11 ms·
The DoE is complicit in this as well (from the original article): > In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took
by alexjplant 5y ago
The DoE is complicit in this as well (from the original article):
> In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.”
> But in the press release, DESE called the person who discovered the vulnerability a “hacker” and said that individual “took the records of at least three educators”
This squares perfectly with my own experience. As a middle schooler I had several interactions with my school system's IT department where they baselessly accused me of hacking and malicious intent; I responsibly disclosed a method of bypassing their web content filter and they responded by going through my roaming profile and leveling charges at me of "remotely hacking computer systems" because of a screenshot of a terminal emulator they found. I was a good kid with a perfect disciplinary record. In retrospect it was a series of incompetent staffers covering for their inability by bullying a child.
The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.
*EDIT: To clarify for anybody that would read the above as "government workers don't care": there are plenty that do. I break bread with them and want them to be able to do their jobs unimpeded by the ones that _don't_.
- ivalm 5y ago> hire people that actually care One thing to note is that hiring skilled IT workers is often outside budget capabilities. It’s not that they want to hire someone incompetent, they simply can’t afford to hire someone competent.
- sirspacey 5y agoNo. There has been massive interest in modernizing these systems. It’s the beliefs and attitudes of leadership that cause well intentioned engineers who are willing to take a lower salary to leave
- deleted 5y ago[deleted]
- willis936 5y agoIt doesn't help that they used a Soviet method of denying shortcomings in hopes that fantasy will overrule reality. What can you do when you have limited resources to make your situation worse? Punish people who are helping you for free.
- AstroDogCatcher 5y agoIncompetent people will do anything they can to avoid admitting that they are incompetent. One of the more interesting possible outcomes of a UBI I hope to see in my lifetime is the ejection of many of the seat-warmers currently occupying IT positions in western public sector organisations.
- passerby1 5y agoOn contrary, it could get worse. The next level after UBI is here, would be an ego satisfaction. Anyone on a power trip is playing this game with passion, more than a merely seat-warmer.
- Iefthandrule 5y agoYou make it sound like no one is responsible for setting the budget and determining that a decently paid IT staff is not worth it. It is malicious intent the whole way down.
- jedberg 5y agoIs it worth it though? If a few teachers have their identity stolen, will that in any way hurt the school? I mean, it should hurt them, but it's unlikely that it will. The only people who might feel bad are the moral IT folk who created the problem.
- jjeaff 5y agoI mean, is there really any risk of that anymore? Equifax had already seen to it that basically every adult in America's personal information is out there.
- josephg 5y agoI don’t think it’s malicious intent. Hanlon’s razor: never ascribe to malice what can be explained by incompetence. It’s simply that nobody at any level takes actual responsibility for outcomes. People at the bottom of the system (teachers, parents) can see problems but are usually disempowered and voiceless, and can’t fix them on their own. And people at the top are either ignorant of the real problems or lack real leadership and incentives to fix them. (Or they feel overburdened and overwhelmed). An old friend of mine teaches the first year CS curriculum at a local university. By all reports he’s phenomenally good at his job. He truly cares and his students adore him. But he’s making a fraction of the salary he could be making in industry. At some point he’s probably going to quit to do a job he’s not as good at, and doesn’t enjoy as much. Why is he paid many times less than he’s worth? Because the university wants to pay CS lecturers who teach 2000 students the same as they pay people who teach poetry to a class of 5. So my friend can’t get a competitive salary without entire departments revolting. Who’s fault is that? I don’t believe it’s malicious intent. It’s just a boring, systematic failure high up in the org chart leading to bland mediocrity. The only people who can do something about it don’t care about outcomes enough to fix the problem.
- heavyset_go 5y agoMiddle schools can pay administrators $250k+ a year, but can't afford sys admins?
- treeman79 5y agoMy wife (teacher) wasn’t allowed to use the microwave for a year due to the cost of electricity. They got upset when I suggested we donate 20 dollars to cover microwave budget for entire school for the year.
- EvRev 5y agoSounds like a good opportunity to teach the kids about solar. The solar ovens were such a memorable experience, but I suppose the cloudy days would be tough. Teaching the kids about DC to AC conversions at the same time as office politics would be a valuable life lesson!
- munk-a 5y agoI disagree - it sounds like a good opportunity for the school to either stop pinching pennies so absurdly or for the district to actually start funding education at a reasonable level.
- ranger_danger 5y agoSomething tells me it wasn't really about the cost. Someone just hates smelling food I bet.
- mixmastamyk 5y agoWe need laws not just to protect whistleblowers (etc.) but to punish those who retaliate against them.
- the_optimist 5y agoAnd just like that, everyone is a “whistleblower”. And I saw that as someone with a very strong interest in disclosure and transparency.
- mixmastamyk 5y agoShorthand, why I put (etc.) in there. I could list a lot of things like "security researcher" and here, "journalist." Good enough?
- throwaway2037 5y agoThis exists in the UK for the finance industry.
- kodah 5y agoThe military and education do hire people that care, insinuating that they don't seems very wrong. What I do see here, is that someone is speaking far outside their domain of expertise. Software Engineers love to do this on a lot of subjects. Having a deep background in Systems it's amusing at times, but I certainly wouldn't say they don't care.
- alexjplant 5y ago> insinuating that they don't seems very wrong It's a good thing that's not what I did then... I said that the bad workers "crowd out those that actually give a shit", which means that there _are_ indeed people that care (albeit fewer than there should be). > What I do see here, is that someone is speaking far outside their domain of expertise. I spent 15 years working in government contracting, specifically in defense. I've worked with a _lot_ of civilian DoD employees (many of whom I respect immensely on a professional basis and consider my friends). I also am related to and am friends with a number of former public school teachers that left their field for greener pastures. Institutional rot isn't exactly a secret. Per the HN guidelines please > Assume good faith.
- kodah 5y agoYeah, your corrected statement still seems wrong. I disagreed with your assessment, I didn't "assume bad faith". My personal disagreement is blaming individual people. There should be funding and education resources set up to ensure that people who make calls like this are educated enough to do so. You're in the business of personal accountability and I'm in the business of saying the people are a byproduct of the failing system. I'll bet my next paycheck if you wash out everyone that you deem lackluster and replace them with people you find to be excellent, the same outcome will be had over a matter of time.
- torstenvl 5y agoThe military does hire people who care, and we are constantly frustrated re people who don't care.
- nend 5y ago>It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit. The people that give a shit are making 10x as much by not working for a public middle school. Fire the current lot if you want, but they'll just be replaced by the next set of people who aren't skilled enough to make market rate.
- ethbr0 5y agoExactly. Most non-core-business organizations can't afford to hire someone competent, and therefore hire someone else. But obviously that person isn't going to say "Gee, I'm really not great at this computer stuff, but I'll do what I can." They say "Sure, I know all about all the computer stuff!" And then you have their leadership (who doesn't know any details), taking whatever they report up at face value. The governor probably believed he had a leg to stand on here, because I'm sure that's exactly what his people told him.
- handrous 5y ago> The governor probably believed he had a leg to stand on here, because I'm sure that's exactly what his people told him. My money's on this being purely a political decision. And for that, considering who it is and their position in the political landscape, I think it's too early to definitively call it a blunder.
- munk-a 5y agoI think it's a pretty terrible political decision regardless of the outcome. Whenever you take a stance on a highly technical issue like this you're rolling the dice and hoping that you don't actually have a number of technical minded folks in your state. It can backfire amazingly. It's much easier to play political games on much more abstract issues where it's harder to evaluate the options.
- handrous 5y agoI don't think many tech folks, even in Missouri, are among this guy's voters, and the ones who are, aren't turning "blue" over this (they're probably in it for religious reasons, i.e. abortion). Meanwhile, he's received national attention. We'll see, but it may yet be a smart play, politically speaking. I'm not saying it for-sure is, I just don't think that result's anywhere near being off the table.
- chucksta 5y agoSimilar experience, their reasoning why it was so stern was because the password acquired was valid throughout the entire district, and used for multiple core systems (security, AD, grades, etc..) No one thought to ask IT why they used the same PW 5+ times for critical infra, its all just the kids fault for finding one of them
- harikb 5y agoPart of this is general attitude towards all hacking - that systems can “never be secured”, it is never the designer/implementer’s fault, and we should just blame the bad actors. When banks/financial systems can get away with not upgrading a decade old Java framework with 6 month old struts vulnerability, and just blame the hacker, it is not surprising the average school sysadmin will do the same.
- hn_throwaway_99 5y ago> unencrypted the source code from the webpage Because "reading HTML" is now "unencrypting". People got caught with their pants down and are now just trying to lie their way out of it, nothing new but still sad.
- xxpor 5y agoSomeone probably tried to explain how TLS works and it flew right over their heads.
- Eldt 5y agoThe SSNs were base64 encoded I believe, which is strange to consider encryption, but they also seem to be conflating the "decryption" of that with viewing the source code. This is just so ridiculous of them.
- extra88 5y agoThere's no mention of any kind of encoding in the delivered HTML. From the newspaper [0]: > the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. and later: > In reality, the Post-Dispatch discovered the vulnerability and confirmed that the nine-digit numbers were indeed Social Security numbers. [0] https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html https://www.stltoday.com/news/local/education/missouri-teach...
- tyingq 5y agoSee https://news.ycombinator.com/item?id=28992667 https://news.ycombinator.com/item?id=28992667
- extra88 5y agoThanks. Given this, I think the journalist over-simplified the situation in their story and that the "F12" jokes are unjustified. Recognizing there's a disclosure of private information here requires a lot more technical knowledge beyond the ability to view the HTML source. The governor is still wrong for pursuing this and what the newspaper did was right, given that they disclosed it to the responsible parties and didn't publish until the problem site was taken down.
- handrous 5y ago> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit. Our purest white-collar welfare system is the health insurance industry, I'd say. IIRC at one point Obama explicitly stated that a reason he didn't think single-payer and similar were viable to advance, is because they'd put too many people out of work. The military is, obviously, our main work-required blue-collar welfare system, among other kinds of wealth-shuffling it does. Why, one can get nearly-European-standard-for-all public benefits, through that program, provided one is reasonably sound of body and mind. Healthcare, pension, housing, et c. [edit] education, too!
- justin_oaks 5y agoI do remember Obama talking about losing jobs in health care. With that kind of logic, we'd never have allowed cars because the horse and carriage industries would lose jobs. I'm not unsympathetic to those who would lose jobs from changes in the industry. Here's my thought: if government action that disrupts an industry then that action should be done piecemeal over several years to allow a softer transition.
- megablast 5y ago> With that kind of logic, we'd never have allowed cars because the horse and carriage industries would lose jobs. Imagine not having 40,000 deaths a year, and many more seriously injured.
- Dylan16807 5y agoDid we invent crash-proof carriages when I wasn't looking? > Reviewing British fatality rates from previous centuries, demographer P. E. H. Hair concluded in 1971 that the “supercession of the horse by the internal combustion engine was by no means the disaster in terms of travel safety it is often supposed to have been,” and suggested that between 1840 and 1900, accidents involving horses produced an average yearly mortality rate of about five per 100,000 population > fatality rates from horse-powered transportation occurred at a rate more than 15 times greater per mile in 1775 than from motor vehicles in 2000 (even using very conservative estimates for per-mile horse-related fatalities) > In New York in 1900, 200 persons were killed by horses and horse-drawn vehicles. This contrasts with 344 auto-related fatalities in New York in 2003; given the modern city’s greater population, this means the fatality rate per capita in the horse era was roughly 75 percent higher than today. Data from Chicago show that in 1916 there were 16.9 horse-related fatalities for each 10,000 horse-drawn vehicles; this is nearly seven times the city’s fatality rate per auto in 1997.
- CoastalCoder 5y ago> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. In my experience, most IT/CS people who seek to work for state/federal government do care. Unfortunately the combination of extreme red tape, low pay, inability to fire lazy employees, and occasionally being punching bags for politicians trying to score cheap points with their constituents, take their toll over time.
- thr0wawayf00 5y agoSo much this. Pay and working conditions are such a joke for so many government jobs compared to the private sector. Government workers make nothing compared to the private sector, we expect them to be miracle workers, we refuse to acknowledge them when they do work miracles, and then we get mad and want to slash the budget when they can't. It really sucks because I'd happily work for slightly under market rate to do work for a government office, but I just can't work for 1/3-1/2 of the pay I make working in the private sector, not with housing prices the way they are.
- pirate787 5y agoFederal govt IT is basically competitive on salary but the hiring process is rigged. The job descriptions are tightly bound to specific experience that only other govt workers or contractors could know and understand.
- d3ad1ysp0rk 5y agoWhere can I make 150-200k/year in federal IT?
- alexjplant 5y agoLast I checked $140k is about the going rate for government contractor software engineering work in the DC/Northern Virginia area. Add $10-20k for a Secret clearance or Public Trust and $30-50k for a Top Secret clearance (though you'll probably have to deal with working in a SCIF at least some of the time with a clearance). I'm pretty sure you can push that latter number even higher if you get a TS/SCI and start doing spooky stuff.
- butterfi 5y agoBack in the 80's, my computer teacher kicked me out of class because I had logged into my friends account at another school and downloaded instructions for an "assassination game" (pick a name from a hat, 'assassinate' your victim with a toy gun) which we never played because we just weren't that interested. The teacher was going through the trash and "discovered" my "hacking" because everything was printed on paper. Fortunately for me, I had access to other computers and went on to a long, successful career in computers. No thanks to you, shitty computer teacher.
- seattle_spring 5y ago> I responsibly disclosed a method of bypassing their web content filter If you don't mind me asking... why on Earth did you do this? My goal as a teenager was to find ways to get around content filters in middle school for fun, not so I could tell the teacher about them. > It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit. Administrators that "gave a shit" would be fighting to remove overzealous content filters, not reinforce them.
- RNCTX 5y ago> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit. That presumes that the purpose of school is perceived by the participants to be something other than printing credentials that justify trans-generational wealth and power accrual.
- causi 5y agoI was accused of hacking when I used the "netsend" DOS command to send the letter "Q" one time to the other computers in the lab.