While not a defence in law, this is precisely the approach that is often needed in IT.

The best tester I ever worked would come up to us and say, "When I do [THIS], then [THIS], then [THIS], it goes kaboom". We would ask, "Why would you even try to do that combination", to which he would reasonably answer, "Because it allowed me to". We would then either make it impossible to so do, unless it was a safe combination and should have worked in which case we would fix it.

Thank you Gordon, you truly were Entropy's Little Buddy.

An unguarded prompt is the same opportunity (or temptation). What can I do with this? What could possibly go wrong?

Thank you Gordon, you truly were Entropy's Little Buddy.

In my case the guy was named Keith. I think most places have one and they really help you improve things (after causing chaos).

Yeeeeeees... This is what QA is *meant* to do. Try anything, everything, see what happens. Even if that doesn't make sense to a developer and they rant on about how QA are trying all sorts of crap instead of testing the software.

No love, that *is* testing the software. If you do not sanitise your inputs, and you don't make sure your software doesn't let silly things like that happen, then yes, love, your software is going to do stupid things.

QA were, as much as they were the bane of the developers, my best friends because they highlighted pathways in the software that hadn't been thought of during the design/development process that needed to be... fixed/accomodated.

And yes. Unguarded prompts? Oh boy!

You mean Testers don't do this type of thing as standard? I've beta tested several products in my time. Knowing the product inside out meant that I could think up many a devious way to try and break it by doing something "unusual".

The mantra goes thus: "If a thing is possible, a user will do it. If a thing is impossible, a user will find a way do it anyway".

In my most recent incarnation, developing software for an automated cat feeder, I spent a long long time thinking up ways things might confuse the feeder. And yet, every now and then, something surprised us, like a cat simply beating up the feeder, or hiding toys in it, or in one case, an owner who rather than pushing the 'open' button simply picked up his kitten and let the feeder detect it to open the lid...

So did you cat or tail the files for that software?

I sometimes get paid for destructive testing, hard, firm and software. Paid quite well. Funny thing is I'd do it for free, in some cases. Don't tell anyone :-)

This reminds me of the episode of Cabin Pressure (can't remember which one) where Douglas challenges Martin to find out how many of the safety features they can disable and still fly.

"Hey, chief, I might be wrong, but I think we're flying into a mountain. This makes me feel... scared of the mountain. One thing we could do is pull up and fly over the mountain. How does that sound to..."

Is exactly why Boots and the Co-Op Dept store in my home town were often filled with white noise of a saturday:

10 Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10 :Goto 10

was left on the BBC Micro, waiting for so less bright kid to hit enter :-)

I did indeed at one point type something into a demonstration computer in a store.

10 print "hello"

20 goto 10

run

I remember "a friend" "accidentally" plugging a PC keyboard back into a Dixons demo machine, and "accidentally" deleting autoexec.bat so that the machine would not start the demo next time it was powered on.

Back in the early 1980s when "Dixons Reject!" was a powerful term of abuse for someone who was completely stupid. Sorry Dixons, RIP.

As per the article..

"Like me, most people used the 'return' key to wake up a terminal."

Yes. Used to. These days its shift key, backspace, or something like that for that very reason.

We used to go into the big box computer chain in the days of (locked) scrolling screensavers being standard for display. Quick reboot got you out of the screensaver, change text, then _unplug the keyboard_ and wait for someone to notice.

Many years ago, but many years after lessons should have been learned, I remember playing with a PC that was running GORILLA.BAS under QBASIC as a floor demonstration, and it was fun making inputs that blew the map up in unexpected ways, but it was even more fun dropping to the editor and changing random things. Like showing my name at the top instead.

Worked in an organisation that used smartcard and pins for authentication. I was in the office where the system admins worked. This was not a secure office. The admins regularly left their cards in the reader and buggered off. They usually had a loooong timeout set too. (saves having to put that long and complex four digit pin in.)

Procedures dictated that unattended smartcards be removed and reported. The System Mangler wasn't happy, the paperwork was a pain, and said to stop it.

So we (I) did stop. Didn't stop us (me) adding clear sticky tape to the chip or trimming the edges of the card so it was to small for the ID card holder. Or adding facial hair in indelible ink to the picture on the card.

Turns out this was more effective than them getting bollockings!

Anonymous for obvious reasons!

Oh yeah.

The number of contacts , switches and orifices to which the new fangled invisible sticky tape could be applied.

Jolly japes on a roll.

The matte Scotch is brillianr. when properly affixed, can be very difficult to spot.

I did like the way SunRays did it and your session "followed" you with the card. insert your card to another SR elsewhere in the office... or in another office in another country.

While at university in the mid 90s, my mate and I were doing some work and needed to FTP a file to/from one of the servers, so we opened up the supplied FTP client (stored on a Novell fileshare IIRC), typed in the server name and found an auto-completed config set for that server. With the root account. And a password saved in the config. We looked at each other and hit "connect"... and promptly had an FTP session on the server as root.

After confirming we were definitely in as root (by downloading, deleting and re-uploading /etc/passwd - yes, a bad choice in retrospect, we could have FUBAR'd the machine), we decided we'd better tell the lecturer who looked after that box about the issue. The config in the FTP client was removed that day.

For some reason, probably to provide a maintenance window, the Unix box we were using for an assignment had user logins disabled for an hour at lunchtimes, just when we wanted to use it.

Fortunately a friendly sysadmin (yes, they do exist) had let slip the password for su so we could use that, then connect to our own accounts.

There were too many fellow students using the same box for anybody to do anything silly with the access, tempting though rm * (no need for the -r back then) may have been.

We used to send data to a third party marketing company for them to prepare mailshots for us. This was done via FTP. One day after uploading our file, I decided to cd ../ and much to my surprise, it allowed me to. Being the curious sort, I then typed ls -la and saw a list of recognisable company names. Picking one at random, I was able to access not only their directory but also their data.

This was in the mid-90s when "hacking" was Very Naughty. I spoke to my boss who was in the same quandary as me - report it as a security risk or potentially get arrested? His decision was to keep quiet about it.

Possibly the best approach might have been to have your boss go apeshit at the third party marketing* company for their lack of security as your own data was as much at risk from anyone else with FTP access as theirs was from you!

* Ah, a marketing company - well, that probably explains their lack of security. Their server was probably set up by the marketing boss's teenage son whose knowledge was based on his experience with AmigaDOS.

At the end of the nineties I had a similar issue with an FTP server managed by one of our suppliers. In that case I knew the guy who managed IT there, gave him a quick call and he sorted it out. Had I not known that guy I would have also mentioned it to my boss, with the remark that “if we can see their data, they can probably see ours”…

/etc/shutdown ?

Binaries in the config dir? Was that really common in those days?

Yes. /etc used to contain the so-called "dangerous" system binaries that are now normally found in /sbin (and possibly in other places, depending on the system).

In the 90's I was working on a system fro a Police research department based in a Home Office building in London - we were based at the IT centre in Liverpool. At a meeting with the moron of a Chief Inspector in charge of the department (obviously deployed there to get him out of the way) he basically accused us all of being IRA sympathisers - "You've even got an Irish name!" I was told. After biting my tongue and assuring him that we were all sevcurity cleared, he went on about how sensitive the info was, and how access to it must be strictly controlled!

A week or two later I visited the office to see how the bobbies using the system were getting along and noticed a sticky label on a function key that said "Login". Using my supreme detective skills I asked the bobby what that was for - he said "we can't be arsed typing in user names and passwords, so we found out how to program it into the function key. One press and we're in!". Oh how I laughed!

Never underestimate the ability of Plod to bend IT to make things "easier"

Around 1986 I put together a "screensaver" for Sun gear that made the screen look like it had a couple of bullet holes in it. I occasionally deployed it on workstations where the user (engineer) had walked away, leaving himself logged in. Quite realistic on the colo(u)r Trinitrons of the day ... realistic enough to draw many a scream of "What the FUCK‽‽‽‽" from people who should know better.

At employer -1 one if you left your PC unlocked then they'd install and run the Sysinternals BSoD screensaver and then when you asked for help you'd get the bollocking...

We would type a resignation email and leave it unsent as a warning of why you locked your machine.