Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

271–280 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#271

Post by jrockway »

tptacek wrote: post #172
jrockway wrote: post #43

Earlier quoted context omitted.

I got a B. The homework was to find and write an exploit for 10 security holes in deployed software, but I only found 2. (3 including the one above, which I must have found the week or so after exams. The holes I found were in nasm and in some amateur open-source smtpd.) FWIW, the exams are quite thought-provoking nearly 10 years later, here's a link to them: http://cr.yp.to/2004-494.html

Didn't he famously fail the whole class one of the times he gave it?

I don't think so, as he's only taught the class once and I didn't fail it:

http://cr.yp.to/courses.html

Re: Youth expelled from Montreal college after finding security flaw

#272

Post by rayiner »

donall wrote: post #261
mustpax wrote: post #207

Earlier quoted context omitted.

A lot of people get engineering degrees as a signalling mechanism to prove they can do hard work, not because they have any interest in becoming engineers. Formal training in a subject combined with a lack of intrinsic curiosity about the subject makes the worst engineering managers you will ever meet.

I think this is probably true. Empirically speaking, a lot of the guys who graduated with their B.Sc. in computer science with me saw their career paths as joining a big consulting company, working on the front lines for a couple of years and then getting into management and leaving the code behind for good. In my PhD program, most guys in the lab saw the actual engineering side of things as a stepping stone to highe…

The claim was that "engineers are never the one in charge." If your argument is that engineers cease to be engineers once they get into management, then it's tautological that "engineers are never in charge."

Re: Youth expelled from Montreal college after finding security flaw

#273

Post by Alex3917 »

tlrobinson wrote: post #217
petenixey wrote: post #100

Earlier quoted context omitted.

Evidently the corollary to Arthur C Clarke's famous quote on technology and magic is that those who create it are witches and wizards. You like the magic and you need a few practitioners but when things start getting weird, it's pitchfork o'clock.

I don't know if he was the first, but I assume you got this from Robert Graham's recently proposed corollary "Any sufficiently technical expert is indistinguishable from a witch" http://erratasec.blogspot.com/2013/01/i-conceal-my-identity-...

The problem with that corollary is that the modern equivalents of witches are doctors, but there isn't really any significant negative connotation there for the average person. It's more like technical expertise + shitty marketing.

Re: Youth expelled from Montreal college after finding security flaw

#274

Post by Dylan16807 »

Confusion wrote: post #257
Dylan16807 wrote: post #232

Earlier quoted context omitted.

>"Unauthorized security testing is indistiguishable from Malicious attack" Of course it's distinguishable. Testing comes before attacking, to provide information. The two are otherwise completely unrelated. It'd dead-easy to distinguish between someone poking your fence and someone stealing your jewelery, for example.

If your test to see if you can pick a lock is actually trying to pick the lock, then the test can of course be indistinguishable from attempted burglary. If you were caught in the act, any defense will be suspicious. However, if you confessed of your own free will, there is usually no reason to suspect criminal intent.

If you're caught in the act, sure. But they called him about it well after the actual actions. That's solid evidence then that he left after entering and logically did not use the entering to commit a crime.

Re: Youth expelled from Montreal college after finding security flaw

#275

Post by alecperkins »

dexterchief wrote: post #222
puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

You are probably correct that what he did is probably unlawful (Canadian law is usually fairly close to US law), I disagree that it was unethical. In a general sense It's not difficult to find instances of behaviour that, while lawful are far from ethical, so those to things don't necessarily travel together. Some examples: http://en.wikipedia.org/wiki/Sexual_Sterilization_Act_of_Alb... http://en.wikipedia.org/wiki/C…

A analogy even more accurate to this case would be: "Let's suppose you let someone store their stuff at your house, and they have previously pointed out a problem with the lock. You come back home and find them picking on your door lock with a lock picking tool. You ask him "what are you doing?" and he says "I'm just checking the lock I said you should fix is safe. I do it for our security."

Re: Youth expelled from Montreal college after finding security flaw

#276

Post by danudey »

blindhippo wrote: post #220
adrianm wrote: post #196

Earlier quoted context omitted.

What an incredibly succinct way to put it. Props. I have a lurking feeling that in spite of all of the technologist/futurist optimism in our community, we are likely underestimating the pushback from the world at large when enough people at the same time are finally put out of work due to the same technological innovation we strive so furiously for in our own lives.

I've always doubted we would ever encounter this situation to be honest. The invention of vending machines didn't put convenience stores out of business but it did create a new class of technician to service them. What I'm worried about is that as we move towards more ubiquity with computer technology in our lives, the "coder" will become a second string, blue collar job rather then a legitimate, organized profession…

When I made this point to my stepfather as a child, he got indignant, claiming that I was saying that the jobs getting replaced 'weren't good enough' and the people who did them 'didn't deserve jobs'.

The point is that not everyone will understand that the shifts are gradual, and that we're not going to sack thousands of convenience store clerks and simultaneously hire thousands of vending machine technicians because the technicians 'deserve' jobs and the clerks don't.

Re: Youth expelled from Montreal college after finding security flaw

#277

Post by sopooneo »

I think hackers need to realize that this type of reaction is the norm. If you find an exploit then use your discretion in deciding to report it, but don't be naive. There is no reason to risk martyring yourself for someone else's interests. The risk to those (including yourself) whose information is vulnerable should be taken into account, but countered by the risk that you will be persecuted for bringing the problem to light.

Re: Youth expelled from Montreal college after finding security flaw

#279

Post by aroberge »

chm wrote: post #268
sudhirj wrote: post #45

Ahmed, if you're reading this, sorry about your college acting like idiots. If finishing college is important to you, I'm sorry they've made it so difficult. That said, please don't think this is going to end your career. There are a lot of companies and startups that would love to have you for your kind of initiative. Not having a degree that you don't seem to need anyway will not be a sticking point with them. And…

He's technically still in Québec's equivalent of a US high-school 12th grade. Since he's 20, he can wait a year and be accepted to a University.

No, cegep has either 2 or 3 year programs. Year 1 is equivalent to US high-school 12th grade. Year 2 of 2-year programs is equivalent to 1st year university for B.A. or B.Sc. 3-year programs tend to be terminal degree of a more "technical" nature.

Re: Youth expelled from Montreal college after finding security flaw

#280

Post by LambdaDriver »

PakG1 wrote: post #193
lifeisstillgood wrote: post #163

Earlier quoted context omitted.

CFO understands finance because the people who hire CFOs know their organisation will bleed out if money is not controlled - they understand the consequences of mismanaging IT They understand their organisation will descend into chaos I their Operations are not controlled But they probably always have lived with crap IT - and so so not understand what competitive advantages come from having IT well controlled. Give i…

Highly doubtful. My day job is at big IT company. Possibly the most well-known in history. You can guess. I'm the lead guy on my team for running our quality control. 6-sigma style stuff. The guy in charge of international training for this quality program said, "The fact is, IT is now a commodity." The whole meme started with Nick Carr's infamous Does IT Matter? editorial in the Harvard Business Review. He argued th…

I've read the original article a while back so forgive me if my memory is a bit off.

His argument centered around these fortune 500 companies whom purchased big ERP systems and had custom development done for various parts of their businesses as a strategic investment (and a trade secret). It turned out that almost all of these companies built similar modules, since all of these companies on average hired smart managers that understood where inefficiencies could be eliminated via technology.

His correct conclusion was that these bits of tech were not strategic but rather simply the cost of doing business and thusly were open to commoditization.

Now here's where folks take a leap of faith and say that /all/ IT doesn't matter.

The way I look at it, all innovation can be strategic depending upon your business and its priorities. For most companies power and ping are commodities, but for Google it is a competitive advantage. Google would never outsource their operations to big blue, but for PWC that would probably be a good move.

Even at the micro scale you can see this in github repos where large companies will open source core modules but keep their competitive code proprietary.

Post reply on HN