Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

581–590 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#581

Post by Steve16384 »

apublicfrog wrote: post #424
Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

Can you explain for the billions of the rest of us why this is the "most stressful time of the year" for the group you're referencing? I assume that's American students and/or teachers?

Here in the UK it's currently exam season. One of my son's had a GCSE exam just today.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#582

Post by Mezzie »

hackyhacky wrote: post #569
Mezzie wrote: post #566

Earlier quoted context omitted.

LMSes have to balance a lot of directly competing needs. It has to be simple enough for the average person to use (both on the learner side and the instruction side) and have enough complexity to allow for a lot of flexibility in setup because every organization is slightly different. They have to support 50 million file formats and everything has to be backwards compatible until the end of time and everything has to…

Everything you say is true, and yet it's clear you've never used Canvas. Canvas is decidedly, not fast, fails to display even trivial files (such as source code) as well as more complex files that should just be handled by the browser (such as video), and it has a non-intuitive, verbose, and tiresome interface that would have felt old-fashioned 20 years ago.

Yes, I should have said 'in theory', because there always ends up being compromise and usually that's the thing that's chucked out first.

LMSes frankly run like shit. I don't work with Canvas right now, but every one I've used has run like shit.

However, there are reasons that the complex files aren't handled by the browser: tracking and persistence. It isn't enough to make a video file watchable, it then needs to be tracked in the same system as every other training/educational material and in the same way. If you don't care whether the students actually watch the video, then yeah, throw them a YouTube link or embed a video on a personal site or just have the LMS serve a basic embed. But being able to track video, make it mandatory, make it so that it can't be fast forwarded/people can't skip to the end etc. all matter when LMSes are used for topics that are required for compliance and regulatory purposes.

I don't disagree on the interface(s). Ours is a farce and I hate it.

It's likely that they're so bad precisely because of the simple tech and complex requirements. Simple tech doesn't mean 'easy' or 'not time consuming'. But it means you're looking for developers who have a decent level of technical proficiency (to handle the numerous edge cases and flexibility the systems demand: it's not hard but things like the data structures need to be well thought out and every single piece of the system is integrated with one another in most LMSes so you can't silo work as easily) and who want to work on problems that aren't hard and require dealing with a lot of unreasonable people (in the form of their requirements). You have to allow/design for a lot of stupid things because otherwise people will throw tantrums about it.

Then on top of that, you're developing something that doesn't directly generate profit, so nobody is going to pay for it or appreciate the work you put in.

Then on top of THAT, they're fairly insulated from the actual end users.

It's just a recipe for shitty software.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#583

Post by ndriscoll »

crazygringo wrote: post #580
trollbridge wrote: post #573

Earlier quoted context omitted.

FERPA allows emailing confidential information to a student email on record if the university controls the email account. Most universities offer their own email service (and require using it) for this exact reason. There is no more risk of access to email than there is to Canvas. They are usually secured by the same SSO, too. However, congratulations for finding the exact dodge around implementing a useful feature.…

I already said it's not about common sense, it's about legal risk. It's about edge cases like someone set up your email to forward all your emails to their account without you knowing. Or other additional situations you could imagine. There is no benefit to not emailing grades directly, from the perspective of Instructure. There is no ulterior motive here. But universities are genuinely risk-averse and their lawyers…

Then the lawyers are incompetent morons. There's "no benefit" to telling the student their own grade at all when viewed from that perspective. You could just not give them any feedback. Or you could allow them to consent to it, which is what the law asks.

It is a dodge. Society should not just say "oh those silly lawyers". These people are not being responsible. They are not doing their jobs.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#584

Post by crazygringo »

ndriscoll wrote: post #583
crazygringo wrote: post #580

Earlier quoted context omitted.

I already said it's not about common sense, it's about legal risk. It's about edge cases like someone set up your email to forward all your emails to their account without you knowing. Or other additional situations you could imagine. There is no benefit to not emailing grades directly, from the perspective of Instructure. There is no ulterior motive here. But universities are genuinely risk-averse and their lawyers…

Then the lawyers are incompetent morons. There's "no benefit" to telling the student their own grade at all when viewed from that perspective. You could just not give them any feedback. Or you could allow them to consent to it, which is what the law asks. It is a dodge. Society should not just say "oh those silly lawyers". These people are not being responsible. They are not doing their jobs.

No, the lawyers are not "incompetent morons", and I highly doubt you have the legal training and domain experience to be qualified to make that assertion.

You would be surprised at the number of frivolous lawsuits and seemingly "zero risk" decisions that wind up turning into actual legal risk and legal fees.

The legal world is a lot more complicated than you think. I've been in some of these conversations. Quite frankly, you don't know what you're talking about.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#585

Post by kccqzy »

j_w wrote: post #525
royal__ wrote: post #257

Earlier quoted context omitted.

Homegrown systems are expensive to maintain and usually still fail to match up to the commercial options available at this point. LMS's are also just really complicated pieces of software. I worked on my university's own version as an undergrad.

The university I went to established has a rule that was essentially "student made software is not permitted to be used." Professors couldn't actually use student made software, the software had to be wrapped up by a "company" and a contract made. This meant that you couldn't just make a tool/utility/whatever and have it be used. I believe the same applied to the professors themselves, although that was hardly enforc…

Imagine this rule back in the 70s. We wouldn’t even have Berkeley Software Distribution.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#586

Post by ndriscoll »

crazygringo wrote: post #584
ndriscoll wrote: post #583

Earlier quoted context omitted.

Then the lawyers are incompetent morons. There's "no benefit" to telling the student their own grade at all when viewed from that perspective. You could just not give them any feedback. Or you could allow them to consent to it, which is what the law asks. It is a dodge. Society should not just say "oh those silly lawyers". These people are not being responsible. They are not doing their jobs.

No, the lawyers are not "incompetent morons", and I highly doubt you have the legal training and domain experience to be qualified to make that assertion. You would be surprised at the number of frivolous lawsuits and seemingly "zero risk" decisions that wind up turning into actual legal risk and legal fees. The legal world is a lot more complicated than you think. I've been in some of these conversations. Quite fran…

The thing is, I don't need that training to recognize that they are failing to contribute to society. This is why I'm saying that it is indeed a dodge. "It's complicated and you don't understand it" isn't an excuse for making the world worse. And yes, it is fully possible for a someone to make that judgement without a large background in law, because it's taking a holistic look at "what was the purpose of this law, and are they interpreting it in line with that purpose?" The details don't matter; the outcomes do. Their job is to deal with the details to reach the desired outcomes. If society is better off for putting them on a boat and sending them into the middle of the ocean, then they are incompetent.

Refusing to give a student their own data because of a privacy law that's meant to give the student control over their data is them failing. Full stop. There's no room for excuses for government funded entities to act in the exact opposite way that they are supposed to to avoid their fear of government imposed penalties from a deliberate misinterpretation of what the entire thing is about. That's incompetence by everyone involved. It is people going out of their way to make the world a worse place to act important. Absolutely unacceptable.

It's like if teachers aren't teaching the kids to read or add, the details about all the compliance stuff they need to worry about and how the school "can't" remove disruptive kids from a class or whatever is missing the point; the schools can't sacrifice actually doing their job at the alter of compliance, or we should just shut them down since all they do is waste resources. The compliance people should be figuring out how to shield the actual workers/create plausible deniability if the law is supposedly that stupid.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#587

Post by [deleted] »

JumpCrisscross wrote: post #277
garciasn wrote: post #221

Earlier quoted context omitted.

I’m not certain, but it appears you’re giving Instructure a pass here, as if this is the first time they were hacked. But, it’s the second, by the same group. As a parent of kids who are impacted by this, I’m not super concerned about the data being held for ransom, but I sure as fuck am concerned about how much it’s going to cost the district to move to another provider.

> I sure as fuck am concerned about how much it’s going to cost the district to move to another provider Does Canvas have cybersecurity insurance?

[deleted]

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#588

Post by GTP »

dotancohen wrote: post #401
GTP wrote: post #397

Earlier quoted context omitted.

I partially solve this by using Thunderbird on my laptop. When I get emails on my smartphone (on the Gmail app), they unfortunately all go to the inbox. But the moment I open Thunderbird, it nicely organizes them for me.

I use Thunderbird on both the desktop and Android. Love it. Perhaps Outlook is difficult to configure. Thunderbird is intuitive.

Yes, every now and then I think I should try it on Android as well, but still have to do it. It would be great if there was the possibility to sync filters across devices, in a similar way of using your Firefox account to sync extensions. Do you know if this is possible?

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#589

Post by tokai »

bradley13 wrote: post #459
Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

I'm in Europe, and we don't use Canvas (at least, I've never heard of it). However, we have similar diseases. In my particular school, it's a massive SharePoint site plus ever more stuff in Teams. Plus Moodle, plus other services. The MS services have not improved teaching at all. What they do, is fragment communications, and add ever more places people have to look, in hopes of finding things. But the administration…

There are plenty of European Canvas customers.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#590

Post by tokai »

ecshafer wrote: post #288
onetimeusename wrote: post #281

Earlier quoted context omitted.

Live streaming of class through Canvas is very popular. Quite a few people just watch from their dorms. So maybe people will have to come back to class, that will be entertaining. The class rooms are almost standing room only (sometimes they are) on the first day of class and then gradually thin out. Sometimes 10 or so people show up out of a class of 100. If Canvas is not back up soon I think it could actually be di…

This is awful to hear. The idea that students are just half assedly streaming the lectures is really just ruining things in the long run. This is a bit old manny, but showing up to lectures is good . You go to class, you get face time with professors, you can ask impromptu questions, you rub elbows with classmates, you talk on the walk between classes, you maybe run into a cute girl. Friction like walking to class an…

Showing up to lectures is vastly overrated. Like note taking it's cargo cult behavior for middling students that care more about going through the acts of studying, than actual learning.
Post reply on HN