4 ms·

I've heard stories from my days at MIT of people doing much worse things in server closets. The MIT community's view on these things is vastly different from th

by ericd 11y ago

I've heard stories from my days at MIT of people doing much worse things in server closets. The MIT community's view on these things is vastly different from the federal government's, and there's a large and shocking disconnect when those laws are applied to what's normally fairly accepted (if not explicitly, then implicitly condoned) behavior in the community.

raldi 11y ago
This wasn't implicitly or explicitly condoned. MIT had detected what Aaron was doing, and deployed countermeasures. Aaron defeated those countermeasures; MIT deployed tougher ones, and Aaron escalated again by breaking into the server closet and patching his laptop directly into the network switch, knowing it was the only way to bypass the considerable efforts MIT was making to protect itself. This was no, "Oops, I didn't realize you minded!" situation. Aaron was fully aware that MIT didn't approve of what he was doing, and he didn't care, and was actively battling to do what he pleased anyway.
- nitrogen 11y ago
  Are you basing this on statements from MIT, from the government, from the indictment...? I ask because, though I've never been near MIT, everything I read about it suggests that every one of these steps is seen as part of the game expected to be played by a few curious students now and then.
  - raldi 11y ago
    Some quotes from the official MIT report: http://swartz-report.mit.edu/docs/report-to-the-president.pdf http://swartz-report.mit.edu/docs/report-to-the-president.pd... Typically, when an excessive use case is reported that is determined to originate from within MIT’s network, the Libraries report this to either the MIT Information Services and Technology (IS&T) network security team or MIT’s “Stopit” group, which deals with inappropriate behavior that occurs electronically. The Stopit group’s general response is to send the offender a warning email message. This is almost always all that is needed to get people’s attention and have them stop whatever it was they were doing that caused the problem. [...] This time, the requests and downloads stimulated a cascade of failures that brought down multiple JSTOR servers. Half the servers in one data center failed, and JSTOR engineers feared that the entire service might go down worldwide. [...] Also on October 12, the Director of the MIT Libraries reported to MIT’s Academic Council that a cyber-attack of the JSTOR database had caused a weekend shutdown of JSTOR to the entire campus. Now take a look at the "MIT Hacker Ethic", particularly bulletpoint #2: http://hacks.mit.edu/misc/ethics.html http://hacks.mit.edu/misc/ethics.html
    - gcb0 11y ago
      > charges thousands of dollars a month for accessing little pdf files > go down in flames with a single user requesting files I guess jstor staff doesn't have access to good technical texts on how to run a network.
    - nitrogen 11y ago
      Nobody was harmed, no property damaged. Sounds like a "hack" to me. Certainly cheaper than getting a car off of a building.
      - foldr 11y ago
        Sure people were harmed. JSTOR going down is a big deal. It's relied on by academics all over the world.
  - clintonb 11y ago
    I'm an MIT alum. There is no "game" being played. If a student is violating certain terms of service (e.g. downloading all of JSTOR) he/she would normally be told to stop, and that's the end of it. You do it again, and you might get another warning. Alternatively, you might find yourself in front of a dean or without network privileges. Breaking into a closet, and connecting your hardware gets you expelled. Regardless of the locked state of the door, entering a closet to which you do not have explicit access is breaking into said closet.
    - ericd 11y ago
      I sincerely doubt it gets you expelled as long as you're not damaging anything, which I wouldn't count connecting a piece of equipment as doing. Breaking into places locked and otherwise is part of the core of MIT's culture. Did you never go roof and tunnel hacking? That said, I'm not as familiar as I should be with what MIT tried to do to get Aaron to stop, and whether he knew that they had deployed those because of what he did.
tzs 11y ago
> I've heard stories from my days at MIT of people doing much worse things in server closets Similar from my days at Caltech. However, there were two important considerations for this kind of thing at Caltech. 1. The "look the other way" attitude of the administration applied to members of the Caltech community, and also depended on how you were connected to Caltech. A student could get away with more than an employee or a friend/relative of a student. 2. The Caltech honor system applied. If you were hacking something without permission and the people in charge of that thing told you to stop, not stopping would have likely been an honor system violation. I'm pretty sure that repeatedly purposefully evading someone's attempt to get you to stop messing with their thing would count as ignoring a request to stop. Does MIT have similar considerations?
- raldi 11y ago
  Yes -- see particularly bulletpoint #2: http://hacks.mit.edu/misc/ethics.html http://hacks.mit.edu/misc/ethics.html

by ericd 11y ago

raldi 11y ago

This wasn't implicitly or explicitly condoned. MIT had detected what Aaron was doing, and deployed countermeasures. Aaron defeated those countermeasures; MIT deployed tougher ones, and Aaron escalated again by breaking into the server closet and patching his laptop directly into the network switch, knowing it was the only way to bypass the considerable efforts MIT was making to protect itself. This was no, "Oops, I didn't realize you minded!" situation. Aaron was fully aware that MIT didn't approve of what he was doing, and he didn't care, and was actively battling to do what he pleased anyway.

nitrogen 11y ago
Are you basing this on statements from MIT, from the government, from the indictment...? I ask because, though I've never been near MIT, everything I read about it suggests that every one of these steps is seen as part of the game expected to be played by a few curious students now and then.
- raldi 11y ago
  Some quotes from the official MIT report: http://swartz-report.mit.edu/docs/report-to-the-president.pdf http://swartz-report.mit.edu/docs/report-to-the-president.pd... Typically, when an excessive use case is reported that is determined to originate from within MIT’s network, the Libraries report this to either the MIT Information Services and Technology (IS&T) network security team or MIT’s “Stopit” group, which deals with inappropriate behavior that occurs electronically. The Stopit group’s general response is to send the offender a warning email message. This is almost always all that is needed to get people’s attention and have them stop whatever it was they were doing that caused the problem. [...] This time, the requests and downloads stimulated a cascade of failures that brought down multiple JSTOR servers. Half the servers in one data center failed, and JSTOR engineers feared that the entire service might go down worldwide. [...] Also on October 12, the Director of the MIT Libraries reported to MIT’s Academic Council that a cyber-attack of the JSTOR database had caused a weekend shutdown of JSTOR to the entire campus. Now take a look at the "MIT Hacker Ethic", particularly bulletpoint #2: http://hacks.mit.edu/misc/ethics.html http://hacks.mit.edu/misc/ethics.html
  - gcb0 11y ago
    > charges thousands of dollars a month for accessing little pdf files > go down in flames with a single user requesting files I guess jstor staff doesn't have access to good technical texts on how to run a network.
  - nitrogen 11y ago
    Nobody was harmed, no property damaged. Sounds like a "hack" to me. Certainly cheaper than getting a car off of a building.
    - foldr 11y ago
      Sure people were harmed. JSTOR going down is a big deal. It's relied on by academics all over the world.
- clintonb 11y ago
  I'm an MIT alum. There is no "game" being played. If a student is violating certain terms of service (e.g. downloading all of JSTOR) he/she would normally be told to stop, and that's the end of it. You do it again, and you might get another warning. Alternatively, you might find yourself in front of a dean or without network privileges. Breaking into a closet, and connecting your hardware gets you expelled. Regardless of the locked state of the door, entering a closet to which you do not have explicit access is breaking into said closet.
  - ericd 11y ago
    I sincerely doubt it gets you expelled as long as you're not damaging anything, which I wouldn't count connecting a piece of equipment as doing. Breaking into places locked and otherwise is part of the core of MIT's culture. Did you never go roof and tunnel hacking? That said, I'm not as familiar as I should be with what MIT tried to do to get Aaron to stop, and whether he knew that they had deployed those because of what he did.

tzs 11y ago

> I've heard stories from my days at MIT of people doing much worse things in server closets Similar from my days at Caltech. However, there were two important considerations for this kind of thing at Caltech. 1. The "look the other way" attitude of the administration applied to members of the Caltech community, and also depended on how you were connected to Caltech. A student could get away with more than an employee or a friend/relative of a student. 2. The Caltech honor system applied. If you were hacking something without permission and the people in charge of that thing told you to stop, not stopping would have likely been an honor system violation. I'm pretty sure that repeatedly purposefully evading someone's attempt to get you to stop messing with their thing would count as ignoring a request to stop. Does MIT have similar considerations?

raldi 11y ago
Yes -- see particularly bulletpoint #2: http://hacks.mit.edu/misc/ethics.html http://hacks.mit.edu/misc/ethics.html