Tbh this is extremely annoying for high school/college students too. High schools are in the middle of AP tests, and many universities have yet to finalize grades, so overall this is a terrible time for this to happen. After the first issue a few weeks ago Canvas should have upped their security and prepared for another attack. They also should provide better communication. If Canvas is down for more than a few days, many schools and universities will have a lot of trouble when it comes time to publish course grades.
Canvas online again as ShinyHunters threatens to leak schools’ data
251–260 of 690 posts
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#252My kids are in the middle of their finals week. What a mess. Universities know nothing, Canvas claims to be in a "scheduled maintenance", and one Prof claims to "not have any copies of material offline" which seems pretty negligent. Sounds like one section of a popular class will be doing paper exams while other sections had Canvas-based "half points for 2nd attempt"-type exams earlier today. How soon before names &…
The "Scheduled Maintenance" is just total B.S. and just honestly makes them look worse. Apparently according to their status pages this is what 99.996% uptime looks like. Pay attention lol.
I was going to make a joke that they should have just taken a page from the military and said “Rapid Unscheduled Maintenance”, but I guess that’s actually the phrase for it.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#253I hate Canvas. I would rather run a course on GitHub. But our university forces it on us. And now this.
Do you remember how Canvas was a gigantic improvement over Blackboard? And GitHub doesn't provide a way to record grades that remain private per student last I checked, much less sync them to the university, or 99% of other things Canvas does. I don't love Canvas, but it's far, far preferable to a world without it.
[deleted]
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#254Earlier quoted context omitted.
> let classes that normally count for a grade just submit grades as pass-fail. Because what else can you do? Schedule a single exam and that's your grade for that subject? That's how it should work anyway, credits for work during semester (or worse attendance) are not needed to evaluate if someone learned the material, give them an exam and done.
Exams have performance variance. Otherwise you're only getting a pass/fall signal in any case.
Exams are the only fair way to evaluate if someone knows something (written or oral, in person). Take homes and attendance are just window dressing.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#255Earlier quoted context omitted.
Students having records of what their score was doesn't prove to the professor / university what score they received. "FWD: Exam 1 Results" is not especially auditable.
As opposed to a screenshot of a website? Presumably the professor has a spreadsheet of all assignment grades that is submitted to the school?
Nope! We're encouraged to keep all that exclusively in canvas. (As noted, I have my own spreadsheet. But I'm an outlier.)
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#256Earlier quoted context omitted.
> It should be illegal It should be illegal to host insecure services, especially when you're dealing with PII. Breaches keep happening and nobody gives a fuck, because the worst that'll happen is you might lose a handful of customers and buy some "credit monitoring". Incidents like this should be followed by an audit and charges being laid. Send corp officers to jail for negligent security failures. If you can go to…
I don't think that criminal negligence is the most helpful legal tool for incentivizing improved security. It's too hard to prove negligence. Instead, there should be standard civil penalties for leaking various degrees of PII paid as restitution to the affected individual. Importantly, this must be applied REGARDLESS of "certification" or whether any security practices were "incorrect" or "insufficient". Even if the…
The only right answer.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#257A friend who teaches at MIT said they were hit by this. I found it ironic and a little sad that a place like MIT doesn't have an IT staff that can maintain their own on-prem solutions for things like this. But it turns out that MIT used to have their own homegrown system, and recently switched to Canvas. Bet they're regretting that now. The build vs. buy decision seems to have swung very hard toward buy in the last d…
Homegrown systems are expensive to maintain and usually still fail to match up to the commercial options available at this point. LMS's are also just really complicated pieces of software. I worked on my university's own version as an undergrad.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#258Perspective from the trenches: I teach at a university that uses Canvas. We are in our final exams period right now. We got our first email (from Academic Affairs) notifying us that it was down at 5:17pm EDT this afternoon, with little info; followup emails were sent at 6:24 and 6:57 with more info, but mostly about how we would be compensating for it and not about what actually was going on (other than, "nationwide…
> let classes that normally count for a grade just submit grades as pass-fail. Because what else can you do? Schedule a single exam and that's your grade for that subject? That's how it should work anyway, credits for work during semester (or worse attendance) are not needed to evaluate if someone learned the material, give them an exam and done.
That's maybe something a school can do if exams are next week, or after.
At my school, tomorrow is the last day of exams. Most of the students have left campus. There's no time or mechanism to schedule an(other) exam.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#259Earlier quoted context omitted.
Not much overlap between students and HN these days, though? I’m an extremely rare outlier afaik :) The administration has so far opened with one “Canvas said” and then an hour later one “Canvas is down indefinitely” email noting that they’re aware it’s serious. (Canvas is a glorified wiki for teaching students, with quizzes and such, for those unaware.)
> Not much overlap between students and HN these days, though? That's my biggest fear.
Is there any internal data on where students are going instead?
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#260Earlier quoted context omitted.
Students having records of what their score was doesn't prove to the professor / university what score they received. "FWD: Exam 1 Results" is not especially auditable.
You forget things can be signed, with the key owned by the school. It can be done.
Does signing really make this easily auditable from the professor’s perspective?