My new favorite game.

My new favorite game: finding the oldest nuggets of bug documentation on DeVry's student portal site.

"11/01/00 BugTar 1614 tomf" is the current winner!!

That's right, a bug was fixed in 2000. For some reason beyond me the developers are actually leaving javascript comments in the HTML stream. They don't bother putting the JS/CSS code on some kind of static content server, no, instead they have large chunks of very old javascript inline with the html, which is also very old.

The more I found out about this school the more I want to just cry.

DeVry student portal

I found this gem in the HTML source of the email form:

//11/21/00  bugtar 991
if (document.SendEmail.ATTACHMENT.value != "") {
  document.StatusUser.submit();
}
//11/21/00  end
selectAllOptions(document.SendEmail.EMAIL, 0);
document.SendEmail.submit();

Wow, is that really 2000-11-21? Seriously, 10 f'ing years?!? ARE YOU KIDDING ME?!?

More fun with DeVry.

Get this, in DeVry's infinite stupidity they actually thought that using your birth date as your password was s good idea. Well, it's actually worse then that. They use the form mmyy, so as long as someone knows your d-number, approximate age and what month you were born, they could get into your account.

So let's see here, in every class they pass around a piece of paper with everyone's d-numbers, so that's not a problem. After you have a camera pic of everyone's d-number it's a matter of guessing their age which is about 10 years ( between 20-30 ), and a month, which is any of 12 possibilities. I know their site doesn't have a max attempt hook on it, so it's a matter of brute force.

The sad part is that they don't make any attempt to make it harder. They don't force you to change your password when you first login, and most of their systems don't use any kind of central auth mech. If a persons birth day is posted anywhere where someone else at school can see it ( facebook friends? ), then you're screwed.

I really have to wonder how DeVry can square itself with this and still call itself a viable source of higher education.

Azure

I just told someone that I thought Azure was awesome. I feel a little dirty now.

Social stratification

I wanted to share an absolutely fascinating conversation I just had with two rather high level Microsoft folks this morning. As it turns out Microsoft ( I’m sure everyone else is working on the same thing ) is developing software and infrastructure to allow the consumers of the Internet to be the brokers of their own e-DNA. What this means is that you can tell everyone out there ( google, facebook, you name it ) that they can have your information - your electronic DNA - for a price which you decide.

This is relevant to the concept of social stratification in so much as this has the potential of creating tiered levels of economic gain. For example, if I am a very popular person and I have several hundred followers on twitter, am an active shopper on froogle.com, and participate in community organizations, then my social data might be worth more then someone that has a relatively low “footprint” in the community. What this could mean is that those who protest about Internet privacy, and fight to keep themselves private and “under the radar” will end up loosing out. However, those who embrace openness, and encourage social interactions will end up gaining more.

What would your e-DNA cost you?

Ruby love

Ohh ruby how I miss you. I never realized how much I truly loved you until you were ripped from my loving arms. How I long to once again snuggle with you and MongoDB in a hot, naughty threesome of pure joy.

I remember when we were young, when the days were long and we sat on my workstation and you allowed me to poke at your insidey parts. Do you remember that warm summer afternoon when you let me write the first few iterations of Heylu? Ohh how I long for those days again. Days of field enforcement, key :love,Integer, { :default: 10000000000 }. Ohh how I miss you!

Another rant about DeVry

It is shocking to me that people in the CIS graduation program can't figure this out. If you don't believe me, go grab a copy of firebug, or use chrome's element inspector and find out for yourself. EVERYTHING I know about this issue was gathered from using firebug and looking at the HTTP headers. If that's illegal, then so is every single web browser since the days of mosaic.

I personally agree with the idea of regulation on the Internet, however, I would put an emphasis on corporate responsibility. In the case of DeVry, I would charge $1000 per violation of their own student privacy policies, and leave the option open for a personal lawsuit. Enforcing a sanction on the person that finds the problem makes absolutely no sense to me, but does act as a reminder for everyone out there to keep things silent; it makes more business sense to eliminate the person screaming about the problem then actually fix the problem.

How does it feel to know that your information is exposed to everyone in the world and there isn't a dam thing DeVry is going to do about it but punish the people that expose the problem? Feel safe? You shouldn't, because you aren't. Remember, the only laws that exist are those that can be enforced, if you don't know the rules are being broken, how are you going to enforce them? Do you really think anyone is checking the server log files? They can't even enable SSL, I seriously doubt they're doing anything about anything else security related.

One final note about the subject: which would you rather have on your side, a Jedi knight with next to no social skills, or a Sith lord hell bent on the destruction of the world? Think about the next time you get the urge to go tattle to the dean. ;)