American View: What a hacked OS teaches us about user psychopathology

Risk Management17 Jun 2026

When I was 10, I stumbled across a silly T-shirt in the kids’ section of a department store catalogue. It showed two cartoon children running towards an iconic Little Red Schoolhouse under the boldfaced title “RACE … for the bathroom!”

When I was 10, I stumbled across a silly T-shirt in the kids’ section of a department store catalogue. It showed two cartoon children running towards an iconic Little Red Schoolhouse under the boldfaced title “RACE … for the bathroom!” Under the cartoon kids was the text “STARRING … Willie Makeit and Betty Don’t.” The running cartoon boy’s expression helped sell the premise; his features were contorted in discomfort. It was a simple gag that resonated with a primary school audience: when you wee yourself in public it’s a humiliating disaster, but when someone else wees themselves it’s hilarious.

No, I didn’t buy that shirt. Even if I’d been able to afford it, I wouldn’t wear it. The joke might’ve been acceptable at school, but I wasn’t going to chance it. I’d had my fill of trips to the principal’s office. Someone else could run that risk, thanks.

All this is to say that I understand the desire to share humour in group settings – it’s kinda my thing – but I take care to avoid tripping management’s “red lines” when cracking jokes in the cube farm. You never know who’s going freak out over a joke they mishear or just don’t understand. “Know your audience” and “stay in-bounds” are my imperatives for office humour. Other folks, though, don’t seem to understand the risks they’re running when sharing what they feel is hilarious with an audience of strangers. Take, for example, the strange case of PhalOS.

My main work-study job in university was providing tech support to other students and faculty members in the campus computer labs. It was fabulous work if you could qualify. We had three different types of labs based on three different computer architectures: Macintosh, DOS, and mainframe (VT-100 green screens, just like in Fallout).

… but with significantly less cannibalism and Super Mutants.

New users traditionally got flummoxed at the start of every new semester. Each user had to bring their own boot disk and application disk to use the “small” computers in our labs: 3.5” floppies for the Macintoshes and 5.25” floppies for the PCs. Rich kids whose parents could afford PCs with hard drives often didn’t know how to create a boot disk. Poor kids (like me) couldn’t afford to buy Microsoft Word to write our assignments. Us lab techs helped the newbies get set up and taught them how to use their new tools. I loved that part of the job; equipping and empowering new peers was deeply satisfying.

After a year on the job, I learned why it wasn’t the gormless newbies that we needed to be warry of … The technical weirdoes were our natural adversaries. Comp-Sci majors and proto h@x0r$. You had to treat their workstations as potentially radioactive.

My favourite example of this came during spring semester, sophomore year. I was working an afternoon Mac Lab shift in the student union. A student came in, showed me her ID card, registered for an hour in the only open cubicle and appeared to get started. After a few minutes of tense silence from the newcomer’s direction, I heard her get up and shuffle my way.

“There’s something … wrong … with my computer,” she said in way too serious a tone. I was well acquainted with users being frustrated, desperate, and/or angry, but this was my first encounter with naked revulsion. I promised to sort it straightaway.

I assumed that her issue was going to be something mundane and easily sorted.

Her machine was booted and running when I got to it. Icons for several apps were visible on the desktop. I asked the student what wasn’t working. She told my is a low voice that the Mac had already been booted when she sat down. That shouldn’t have happened; these were dual floppy Macintosh SE machines; they didn’t have hard drives. You booted them from your own floppy and had to shut your session down before you got your boot floppy back. This one, however, was running and both its FDDs were empty.

I went to reboot the Mac and instantly understood why the student was acting discombobulated … The System 6 OS that had booted this computer had been extensively modified – “hacked” in the original sense – to resemble a computer from Barberella. Every menu option had been changed; for example, the Restart command now read “Do it AGAIN!” while the Shut Down command was changed to “Roll over and go to sleep.” Every icon was now a crude pixel art phallus that toggled between … let’s say “attentive” and “expended.” It was an X-rated Macintosh long before MacOS X was an idea.

This operating system mod was wrong on so many levels. To be clear, I wasn’t a Phallus-tine; the sophomoric text and pixel art didn’t shock or offend. From the student user’s perspective, though, the running OS was incomprehensible. She was a new user and hadn’t memorized the locations of all the commonly used menu entries in the GUI, so she couldn’t use the machine. More importantly, I knew, was the likelihood that the booted OS was probably thoroughly borked; I suspected that whoever had gone to so much effort to … *ahem* … personalize their user experience might’ve mucked about with more than just the user interface. Some bawdy change they’d made to the guts of the OS might cause the new user to lose or corrupt her work. Couldn’t risk that!

Two hard reboots later and the grateful student was back in action. I reported the incident to the Help Desk and all of us field techs kept an eye our for the return of the Freaky Freudian. I never heard about a second encounter, but the prankster is probably still out there … somewhere … masquerading as one of us normal folks …

Look to your left and right, then to your front and back. One of those people might be the secret p33n pix3l p@aint3r. Probably not, though, since this happened in Texas.

The PhalOS incident has been my favourite example of “inappropriate user behaviour” since it happened. For the life of me, I can’t fathom why this Junior h@x0r brought his pornographic user interface experiment into an open student computer lab and left it running. It was like he was eager to get caught; like he was trying to prove a point, maybe. This is one of those “psychopathology of the suspect” challenges for experts with more degrees than I have.

Still, it served as a great lesson that came in handy when I started running my own business networks. Some people like to push the rules to see how much they can get away with. Some of my favourite cybersecurity authors have opined that this specific flavour of psychopathology is about being compelled to violate boundaries to prove to themselves and others that the offender is so special that the rules that govern everyone else don’t apply to them. Such people are compelled to push every boundary, just because there is one.

This is why the “psychopathology of the offender” part of every cybersecurity program is so danged important. Everyone working in our field needs to understand just how far some users will push their limits. They can’t help themselves; they’ll blow past all the established behavioural boundaries and wear the offensive T-shirt while they’re doing it. Their “main character syndrome” compels them to transgress every boundary and challenge every authority. It goes with tech work like novelty T-shirts and bad jokes. Sometimes it’s even funny.

Risk Management