Cambridge University refuses to censor student's thesis

http://www.boingboing.net/2010/12/25/cambridge-university-1.html

by r11t • 16 years ago

498 61 16 years ago

boingboing.net

instakill2• 16 years ago

Brilliant. If only more institutions had a spine like the one displayed here.

CrazedGeek• 16 years ago

They're legally required to: http://news.ycombinator.com/item?id=2039235

Qz• 16 years ago

They're not legally required to be so badass about it.

liuhenry2• 16 years ago

Previous post/discussion: http://news.ycombinator.com/item?id=2039117

w1ntermute• 16 years ago

Dupe: http://news.ycombinator.com/item?id=2039117

rlmw• 16 years ago

To be fair I didn't read this the first time it was on HN - I'm inclined to think that the title of the post is more descriptive than the original, and its deserving front page material, even if it is a duplicate.

liuhenry2• 16 years ago

Agreed, but it is useful/insightful to have the comments/discussion on hand.

jburwell• 16 years ago

First, he thrusts the knife in, then violently twists it -- "Accordingly I have authorised the thesis to be issued as a Computer Laboratory Technical Report. This will make it easier for people to find and to cite, and will ensure that its presence on our web site is permanent....". Classic.

p_nathan• 16 years ago

The Brits often have such a way with words. Bless them.

chunkyslink• 16 years ago

The English have a way with ... English!

Fancy that.

isomorph2• 16 years ago

He's a good lecturer too. Funny how being a good lecturer and being a badass correlate.

jlees• 16 years ago

"Security! Security! Security!"

Although there were some fantastic lecturers at Cambridge who were somehow very terrible at getting the material across, but whose content/personalities were so enjoyable it was worth turning up anyway. I dare say it's the same everywhere.

Tarski3• 16 years ago

Wouldn't it have been far nobler to approach the banks affected by the exploit with these findings rather than publishing schematics for the exploit into the public domain?

ars• 16 years ago

Based on their response it wouldn't be effective - they would just try to cover it up.

Plus it's likely it's already being used secretly by those with nefarious purposes, publishing just means the average person knowns about it - it's not likely to change how many actually use it.

wjy• 16 years ago

I believe the article states they notified the banks before publishing the original work.

Tarski3• 16 years ago

No it doesn't? I'm not taking the side of the banks here, just trying to understand why the author took the approach he did. It's a shame that at times the HN community is one of single-mindedness where opposite views are met with immediate down-votes.

tsycho• 16 years ago

Wouldn't have worked, in the same way that emailing Facebook and others, instead of releasing Firesheep wouldn't have worked (since they haven't fixed it even after Firesheep has been released, it's unlikely they would have paid much attention to a letter or email).

given the letter says that this is a known vulnerability

blhack• 16 years ago

>Cambridge is the University of Erasmus, of Newton, and of Darwin.

This is a very elegant way of giving them the finger.

elblanco8• 16 years ago

It's also a surprising appeal to authority logical fallacy. Those people don't work there anymore.

(not that I disagree with them that they shouldn't censor the findings)

isomorph2• 16 years ago

it's browbeating, a cornerstone of academia

telemachos2• 16 years ago

On the one hand, I don't want to feed the pedantry. On the other hand, it's only a logical fallacy if it fouls an argument. In this case, it's not being used (so far as I can see) in the course of a direct argument. Here's the whole sentence:

> Cambridge is the University of Erasmus, of Newton, and of Darwin; censoring writings that offend the powerful is offensive to our deepest values.

It's not part of a syllogism. It's the author's statement of core values (as he sees them) of Cambridge. It's part of an explanation for why he won't do something, not an attempt to prove that he shouldn't.

bobz• 16 years ago

If appeal to precedent is a fallacy, we (the western world) really need to rethink our legal system.

vl• 16 years ago

I don't see the reason for downvoting parent. Full quote is "Cambridge is the University of Erasmus, of Newton, and of Darwin; censoring writings that offend the powerful is offensive to our deepest values", and first part struck me as completely irrelevant to the second part, somewhat unworthy of this otherwise well-convened letter.

In addition to that I don't see it as an "elegant way of giving finger", how mentioning of historic figures conveys the "finger message"?

aphyr• 16 years ago

As telemachos points out, this is not an appeal to authority. The article does not claim that Darwin et al would support this research; it claims that it is consistent with the university's character to publish the work. Furthermore, this sentence reminds us that in prior cases where authority has sought to suppress the university's research, the release was justified by history. It's not a purely deductive argument, but it's impossible to make a statement about the world without relying on inductive examples.

nsdsudf2• 16 years ago

Prof. Anderson shows good character.

Let's talk about the other side. Businesses have always acted this way when it comes to computer security (for at least the last 15 years, feel free to cite earlier examples). By now they probably understand that what they're doing is wrong, from a security perspective. They may even understand that issuing takedowns increases publicity. Still, business are sociopathic, they don't care about the legitimacy of their actions. They have a staff of lawyers they're already paying for, and a responsibility to defend trade secrets and protect their product base. So they marshal their lawyers, essentially for free, and maybe they get something out of the effort as a result. If they don't, nothing much was lost, and they generally don't care about their perception in the security community. Same old story. This incident is less about someone standing up to a bully and more about someone weathering another wave coming out of the ocean.

ggchappell2• 16 years ago

I think I see what you are saying, but I don't agree with the contrast you mention in your last sentence.

Consider: being sociopathic, not caring about the legitimacy of their actions, harassing someone when the risk to them is small -- how does this differ from being a bully?

sudont• 16 years ago

Eventually a bully may learn. A true sociopath will continue no matter how many times punished.

yesbabyyes3• 16 years ago

Link to original letter - oh boy this is a good read: http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf

gridspy• 16 years ago

Nice last paragraph:

Nonetheless, I am delighted to note your ﬁrm statement that the attack will no longer work and pleased that the industry has been ﬁnally been able to deal with this security issue, albeit some considerable time after the original disclosure back in 2009.

drivebyacct2• 16 years ago

For the third time, we get it.

fleitz• 16 years ago

I tend to disagree with the banks' assessment that it will undermine public confidence. The research gives the public one more piece of information to judge the risks for placing their money in a financial institution.

The banking sector as participants in a free market who frequently advocate for opening of more sectors of the economy to the free market (and rightly so) should be encouraging such research. The research gives consumers of banking services more accurate information to consider when deciding how accessible their money should be. Additional information allows consumers to make more informed choices regarding the trade offs between security and convenience. Banks could offer insurance to their customers to protect them against the risks while still keeping the benefits of increased convenience.

It's an opportunity for the banks to differentiate their services and cater to the needs of their customers. Yes, not having a PIN is less secure, but it's also more convenient, with proper positioning of their products banks should be able to offer tailored solutions that better address the needs of their customers.

GrandMasterBirt• 16 years ago

"we have no choice but to back him. That would hold even if we did not agree with the material!"

Reminds me of a Frankin quote: "Sir, I disagree with you, but I will fight to the death for your right to say it."

instakill2• 16 years ago

Surely you mean Voltaire?

"I disapprove of what you say, but I will defend to the death your right to say it"

emilepetrone• 16 years ago

BBC video on chip & pin findings: http://www.youtube.com/watch?v=_yyfcHSXZLc

raghava• 16 years ago

>You complain that ... and indeed to censor it.

The penultimate para in the original letter, wow! A befitting answer to a bully, and how! :)

koski• 16 years ago

I wonder when Cambridge starts to be blocked by the banks then ... :)

revorad• 16 years ago

The thesis - http://www.cl.cam.ac.uk/~osc22/docs/mphil_acs_osc22.pdf

kwoks• 16 years ago

Am proud of being in the University of Cambridge.....we don't produce apps.

marcamillion• 16 years ago

Intentionally or unintentionally, this has got to be one of the best pieces of marketing for research inclined students and faculty that they could have ever produced.

So much so, that the skeptic in me thinks this was intentionally leaked.

I had always considered possibly applying to the University of Cambridge, and I know they are Ivy League...but this letter, firmly solidifies them as a contender for any higher education I might pursue.

Cambridge University refuses to censor student's thesis

Related Stories