| courseCode | varchar(25) |
| dob | date |
| email_address | varchar(50) |
| first_name | varchar(25) |
| ID | int(11) |
| last_name | varchar(25) |
| lastupdated | date |
| orgnameID | int(11) |
| orgnameother | varchar(50) |
| student_id | varchar(25) |
EDIT: This was the Student Union database. I'm not sure how many students it would contain. Maybe a small number? Maybe all of them?
Cute. There's an odd, and I would say silly, obsession amongst some tech-obsessed people to claim the soon obsolescence of things like libraries and universities.
It's wonderful the recent huge push and availability of online materials and courses from big universities and others, especially for those who otherwise could not attend a university for whatever reasons, but to dismiss universities as a singular blob shows a certain misunderstanding and appreciation of what they are actually for and for teaching in general.
I'd recommend sitting in on various mentoring services, other student services, practicals and other things and also to read Zen and the Art of Motorcycle Maintenance.
Edit: Looks like one of the tables has plaintext passwords. If I recall correctly, security practices at this university were horrible - social security numbers could be accessed in plaintext, and resetting a password took only a single security question without email confirmation.
For example to reset your university email account you needed the last three digits of the ssn and your date of birth. In my case, the school somehow never got my ssn so my ssn in this case was just "0". So theoretically if anyone wanted to change my password they just needed to use "yyyymmdd0" to access it.
We would spend days crafting policy, designing/implementing security at perimeter and core for business systems to prevent these types of leaks.
We believed we were largely successful. Until we realized that some professor had developed a screen scraping application that would spit out CSVs of student enrolment data (including personal data) and ship it to whomever he liked (alumni, student unions etc.). Once certain departments got a hold of the data, others felt obligated to it and a quazi-underground data distribution system was in place.
We tried to explain, coerce and beg. We used HR, unions to effect policy that they helped create to shutdown these systems, stop the professor (and his copycats) all to little or no success.
It is not mistake that I left soon after. Such amazing, but ineffectual institutions. It doesn't matter how many of these leaks occur, no accountability means no changes. Might plug these holes, only to have 3 more popup by the end of the year.
Fairly mundane as these things go.
This doesn't necessarily mean that students would be allowed to alter the software, but they certainly could analyze and audit it, and perhaps provide patches in some cases.
The school couldn't assure that all the data going over the wire was protected from these tools, but felt it good practice to teach us. Of course, many students then left the class after the two hours were up and stupidly practiced their newfound skills on the network anyway. After that day, we lost more than a couple students from the class (and possibly the university).
The schools know their systems are insecure. The leadership is comfortable in accepting this risk. I just wish they would make this information public to the students, so they can choose to accept the risk as well.
And there are problems with letting students have permission to run penetration tests - you have no idea if they're white hat or grey hat or black hat.
I find internal auditing, under strict surveillance to be a very good idea indeed. This could even lead to some healthy form of competition between universities, not only base on who teaches that Lisp class, or what professor/university's name is.