What is the proper response when a professor teaches a side topic related to the course but the information is wrong?

Question

I've been a software developer for about 10 years or so and am familiar with various security related concepts (SQL injection, server-client validations, man-in-the-middle attacks, etc.)

I'm upgrading from a college diploma and found myself sitting in an "Enterprise Application Development" class learning about SQL.

The core content is very basic and normally doesn't cover security, but the teacher decides to talk about it. He advised students to use mixed cased table names as "security" so that it is harder to guess. This is known as "Security Through Obscurity" and is one of the least effective form of security (it is treated as insecure). Security is talked about throughout the class and they're all forms of the same thing and extremely dangerous since it is completely ineffective.

As a professional that knows better, if he was an employee I would've had to sit him down and have a thorough talk, and probably advise some security training.

What can do I do as a student? Since the other students are probably clueless and security is not even one of the program's topic, there is no foreseeable chance for correct learning and they will probably end up doing this in the future, possibly jeopardizing their own career, the company, and all the data they work with.

Answer 1

If the teacher is not a reasonable person, and some are not, you should keep your head down and hope that your fellow students will get some real security training, at least on the job, before making decisions in this area.

If the teacher is reasonable, select a very small number of references on the topic, preferably including peer-reviewed papers. Look for an opportunity to talk with the teacher privately, definitely not in class and preferably without any of your fellow students nearby.

Explain that you have had to learn about some security issues because of your jobs over the last 10 years, and that you have more up-to-date information than is being presented in class. (Yes, I know something of the history of security-through-obscurity, but we are being tactful here). Offer your references. How you play it from there on will have to depend on how receptive the teacher is, and how helpful you are willing to be.

Answer 2

I don't know enough of the details to actually judge, but there is a benign explanation. You say the the course overall is quite elementary. You also say that it is focused elsewhere than security and that this is a side topic. Let me start with that.

There is a Pedagogical Pattern called Spiral in which it is suggested that advanced topics can be mentioned in early courses just to put out a few terms and to put the ideas into the heads of students so that when they see the topic later, in a more complete way, they have already seen a few basic ideas. The later course then builds on the earlier base. So, learning is a spiral with each loop being deeper than the earlier one.

Unless the instructor is presenting obscurity as an important security technique, perhaps they are just introducing the idea that security, itself, is an important consideration (to be explored later). After all, if they give the complete course in security within the current course it can't meet its objectives. It would be bad, of course, if they suggest that obscurity is sufficient.

Look at the overall picture before you make a judgement. You may not need to challenge the professor, but it might be worth a visit to the office to see what their goals are in opening the door to security in this way. In general, mentioning advanced things early to set the stage for later development is a good thing that gives students a bit of perspective on the whole field.

---

Related to this is that instructors teaching a first programming course might have students implement something simple like the Caesar Cypher, and mention the idea of encryption, but not suggesting that this is a good one.