Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

461–470 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#461

Post by ericpauley »

freedomben wrote: post #444
hackyhacky wrote: post #434

Earlier quoted context omitted.

I've been using Canvas for years and it's some of the worst written software I've ever used. It's slow, buggy, with an atrocious 2001-era UI. It's a CRUD app that has no excuse for being so cumbersome. I'm not surprised at all that their security is just as bad as the rest of the product. A bright undergrad could build a superior replacement in a few months, even without AI.

I won't disagree on usability. It has some sharp edges for sure. But > A bright undergrad could build a superior replacement in a few months, even without AI. Is quite naive. Canvas is not at all just a crud app. You can view the code yourself as it's AGPL

What component in particular goes substantially beyond CRUD?

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#462

Post by hootz »

0123456789ABCDE wrote: post #435
myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

i disagree wholeheartedly with this. a loved one, gun to the head: "please pay the ransom, i don't want to die!" what's your play now? save loved one, and go to prison? or worse, bank blocks transfer, and they die? go ahead and tax ransom payments (0 tax if human life at risk, 10x otherwise) if you have to, but making it illegal feels disconnected from the messiness of the real world. then, go after the attackers.

The idea behind blocking ransom payments is to disincentivize asking for ransom. If you know it's almost impossible to pay ransom, the risk of not getting paid for your attack is much higher.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#463

Post by timdiggerm »

onetimeusename wrote: post #281
Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

Live streaming of class through Canvas is very popular. Quite a few people just watch from their dorms. So maybe people will have to come back to class, that will be entertaining. The class rooms are almost standing room only (sometimes they are) on the first day of class and then gradually thin out. Sometimes 10 or so people show up out of a class of 100. If Canvas is not back up soon I think it could actually be di…

What a failure of university leadership to allow or even encourage that practice

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#464

Post by bearjaws »

walrus01 wrote: post #393
royal__ wrote: post #257

Earlier quoted context omitted.

Homegrown systems are expensive to maintain and usually still fail to match up to the commercial options available at this point. LMS's are also just really complicated pieces of software. I worked on my university's own version as an undergrad.

There is no need to reinvent any wheels by making a homegrown LMS. Moodle exists and is completely open source. Lots of large institutions use it. Even in the case that you need to do something really weird with it that isn't solved by one of the many plugins that exist, you're already 90% of the way there with its base platform, and only 10% remaining for DIY software development.

Moodle also scales to pretty large schools, I work on an instance that is over 27k students. Integrates with pretty much every platform, authentication, etc.

And it's pretty easy to customize which is nice.

Throw it in an auto-scale ECS cluster and you have something that goes from 100 students to 20k easy.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#465

Post by bradley13 »

isityettime wrote: post #242
Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

What? What makes Canvas accessible in a way that HTML and PDF files are not? It's true that PDF readers aren't the best for screenreaders, but surely you can just upload a .html copy as well.

Why does everything have to be 100% accessible?

I'm a prof. When I have a student with special needs in my class, the administration tells me ahead of time. I make the necessary allowances - and those differ from case to case, anyway: whether it's extra time in exams, or someone who is deaf, or someone who is blind, or whatever.

When it happens, I make the necessary allowances. When I don't, then...I don't.

The obsession that everything has to be 100% accessible, for every kind of disability, all of the time? That's just nuts, not to mention a complete waste of resources.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#466

Post by kzrdude »

adampunk wrote: post #52
bagels wrote: post #48

It's been a long time since I was in school. What does this software do?

If you’re a student or teacher: nearly everything that matters. Homework, materials, lectures, grades. It’s all on canvas.

For my uni: mostly only lecture notes and materials.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#467

Post by forgetfreeman »

shnock wrote: post #365
forgetfreeman wrote: post #140

Earlier quoted context omitted.

Maybe. I still remember the Drupal community sneering at the New York Times when they unveiled their homegrown online news platform bitd. After 15 years of recursively scraping ad-hoc porn sites off of server hard drives when clients dragged their feet on migrating to latest versions I 'm less certain the assumption that homegrown == less secure is as valid as it sounds.

Could you explain the last sentence a bit more? I don’t follow

Back before the Laravel folks utterly misguided but weirdly popular attempts at turning PHP into JavaScript gutted the Drupal community (your boos mean nothing, I've seen what makes you cheer) one of the most common outcomes of a site getting hacked was malware-infested porn sites would be uploaded to the site server. This failure mode wasn't particular to Drupal, it's just what happened when websites got hacked. This was the same period of time when the Drupal project was reporting ~16M active installs, had literally thousands of developers volunteering code to the core development project, a dedicated security team, and an automated test suite that ran around the clock.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#468

Post by ryukoposting »

walrus01 wrote: post #393
royal__ wrote: post #257

Earlier quoted context omitted.

Homegrown systems are expensive to maintain and usually still fail to match up to the commercial options available at this point. LMS's are also just really complicated pieces of software. I worked on my university's own version as an undergrad.

There is no need to reinvent any wheels by making a homegrown LMS. Moodle exists and is completely open source. Lots of large institutions use it. Even in the case that you need to do something really weird with it that isn't solved by one of the many plugins that exist, you're already 90% of the way there with its base platform, and only 10% remaining for DIY software development.

My university (a very large state school) transitioned from Moodle to Canvas while I was a student (2016-2020). They transitioned because Moodle sucked. Profs hated it, students hated it more. Basic things were difficult to find.

A lot can change in 10 years, sure. Maybe Moodle is better now (I doubt it). I'm all for self-hosting a LMS. But, can we at least self-host a good one?

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#469

Post by smcin »

weird-eye-issue wrote: post #448
smcin wrote: post #430

Earlier quoted context omitted.

I understood your comment perfectly fine. I'm asking which graduates of which colleges you were referring to. It looked like you were generalizing about US HS and colleges. If so, plenty of other countries' HS and college education systems work better, so your comment doesn't extend.

I didn't even reply to you.

I'm not confused.

Your comment stated that college doesn't add much to a person's employability. (If you had wanted to be less obfuscatory, you could simply have said "a [HS] education is already adequate qualification for many jobs; college doesn't add much").

That was your claim. (I don't think your claim is correct of many OECD countries' colleges, but it was the claim you made.)

You then replied to J-Kuhn to say that they had misunderstood your comment by (mis)paraphrasing it as "Students attend college to become qualified to work."

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#470

Post by BigTTYGothGF »

dotancohen wrote: post #336
gucci-on-fleek wrote: post #315

Earlier quoted context omitted.

I've never used Canvas before, but all the LMSes that I've used allow students to enable emails whenever anything is updated, including when grades are posted. This is off by default because it's often 10+ emails a day, because many teachers post notes once a day, and with 5 classes, that adds up pretty quick. I personally have it enabled because it's pretty manageable with some custom Outlook rules, but setting this…

> setting this up is well beyond the capabilities of most students. Setting up custom email filters is beyond the capabilities of most students? What are they learning? Where will they be qualified to work?

> What are they learning?

Are you suggesting that outlook wrangling be explicitly taught at the college level?

Post reply on HN