8 ms·

We had an "open-ended" project in an undergraduate Computer Security course to discover a 0-day in Firefox. The professor (a researcher, not lecturer, by trade)

We had an "open-ended" project in an undergraduate Computer Security course to discover a 0-day in Firefox. The professor (a researcher, not lecturer, by trade) didn't really have a curriculum, and said this artifact accounted for 70-80% of our grade. Trying to compile Firefox was already a challenge. That, and each compile took an hour. IIRC, Firefox is built on some esoteric architecture / design pattern that's definitely beyond the scope of design patterns undergraduate students are familiar with. By the end of the term, no one discovered a 0-day, unsurprising considering half the class didn't even try. There were 90 students in the class, and I ended up being the only person to produce a JS payload that would crash Firefox in one of the newer HTML5 libraries. It's neither a zero-day or exciting or profitable vulnerability though. Realizing everyone in the class would fail, the professor changed the grade of this project to only account for 30% of the grade. I spent most of my time on this project while disregarding the rest of the busy work for the class. In the end, I got a C grade while my peers who didn't even attempt to tackle this project received higher grades.

freeboson 7y ago
The syllabus where a grade is broken down by percentages is (at US institutions) considered to be like a contract. If the course originally had it at "70-80%", then it cannot be changed mid-semester without being acceptable to you. It's fairly incredible for this to happen (at a US institution).
totony 7y ago
Whenever you have trouble compiling something, just look at how gentoo approaches it. They're the last bastion making sure OSS is actually buildable. Them are their users most likely are the #1 source of build documentation, bug reports and fixes in OSS
vikramkr 7y ago
That makes no sense as a class design - are there so many zero days in firefox that are so easy to find that you can expect undergrads to casually find enough that you can base 70% of the class grade on it?
- jimbob45 7y ago
  Every teacher wants to be the next Jaime Escalante. Sometimes they take their idealism too far.
  - dmoy 7y ago
    I'm gonna go out on a limb and say that a research professor at presumably a large research university doesn't give two shits about being the next jaime escalante. The reality is probably that they're more focused on research, and don't care much about actually teaching. You see quite a bit of that.
- Hello71 7y ago
  my guess is that the prof wanted to plagiarize the work as their own.
vkou 7y ago
I'm sorry that your professor treated their instruction as an open-ended research project.
foota 7y ago
Any change to the grading scheme of a class should be Max(old grade, new grade). One of my profs once offered a re-test opportunity such that you would have had an incentive to do worse on the exam for certain original scores. Drove me up the wall.
- bobongo 7y ago
  From these, > ... I ended up ... neither a zero-day ... > Realizing everyone in the class would fail, the professor changed the grade of this project to only account for 30% of the grade. > I ... disregarding the rest of the busy work for the class. It sounds like OP could not find a zero day (old_grade=0) and did not do any other homework (new_grade=0), therefore should have received max(0, 0), but received a C.
- snazz 7y ago
  I also think that just keeping the new grade is a valid retake scheme. Although it's less forgiving for the students, it encourages them to make absolutely certain that they know the content for the retake. Anything with a square root curve where you have to pinpoint your retake score perfectly to maximize the final grade is unfair and encourages the wrong thing.
  - foota 7y ago
    Yep, that's also fine by me. Although ideally (and especially if it's required to do a retake!) this would be set out ahead of time. Many profs don't seem to understand the kind of time and grade tradeoffs students need to make. Once had a prof come in to a class with a bunch of seniors with many other high priority classes that wouldn't release the grade weighting at all. They didn't understand that people need to know that kind of thing to know whether they need to do really well on something or if it's the kind of thing that can be dropped or half assed when push comes to shove.
veeralpatel979 7y ago
what college was this if you don't mind sharing? I recall a similar thing happening at the college I went to
bhearsum2 7y ago
I'm curious what year this was. When I was in college (~2005) we had an entire class based around contributing to Mozilla (both Gecko and other parts - https://wiki.cdot.senecacollege.ca/wiki/DPS909 https://wiki.cdot.senecacollege.ca/wiki/DPS909). The very first assignment in that course was compiling Firefox. Which, especially on Windows, was a herculean task at the time. I believe this sort of experience helped to spawn https://wiki.mozilla.org/MozillaBuild https://wiki.mozilla.org/MozillaBuild and other developer experience projects. Things are much better these days, but there is still much inherent complexity in a project like Firefox.
thayne 7y ago
> Trying to compile Firefox was already a challenge. That, and each compile took an hour. At first glance, this sounds terrible. But when compared to software projects of comparable size, Firefox is hardly unique. Compare to compiling Chromium for example, or even the Linux kernel.
- alephnan 7y ago
  Right. I did not mean this as knock against Firefox. At one of the FAANG I previously worked at, it took an hour to compile JavaScript.
- Polylactic_acid 7y ago
  I had to compile linux once and I found the process to be trivial. My distro had a guide for how to do it and then how load the kernel in to grub and it was basically just copy/paste
- sondr3 7y ago
  I think at scale (according to Wikipedia the 5.6 release has ~33M lines of code) the Linux kernel might be one of the easiest (and quickest) projects to compile[1]. [1]: https://techgage.com/wp-content/uploads/2019/11/Compile-Performance-Linux-Kernel-AMD-Ryzen-9-3950X-680x383.jpg https://techgage.com/wp-content/uploads/2019/11/Compile-Perf...
  - gpderetta 7y ago
    I haven't compiled my own kernel in at least 15 year but I remember it was quite easy (is make menuconfig still the way to go?). I did have much more free time though.
  - haihaibye 7y ago
    Surely most of those lines of codes are optional modules and device drivers - so aren't compiled for most users or this test?
- swiley 7y ago
  Those are all very different levels of difficulty IMO: Linux is almost trivially easy, only slightly harder than the usual configure && make and has very few dependencies. Firefox is pretty painful but it's doable with a decent amount of care and bandwidth. Chromium is a fairly typical google project where the recommended first step to building it is to become a google employee but some alternative workarounds are also available if that's not practical.
juskrey 7y ago
He is neither a researcher nor teacher - typical academic parasite. Makes a bet on trendy advanced task and, if it works, lets you be a coauthor. If it does not - no big deal some naive student spent 1/2 year on something virtually impossible w/o deep industry experience.
- alephnan 7y ago
  Actually, they were an industry researcher coming in as a guest lecturer.
  - juskrey 7y ago
    Are you sure he doesn't employ the same tactics instead of actual research? (I am generally suspicious of anyone who voluntary pursues academia)
    - dbmueller 7y ago
      > I am generally suspicious of anyone who voluntary pursues academia That's very unfair imo. The majority of people I know in academia don't fit this profile at all. There is obviously disappointing stuff happening, but people generally still are working/teaching in good faith.
      - juskrey 7y ago
        The main problem in academia is that people still can be harmful even being in good faith. (remember that "road to hell" saying, right?)
        dbmueller 7y ago
        > people still can be harmful even being in good faith That's a general truth. You make it sound like people choose academia to somehow cheat the system and profit from free student's work or whatever. Make a real case for you thesis then.
dontbenebby 7y ago
You can’t arbitrarily change the syllabus to a student’s detriment. I’d have argued up the chain.
- rataata_jr 7y ago
  Where exactly does that end well for the student?
- kiplkipl 7y ago
  They'd have ignored you. I went through something similar myself. The barrier to exit for students is so high that colleges have little incentive to care about pleasing them.

freeboson 7y ago

The syllabus where a grade is broken down by percentages is (at US institutions) considered to be like a contract. If the course originally had it at "70-80%", then it cannot be changed mid-semester without being acceptable to you. It's fairly incredible for this to happen (at a US institution).

totony 7y ago

Whenever you have trouble compiling something, just look at how gentoo approaches it. They're the last bastion making sure OSS is actually buildable. Them are their users most likely are the #1 source of build documentation, bug reports and fixes in OSS

vikramkr 7y ago

That makes no sense as a class design - are there so many zero days in firefox that are so easy to find that you can expect undergrads to casually find enough that you can base 70% of the class grade on it?

jimbob45 7y ago
Every teacher wants to be the next Jaime Escalante. Sometimes they take their idealism too far.
- dmoy 7y ago
  I'm gonna go out on a limb and say that a research professor at presumably a large research university doesn't give two shits about being the next jaime escalante. The reality is probably that they're more focused on research, and don't care much about actually teaching. You see quite a bit of that.
Hello71 7y ago
my guess is that the prof wanted to plagiarize the work as their own.

vkou 7y ago

I'm sorry that your professor treated their instruction as an open-ended research project.

foota 7y ago

Any change to the grading scheme of a class should be Max(old grade, new grade). One of my profs once offered a re-test opportunity such that you would have had an incentive to do worse on the exam for certain original scores. Drove me up the wall.

bobongo 7y ago
From these, > ... I ended up ... neither a zero-day ... > Realizing everyone in the class would fail, the professor changed the grade of this project to only account for 30% of the grade. > I ... disregarding the rest of the busy work for the class. It sounds like OP could not find a zero day (old_grade=0) and did not do any other homework (new_grade=0), therefore should have received max(0, 0), but received a C.
snazz 7y ago
I also think that just keeping the new grade is a valid retake scheme. Although it's less forgiving for the students, it encourages them to make absolutely certain that they know the content for the retake. Anything with a square root curve where you have to pinpoint your retake score perfectly to maximize the final grade is unfair and encourages the wrong thing.
- foota 7y ago
  Yep, that's also fine by me. Although ideally (and especially if it's required to do a retake!) this would be set out ahead of time. Many profs don't seem to understand the kind of time and grade tradeoffs students need to make. Once had a prof come in to a class with a bunch of seniors with many other high priority classes that wouldn't release the grade weighting at all. They didn't understand that people need to know that kind of thing to know whether they need to do really well on something or if it's the kind of thing that can be dropped or half assed when push comes to shove.

veeralpatel979 7y ago

what college was this if you don't mind sharing? I recall a similar thing happening at the college I went to

bhearsum2 7y ago

I'm curious what year this was. When I was in college (~2005) we had an entire class based around contributing to Mozilla (both Gecko and other parts - https://wiki.cdot.senecacollege.ca/wiki/DPS909 https://wiki.cdot.senecacollege.ca/wiki/DPS909). The very first assignment in that course was compiling Firefox. Which, especially on Windows, was a herculean task at the time. I believe this sort of experience helped to spawn https://wiki.mozilla.org/MozillaBuild https://wiki.mozilla.org/MozillaBuild and other developer experience projects. Things are much better these days, but there is still much inherent complexity in a project like Firefox.

thayne 7y ago

> Trying to compile Firefox was already a challenge. That, and each compile took an hour. At first glance, this sounds terrible. But when compared to software projects of comparable size, Firefox is hardly unique. Compare to compiling Chromium for example, or even the Linux kernel.

alephnan 7y ago
Right. I did not mean this as knock against Firefox. At one of the FAANG I previously worked at, it took an hour to compile JavaScript.
Polylactic_acid 7y ago
I had to compile linux once and I found the process to be trivial. My distro had a guide for how to do it and then how load the kernel in to grub and it was basically just copy/paste
sondr3 7y ago
I think at scale (according to Wikipedia the 5.6 release has ~33M lines of code) the Linux kernel might be one of the easiest (and quickest) projects to compile[1]. [1]: https://techgage.com/wp-content/uploads/2019/11/Compile-Performance-Linux-Kernel-AMD-Ryzen-9-3950X-680x383.jpg https://techgage.com/wp-content/uploads/2019/11/Compile-Perf...
- gpderetta 7y ago
  I haven't compiled my own kernel in at least 15 year but I remember it was quite easy (is make menuconfig still the way to go?). I did have much more free time though.
- haihaibye 7y ago
  Surely most of those lines of codes are optional modules and device drivers - so aren't compiled for most users or this test?
swiley 7y ago
Those are all very different levels of difficulty IMO: Linux is almost trivially easy, only slightly harder than the usual configure && make and has very few dependencies. Firefox is pretty painful but it's doable with a decent amount of care and bandwidth. Chromium is a fairly typical google project where the recommended first step to building it is to become a google employee but some alternative workarounds are also available if that's not practical.

juskrey 7y ago

He is neither a researcher nor teacher - typical academic parasite. Makes a bet on trendy advanced task and, if it works, lets you be a coauthor. If it does not - no big deal some naive student spent 1/2 year on something virtually impossible w/o deep industry experience.

alephnan 7y ago
Actually, they were an industry researcher coming in as a guest lecturer.
- juskrey 7y ago
  Are you sure he doesn't employ the same tactics instead of actual research? (I am generally suspicious of anyone who voluntary pursues academia)
  - dbmueller 7y ago
    > I am generally suspicious of anyone who voluntary pursues academia That's very unfair imo. The majority of people I know in academia don't fit this profile at all. There is obviously disappointing stuff happening, but people generally still are working/teaching in good faith.
    - juskrey 7y ago
      The main problem in academia is that people still can be harmful even being in good faith. (remember that "road to hell" saying, right?)
      - dbmueller 7y ago
        > people still can be harmful even being in good faith That's a general truth. You make it sound like people choose academia to somehow cheat the system and profit from free student's work or whatever. Make a real case for you thesis then.

dontbenebby 7y ago

You can’t arbitrarily change the syllabus to a student’s detriment. I’d have argued up the chain.

rataata_jr 7y ago
Where exactly does that end well for the student?
kiplkipl 7y ago
They'd have ignored you. I went through something similar myself. The barrier to exit for students is so high that colleges have little incentive to care about pleasing them.