Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

101–110 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#101

Post by asdff »

afavour wrote: post #92
asdff wrote: post #74

Earlier quoted context omitted.

Universities used to do this sort of stuff themselves. Then it became a business handled by purchasing rather than needs met by the department themselves.

In fairness in the era where universities did it themselves the tech requirements and expectations were dramatically lower.

Tech requirements are the same as they always were. One needs to ask whether they need so many frameworks to host some files on the internet and submit some files and perform spreadsheet calculations. We still used one of those First Age 1990s websites for sort of pre lab quizzes this one class when I was going through it, and it might have looked a little "old" but I mean it did the thing and worked for years and will continue to do the thing and work for years.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#103

Post by Avicebron »

myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

We could also throw the CEOs of companies who don't properly secure their infrastructure and pay their security engineers enough in jail. A little justice on both ends.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#104

Post by frollogaston »

thecatapps wrote: post #38

I remember when I was in high school (2016? 2017?), I found a super simple XSS in the assignment submission form and told the programming teacher. Canvas then proceeded to lock my account and got me my first (only?) detention. Good times.

Uh, did you tell the teacher by exploiting the vuln?

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#105

Post by ibgeek »

sharkweek wrote: post #58

My wife is in grad school at a major university and is dealing with this right now the week of midterms for spring quarter. I totally understand why a university wouldn’t want to bake their own learning portals but just feels like such a single point of risk to use third party solutions for something like this. Back in my day… all we had was a school email via on-premise services. I guess we registered for classes in…

Moodle is an open-source LMS that can be self-hosted.

https://moodle.org/

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#106

Post by parliament32 »

myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

> It should be illegal

It should be illegal to host insecure services, especially when you're dealing with PII. Breaches keep happening and nobody gives a fuck, because the worst that'll happen is you might lose a handful of customers and buy some "credit monitoring".

Incidents like this should be followed by an audit and charges being laid. Send corp officers to jail for negligent security failures. If you can go to jail for accounting fraud, you should be able to go to jail for cybersecurity-promises-fraud.

They claim to be compliant with a number of security standards [1]. I would love to see a postmortem audit of how much of this they actually implemented.

[1] https://www.instructure.com/en-au/trust-center/compliance

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#108

Post by frollogaston »

bombcar wrote: post #95
vinni2 wrote: post #23

I hate Canvas. I would rather run a course on GitHub. But our university forces it on us. And now this.

How does Canvas compare to things like Moodle? Or is it an entirely different class of beast?

Wow, I last used Moodle in 7th grade, 2008. It seemed like a similar thing.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#109

Post by mikeweiss »

myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

Shouldn’t we be focusing on making it harder to pay overseas criminals in the first place? /ahem/ crypto platforms facilitating transfers to bad actors /ahem/

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#110

Post by quadrature »

asdff wrote: post #79
matthewfcarlson wrote: post #57

I remember circa 2010 a friend of mine at college was like “blackboard sucks, let’s build something new”. At the time I poo pood the idea and lo and behold canvas came out a year later. Outside looking in, they been crushing it.

I used both and could not tell you the major differences. I feel like they are equivalent in the bread and butter features. Most people don't use 99% of the functions they bake into these. Just use it to hold the syllabus, maybe hold the slides, submit assignments, and spreadsheet for grades. All stuff you can do with email + spreadsheet already. Maybe throw in a shared drive for larger files, which every university…

"Equivocal describes something ambiguous, uncertain, or open to multiple interpretations, often used to intentionally mislead or evade."

do you mean equivalent ?.

Post reply on HN