Pretty sure it's Apple Menlo, which IIRC from my OS X experience is the default font for Terminal.app. (Or is it? Might have been Monaco. I'm sure it's one of the two, and the other is the one I ended up preferring for reasons I've since forgotten; they are very similar overall.)
Monaco is a vectorization of a bitmap font that dates back to the original Mac OS (possibly even older). Menlo is an entirely separate font -- it's a version of Lucida Sans Mono with some minor tweaks by Apple.
This one is clearly Menlo. Monaco had some peculiar letterforms, including an odd "asymmetric" loop in lowercase letters like "b", "g", and "p". The LSM / Monaco shapes for those letters are much rounder, and that's what I see in that image.
You can roll your own localtunnel too if you want. I was working on a shopify app earlier this year and needed a consistent URL to test with. I wrote a tutorial on how to do this here: https://neil.quora.com/Roll-Your-Own-LocalTunnel-With-Nginx
I advice everyone to read the original expulsion letter. It is just one page, and the parent's post completely (and I must assume intentionally) twists the facts as mentioned in the letter to make the student look better.
In particular the letter claims that the student has in fact attempted to exploit the SQL injection to gain unauthorized access, and that both notifications to the IT department were made after they detected him and blocked his account.
Actually the letter says nothing about detection and all other sources[1][2] about this matter agree that the 'detection' took the form of a voluntary disclosure, which was rewarded with an NDA demand under threat of arrest.
So it seems you are the one twisting the facts for reasons unknown.
---
[1] "Al-Khabaz immediately alerted the head of information technology for the school about the breach in the Omnivox software used by the college. At first he was thanked for the discovery." -- http://www.thestar.com/news/article/1318163--montreal-studen...
[2] "they discovered that by exchanging other student numbers in the encrypted links, they could easily obtain information such as the social insurance numbers, home addresses and phone numbers of more than 250,000 students. Al-Khabaz said he informed the school’s head of information technology immediately after discovering the vulnerability in the school’s Omnivox software and was congratulated for the discovery." -- http://www.cbc.ca/m/rich/canada/story/2013/01/21/montreal-da...
Read point 2: "On September 21, the IT Policy was applied and your network and portal accesses were suspended."
Read point 3: "On September 22, you admitted to these attacks in writing."
Compare the dates. According to the letter, his disclosure came after the account was suspended. Implying that they did detect the attack before he admitted to it.
An admission in writing is not the same thing as a disclosure.
You're using uncorroborated dates in a document that's clearly worded to paint the student in the worst light possible to infer a 'detection' which it doesn't mention and for which there is no evidence. You're then sharing your inference as documented fact. That's a smear.
I was merely communicating the content of the letter. Whether its claim or the contradicting ones of the student are true, I don't know. What I do know is that mrtron's "translation" of the letter conveniently leaves out the actual exploitation of the SQL injection and the blocking of the account that are claimed to have happened in the letter, and is therefore completely unfit as a summary of the letter.
I did read the blocking of his account to mean that he was detected in some form. You may not agree with my reading of that letter, and I certainly don't agree with mrtron's reading of the letter, but that's why I asked people to read the original letter anyway.
I never said that it was not a case of responsible disclosure. I simply don't know, the evidence at this point seems insufficient to support either conclusion.
What kind of IT Policy was applied? Was this automatic, did they detect the event before he alerted them, or did they do this after he had disclosed the vulnerability?
The first application of the IT Policy is the interesting one here, as it lays the foundation for - or undermines Hamed's case as a white hat.
