Here's an analogy: if you visit a web page with a password field, and the password is embedded in a comment in the HTML markup, who is at fault for unauthorized

Here's an analogy: if you visit a web page with a password field, and the password is embedded in a comment in the HTML markup, who is at fault for unauthorized people logging in? While it may be morally wrong (and illegal) to exploit the system, I have a pretty strong opinion on which party is more at fault. The students' punishment seems fitting, it's sad that there is no mention of disciplinary action against the prof who is crying foul for leaving his password barely hidden, so to speak.