Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

551–560 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#551

Post by sillywabbit »

denkmoon wrote: post #407
Poacher5 wrote: post #377

Earlier quoted context omitted.

And there are no other students at any college other than CS students? I'm not sure why a biologist or a literature student would need to be au fait with Google's admittedly fairly unfriendly email management setup.

Digital literacy is important to every field. Email filters are not some arcane computer science concept, they are the modern equivalent of filing physical mail into the right folder/pidgeon hole/inbox/whatever. Biology is a great example because of just how important digital record management is to experimentation in the field.

I don't think you've seen many biology field data sets.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#552

Post by tejohnso »

matsemann wrote: post #410
p-e-w wrote: post #399

Earlier quoted context omitted.

I guess what surprises me the most is that it’s even legal for schools to outsource the core of what they do to some random tech company. Either way, they were under no obligation to adopt this garbage technology regardless of whether it’s available, so this is 110% on them.

The alternative would be that each school develop their own platform for this, which also isn't very good use of their time and money? Edit: No idea why this was down voted so much. I'm not defending Canvas, just wondering what the alternative would be.

The alternative could be to self host.

https://github.com/instructure/canvas-lms/wiki/Production-St...

Or maybe consider not following the herd, and use a much simpler but sufficient system that can be self hosted, if available.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#553

Post by christina97 »

jameshart wrote: post #544
varun_ch wrote: post #484

Earlier quoted context omitted.

I think it’s a very fair analogy. The _only_ way to stop them is to make your stuff secure. That’s literally the only way.

We do not generally hold victims of crimes accountable for failing to defend themselves adequately. If someone threatens you with a knife and gets you to hand over your wallet, your bank doesn’t get to say ‘you should have hired better security’ when the mugger uses your credit card. The problem here is the mugger, and that’s who the state goes after. Even if the victim walked into a bad area. Even if the victim coul…

While I’m sympathetic to this argument (it would be great if the internet were a safe place), in practice this thinking leads to governments trying to impose legislation that hurts legitimate uses but does little to protect from the long tail of harm. There’s little that can be done about North Korean state sanctioned cybercrime without a great firewall.

If the perpetrators of this hack were caught and in a developed country, they would certainly be prosecuted for their crimes and not get off light (especially if any data is actually leaked).

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#554

Post by zulban »

myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

"It should be illegal for any company to pay ransomware attacks. Period. No pay out ever."

You seem to think "if it's illegal it won't happen". Instead you need to think about unintended consequences and what would actually happen if this were law. People would hesitate to contact the police for help before they've decided, or not do it at all. And not report it.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#555

Post by bauldursdev »

matthewfcarlson wrote: post #57

I remember circa 2010 a friend of mine at college was like “blackboard sucks, let’s build something new”. At the time I poo pood the idea and lo and behold canvas came out a year later. Outside looking in, they been crushing it.

Well, now's probably a good time to release something...

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#556

Post by hackyhacky »

jameshart wrote: post #532
ericpauley wrote: post #461

Earlier quoted context omitted.

What component in particular goes substantially beyond CRUD?

It is a very common error to look at a specialist piece of software, superficially consider the basic data structure it appears to have and think ‘seems simple enough. Basic CRUD app.’ But it’s rarely the case in practice. In a sibling comment right here for example someone bemoaned the difficulty in Canvas of having two TAs simultaneously grade separate parts of the same assignment. That sounds like something that g…

I think you are confusing the reality of Canvas with a different, theoretical learning management system.

In reality, Canvas does not have workflow and does not prevent race conditions in grading. I can certainly imagine an LMS that does these things, but Canvas does not.

It would probably help if you had actually used Canvas before trying to convince us that it is non-CRUD.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#557

Post by crazygringo »

skeeter2020 wrote: post #527
trillic wrote: post #477

Earlier quoted context omitted.

yup you just get an email saying "A new grade has been posted for EECS 420"

...then all those clicks juice engagement and utilization numbers; why would someone want to just know their grade when they can use more clicks and custom apps to get the same info? The party line is probably something about "a lack of data security" with email, which would almost be funny given the current situation if it wasn't so stressful for those impacted...

No, students are already forced to use Canvas enough as is. This is enterprise software, it's not a consumer phone app. This is nothing to do with "engagement".

This is to do with FERPA which requires that student grades be kept private. There is a small but still a significant legal risk that someone else such as a parent or roommate could have access to a student's email. And so to avoid even the possibility of a court case, schools prefer to play it safe and display grades only to a user they can authenticate directly.

This doesn't have anything to do with common sense, it's simply about legal risk. And it's not about security in a broader sense, it's specifically about privacy FERPA legislation.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#558

Post by jameshart »

christina97 wrote: post #553
jameshart wrote: post #544

Earlier quoted context omitted.

We do not generally hold victims of crimes accountable for failing to defend themselves adequately. If someone threatens you with a knife and gets you to hand over your wallet, your bank doesn’t get to say ‘you should have hired better security’ when the mugger uses your credit card. The problem here is the mugger, and that’s who the state goes after. Even if the victim walked into a bad area. Even if the victim coul…

While I’m sympathetic to this argument (it would be great if the internet were a safe place), in practice this thinking leads to governments trying to impose legislation that hurts legitimate uses but does little to protect from the long tail of harm. There’s little that can be done about North Korean state sanctioned cybercrime without a great firewall. If the perpetrators of this hack were caught and in a developed…

I think states should be able to do better than a ‘great firewall’ to defend their domestic net infrastructure from malicious foreign actors.

But I do think it should be much more states’ responsibility to make their domestic network safe for citizens and businesses and institutions to operate.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#559

Post by jameshart »

hackyhacky wrote: post #556
jameshart wrote: post #532

Earlier quoted context omitted.

It is a very common error to look at a specialist piece of software, superficially consider the basic data structure it appears to have and think ‘seems simple enough. Basic CRUD app.’ But it’s rarely the case in practice. In a sibling comment right here for example someone bemoaned the difficulty in Canvas of having two TAs simultaneously grade separate parts of the same assignment. That sounds like something that g…

I think you are confusing the reality of Canvas with a different, theoretical learning management system. In reality, Canvas does not have workflow and does not prevent race conditions in grading. I can certainly imagine an LMS that does these things, but Canvas does not. It would probably help if you had actually used Canvas before trying to convince us that it is non-CRUD.

Sorry, I wasn’t trying to defend Canvas, so much as give general advice that ‘I could build this in a weekend’ is rarely a wise claim. The specific ways in which Canvas could not be built in a weekend do not need to be the ones I identified.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#560

Post by crazygringo »

dotancohen wrote: post #336
gucci-on-fleek wrote: post #315

Earlier quoted context omitted.

I've never used Canvas before, but all the LMSes that I've used allow students to enable emails whenever anything is updated, including when grades are posted. This is off by default because it's often 10+ emails a day, because many teachers post notes once a day, and with 5 classes, that adds up pretty quick. I personally have it enabled because it's pretty manageable with some custom Outlook rules, but setting this…

> setting this up is well beyond the capabilities of most students. Setting up custom email filters is beyond the capabilities of most students? What are they learning? Where will they be qualified to work?

You know that most students aren't computer science majors?

Have you met the average community college student who doesn't even own a laptop but does all of their work on their phone? Gmail doesn't even allow you to create or manage filters from their phone app or mobile web interface.

Post reply on HN