Author Topic: College expels student for reporting security hole  (Read 440 times)

Offline AndrzejL

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 12798
  • RLU #490933
    • Wordpress On The Wardrobe...
Re: College expels student for reporting security hole
« Reply #15 on: January 23, 2013, 03:02:23 PM »
That is a legal approach, hardly an educational one.

So if a adult student breaks into a bank vault we should still educate him and we shouldn't send him to prison? No - he would go to prison like every other criminal. This guy committed crime - he pentested (and possibly broke into) the students database... I am asking again. Why should we treat him any different? He is lucky he was expelled from school and not arrested...

Regards.

Andrzej

Offline Crow

  • Hero Member
  • *****
  • Posts: 8768
  • OBJECTS IN MIRROR... ARE LOSING
Re: College expels student for reporting security hole
« Reply #16 on: January 23, 2013, 09:02:28 PM »
AndrzejL you keep pulling things out of context or simply not existent, I don't discuss anymore, you win.
I shall pass this way but once;
any good therefore that I can do,
or any kindness that I can show
let me not defer nor neglect it,
for I shall not pass this way again.

Linux User #330412

Offline AndrzejL

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 12798
  • RLU #490933
    • Wordpress On The Wardrobe...
Re: College expels student for reporting security hole
« Reply #17 on: January 24, 2013, 06:48:19 AM »
AndrzejL you keep pulling things out of context or simply not existent, I don't discuss anymore, you win.

I didn't realized that we were in a contest / battle Crow?

All I do is call it as I see it. I am not going for the prize of the Golden Carrot - if You thought I was that means that You misread me Amigo.

Online µT6

  • Hero Member
  • *****
  • Posts: 1892
Re: College expels student for reporting security hole
« Reply #18 on: January 24, 2013, 07:02:01 AM »
crow, i still agree with you, the rest, well, i and taking it as the grain of sand it is  ;)
"A question that sometimes drives me hazy: am I or are the others crazy?"

Albert Einstein

Offline kjpetrie

  • PCLinuxOS Tester
  • Hero Member
  • *******
  • Posts: 3991
Re: College expels student for reporting security hole
« Reply #19 on: January 24, 2013, 11:50:58 AM »
You will get no agreement because this is a cultural issue around what constitutes crime and whether there has to be criminal intent or serious harm. That depends on local beliefs.

Suppose I walk down your street and notice your door is open so I point it out to you. The next day I walk down your street again and see your door is shut but I'm not sure whether it's locked, so I try the handle. Am I doing right (looking after your interest by making sure your house is secure) or wrong (trying to open your door when it's none of my business)? The answer is cultural. In some countries that would be seen as being a good neighbour, and in others the owner would be entitled to shoot me down on the spot for interfering with his property. It's cultural.

The case is complicated here because the student concerned has a foreign name and may well not be in his own country, and therefore might well have been brought up with different values from those in which the college exists. In such circumstances it is easy for actions and boundaries to be misunderstood. We don't know enough to form a judgement. We have to trust those on the scene to have taken relevant factors into account.
-----------
KJP
-----------------------------------------------------------
PClos64 RC1 on Intel D945GCLF2 motherboard (Atom 330), 2GB DDR2 RAM, Maxtor STM325031, HL-DT-ST DVDRAM GSA-H42N, Amilo LSL 3220T monitor. Also Acer 5810TG (with custom kernel) and Asus eeePC 2G surf

Online µT6

  • Hero Member
  • *****
  • Posts: 1892
Re: College expels student for reporting security hole
« Reply #20 on: January 24, 2013, 11:59:19 AM »
you are right Kjpetrie, some things are relative to where you live

still some things must be tolerated and others not

this guy showed that he can do alot, and certainly will get a job very quickly after this

if he is a good or bad person, that is questionable, still he left everybody trying to digest what he did but the way he did it, i think he made everything right, as in right for him  ;)

"A question that sometimes drives me hazy: am I or are the others crazy?"

Albert Einstein

Online Just17

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 10648
  • MLUs Forever!
Re: College expels student for reporting security hole
« Reply #21 on: January 24, 2013, 12:19:28 PM »
You will get no agreement because this is a cultural issue around what constitutes crime and whether there has to be criminal intent or serious harm. That depends on local beliefs.

Suppose I walk down your street and notice your door is open so I point it out to you. The next day I walk down your street again and see your door is shut but I'm not sure whether it's locked, so I try the handle. Am I doing right (looking after your interest by making sure your house is secure) or wrong (trying to open your door when it's none of my business)? The answer is cultural. In some countries that would be seen as being a good neighbour, and in others the owner would be entitled to shoot me down on the spot for interfering with his property. It's cultural.

It is my understanding he did not only test the door, but entered.

That, to me makes a huge difference .....  and yes might be a cultural thing, but having strangers (to me) not only test my security, but enter if possible, is not acceptable.
Yes he was a 'stranger' in so far as he was not approved to enter.

Quote
The case is complicated here because the student concerned has a foreign name and may well not be in his own country, and therefore might well have been brought up with different values from those in which the college exists. In such circumstances it is easy for actions and boundaries to be misunderstood. We don't know enough to form a judgement. We have to trust those on the scene to have taken relevant factors into account.


As I said earlier, there is too little information available to form a firm opinion ....   I would not be inclined to jump either way because of that.
« Last Edit: January 24, 2013, 02:21:58 PM by Just17 »
MLUs rule the roost!

Linux XPS 3.4.38-pclos1.bfs  64 bit
Intel Core2 Quad CPU Q9450 @ 2.66GHz
4 GB RAM
MCP51 High Def Audio
GeForce GTX 550 Ti
PHILIPS  ‎DVD+-RW DVD8701
‎Logitech ‎BT Mini-Receiver
Afatech DTT

Offline AndrzejL

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 12798
  • RLU #490933
    • Wordpress On The Wardrobe...
Re: College expels student for reporting security hole
« Reply #22 on: January 24, 2013, 02:03:47 PM »
You will get no agreement because this is a cultural issue around what constitutes crime and whether there has to be criminal intent or serious harm. That depends on local beliefs.

Suppose I walk down your street and notice your door is open so I point it out to you. The next day I walk down your street again and see your door is shut but I'm not sure whether it's locked, so I try the handle. Am I doing right (looking after your interest by making sure your house is secure) or wrong (trying to open your door when it's none of my business)? The answer is cultural. In some countries that would be seen as being a good neighbour, and in others the owner would be entitled to shoot me down on the spot for interfering with his property. It's cultural.

The case is complicated here because the student concerned has a foreign name and may well not be in his own country, and therefore might well have been brought up with different values from those in which the college exists. In such circumstances it is easy for actions and boundaries to be misunderstood. We don't know enough to form a judgement. We have to trust those on the scene to have taken relevant factors into account.

I see what You did there and I must agree. I will admit I trust no one... which makes Your post even more more accurate.

Regards.

Andrzej

Offline AndrzejL

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 12798
  • RLU #490933
    • Wordpress On The Wardrobe...
Re: College expels student for reporting security hole
« Reply #23 on: January 26, 2013, 09:27:06 AM »
What chances?  he reported the problem, "checked" if the solution was there and that was all.

There was an update on the matter:

Quote
In a statement posted to the college's website, the school implied that Al-Khabaz had been previously warned off his actions, and despite that warning went back again and ran the site scanner. "The reasons cited in the National Post article for which the student was expelled are inaccurate," the college administration's statement read. "The process which leads to expulsion includes a step in which a student is issued an advisory to cease and desist the activities for which he or she is being sanctioned, particularly in the area of professional code of conduct. Conditions for remaining in the College on good terms are clearly explained in person to the student."

http://arstechnica.com/security/2013/01/canadian-student-expelled-for-playing-security-white-hat/#p3n

Quote
One of Al-Khabaz's former instructors went further, writing a letter to the Montreal Gazette on the matter, mocking the media for painting an unfair picture of the college's actions. "I can tell you that our Computer Science program, like virtually all professional programs, has a professional conduct policy that lays out expectations that our students must meet, in addition to purely academic requirements," wrote Alex Simonelis, a member of the faculty of Dawson College's Computer Science Department.

"The media need to fill in some blanks in their accounts," Simonelis continued. "Exactly how did the student “stumble upon” the flaw? Was it by running intrusion tests against Skytech’s website? If so, did he have Skytech’s permission to do so, given that it is unacceptable to do so otherwise? Was the student given a cease-and-desist warning regarding such actions by our college’s administration? After informing our college of the flaws, and being invited to demonstrate them at the college on a specific date, did the student sign an agreement not to run further intrusion tests against Skytech? Did the student run such an intrusion test again, after the warning/signing?  Did the student have a hearing with our department chair and dean? I believe I know the answers to those questions, but I could be wrong, and so would really appreciate any correction the media provide."

Regards.

Andrzej
« Last Edit: January 26, 2013, 09:28:55 AM by AndrzejL »