Doctor John wrote:
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1

> 
> 
> Can't make my mind up on this; is the university right in prosecuting or 
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing 
> to be convinced otherwise

The university is acting within its rights.  There were other ways of 
drawing attention to the problem other than breaking the law.  Notifying 
the security people risk, and then their non-IT bosses, are prudent 
steps, and I see no indication that the student did this *prior* to his 
own hacking.

Granted, you cannot *prove* that the vulnerability is real without 
making a successful penetration, but that really is beside the point.

It is not substantively different from a situation where you live in an 
apartment for which the landlord has failed to install adequate door 
locks.  You cannot break into other people's apartments in order to 
demonstrate the inadequacy of the existing security.  You tell the 
landlord, advise the tenants, and if nothing happens, move out.

Consider for a moment the results of allowing people to hack first, and 
then report the results of their hacking.  People who are hacking for 
criminal reasons will, if caught, claim that as a defense.

Regards,
John

Post a reply to this message