom is their lot, unless you can get them interested, and once you manage that better hold on to your hat.

One thing I have found to be universal in dealing with 'gifted' or 'fast' children (I prefer those terms), it is that once you have gained their respect it gets a lot easier to communicate with them and to get them interested in the stuff that they should know.

It's just that if you're a teacher and you get these knowledge seeking missiles that can run rings around you your visceral response is probably to want them to slow down to your level. I think that is the best way to lose their respect.

Congratulations to your parents, they seem to have done just fine :)

Re: Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

#30

Post by unalone »

r11t wrote: post #4

The best reference I can recommend would be Eric Raymond's "How To Become A Hacker" : http://www.catb.org/~esr/faqs/hacker-howto.html The key point the article points out is that "The basic difference is this: hackers build things, crackers break them." The teenage thrill of breaking into computer systems is certainly exciting but perhaps he will be even more enthusiastic about learning to be curious about how things…

I have a problem with that essay. It makes good points, most of which I agree with, but Raymond states them as values to be learned without explaining why. He essentially states his own beliefs without giving reason for some of them or explaining why such mindsets are useful. (Or: he shows rather than tells.)

The phrase that stands out most upon first glance is this:

Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.

If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval.

I've found this not to be the case. Wanting sex, money, and social approval is not necessarily detrimental. Similarly, I get no thrill from solving problems per se. I don't think that that thrill is a necessity for hackers. Raymond uses too broad a brush.

Post reply on HN