this post was submitted on 03 May 2025
102 points (99.0% liked)
Casual Conversation
3209 readers
429 users here now
Share a story, ask a question, or start a conversation about (almost) anything you desire. Maybe you'll make some friends in the process.
RULES (updated 01/22/25)
- Be respectful: no harassment, hate speech, bigotry, and/or trolling. To be concise, disrespect is defined by escalation.
- Encourage conversation in your OP. This means including heavily implicative subject matter when you can and also engaging in your thread when possible. You won't be punished for trying.
- Avoid controversial topics (politics or societal debates come to mind, though we are not saying not to talk about anything that resembles these). There's a guide in the protocol book offered as a mod model that can be used for that; it's vague until you realize it was made for things like the rule in question. At least four purple answers must apply to a "controversial" message for it to be allowed.
- Keep it clean and SFW: No illegal content or anything gross and inappropriate. A rule of thumb is if a recording of a conversation put on another platform would get someone a COPPA violation response, that exact exchange should be avoided when possible.
- No solicitation such as ads, promotional content, spam, surveys etc. The chart redirected to above applies to spam material as well, which is one of the reasons its wording is vague, as it applies to a few things. Again, a "spammy" message must be applicable to four purple answers before it's allowed.
- Respect privacy as well as truth: Don’t ask for or share any personal information or slander anyone. A rule of thumb is if something is enough info to go by that it "would be a copyright violation if the info was art" as another group put it, or that it alone can be used to narrow someone down to 150 physical humans (Dunbar's Number) or less, it's considered an excess breach of privacy. Slander is defined by intentional utilitarian misguidance at the expense (positive or negative) of a sentient entity. This often links back to or mixes with rule one, which implies, for example, that even something that is true can still amount to what slander is trying to achieve, and that will be looked down upon.
Casual conversation communities:
Related discussion-focused communities
- !actual_discussion@lemmy.ca
- !askmenover30@lemm.ee
- !dads@feddit.uk
- !letstalkaboutgames@feddit.uk
- !movies@lemm.ee
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's not a university project. I'm obviously not gonna report it to anyone.
The logs were deleted but the database entries remain, tied to their username and confirmed email.
Even if the project wasn’t for university, it’s still yours. And the other student probably broke your schools code of conduct by doing what they did. You should still inform if not the dean of the program, then at least your professor. What’s to say this person isn’t also going around and fucking with other people’s projects?
Might be able to recover the logs with
testdisk. The email and other info might be enough. If you do get your logs back might impress the CS Prof. Shows willingness to figure shit out when things go wrong.To me, what they did shows intent to commit a crime if not the crime itself. Possibly legal offences likely wont be taken lightly.
If your gonna hack shit it better be your own in a lab or have consent from the party involved
How can you determine that someone didn't use their info as subterfuge? It sounds like most people could find that information and use it. You'll need a little more evidence.
Personally, I'd ask them if they want to pen test my next application and see how they respond.
What do you mean? If their email is confirmed, then I assume only they have access to it. Is there something I'm missing?
Perhaps it's something that I'm missing. What do you mean when you say their email is confirmed?
Usually when this happens, it's a result of someone taking advantage of an application vulnerability, e.g. sql injection. Sometimes it's more serious, like a script uploaded and a privilege escalation to execute it. The email value written to your database could be anything.
Not to condescend, but this is a good learning experience. If they were able to write to your db, they could likely also read from it, dump the whole thing and harvest the data.
They did not gain access to the db. They just inserted some garbage data that due to a bug in my code caused a background worker to try to insert some invalid data to the db and fail on loop, hogging network resources until eventually the main server couldn't serve anymore.
When I say their email is confirmed, I mean the email they used to sign up is presumably one they have access to because they clicked on the confirmation link with a token sent to their email. The data they inserted is tied to that account with a foreign key.
No SQL injection or anything like that was done. It was more them triggering a bug more than anything. But it's still clearly intentional because the data they inserted is spam about forex trading with no spaces (which is what caused the error, long story). My code is open source so presumably they knew that would happen.
Gotcha. Then maybe it is time for them to have a conversation with the friendly network administrator. You might have lost your logs, but university network appliances usually log alot.