At my old public highschool, the District (maybe even the State)
mandated that every class must have a final exam, and it must account
for 20% of the student's grade. Of course, this fails to explain how
it is even possible to give a final in, say, Vocal Music. The teachers
hated it and even the principal sympathized, and thus was born the
Exemption System.
I should start with a brief primer of how my school's computerized
records worked. A few years before, they discovered that their
existing client/server OLE networked grading system was hackable (some
fool stole the client off of a public network share and told everyone),
and so the District authorized a multi-million dollar expenditure to
'upgrade' the system. The upgrade consisted of constructing a Java web
application that was hosted over SSL. There were strong password
requirements and MD5 hashing that they undoubtedly borrowed from some
other library, and all the other bullet points you need in a
multimillion dollar government contract. What everyone failed to
realize, however, was that all the SQL commands were being sent to the
SQL server in unencrypted plain text over a standard TCP connection.
One of the 'hacker' students must have noticed this on ettercap, or
something, because it wasn't long before someone opened a telnet
session to 172.16.55.55:2500 and sent "DROP TABLE GRADES." Of course,
the SQL server kept no IP logs, and even if it did, there were no logs
to tie an IP address to the user logged on at that workstation, and
there were several well-known anonymous accounts (more about that in
another WTF). The software company characterized the loss of 100% of
the grades throughout the entire school of 2500 students as a "server
crash" and pushed for more upgrades and more patches that the State
paid for. In most cases these 'patches' amounted to introducing new
loading screens that said exciting things like "Encrypting access..."
and "Enabling cyphertext..." (not kidding). This continued for several
weeks, and eventually teachers went back to tracking grades in a
physical gradebook, and just re-entering every week after a "crash."
Anyway, this same SQL server and software was used to track absences,
and someone had the bright idea of extending it to form the Exemption
System. The idea was that if you missed only a couple of classes a
semester, you would receive an Exemption Pass that you could use in a
single class to skip the final exam. Of course, there was great
success duplicating the paper Exemption Passes (attempts to thwart this
included deliberately misspelling the name of the high school).
Automating this should be easy enough, right? Just write an SQL query
that SELECTs all STUDENTS WHERE ABSENCES < 3 and hand them all
passes.
There was also a little bit of logic to exclude certain absences
(bereavement, jury duty, etc. should not count against you).
Unfortunately, there were several absence codes stored in the database
that were not really an absence--that is, the software would sometimes
store other information (a student's year, or their state-wide test
scores) as a "fake" absence code. If you have "J" marked on a day,
that might be jury duty, and "B" might be bereavement, but "L" on
January 25th means you're a Sophomore. Long story short, many students
who should have gotten exemption passes did not. Mass panic.
So half the student body (1200+ students) shows up in the main office
on the day exemption passes were handed out at 4:00PM, demanding
absence reports (fortunately these were generated in a way that they
did not include "fake" absences). The students were to go to one
office, get their attendence report printed out, go to another office
on the other side of the building and get it checked (and hopefully get
an Exemption Pass). Of course, there were only one or two days before
the exams, because the administration didn't want the precious
Exemption Passes out long enough for students to be able to forge them
(it would be easier to forge the Attendence Reports, they looked for
all the world like Excel spreadsheets). This means that 1200 students
needed their pass TODAY, and the Attendence Office typically had a
turnaround time of 24 hours (e.g. you would submit a request for a
report and receive it the next day). Somebody discovered that teachers
could print out attendence reports for their students, and thus the
Attendence Office was saved from printing out 1200 reports, and
individual teachers had to print out the reports.
So I got my report printed out by a sympathetic teacher and headed to
the Main Office to fight with the powers that be. There were three
people dealing with 1200 angry students. I waited in line for a few
hours and finally got in to see The Exemption Lady. She was bald and
overweight, with curly graying hair. She looked at my Attendence
Report and determined that I had more than three absences. The
sympathetic teacher had accidentally printed out an Attendence Report
for the year, of which this was the second semester, and the Exemption
Passes were handed out based on per-semester attendence (not per
year). Now this wasn't some type of totals sheet--the Attendence
Report had a row for every school day and its date along with the
attendence code. So it would be easy to just start counting in January
on page two rather than in August on page one. This logic completely
escaped her--she counted the absence codes, completely ignoring the
dates, and she counted more than three. When I got up from my chair so
that I could point to January on the page and the fact that it might
make sense to start counting there, she flipped out and threatened to
have me suspended for what she perceived to be "agression." I was a
white kid with glasses, weighing maybe 160, and she weighed like 220,
at least. Anyway, I decided that it might be easier to just get
another report.
And so I did, this time making sure the teacher clicked the "Semester
only" button. Got back in line, waited a few more hours (it was like
7:00 at this point). Saw the Exemption Lady again, this time with a
new report, that started on page two with "January". This was
literally the exact same document, except it had 60-70 records less
than the last one did. She held the two reports side-by-side and
looked slowly to one and then to the other. I was thinking "any minute
now, she will see it! One is for a single semester and the other is
for the entire year!" After a few minutes of careful scrutiny she held
them both up to the light. I don't know what watermark she expected to
see; they were both printed out using the school's printers. Finally
she said "This is odd. According to this report, you have too many
absences, but according to this other one, I can give you a pass." I
sat there, dumbfounded, hoping to get away without being hauled out for
'agression'. Finally, she put both reports down, gave me a long
lecture about how I much further in life I can get if I'm not
'agressive', and she gave me my pass.