5 ms·

> No, it's not as benign as you implied. Yes it is. He didn't hurt anyone or even mess with their files in a naughty way. I was so happy to get away from scho

> No, it's not as benign as you implied. Yes it is. He didn't hurt anyone or even mess with their files in a naughty way. I was so happy to get away from school and this kind of bullshit.

MBCook 10y ago
He purposely went out of his way to crack a password for the purpose of gaining unauthorized access to a system that wasn't his. That's exactly the kind of thing the CFAA was created for. I agree with the GP that he was harmless, and doesn't deserve anything terribly serious as punishment. But what he did is a lot more than using simple HTML injection to add a rick roll to something.
- zaroth 10y ago
  It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something". 'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.
  - MBCook 10y ago
    By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page. Getting access to the administrator account is pretty different.
    - nitrogen 10y ago
      Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.
corobo 10y ago
The IT dept has no idea if he messed with their files in a naughty way. They will have to spend x hours and y moneys on checking now. While finding the problem should never be punished if it's responsibly disclosed, exploiting it (publicly in this manner) should be.
ceejayoz 10y ago
> He didn't hurt anyone or even mess with their files in a naughty way. I've had people deface sites. It's stressful, upsetting, and a lot of work. You can't really trust a compromised server, and school IT is fairly unlikely to have great processes for it. > I was so happy to get away from school and this kind of bullshit. The real world isn't likely to look any more fondly on this sort of behavior.

> No, it's not as benign as you implied. Yes it is. He didn't hurt anyone or even mess with their files in a naughty way. I was so happy to get away from school and this kind of bullshit.

MBCook 10y ago

He purposely went out of his way to crack a password for the purpose of gaining unauthorized access to a system that wasn't his. That's exactly the kind of thing the CFAA was created for. I agree with the GP that he was harmless, and doesn't deserve anything terribly serious as punishment. But what he did is a lot more than using simple HTML injection to add a rick roll to something.

zaroth 10y ago
It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something". 'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.
- MBCook 10y ago
  By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page. Getting access to the administrator account is pretty different.
  - nitrogen 10y ago
    Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.

corobo 10y ago

The IT dept has no idea if he messed with their files in a naughty way. They will have to spend x hours and y moneys on checking now. While finding the problem should never be punished if it's responsibly disclosed, exploiting it (publicly in this manner) should be.

ceejayoz 10y ago

> He didn't hurt anyone or even mess with their files in a naughty way. I've had people deface sites. It's stressful, upsetting, and a lot of work. You can't really trust a compromised server, and school IT is fairly unlikely to have great processes for it. > I was so happy to get away from school and this kind of bullshit. The real world isn't likely to look any more fondly on this sort of behavior.