Live data from Hacker News

Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

sh1mmer.me

151–160 of 203 posts

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#151
post #111

Earlier quoted context omitted.

They're K-12 IT staff... they've got 900 other things to worry about. If someone is smart enough to find this and unenroll their device, they're probably smart enough to be left to their own devices. (Literally)

Except then they're going to spread the exploit. Kids don't keep their mouths shut. Then word goes around Jimmy knows how to kill the lock and get Roblox again on his Chromebook and suddenly there's a problem because now the flash drives and instructions are pared down and now half your class's Chromebooks just went unmanaged. They won't think or understand the repercussions (like not being able to suddenly start a m…

So was I, but that's the point of instilling a culture of "you break it, you deal with the consequences."

Getting a zero on your next hw/quiz/lab/test, because your machine was non-compliant and you didn't know how to switch it back, is fair.

Then reimage the machine on IT's timeline.

And if mom and dad want to bitch, they deserve to be told that little Timmy screwed up his own laptop.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#152
post #119

I stand with everyone on Hacker News in admiration for young’uns sticking it to the man and learning about command-line secret power. _However_, I’m a little more ambivalent knowing that most of them do that to look at naked ladies, presumably. Maybe create pictures of naked ladies (again: very impressed by Generative AI, with the caveat that it’s widely used for pr0n) That doesn’t feel ideal for the emotional matura…

>hacking the school network meant you risk exposing yourself to people with strong opinions about plot points in Buffy The Vampire Slayer Not really, porn and gore were integral parts of the internet even "back then". Rotten.com launched in 1996 for example, Ogrish at 2000. Eating disorders are also fluorishing in the current era, on TikTok for one, but I remember the pro-ana websites from my youth as well, distribut…

> Emotional maturation, strong connection to people matter a lot

The first time I got called to the office was as a freshman in high school for fixing the 4 computer lab computers another kid had borked. That was Windows 3.0 and there was no network. The vice principal sat us down together and said the other kid was headed for a life of trouble and should be more like me. It was his considered opinion that I would go on to solve computer problems for a living and get paid $100,000. Honestly, I was way more impressed with him than myself. Unfortunately I went to medical school and never got to solve other people's computer problems for money. I mean, I solve computer problems for people, I get paid, but those two events are thoroughly decoupled.

I now have a 17 year old and a 21 year old. I think they are more aware of their maturity level than I was. They sit around and think of what they are probably capable of doing. Which is a level of introspection I rarely have even today.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#153
post #149

Earlier quoted context omitted.

https://support.google.com/chromebook/answer/9145439?hl=en-G...

>> Important: If you use your Chromebook at work or school, you might not be able to use Linux. For more information, contact your administrator. >> {enable developer mode} If it were sandboxed, that's shouldn't be something it's possible for managed administrators to disable.

It definitely is sandboxed. I think the concern is that kids will get off task with it by installing games and stuff.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#154
post #85

Earlier quoted context omitted.

Learning how to use a computer is like learning how to use a pen. It’s not binary there is a huge difference between knowing how to say surf the web and actually know how to use it for research. Carpentry a great analogy as you can learn the basic skills to build a perfectly functional house in a few weeks. However, you can literally spend a lifetime mastering it. So, let’s not pretend the bare minimum of computer li…

And in school they don't teach how to use them effectively… or they wouldn't be using locked down google stuff.

Learning is a multi stage process. The military doesn’t start 17 year old kids on F-35 fighter jets. It’s the same deal here, the vastly lower cost option is good enough to be useful training.

Chromebooks are the baking soda equivalent in middle school school chemistry experiments. Cheap and instructive is considered good enough.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#155

Is there a source for `bored kids`? I dont see any evidence of kids creating this exploit?

I don't know how to prove it, because I don't want to post screenshots or other identifying info, but I've been in communication with a couple members of the sh1mmer crew. After posting some technical info about it on Reddit, they reached out. They claim to be in high school, and the way they converse seems to match. They're good kids. Good hackers.

You might've talked to me.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#156
post #139

Earlier quoted context omitted.

Chromebooks don't even have a Terminal for the kids. Vim's great, but VScode with Jupyter Notebook support would make the computers we bought for them into great offline calculators, too. VSCode on a Chromebook requires VMs and Containers which require "Developer Tools" and "Powerwash"; or the APK repack of VSCodium that you can't even sideload and manually update sometimes (because it's not on the 15-30% cut, and mu…

I actually use a Web Assembly port of VIM on my school computer.

Nice. TIL about vim.wasm: https://github.com/rhysd/vim.wasm

Jupyter Notebook and Jupyter Lab have a web terminal that's good enough to do SSH and Vim. Mosh Mobile Shell is more resilient to internet connection failure.

Again though, Running everything in application-sandboxed WASM all as the current user is a security regression from the workload isolation features built into VMs and Containers (which Windows, Mac, and Linux computers support in the interests of STEM education and portable component reuse).

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#157
post #149

Earlier quoted context omitted.

>> Important: If you use your Chromebook at work or school, you might not be able to use Linux. For more information, contact your administrator. >> {enable developer mode} If it were sandboxed, that's shouldn't be something it's possible for managed administrators to disable.

It definitely is sandboxed. I think the concern is that kids will get off task with it by installing games and stuff.

IMHO, a limited (read: CLI) but general-purpose computing environment is exactly what we should be providing our kids.

No one would play TI-83 games if they had other options... but it'd be hard to say writing and modifying them wasn't educational.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#158
post #151

Earlier quoted context omitted.

Except then they're going to spread the exploit. Kids don't keep their mouths shut. Then word goes around Jimmy knows how to kill the lock and get Roblox again on his Chromebook and suddenly there's a problem because now the flash drives and instructions are pared down and now half your class's Chromebooks just went unmanaged. They won't think or understand the repercussions (like not being able to suddenly start a m…

So was I, but that's the point of instilling a culture of "you break it, you deal with the consequences." Getting a zero on your next hw/quiz/lab/test, because your machine was non-compliant and you didn't know how to switch it back, is fair. Then reimage the machine on IT's timeline. And if mom and dad want to bitch, they deserve to be told that little Timmy screwed up his own laptop.

I would note that "screwing up your laptop" for a test written online, is a lot like "screwing up your pencil" for a test written on paper. A laptop can be borked, but it can also just have keys that break off, or other damage, some of which might be entirely accidental. Likewise, a student might snap their pencil in half or forget to bring it or grind it down to an unusable nub, but they also might just have a crap pencil where the lead got broken into little bits on the inside during shipping.

In the case of the pencil, I'd expect the student to just put up their hand and ask for a pencil to do the test with; and the teacher to begrudgingly provide them one—mostly due to the possibility of the accidental case.

Would that not be the case for school-issued laptops — just grab one from some cart of "extras" and tell the student to log into that one to do the test?

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#159
post #105

I hope I don't sound like a Luddite, but I don't think kids should have chrome books, or any type of laptops in school...

My son's programming classes would be pretty hard without his laptop. For primary school I might agree with you, but not for secondary school.

Yes but not all students are in your son's programming class. :-/

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#160
post #55

Earlier quoted context omitted.

Why? I used a laptop full time in school from 16-18 (and then at university too) and found it much more productive. My notes were better and more usable. For younger children I think everyone agrees that it's important to be teaching computer skills, and that requires computers. Having rooms of desktop computers is arguably outdated, and a poor use of space, so many schools have switched to trolleys of shared laptops…

Developmentally, a 16-18 year old is very different than a child. I don’t know whether laptops in school are bad for children, but you can’t really make that comparison. Personally, my belief is that children should learn to use computers (I did as a child, and it was massively beneficial) but that computers should not be central to their foundational education. Kids shouldn’t learn basic arithmetic on a computer. Th…

One thought: if the computer is locked down into a mode where it's acting as a fancy typewriter to fill form-fields (i.e. if you're kiosked into the Blackboard worksheet "app" during the lesson), then what's the difference between learning by typing vs. "by writing"?

Another thought: "learning with their hands, with things they can hold" is nice to say, but counting blocks/geometry boards/etc are actually rather expensive (hard to have as many sets as there are kids, for several reasons), so often kids will only get a short amount of time to experience such things, rather than being able to use them as a thinking aid whenever they want until they grow out of the need for them. On the other hand, presuming each child has a computer, "learning by interactive example" — i.e. having interactive touch-enabled simulations of these same learning toys — is almost as good, and freely scalable to the entire student population, such that each child gets as much time to experiment with the simulation — and really learn the lesson of it — as they want. Including taking it home with them!

A third thought, perhaps less persuasive because I'm an outlier, but personally meaningful to me: back in the 90s, I learned PEDMAS before parentheses were even taught to us in school. I had grabbed "C for Dummies" from a grocery-store shelf — asking my mum to purchase it for me — because I knew that C was how you made video games. Instead, I ended up reading about "operator precedence" / "operator binding affinity" as a general concept. Yes, I was 9; yes, most of what I read flew right over my head. But that part stuck! And when I later — at the age of 11 — learned PHP and then Ruby, I already understood how to translate math on a page into syntax for a REPL, because I had seen the C example of how to write binding-precedence parsing. And then I did start creating (simple) game demos — and more interestingly, from-scratch game engines to power them (because toolkits like Unity weren't a thing back then), which involved more than a little bit of maths to make even the simplest physics integration steps work. (Yes, this means I understood how acceleration translates to velocity and then displacement — and so had an intuitive grasp of integrals, despite never having been exposed to them — when I was 12. I came into my pre-calc and physics classes prepared!)

Post reply on HN