Jump to content

Bert the Derp

Member
  • Posts

    36
  • Joined

  • Last visited

Reputation Activity

  1. Funny
    Bert the Derp got a reaction from Mark Kaine in How to preserve our games for future use?   
    Yee, probably this is going to be the best solution. Now, would you help me make a custom installer application to install my "pirated" (some are just simply CD RIPs) games from the network from an ISO? I don't want it to be just a network folder that I open, double click the ISO and install as usual. I want the comfort that the game stores provide. A simple, one click install solution. Or maybe I'M aiming too high? 😅
  2. Like
    Bert the Derp reacted to Kisai in The most dangerous leak in the history of GDPR era ?   
    Let's roll back the clock to 1970, when everything was on paper, or if you're lucky some computer the size of a warehouse. 
     
    1. Student moves
    2. Student graduates
    3. Student is suspended, expelled
    4. Student is sent on a foreign exchange / school receives a foreign exchange student
    5. School staff list
    6. School standardized testing
    7. Student contact information
     
    Look back in the 80's, we had to fill out scantron's my "full" name didn't fit on the card. 8.3 filenames clearly in play. I never transferred schools, but the provincial "final exams" from grade 1 to 12, all used the same scantron cards

    They look like this, except older and square-bubbles. The ones students fill out have 8 bubbles for the first name and 8 for the last name when it wasn't a provincial exam. 
     
    Standardized tests have been around for 40+ years. They may change the answer key every year, but the tests are ultimately the same. They then rank students in the school, and rank schools as well. So if a school is failing, then you know, the politicians get involved. Teachers or School district staff get replaced or rotated to different schools (this actually happened frequently as the teachers I went to school with, pretty much all retired the year I got them.) 
     
    Now that I think about it, the computer systems also printed the report cards with generic "student excels at this this class"/"student does not apply themselves" type of teacher multiple choice answers. They were never simple hand-written report cards, they were these dot-matrix printouts that you could barely read on the green-and-white paper.
     
    I had access to "on paper" versions of the student contact lists throughout high school, and had access to the student "report card" diskettes back in grade 8. It takes 2 minutes to photocopy the hard copies and maybe a few seconds to copy the digital ones. So no "on paper" also is not any more secure, because the teachers will just have them in their desks, unlocked, and anyone can look at it. Now consider how fast someone can take photos of a hard copy vs needing the password to the computer. If I had easy access to these things, that means at least 30 other students did as well. Fortunately I was a trustworthy individual that didn't see a reason to exploit it, but I did know where these things were.
     
    You can not rely on the teachers to memorize the student names, birthdates, contact numbers and parents unless the school is extremely small.  Every year you get a new teacher, and that new teacher has to learn everyone's names again. High school would have 4 or more teachers for different classes. You think one teacher is going to remember 1000 names? Nope.
     
    Nothing has changed in the last 40 years ultimately. We've just gone from having careless individuals at schools to careless phishable staff. If someone were so inclined to, even back in the 90's, any random visitor from off the street could have gone to the library where the photo copier is easily accessible, and borrowed the contact list right off the desk of any teacher and returned it and nobody would have even noticed it missing, and even if it did go missing, they'd assume they misplaced it and make another copy.
     
    The amount of damage that can be done, is only multiplied by how many people have access to things. A school district with 5000 students vs a province with every student, past or present's records and contact information. Now imagine that on a country-level scale where every single person who has been to ANY school at all.
     
    We do kind of need to question why people have access to things they do not need. Tech people need access to copy and move/maintain things, they don't need to be able to decrypt it to a level that they can read the data. Likewise why does anyone outside the individual school has access to anything in the first place. If a student is transferred, just move them from one database to another, done. Or mark the original database as "student transfered to X" and then make a new entry in X's school databases. I can think of many ways to silo the data to reduce access.
     
    However the actual students/citizens/residents may want access to this data in a central place, and that's how I feel this leak became a thing. Even in Canada we've found that trying to do this, is a bad idea because it results in too many eggs in one basket *cough*phoenixpay*cough* that takes years to fix, or never does get fixed. Likewise, when data changes (eg name changes, address changes) it can take a decade or more for that information to be reflected in all these other databases. When the Covid stuff happened, the Canadian government sent me information that hadn't been correct in 20 years. Somehow they had the right address, but the typos were still there.
  3. Agree
    Bert the Derp got a reaction from HenrySalayne in The most dangerous leak in the history of GDPR era ?   
    a; They do share the data between them because the data is controlled by government institution and then delegated access to the schools. The governing ministry was the HUB where the data was stored (on paper. In reality, it was stored by a centralized server build by this company)
     
    b; Yes, there is Moodle, but then how can the corruption give hundred millins of dollars to a friend who has a developing company? 🤬 This was the sole goal, it was always secondary to make the system actually good and useable.
  4. Funny
    Bert the Derp got a reaction from Gamer Schnitzel in The most dangerous leak in the history of GDPR era ?   
    Hey Forum,
     
    I want to give a little more echo to the thing happened this week in Hungary which could pose as a HUGE example how NOT TO implement a new software. Now I know this article is not in english (it will appear probably very soon tho), but Google Translate does well as far as I can see it. (find sources and translate https://translate.google.com/?hl=hu&sl=hu&tl=en&op=websites ) TL;DR at the bottom.
     
    Background
    In Hungary, the government have centralized and digitalized the education system in primary and secondary schools. Unified software, school books, curriculum, etc... For this, they made contract with a company to develop the software that can has to be used in every school by every teacher and every student as well. This is where they get their grades, this is where their timetables appear, important messages, notifications, sick leave management, etc... Really everything. This is called "KRÉTA". (Translates to "chalk")
     
    The event
    The developing company was hit by a phishing attack back in September. According to the GDPR in Europe, they required to report this to the local authorities within 15 days. Now it is November and earier this week, the attack was surfaced. After 2 months... The hackers gained access to the source codes of the software (both WebService, Mobile App, Desktop app) and even credentials for the test, staging and LIVE SERVERS ! Now what that means in practice:
     
    EVERY student and teacher in Hungary has their personal data leaked and proven to be stolen !
     
    What this means if a sick bastard gets its hand on the data, it can make a similar query like this:
    female students age between 13-16 lives in X county lives with grand parents or foster parents (which means she is probably orphan) has bad grades I don't think I have to tell you, this is opening doors to some very serious crimes.
    said the cyber security expert.
     
    My thoughts and TL;DR
    This is a story. A story of a "how not to develop" and "how not to manage IT incidents". The developers knew they were hacked, they knew the data is compromised, they know how sensitive the data is, they just tried to keep quiet about it. Sadly, this company is owned by current government personell friends, thus they will certainly not go to jail or get fined. Only on a symbolic level only. But I hope I can raise attention to this case and "maybe put pressure" on the local authorities to act faster and more strictly. The data of our children are no joke and this must be protected at all cost.
     
    Sources
    https://telex.hu/tech/2022/11/07/kreta-rendszer-e-naplo-kozoktatas-adathalasz-tamadas-adatszivargas-ekreta-informatikai-zrt
    https://telex.hu/tech/2022/11/09/kreta-rendszer-ekreta-zrt-adathalasz-tamadas-adatszivargas-elhallgatas-naih-vizsgalat-eljaras
    https://telex.hu/tech/2022/11/11/kreta-adatszivargas-forraskod-ekreta-zrt-fejlesztok-elvandorlas
     
  5. Like
    Bert the Derp got a reaction from Master Disaster in CentOS Linux abandoned, welcome CentOS Stream. Where to go now?   
    I agree with "they are basically all the same", but as you've said it, the main difference is the packet manager and the packages they use. You even mentioned Arch Linux (big bow before you, for using it). At the end, it all comes down for personal experiences and preferences. And the simplicity of the packet manager.
  6. Informative
    Bert the Derp got a reaction from Ben17 in INTEL VS AMD!!   
    I was watching DragonBall Z a few days before and then I realized, they have imagined the perfect way how AMD "risen" above Intel in terms of Performace/$.
    If I was you, I would definitely go for AMD, but not the 1st gen. A good used 2nd gen CPU is even a better deal, but if you can squeeze it out somehow, then a Ryzen 5 3600 or Ryzen 3 3400G. 
     
    https://www.youtube.com/watch?v=0edNLlCS-XY
  7. Funny
    Bert the Derp got a reaction from Flying Sausages in Help me make my gift for Linus in an awkward way   
    Oh sh*t. You are right. I'll look up something, let's see if I can dig something up. I'll post the results as well as soon as Linus receives it.
  8. Funny
    Bert the Derp got a reaction from Ezzy-525 in Help me make my gift for Linus in an awkward way   
    Oh sh*t. You are right. I'll look up something, let's see if I can dig something up. I'll post the results as well as soon as Linus receives it.
×