Re: Web security breach changes the lives of 119 people

[Peter Conrad <conrad () tivano de>]

Hi,

On Mon, Mar 21, 2005 at 10:46:42AM -0500, ed.tracy () aspectsecurity com wrote:
> I really don't understand your position that this is Harvard's fault. You
> claim the "issue" isn't applicants hacking but rather Harvard's failure to
> prevent their hacking. Well sure Harvard could and should do better, but
> that doesn't diminish the culpability of these applicants one bit!

yes it does. Simply modifying a URL does not constitute "hacking".
(There was a case in Sweden where some Reuters employee downloaded
 documents from a company's server by guessing the URL. The case was not
 even brought into court. See http://www.heise.de/newsticker/meldung/34041
 for a german article.)

> Frankly, I think our industry is riddled with this type of sentiment. And
> that some of us have become so warped by our security expertise so as not
> to use logic when assigning blame. For example, Harvard rejected these
> applicants NOT as a fix to their problem," but rather because the
> applicants showed a character flaw, hacking.

Curiosity is not a character flaw, it is a requirement for every scientist.

Bye,
        Peter
-- 
Peter Conrad                        Tel: +49 6102 / 80 99 072
[ t]ivano Software GmbH             Fax: +49 6102 / 80 99 071
Bahnhofstr. 18                      http://www.tivano.de/
63263 Neu-Isenburg

Germany