Right. I have an analogy I prefer in many of the cases where there is a clear smell of gross negligence, which does seem to be most. Consider if a bank that ta

Right. I have an analogy I prefer in many of the cases where there is a clear smell of gross negligence, which does seem to be most. Consider if a bank that takes safety deposits has accidentally given open access to their vault to the street and none of their employees or customers seem to have noticed. You will get people oblivious, you'd imagine you'd get thieves in there, but you may get people just poking their head in in sheer wonder. Then you're going to get people who are slightly more curious as to how this bewilderment came to be. I have been that latter person on two occasions. Once when a friend was restoring an e-commerce site from a backup (including customer details) and didn't initially see what was wrong with the backup being publicly accessible until I pointed out there was a link to it where the home page might once have been. The second involved a university network outsourced to a multinational engineering firm; a DHCP server; Windows Vista's DHCP client; the DHCP broadcast bit and a power outage. I can't remember the specifics but I realised that I could restore connectivity to people who had mysteriously lost it by responding to their DHCP requests after relaying them to the real DHCP server and repeating the response as a broadcast. I was naturally cautious and gained permission from the laptop owners. I only realised the implications of what I could have done to everybody affected on the network after the fact. If anybody ever wants a real-world example of how a MITM attack can be carried out by somebody other than a network admin, consider what would happen if your DHCP server didn't respond in the expected way and the client was waiting for a broadcast. It is only recently that I realise how exposed I was. I had no ill intent, but was merely seeking a better understanding of the world as opportunities arose. The latter experience is deeply important on a personal level as it turned coding from something vaguely interesting but too difficult to do anything useful into something more like a microscope, telescope or oscilloscope to me. The problem is that intent is hard to measure. In the mock trial that plays out in my head from time to time, was I poking my head around or casing the joint? I believe that the evidence could have pointed to either.