Hacker News Reader

Comment by dmix | Hacker News Reader

Punishing students that aggressively over DMCA requests sounds like a terrible idea. They are so easy to abuse.

It also seems like it would affect their academic ability because they pirated a few movies. Who cares.

I was at a school who was just starting to do some similar things. They had students register the mac of their devices (wired and wireless). So they identified students by mac. With this it was actually pretty easy for a bad actor to frame someone else by just changing their mac to another device on the network.

Same school would also lock your university account after 3 bad password attempts and you could only unlock in person at the library help desk. Again you can see the problem.

We required MAC registration but you also had to auth with 802.1x to get an IP so we knew who was doing what and when. MAC registration came in handy several times for locating stolen laptops and phones. I think there may have been an exception for devices that couldn't auth but it could have been a different vlan and probably port.

We also had adaptive password expiration and complexity policies based on length. If you used a passphrase (~15+ characters) you could use dictionary words but if it was under that you couldn’t and had to include a number and symbol too.

Passphrases had like a 90 or 180 day expiration. Passwords were I think 30? You set them in the same text box and the rules were based on your entry.

I think the lockouts had a timer with an exponential increase. You'd get like five or ten tries before you'd have to start waiting minutes for the next attempt. Not sure if there was a hard lockout option. Phone support was daytime hours in the main office, all times when labs were open (some labs were 24 hour) and email support was 24/7. 24/7 lab monitors worked the ticket queues as well.

It was a great department actually. Lots of great work being done to make things easier for students. Relied heavily on students to operate the department and gave a lot of people careers.

Back in the 90s a student wrote a ticket management app in Perl. The university hired him and he was still in the department writing code 20 years later when I was there. One of the techs I worked with was hired by the law school to handle their IT. I got several jobs including my first out of school through people I met and worked with there.

Some Universities in the UK for a number of years have been making students download certificates that allow SSL decryption as part of counter radicalisation efforts.......

Oh god, Universities with CS divisions allow this sort of thing? Where are the sane people who go wtf?

These "IT" people who push to implement this probably end up working for the DoD or White Hall and push anti-encryption measures.

I find `mulmen`'s efforts very distasteful (trying to stop piracy on networks is like trying to stop kids from doing drugs) but not crossing the line as much as forcing certs on kids personal machines.

> I find `mulmen`'s efforts very distasteful (trying to stop piracy on networks is like trying to stop kids from doing drugs) but not crossing the line as much as forcing certs on kids personal machines.

You have badly misinterpreted my comments here. Everything we did was to protect the student's interests. We were the gateway between them and whoever was trying to sue them. The University took whatever action it needed to in order to maintain that position and keep students safe from abuse. We were often riding the line of legal action taken against us by those rights holders, frivolous or not.

I'm not aware of any student ever losing network access because of piracy. We just sent a lot of emails saying "please stop" and in general students did.

I'm not sure what you find distasteful about that but I stand by my words here and my actions at the time.

That seems like a very different requirement. The University I worked for just had hundreds of wired and wireless access points and limited staff to manage them so devices had to be registered to protect everyone. It was self-service IIRC. If you connected with an unrecognized device it just took you to a login page and then the device was registered to you. I don't think there was any tracking of what students were actually doing once they were connected. Certainly not at the kind of detail that could suggest anything about radicalization.

Wow, both of those describe the system at my alma mater Washington University. The 3 strikes logout was the biggest pain ever. I knew someone who got DOSed because his papercut printer driver kept trying to use old credentials, which somehow kept locking him out of his account until they diagnosed it.

We investigated each accusation and the strikes were only applied if the student was actually violating the terms of use of the network. Like actually pirating stuff. I forget what it took to lose network access but it wasn't something you could do on accident.

Every "strike" would have included a warning.

I mean they let us run Counter Strike servers out of our dorm rooms. It was a pretty relaxed environment really.

Not to mention that commercial ISPs also follow a three-strike system -- unless that's changed. I haven't been keeping track since it's not relevant to me. So it sounds like the only difference is that you all did a bit of investigation before issuing a strike.

My friend was in a brand new dorm built for honors students. Network topology was quickly worked out that each floor was immediately visible, and I believe other floors could be found with some work. There were several 24-hour Halo lobbies going.

We were like a non-terrible ISP basically. Our job was primarily to facilitate learning. Secondary was to protect the university. Students pay the bills so their interests were always put first and we would go to bat for students if necessary. I don't recall if we used a three strike system or if it was more case-by-case.

While I understand the position that a university ISP has and the potential fear of getting cut by upstream ISPs if one does not address abuse issues, it still sounds a bit like removing a student's access to the university if they got three parking tickets. Sure, it is against the law, but is it the university's role to enforce those laws?

I can't recall a specific case of a student actually getting banned for anything DMCA or piracy related. We issued warnings to the most egregious offenders and that was always enough. To actually get banned from the network you'd pretty much have to get expelled first. The point was we did have the capability to enforce it and keep the network secure.

> Not to mention that commercial ISPs also follow a three-strike system -- unless that's changed.

Nearly every commercial ISP I've ever interacted with has a three-strike system to fulfil their legal requirements, but also unfortunately has an undetected bug in said system that causes it to do absolutely nothing.

It's kind of a legal requirement for an ISP - failing to terminate repeat infringers loses your safe harbor. Cox actually got a billion dollar judgment for exactly this reason.

Reply on news.ycombinator.com