College busts student for register service, then yanks idea

[Aikanaro]

Spoiler:

After a university punished a student for creating a paid service to expedite registration, the school is launching its own improved registration program. On Friday, the University of Central Florida said its new system would "allow students to secure classes faster, more efficiently and free of charge."

UCF made the announcement on its own website, acknowledging the work of Tim Arnold, the senior marketing major currently under university sanction and academic probation — although they didn't acknowledge him by name.

“As we implement our enhanced registration process — one that is free and compatible with our systems — we invite the developer of the outside website, and others, to help us make UCF more efficient," said Grant Heston, UCF associate vice-president for communications, on the site. "Any idea that has the potential to improve services for students is worthy of consideration.”

In an interview earlier this week with NBC News, Heston said that UCF had already been at work on a "similar program" to Arnold's when the controversy erupted in June.

Arnold developed a Facebook app, called U Could Finish, to help his fellow students find out via text message as soon as seats became available for classes they needed. The app notified students as often as every 60 seconds. The way it did it was to access UCF's schedule search page, which is what caused the problem.

University officials said the app got so popular, it dramatically slowed down the university’s myUCF servers. There were also concerns that Arnold planned to charge 99 cents for the app. Arnold told NBC News that he had "no intentions of making a profit" on his app, that it "was just to help pay the hosting ad other bills to keep the service online and possibly make back some of my development costs."

He said he did receive two payments from one user, "for a total of $7.87. I refunded both transactions right after I found out there was a block between UCF and my server."

But it wasn't only having his app's access cut that hurt Arnold. He was put on probation for three semesters, along with lesser penalties. He appealed the decision, and on Friday, he told NBC News via email, "They have sustained the decision and three sanctions, but have reduced my probation from three to two terms."

Arnold also has to give up his treasurer role for the Society for Marketing Professionals through next spring, "as student leadership requires fall and spring terms, it has the same effect of preventing me from continuing my leadership," he wrote.

"I'm definitely glad that they have made registration better and easier to use for students, and I'm honored that my actions helped create change," Arnold wrote. "However, I think that in light of UCF seeing my innovation's value and using it as an inspiration/motivation to create their own version, it should have changed their actions accordingly."

Asked about the fairness of the university's decision, Heston told NBC News Friday via email that he can't comment on "individual students. What I can say is that UCF encourages and applauds innovation and entrepreneurship. The issue about the outside website was not about its innovation, rather its execution. Inadequate coordination with the university caused system issues for the university."

Arnold isn't buying it. "I think they've enforced a double standard here," he said. "They taught me to think innovatively, and now they've punished me for doing so even after acknowledging it was a good idea."

On what planet is his continuing punishment reasonable? I wonder if he has grounds for a lawsuit.

[Iulus Cofield]

I'm willing to bet their student code of conduct or equivalent included a section on not disrupting the use of the university website, or not disrupting university student services in general, or even prohibiting the running a business on campus.

[Dauric]

I'm willing to bet their student code of conduct or equivalent included a section on not disrupting the use of the university website, or not disrupting university student services in general, or even prohibiting the running a business on campus.

This most likely. Probably liability issues with third party information being presented as (quasi) official notifications as well.

[Tirian]

On what planet is his continuing punishment reasonable? I wonder if he has grounds for a lawsuit.

The planet of limited server resources. A script that searches a public database every sixty seconds on demand is an enormous drain on legitimate users. Until he realizes that, keeping him out of a leadership position in a marketing club is a feature.

[fifiste]

+1

[Tirian]

While he's on probation, maybe he can branch out and sell napkins with the McDonald's logo on them for half the price of grocery-bought napkins. It's free advertising for McDonalds, so I'm sure they wouldn't mind.

[qetzal]

Yeah, using someone else's logo is illegal. Are you suggesting his app was somehow illegal?

[Tirian]

Yeah, using someone else's logo is illegal. Are you suggesting his app was somehow illegal?

Like Iulus Cofield suggests, yeah, it's undoubtedly a breach of the terms of service for using the university computer resources. It's not *illegal*, but it would be grounds for academic sanctions. The reason that I mention the McDonald's analogy is that there should be no doubt that being offered a free resource doesn't give arbitrary people the right to abuse it, whether it is for profit or for great justice.

[Princess Marzipan]

He was offering MORE than the school was, though. This is more like selling napkins inside a McDonald's that doesn't have any.

[yurell]

And Maccas would be well within their right to kick you out and start selling napkins themselves, were that the case.

[Williks]

Isn't this more like offering a free bus service that takes people to MacDonald's and the increase in customer traffic as a result of this service overloads the MacDonald's staff/inventory?

I mean, if the issue is that the app was putting too much strain on the system, then disallow the app. He wasn't acting maliciously. It was a simple oversight, a mistake, and its already been rectified. What do they hope to achieve by continuing to punish him?

[Princess Marzipan]

The point of my post (I somehow never remember to include points in posts) was that there is a difference between making money off an existing brand by using it as a marketing tool and making money by adding value/convenience to an existing service. This difference makes the McDonald's analogy inapplicable.

The continual searching of the database may indeed be problematic, but I don't see how any further action than prevention is necessary.

What do they hope to achieve by continuing to punish him?

The most apparent and likely seeming objective would be to make an example as a deterrent to any future attempt to improve the usability of school services.

[Tirian]

Did you miss that he added value to the service at the expense of every user of the service who wasn't one of his customers?

University officials said the app got so popular, it dramatically slowed down the university’s myUCF servers.

[Princess Marzipan]

I didn't say he did so flawlessly.

To reiterate what I DID say, blocking his server from accessing the university's systems was sufficient to solve any problems it caused and therefore I don't see what good comes of punishing him. (I wouldn't mind if he were then threatened with sanctions should he attempt to get around the block.)

[Iulus Cofield]

We're all internet people here, I think we can talk about this without need for muddling analogies.

I didn't say he did so flawlessly.

To reiterate what I DID say, blocking his server from accessing the university's systems was sufficient to solve any problems it caused and therefore I don't see what good comes of punishing him. (I wouldn't mind if he were then threatened with sanctions should he attempt to get around the block.)

In my limited experience, universities tend to be pretty rigid in their application of disciplinary action in response to code of conduct violations once it's been decided to take such action instead of sweeping it under a rug. Given his protests in the OP, it doesn't sound like he was willing to quietly shut down his service and if so, that wouldn't leave UCF many options aside from formal disciplinary action.

There are a lot of unanswered questions in the OP though. Did Arnold approach UCF about the app before he launched it?

[Princess Marzipan]

“As we implement our enhanced registration process — one that is free and compatible with our systems — we invite the developer of the outside website, and others, to help us make UCF more efficient," said Grant Heston, UCF associate vice-president for communications, on the site. "Any idea that has the potential to improve services for students is worthy of consideration.”

"I'm definitely glad that they have made registration better and easier to use for students, and I'm honored that my actions helped create change," Arnold wrote. "However, I think that in light of UCF seeing my innovation's value and using it as an inspiration/motivation to create their own version, it should have changed their actions accordingly."

Asked about the fairness of the university's decision, Heston told NBC News Friday via email that he can't comment on "individual students. What I can say is that UCF encourages and applauds innovation and entrepreneurship. The issue about the outside website was not about its innovation, rather its execution. Inadequate coordination with the university caused system issues for the university."

Arnold isn't buying it. "I think they've enforced a double standard here," he said. "They taught me to think innovatively, and now they've punished me for doing so even after acknowledging it was a good idea."

The italicized quotes from the PR guy look to me like the University is talking out of both sides of its mouth. If inadequate coordination was the problem, the solution is an increase in coordination. Academic probation does not accomplish this; in fact, I would think it make collaboration much less likely, and so the earlier invitation to the developer to "help make UCF more efficient" falls flat to my ears.

The bolded quotes from Arnold indicate to me that he set out to make registration easier and he would have worked with the university and addressed their concerns - had they not simply noticed what was happening and decided to punish rather than determine a mutually beneficially way forward.

That's all just my best guess, as it's pretty unclear exactly what happened - if I knew the university indeed contacted Arnold and attempted to collaborate, or even just told him to stop or else face sanctions, I would not perceive any injustice here.

[Tirian]

The bolded quotes from Arnold indicate to me that he set out to make registration easier and he would have worked with the university and addressed their concerns - had they not simply noticed what was happening and decided to punish rather than determine a mutually beneficially way forward.

Yeah, maybe I'm looking at this from a software engineering guy perspective which sees the story a little differently. The way the university implemented this solution is radically different from what Arnold was doing. When you put your name on the wait list for Calc 2, the university added your name to a list of people to notify when someone dropped Calc 2. Only when someone drops Calc 2 is that list checked and worked on. That is such a completely different solution than Arnold's -- because he doesn't know from outside the system when someone drops Calc 2, he decided to submit a search request once a minute. That's different from "not flawless", that's dereliction of common sense. You can't write a bot like that without sensing that a majority of the site's traffic would soon be from you and the answer would always be "no, nobody has dropped a course since the last time you checked." Eventually, nobody ever could drop the course, because anyone who would want to can't get through Arnold's denial of service attack.

I know you liked my last analogy so much that you'll look forward to this one. If you think that the traffic at your local intersection gets snarled up and you perceive that a left turn traffic signal would help, then you send a message to the local department of public works and suggest that -- and that's all you do. At no time do you decide to get an orange vest and a flag and direct traffic. Even if you do a good job. And when you are sued for directing a car into an accident, nobody is going to care about what a good job you were doing, even if the county installs a left turn traffic signal after the accident. Because it was never your job to do.

[Williks]

I know you liked my last analogy so much that you'll look forward to this one. If you think that the traffic at your local intersection gets snarled up and you perceive that a left turn traffic signal would help, then you send a message to the local department of public works and suggest that -- and that's all you do. At no time do you decide to get an orange vest and a flag and direct traffic. Even if you do a good job. And when you are sued for directing a car into an accident, nobody is going to care about what a good job you were doing, even if the county installs a left turn traffic signal after the accident. Because it was never your job to do.

The difference being there's no cost assumed by the school, whereas an auto accident can result in thousands of dollars in damages and possible loss of life or limb. It's not like the school was selling a product and while their system was down potential customers turned to alternative providers. Their customers are already locked in. So what harm has this actually caused beyond a brief delay?

Either a punishment is proportional to the damage caused or its greater in an attempt to deter future offenses. In the latter case, the problem he's being punished for is also a significant design flaw in his app. It makes no sense to design an app in such a way that prevents it from being used. The only way this could serve as a deterrent then, is if someone had intended to consciously released an intentionally flawed app. In the former case, it would seem that any damage is minimal.

[fifiste]

NO cost? No cost? When my site stays under denial of service then it is no cost to me?

[Williks]

NO cost? No cost? When my site stays under denial of service then it is no cost to me?

Right, if your website is briefly down due to a mistake and there is no monetary damage, what has this cost you? I mean, unless you just want to be pedantic and claim the cost was a loss of access between X and Y o'clock. Really, what harm has been inflicted on the school? Were there students who decided to cancel their education plans at UCF and enroll elsewhere because the class selection site was temporarily down? Did this require the hiring of additional staff to solve? Specifically, explain the damage anyone suffered here.

[Meteoric]

I don't know about the website in question specifically, but when the university websites I've used slow down "dramatically", it severely impairs students' ability to use the website for things like registering for classes. In the worst cases, it can make registration and other tasks effectively impossible. I'm not sure how one would assign a dollar value to it, but impeding or preventing students from signing up for the classes they need for the semester is not harmless.

But I'm still not sure the punishment is appropriate to the offense; it depends on the details of how things transpired, IMO.

[kiklion]

On what planet is his continuing punishment reasonable? I wonder if he has grounds for a lawsuit.

The planet of limited server resources. A script that searches a public database every sixty seconds on demand is an enormous drain on legitimate users. Until he realizes that, keeping him out of a leadership position in a marketing club is a feature.

Not if it is done correctly. My thinking is that the web developer did not do it correctly, or the schools website itself is horribly coded if a single query every 60 seconds bogs it down. I work for a small accounting company and one of our databases probably has hundreds of queries a minute. If we can get that accomplished with multiple databases with only 3 programmers a school the size of UCF should be able to as well.

Because I will assume UCF did develop it relatively well and it is not being bogged down by one query every minute when they have over 50,000 students (http://en.wikipedia.org/wiki/University ... al_Florida), then the issue is that the web dev did not program the app well. Just a hunch, but each app probably queries the schools site individually, this leads to tens of thousands of queries every minute, furthermore this is tens of thousands of queries at the same time every minute. If instead he had setup his own website and the app flags his site that someone is interested in a given class, then he queries the school site once every minute looking for status of interested classes and then his app queries his own site, the school would probably have not noticed and everything would be fine.

Furthermore, his website would be under the heavy load, so people without the app would not be troubled AND he could optimize the query steps that his app does. For instance, rather than search status of all interested classes, he could update a table containing each users info when he queries the school site so that when the app queries his site it will first return only one bit from one field in one table telling it if any of it's classes are available, and then another query detailing which classes are available if the first query returned true.

[Chen]

If he had worked WITH the school it probably wouldn't have been an issue. Depending on how he had it setup it could just amount to a big DoS attack. Now the punishment is still a bit much considering that wasn't his intent. One could assume that he could plead that case to the university. The service in and of itself though was poorly thought out.

[Diadem]

On what planet is his continuing punishment reasonable? I wonder if he has grounds for a lawsuit.

The planet of limited server resources. A script that searches a public database every sixty seconds on demand is an enormous drain on legitimate users. Until he realizes that, keeping him out of a leadership position in a marketing club is a feature.

A minute is an astronomically long time for computers. Searching a database once a minute shouldn't even be noticeable. So either the university website was coded horribly badly, in which case the student is not to blame, or the student's program was coded horribly badly. In which case he is to blame, but in which case it's also a mistake, and not something done on purpose. Similar to how virus infected computers often ddos their local network. Such computers are generally thrown off the network until they are fixed. Their owners aren't suspended for 3 months. That's ridiculous over-punishment.

[Iulus Cofield]

It is unclear from the article whether Arnold had a server running that ran a single query every sixty seconds that then sent notifications to the individual phones that the app was installed on or if each phone that the app was installed on ran a query every sixty seconds. The sentence "The app notified students as often as every 60 seconds" strongly suggests the latter. UCF has a little less than sixty thousand students and as few as ten thousand students hitting F5 every sixty seconds is a substantial server load. As Tirian pointed out, UCF's implementation of a similar service accomplishes the same result, but only from the user perspective, with a tiny fraction of the server load and such an implementation can only be accomplished by the university.

[Chen]

It is unclear from the article whether Arnold had a server running that ran a single query every sixty seconds that then sent notifications to the individual phones that the app was installed on or if each phone that the app was installed on ran a query every sixty seconds. The sentence "The app notified students as often as every 60 seconds" strongly suggests the latter. UCF has a little less than sixty thousand students and as few as ten thousand students hitting F5 every sixty seconds is a substantial server load. As Tirian pointed out, UCF's implementation of a similar service accomplishes the same result, but only from the user perspective, with a tiny fraction of the server load and such an implementation can only be accomplished by the university.

Yeah I assumed each app was querying since the school said it got worse as the App got popular. If it were just a single server querying every 60 sec, the load shouldn't have changed on their end as more people used the app (only HIS server load would).

[sam_i_am]

The way I see it, The app can do one of 2 things

A small query every 60 seconds PER USER OF THE SERVICE

A large query every 60 seconds of the ENTIRE REGISTRATION DATABASE(or at least a large portion of it)

Either way, That consumes a lot of bandwidth. The school's bandwidth.

[garaden]

Well, this one does ruffle my open-source feathers, as I'm sure is happening with many here. If it was just the DDOS, I'd agree that the punishment is excessive and he should have just been slapped on the wrist by their IT department. But I think I'll side with the university on this one, for two reasons.

I'm surprised the article and the posts here seem to be mostly concerned with the DDOS. I personally think his plans to charge for the app are a much bigger issue. When I was at Maryland, you couldn't call your student group "University of Maryland X": it had to be "X at the University of Maryland" or similar, because the former implies official sanction, which is not cool if you don't have it. Point being, universities defend their brand ferociously.

I feel like if your app is generating sufficient traffic to justify a paid version, that's the point where you should call up the university and see if they'll work with you, maybe even give you space on a server and a university domain name (it's happened at Maryland). Or maybe they'll say "no". Or "No, and you shouldn't have done that in the first place *slap on the wrist*". But once you start commercializing something integrated with the university resources... man, they're not going to be happy. And "just recouping costs" doesn't make him much less commercialized. Plenty of startups spend years "just recouping costs" until they're profitable.

The other reason is, I didn't see any mention of an apology for bogging down the server. Perhaps the article omitted it, but it's already pretty sympathetic towards him so you 'd think they'd print something like that if they had anything to print.

The issue about the outside website was not about its innovation, rather its execution.

implies that he may have gotten too indignant, too fast.

[kiklion]

The way I see it, The app can do one of 2 things

A small query every 60 seconds PER USER OF THE SERVICE

A large query every 60 seconds of the ENTIRE REGISTRATION DATABASE(or at least a large portion of it)

Either way, That consumes a lot of bandwidth. The school's bandwidth.

While a query to populate his own server would be larger than any individual's query as his would be the sum of all unique queries, there are a few reasons why it still would not be a large query. Firstly, and most simply, is that there is overhead applied to each individual query, it would only be applied once to a large query but applied to each of the individual queries. Secondly, there would be a large overlap of people looking to get into the same class. if a class is full, it is probably due to it's popularity such that many people want to get into that class. In this case, you would have many people submitting the same small query whereas to populate his own database he would only need to submit a single query.

[sam_i_am]

The way I see it, The app can do one of 2 things

A small query every 60 seconds PER USER OF THE SERVICE

A large query every 60 seconds of the ENTIRE REGISTRATION DATABASE(or at least a large portion of it)

Either way, That consumes a lot of bandwidth. The school's bandwidth.

While a query to populate his own server would be larger than any individual's query as his would be the sum of all unique queries, there are a few reasons why it still would not be a large query. Firstly, and most simply, is that there is overhead applied to each individual query, it would only be applied once to a large query but applied to each of the individual queries. Secondly, there would be a large overlap of people looking to get into the same class. if a class is full, it is probably due to it's popularity such that many people want to get into that class. In this case, you would have many people submitting the same small query whereas to populate his own database he would only need to submit a single query.

He would have to submit a single large query. Some large queries on large databases can take multiple minutes to resolve(this particular issue is not so extreme, but these query could more than likely be measured in seconds), and then there's the issue of bandwidth which is even more restrictive.

Also, from the sound of the article, the student's bandwidth usage increased the more popular his app became, so it sounds like queries per user was the method that he used.

[Diadem]

It is unclear from the article whether Arnold had a server running that ran a single query every sixty seconds that then sent notifications to the individual phones that the app was installed on or if each phone that the app was installed on ran a query every sixty seconds. The sentence "The app notified students as often as every 60 seconds" strongly suggests the latter. UCF has a little less than sixty thousand students and as few as ten thousand students hitting F5 every sixty seconds is a substantial server load. As Tirian pointed out, UCF's implementation of a similar service accomplishes the same result, but only from the user perspective, with a tiny fraction of the server load and such an implementation can only be accomplished by the university.

I see. Yeah, good point.

That's a pretty bad way to code such an app.

[Dauric]

That's a pretty bad way to code such an app.

The guy in question is a marketing major, not comp-sci. He obviously has some ability to write code, but odds are he doesn't have a firm grasp of 'best practices' and probably went with whatever worked, which in this case apparently equated to a DOS attack on the university.

[Tyndmyr]

That's a pretty bad way to code such an app.

The guy in question is a marketing major, not comp-sci. He obviously has some ability to write code, but odds are he doesn't have a firm grasp of 'best practices' and probably went with whatever worked, which in this case apparently equated to a DOS attack on the university.

In this case, having a chat with the guy and getting the code fixed is probably going to be more useful than disciplinary action.

Sure, the guy screwed up. But hey, he was at least attempting to provide a useful service to enhance the college, and I don't see any sign of maliciousness. Their reaction is probably a little over the top.

[Dauric]

That's a pretty bad way to code such an app.

The guy in question is a marketing major, not comp-sci. He obviously has some ability to write code, but odds are he doesn't have a firm grasp of 'best practices' and probably went with whatever worked, which in this case apparently equated to a DOS attack on the university.

In this case, having a chat with the guy and getting the code fixed is probably going to be more useful than disciplinary action.

Sure, the guy screwed up. But hey, he was at least attempting to provide a useful service to enhance the college, and I don't see any sign of maliciousness. Their reaction is probably a little over the top.

I'm not saying anything about the school's reaction (which as an aside I suspect is bureaucratically anchored in their school policies), but rather the assertions being made about how an app coded with best practices in mind wouldn't be a drain on the university's servers. There's nothing to suggest that best programming practices were being used in the creation of the app and it could have eaten -more- resources than we're theorizing depending on how it was coded.

[Heisenberg]

There's nothing to suggest that best programming practices were being used in the creation of the app and it could have eaten -more- resources than we're theorizing depending on how it was coded.

There's also nothing to suggest that they weren't used.
There's also nothing to suggest that he did actually violate TOS or policy.
There's also nothing to suggest he meant for it to be used by such a large group of people. It very well could've been a homebrew for a few friends that spread virally.

I don't think there's enough information here to condemn the kid, so I'm leaning towards a presumption of innocence.

[Dauric]

There's nothing to suggest that best programming practices were being used in the creation of the app and it could have eaten -more- resources than we're theorizing depending on how it was coded.

There's also nothing to suggest that they weren't used.
There's also nothing to suggest that he did actually violate TOS or policy.
There's also nothing to suggest he meant for it to be used by such a large group of people. It very well could've been a homebrew for a few friends that spread virally.

I don't think there's enough information here to condemn the kid, so I'm leaning towards a presumption of innocence.

-AGAIN- I'm not saying anything about the university's decision, I'm only addressing the assertions on how much bandwidth the app would have used and whether it was an undue drain on the university servers. There's a lot of suggestions going around in this thread that are being made by people who obviously know what they're doing, when there's no evidence that the student had that same level of competency. Was the app legitimately a drain on the servers ? It depends on how it was coded, and since it did result in an effective DDOS situation at one point it's probably safe to assume that it wasn't the most streamlined code or the most efficient SQL queries.

Note: I'm not saying his degree in marketing excludes him from being a good coder, but it's certainly not his career focus. Even if it was I've seen professional document management software, stuff certified to adhere to Dept. of Defense standards, use an add-on web app that put security information in the URL. You could bypass all their DoD internal security by hand editing a 0 to a 1 in the URL. Even professionals aren't immune to colossal fuckups.

[kiklion]

Maybe this is all a marketing stint to get his name out there? He should get his degree tomorrow!

[Heisenberg]

Personally, I don't care whether or not it was effectively a DDOS. If it was, that's enough for the University to take immediate action to protect themselves, but not, in my opinion, enough to justify punishing this student.

It seems very unlikely that this was done knowing it would slow or stop access to the network since that defeats the purpose of the app. So even if it was effectively a DDOS, it wasn't an intentional DDOS. It was probably a mistake, and a mistake shouldn't be punished that severely.

[Dauric]

Personally, I don't care whether or not it was effectively a DDOS. If it was, that's enough for the University to take immediate action to protect themselves, but not, in my opinion, enough to justify punishing this student.

It seems very unlikely that this was done knowing it would slow or stop access to the network since that defeats the purpose of the app. So even if it was effectively a DDOS, it wasn't an intentional DDOS. It was probably a mistake, and a mistake shouldn't be punished that severely.

I suspect the like most bureaucracies their TOS for the website -and- the student policies combined don't make that distinction and thus the reason the organization isn't lifting the punishment. It's not uncommon for contractual obligations (such as punishments for vandalizing school equipment) to be unjust in unusual circumstances.

[induction]

I'm surprised the article and the posts here seem to be mostly concerned with the DDOS. I personally think his plans to charge for the app are a much bigger issue. When I was at Maryland, you couldn't call your student group "University of Maryland X": it had to be "X at the University of Maryland" or similar, because the former implies official sanction, which is not cool if you don't have it. Point being, universities defend their brand ferociously.

This.