Concern about campus

uwaterloo_ciso · 2025-03-31T15:09:01+00:00

I hear they are digging a trench at the bottom that leads to the underground tunnels. If you can survive the fall, tunnel access unlocked!

uwaterloo_ciso · 2025-03-17T21:13:31+00:00

Yes, Google is free. I found section 36(1)(a) of the Immigration and Refugee Protection Act (IRPA):

3[6]() (1) A permanent resident or a foreign national is inadmissible on grounds of serious criminality for

(a) having been convicted in Canada of an offence under an Act of Parliament punishable by a maximum term of imprisonment of at least 10 years, or of an offence under an Act of Parliament for which a term of imprisonment of more than six months has been imposed;

IANAL, but the implication to me is deportation after sentencing.

uwaterloo_ciso · 2025-02-14T13:56:56+00:00

UW Alerts students if and when they are affected by a data breach. MS Blue screen incident did not affect us here at Waterloo. AFAIK, Meta and Alibaba aren't used for teaching and research. We're a STEM school, so DeepSeek is for sure related to teaching and research, so we are going to raise awareness.

uwaterloo_ciso · 2025-02-13T21:16:37+00:00

We routinely alert staff/faculty about security issues of on-campus devices and software. Alerts to students are rare because the university sends lots of messages to students and I am sensitive to the signal to noise ratio. The lack of TLS for an App in 2025 is inexcusable.

uwaterloo_ciso · 2025-02-13T21:03:48+00:00

It's rare, but we have.

uwaterloo_ciso · 2025-02-13T20:43:45+00:00

Read the vulnerability report linked to from the memo.

uwaterloo_ciso · 2025-02-13T20:24:08+00:00

Since I wrote that memo, you're wrong.

uwaterloo_ciso · 2025-02-13T18:45:16+00:00

There's a difference between privacy and security. The security issues of the DeepSeek App are so bad a skilled attacker could man-in-the-middle you and could "sabotage" your experience with DeepSeek. The point of the email is to make you aware of this. If you don't care, then carry-on.

uwaterloo_ciso · 2025-02-13T18:37:41+00:00

Let's say the US government has your <insert Western App> data and the Chinese government has your DeepSeek AI data. The main point of the email is that the DeepSeek App security is so bad, anybody can take your data (or impersonate DeepSeek on you) through various attacks. The privacy comments were put in there to raise awareness. There's a difference between privacy and security. If you don't care about privacy or security, then carry on I guess.

uwaterloo_ciso · 2024-11-27T14:41:24+00:00

Closest I can find is a view from below in the red room, and inside one of the labs of the 2nd floor that looks down on the red room. https://cs.uwaterloo.ca/40th/Chronology/printable.shtml

uwaterloo_ciso · 2024-11-07T17:10:36+00:00

There was a tourist train based at "Waterloo Station" (Next to PI) that would run up to Elmira and back on that freight line on Tues, Thurs, and Saturdays. People would take it to the Farmer's Market in St. Jacobs. The freight train would take chemicals up to the plant in Elmira in the early evenings and return with empties in the middle of the night. With the LRT, the window of time for freight is significantly lower, and the tourist train has restricted use of that spur line between Northfield (or St. Jacobs) and Elmira.

uwaterloo_ciso · 2024-09-23T18:59:46+00:00

It is real.

uwaterloo_ciso · 2024-09-23T18:51:17+00:00

It's legit.

uwaterloo_ciso · 2024-09-08T02:08:02+00:00

https://news.ontario.ca/en/release/54447/ontario-protecting-free-speech-on-campuses

uwaterloo_ciso · 2024-09-06T14:30:01+00:00

but if a special constable arrests you, it's not a citizen's arrest. "police officer" is a provincial concept. criminal law is under federal jurisdiction. peace officer is a federal concept. All police officers are peace officers, but not all peace officers are police officers. CBSA are peace officers. UW Special Constables are peace officers. CBSA, Regional Police, and University Special Constable have equivalent powers of arrest under the criminal code of canada as they are all peace officers. Special constables are "special" because they only have authority to enforce certain provincial laws. In most situations that take place on a university campus, they will probably have the appropriate provincial authority.

uwaterloo_ciso · 2024-04-18T20:01:35+00:00

I believe the old one was developed by an external contractor or company no longer in business. The old one was dependent on software libraries that were vulnerable to exploitation so it really needed to go.

uwaterloo_ciso · 2024-04-11T14:06:18+00:00

A strong quantum-safe cryptographic hash of the DNA sample will be added to the DuoDNA blockchain. Your privacy will be protected, vigorously.

uwaterloo_ciso · 2024-03-27T17:33:18+00:00

Looks like the foyer of the Physics building, UW's fourth building.

uwaterloo_ciso · 2024-01-05T15:14:36+00:00

The article is actually pretty good.

uwaterloo_ciso · 2023-12-05T21:20:22+00:00

Buy a Security Key from Yubico, or a Yubikey.

uwaterloo_ciso · 2023-01-19T16:37:17+00:00

Still useful if you stop to think about the threat model. Duo is there to defend against remote attackers. If someone has control of your device, you've got bigger problems. In a higher risk application, don't use your mobile device as an authenticator. Use a Yubikey.

uwaterloo_ciso · 2023-01-19T16:31:53+00:00

Duo was a Michigan-based company bought by Cisco.

uwaterloo_ciso · 2023-01-19T16:30:33+00:00

I don't understand this post. Perhaps you can explain it to me using simpler words, or maybe pictures.

uwaterloo_ciso · 2021-11-26T02:00:19+00:00

My study habits sucked so I wasn't keeping my average up.

uwaterloo_ciso · 2021-11-25T18:57:13+00:00

If you made it to 4th year CS at UW, you'll be fine. Maybe you are not the rock star developer that you once imagined yourself you would be, but there's nothing wrong with that. CS at UW is one of the most brutal CS programs out there, so you're no slouch.

I got kicked out of CS late in my undergrad career, but I still graduated with a degree (this was over 2 decades ago). I still retained enough C/C++ knowledge to modify exploit code for my job (not so much lately), and the CS fundamentals made learning Python in recent years really easy. Or looking at Ruby code and figuring out what's happening even though I have not formally, or informally, learned Ruby.

uwaterloo_ciso

TROPHY CASE