Item — HN Reader

If you look at the GitHub commit history, the repo was created before the blog post from UW, and also never contained actual courses.

This is important, because it's the only explicit reference to "trading open spots" they've made.

The Registration Abuse policy covers access to the registration system for:

* buying or selling one’s seat in a class,

* holding seats for another student,

* or otherwise registering for a section that one has no intention of taking.

It's unclear if HuskySwap actually violated this policy, given that it never actually accessed the registration system and no students used it in conjunction with the registration system of the school.

1 comments

UW student - see the "Tampering and Abuse" section of (https://registrar.washington.edu/registration/policies-proce...) which has been around for much longer and is well communicated with students.

Yes, I saw that linked in the top comment.

What isn't clear is how this site actually violated that policy, if there was no course slot trading actually occurring. You could describe it as an attempt, but in this situation, the student asked for permission from the school before doing something that would violate their policies.

To use an analogy, if I sneak notes into an exam, that is likely academic misconduct. However, creating a formula sheet and asking the professor if I can use it is not academic misconduct. I wouldn't consider that to be attempted cheating.

He might have violated the following by testing alone:

> The use of robots and other automated tools to submit registration requests is expressly forbidden.

Some sort of testing will likely have happened, in which case an automated tool has been used. Even if only by TFA himself.

Also note:

> Because use of scripts, robots, or other automated queries can adversely impact University network and computing resources and interferes with equal access to registration, such automated querying of registration-related resources is expressly forbidden. Violators may have their access to University network and computing resources terminated and may be subject to action by the University under applicable law, regulation, or policy, including but not limited to, discipline under any applicable University conduct code.

The whole purpose of the project is to violate this clause. I agree that if no testing had happened, no sanctions should apply because the clause above doesn't say anything about attempts of use being sanctioned.

I'd personally describe it as an attempt for two reasons, although reasonable minds can differ:

1. They made substantial progress towards a working tool with available code, before requesting permission from the school. That request was to enable parts of the site, not requesting permission to develop/release it publicly.

2. It is pretty clear to students that you aren't allowed to mess with any of the registration systems/process (e.g. trading/holding classes). Your analogy has a very reasonable question (are notesheets allowed) vs a policy which is made very clear.

A different analogy is creating a hidden device to cheat on exams, then asking the professor for the exam room's wifi password as to enable it it in the future. While the situation is not as clear-cut as the analogy, I hope it helps show my perspective.

Yet another analogy is designing and presenting a radar detector/jammer but never using it on public roads.

Until the author has used the tool on the UW server during registration, he is not violating their policies and procedures: He hasn't attempted to tamper with records. He admittedly hasn't used their registration system with this tool. Those are the two key phrases in their policy. The text goes on to specifically describe abuse as "use" of a script or robot. There isn't anything forbidding a student from authoring a script.

One problem here is that by releasing the source, it makes it easier for another student to exploit the system. In the case where another student uses this tool during registration, the other student is fully responsible.

Besides all that, it's a great project idea because everyone in his program would instantly relate to the problem.

It's easy to understand the University's overreaction---and it is an overreaction. The better solution from UW would have been to sternly inform the student(s), "The website can never go live. It dies as a proof of concept. Please use your own dummy data; no API access. A disclaimer must be added to any class demos (presentations, code, etc.) with the Tampering and Abuse policy, and that this only uses generated data. Our efforts to improve the registration system in the future will be X, Y, Z."

This student has done nothing wrong (yet) (based on what he revealed) and is getting punished for being near the border.

How does a fake site, with fake classes, that had nothing to do with actual registration, violate that?