Youth expelled from Montreal college after finding security flaw

Post by kibwen » Mon, Jan 21, 2013, 2:35 PM UTC

twentysix wrote: post #129

rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

Its certainly a grey area and covering all your bases legally before embarking on a penetration test would be good idea. Even with all the legal formalities, there needs to be a good level of trust between the client and the auditor for things to go smoothly. Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he…

  > While his intentions were good, I think it was a bit 
  > naive of him to take upon himself the responsibility to 
  > make sure the flaws were fixed and conduct a test.

Post by lifeisstillgood » Mon, Jan 21, 2013, 2:44 PM UTC

awakeasleep wrote: post #156

ihsw wrote: post #154

Earlier quoted context omitted.

This is a C-level position at a publicly-funded institution, that ratio is closer to 95% and 5%. I would even go so far as to say that these individuals very likely have a background in law or simply have an MBNA. Engineers aren't in charge, anywhere, other than tech companies.

I still can't wrap my head around this. The CFO damn well understands finance. The COO understands operations. Why aren CIOs held to the same standard?

Post by ptolts » Mon, Jan 21, 2013, 3:00 PM UTC

puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

Post by guard-of-terra » Mon, Jan 21, 2013, 3:21 PM UTC

Tichy wrote: post #116

guard-of-terra wrote: post #30

Earlier quoted context omitted.

You can also pastebin it. That's what you should do.

How do new pastebins get discovered? I've never used the service - was assuming someone should post the link to the pastebin on Reddit?

Post by chollida1 » Mon, Jan 21, 2013, 3:39 PM UTC

ihsw wrote: post #154

ivix wrote: post #137

Earlier quoted context omitted.

I would guess that being a CIO is 80% about management/people skills and 20% about technology. Hopefully that goes some way to explaining why these people did not understand your email.

This is a C-level position at a publicly-funded institution, that ratio is closer to 95% and 5%. I would even go so far as to say that these individuals very likely have a background in law or simply have an MBNA. Engineers aren't in charge, anywhere, other than tech companies.