291–300 of 308 posts
Earlier quoted context omitted.
He's technically still in Québec's equivalent of a US high-school 12th grade. Since he's 20, he can wait a year and be accepted to a University.
No, cegep has either 2 or 3 year programs. Year 1 is equivalent to US high-school 12th grade. Year 2 of 2-year programs is equivalent to 1st year university for B.A. or B.Sc. 3-year programs tend to be terminal degree of a more "technical" nature.
http://www.cbc.ca/news/canada/montreal/story/2013/01/21/mont...
I found something like this at my school. The administration reacted similarly. But fortunately, I was taking djb's Unix Security Holes at the time, and a harshly-worded note from djb to the Computer Center folks ended up getting me a thank you. Next semester, though, I refused to sign the new AUP (which included a clause allowing the computer center staff to seize any computer I was using, even at my off-campus home…
For me, it was a way to steal the AFS space of the previous user (basically, they didn't expire the token... oops). I actually found the initial vulnerability by accident (something crashed due to network problems, reconnected and went, "WTF, those aren't my files!"), but I did find a good way to reproduce it on demand (yank Ethernet cord at proper time). Thankfully, I had read enough stories like this way back then and submitted the bug anonymously. This was ~2000 or around then, mind you.
I also tried to get university management to switch people over to using SSH way back in 1998, but it was something like 4-5 years before they eventually did so. I'm guessing they had no idea what I was talking about or why it even mattered back then, even though anyone could see everyone's passwords going over the wire with all the people who had to telnet for various reasons. Maybe they assumed that log file they were writing our activity to would catch anybody doing anything weird? It was cleverly named "resugol"--read that backwards if you're confused.
Earlier quoted context omitted.
Scanning is the second phase of the standard hacker attack procedure. Phases of hacking: Phase 1—Reconnaissance Phase 2—Scanning Phase 3—Gaining Access Phase 4—Maintaining Access Phase 5—Covering Tracks Regarding this guy's intention, you're probably right. The main reason why I'm commenting here is that guys with good intentions don't get themselves in the trouble for not knowing what they're doing. Finding vulnerab…
But you wouldn't call reconnaissance hacking, would you? That's just vaguely looking at the site and information about the company. Step 2, pointed at something like a webserver, does not connect to any systems the person is not supposed to have access to. Only step 3 crosses the line.
Scanning is an active method and it's done on the attacked system. Web scanning is not the same as web crawling (downloading pages of the site). It include all kinds of invasive tests, like SQL Injection, XSS, command injection and other attack attempts. It can cause many kinds of problems, named here in this thread.
From security perspective, scanning is an attack. Everyone who uses these tools should be aware of this.
Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…
You are probably correct that what he did is probably unlawful (Canadian law is usually fairly close to US law), I disagree that it was unethical. In a general sense It's not difficult to find instances of behaviour that, while lawful are far from ethical, so those to things don't necessarily travel together. Some examples: http://en.wikipedia.org/wiki/Sexual_Sterilization_Act_of_Alb... http://en.wikipedia.org/wiki/C…
If you are in business of finding vulnerabilities in IT systems, you should be aware of it. If for noting else, to save yourself form situations like this.
This guy is not a security professional (yet), but running vulnerability scanners on other people systems definitely puts him in context.
Earlier quoted context omitted.
Highly doubtful. My day job is at big IT company. Possibly the most well-known in history. You can guess. I'm the lead guy on my team for running our quality control. 6-sigma style stuff. The guy in charge of international training for this quality program said, "The fact is, IT is now a commodity." The whole meme started with Nick Carr's infamous Does IT Matter? editorial in the Harvard Business Review. He argued th…
I think we are agreeing - it is rare that a senior board member has seen how effective and competent IT embedded through out a organisation can transform that organisations flexibility, responsiveness etc etc. Most CEOs think IT is a commodity like electricity - you cannot buy "better" electricity. But this is crap - way back when you could buy better electricity - the debate ranged from power smoothing to DC/AC - an…
And even today when it comes to the price it still matters. And in the developing world you still can buy electricity with different quality and uptime.
Earlier quoted context omitted.
How do you prevent the schools from just lowering graduation requirements in order to artificially boost the percent of graduates and get a better payout?
Well, that is a problem. But universities also doesn't want to be known for poor quality. And then there is pretty strong government oversight. In Sweden the National Agency for Higher Education do regular audits and have the right to remove a schools privilege to award degrees.
Earlier quoted context omitted.
Yes, Finland. Maybe it's because all of our schools are public? For example higher ed. providers are funded based on enrollment and rate of graduation. If someone does not graduate, significant chunk (20-30%) of money won't be paid at all. This creates some incentive for the institution to actually guide and see that people don't fall through all kinds of cracks. I guess it's necessary when there is no ordinary payin…
> Maybe it's because all of our schools are public? There are Asian countries where this model has failed. Perhaps because of population pressure or other social factors. But I truly like the Nordic way of life.
Back in 1999 when I was a freshman in university, my school had a server for students to host their websites on and use Pine for email. The server did not give shell access... but then there was a security hole in Pine that would allow you to run chsh. So I did that, and got shell access. I think the worst thing I did (other than running ls in a few directories) was use it to connect to IRC. Since I wasn't really try…
Was MAC spoofing not doable in 1999?
Earlier quoted context omitted.
I think this is probably true. Empirically speaking, a lot of the guys who graduated with their B.Sc. in computer science with me saw their career paths as joining a big consulting company, working on the front lines for a couple of years and then getting into management and leaving the code behind for good. In my PhD program, most guys in the lab saw the actual engineering side of things as a stepping stone to highe…
The claim was that "engineers are never the one in charge." If your argument is that engineers cease to be engineers once they get into management, then it's tautological that "engineers are never in charge."
That is, people working on actual engineering aren't really "engineers" if they have their eyes set on something else, like a higher position in acadaemia.