Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

311–320 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#311

Post by freeopinion »

JumpCrisscross wrote: post #275
gruez wrote: post #235

Earlier quoted context omitted.

As opposed to a screenshot of a website? Presumably the professor has a spreadsheet of all assignment grades that is submitted to the school?

> Presumably the professor has a spreadsheet of all assignment grades that is submitted to the school? This would undermine Canvas's lock-in.

Canvas is built to automatically export its gradebook to an external system. It will do that automatically every day if you want it to. Teachers or others can manually export to the configured foreign system on demand. So if you grade something and want it to show up in the foreign gradebook without waiting for the daily export, you can just press the button to make it happen right away.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#312

Post by copperx »

blahedo wrote: post #176

Perspective from the trenches: I teach at a university that uses Canvas. We are in our final exams period right now. We got our first email (from Academic Affairs) notifying us that it was down at 5:17pm EDT this afternoon, with little info; followup emails were sent at 6:24 and 6:57 with more info, but mostly about how we would be compensating for it and not about what actually was going on (other than, "nationwide…

I don't understand what's the panic and doomerism about. Any competent IT team has backups and will be up and running as they go back to a state before the breach. This is HN. I'm disappointed that everyone is talking about losing grades and going back to pen and paper. I don't see how that could happen in 2026.

And from the hacker's message itself, it's clear they want money in exchange for not releasing private info, not for the data itself.

Do we live in a fear based culture? Why the panic? Even if everything was hosted on Instructure's infrastructure, it's all AWS. I'd be VERY surprised if there aren't multiple way to go back to a previous state.

Most of the work and delay is to make sure they figure out where the breach occurred.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#313

Post by bravura »

tempaccount5050 wrote: post #300
AmblingAvocado wrote: post #287

Earlier quoted context omitted.

DKIM signature could be used to verify that Canvas' server sent the email with the given content

And who exactly do you think is going to verify 100s of thousands of emails this way dude?

A computer?

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#314

Post by zuzululu »

eiiot wrote: post #243

I'm a student at Stanford — this is hitting the whole school hard. Unlike a lot of schools on the east coast that are affected (Brown, Harvard, MIT) we are on the quarter system so we're just ending Midterms right now. We're also lucky enough to have our CS department entirely independent from Canvas, but most of my humanities classes are not so lucky. One art history class is having us submit our midterm papers by u…

I really feel like SH fucked up by sinking this low hitting students and Americas young minds like this....

One thing to target coroporations but leave the students alone....

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#315

Post by gucci-on-fleek »

JumpCrisscross wrote: post #202
blahedo wrote: post #176

Perspective from the trenches: I teach at a university that uses Canvas. We are in our final exams period right now. We got our first email (from Academic Affairs) notifying us that it was down at 5:17pm EDT this afternoon, with little info; followup emails were sent at 6:24 and 6:57 with more info, but mostly about how we would be compensating for it and not about what actually was going on (other than, "nationwide…

> the students themselves don't have the artifacts to resubmit via email because they were done in Canvas It’s so simple to send an e-mail to the student with relevant records on completion of a quiz or whatnot. They don’t do it, because they want to control the data. (And universities don’t insist on it for who knows what reason.)

I've never used Canvas before, but all the LMSes that I've used allow students to enable emails whenever anything is updated, including when grades are posted. This is off by default because it's often 10+ emails a day, because many teachers post notes once a day, and with 5 classes, that adds up pretty quick. I personally have it enabled because it's pretty manageable with some custom Outlook rules, but setting this up is well beyond the capabilities of most students.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#316

Post by gucci-on-fleek »

e28eta wrote: post #212
JumpCrisscross wrote: post #202

Earlier quoted context omitted.

> the students themselves don't have the artifacts to resubmit via email because they were done in Canvas It’s so simple to send an e-mail to the student with relevant records on completion of a quiz or whatnot. They don’t do it, because they want to control the data. (And universities don’t insist on it for who knows what reason.)

Students having records of what their score was doesn't prove to the professor / university what score they received. "FWD: Exam 1 Results" is not especially auditable.

Presumably the system will be back up eventually, so there's not much benefit to lying here, since at best you'll raise your grade in a few classes for a couple months, while taking on a pretty big risk of getting caught.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#317

Post by freeopinion »

doctorpangloss wrote: post #302
JumpCrisscross wrote: post #275

Earlier quoted context omitted.

> Presumably the professor has a spreadsheet of all assignment grades that is submitted to the school? This would undermine Canvas's lock-in.

i cannot believe how much benefit of the doubt people are giving canvas ed tech is the WORST performing VC sector the ONLY game in that town is vendor lock-in! are people joking? c'mon, canvas is a huge piece of shit. the SaaSpocalypse is coming for them - it seems it is simply that LLMs will be used to exploit it first, rather than universities writing an open alternative they share with each other for free.

On paper your idea seems obvious. You take a bunch of institutions that actually teach students how to program and have them cooperate to build an open LMS that benefits them all.

In reality, universities always spin off anything that looks like it could generate revenue. It is very telling that you can't even get your college transcript from your college. You have to go to (and pay) some third party to get it. Some universities even outsource their "classes" like elderhostel to cruise lines and travel companies.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#318

Post by gucci-on-fleek »

doctorpangloss wrote: post #302
JumpCrisscross wrote: post #275

Earlier quoted context omitted.

> Presumably the professor has a spreadsheet of all assignment grades that is submitted to the school? This would undermine Canvas's lock-in.

i cannot believe how much benefit of the doubt people are giving canvas ed tech is the WORST performing VC sector the ONLY game in that town is vendor lock-in! are people joking? c'mon, canvas is a huge piece of shit. the SaaSpocalypse is coming for them - it seems it is simply that LLMs will be used to exploit it first, rather than universities writing an open alternative they share with each other for free.

> rather than universities writing an open alternative they share with each other for free

That already exists [0], and is actually reasonably popular.

> the SaaSpocalypse is coming for them - it seems it is simply that LLMs will be used to exploit it first

I doubt it, because enterprise sales has nothing to do with how good your product is, how expensive it is, how easy it is to administer, how secure it is, etc.; it only depends on how good you are at enterprise sales. I mean, my university is Oracle-based, and I'm pretty sure that you could get 3 random undergraduates to write something better, so I don't think that LLMs writing better/cheaper software will make any difference here.

[0]: https://moodle.org/

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#319

Post by gucci-on-fleek »

dang wrote: post #220
altairprime wrote: post #209

Earlier quoted context omitted.

Not much overlap between students and HN these days, though? I’m an extremely rare outlier afaik :) The administration has so far opened with one “Canvas said” and then an hour later one “Canvas is down indefinitely” email noting that they’re aware it’s serious. (Canvas is a glorified wiki for teaching students, with quizzes and such, for those unaware.)

> Not much overlap between students and HN these days, though? That's my biggest fear.

FWIW, I'm a student, so there are at least a few still here. Feel free to ask me any questions (either via email or via replies to this post) and I'll try to answer them.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#320

Post by GaryBluto »

HDBaseT wrote: post #18
exprez135 wrote: post #3

The Canvas instance at the nearby university is now down (May 7, 4 PM Eastern), but was briefly displaying the message in this screenshot (1). The ransom message implies that today's problem is the second wave in an attack on Instructure after ignoring their first breach in recent days. 1: https://ibb.co/r29RjdnH

Yeah, this is ongoing. We received communication that Canvas is down for "Under Maintenance" although it seems ShineyHunters have compromised Canvas again with that message you posted. We do not see that message anymore, although all instrucuture.com URLs are down. The list of schools in the ShinyHunters publication can be found here: https://web.archive.org/web/20260507042014/http://91.215.85....

https://web.archive.org/web/20260507042014fw_/http://91.215....

Original now shows 404.

Post reply on HN