Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

481–490 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#481

Post by [deleted] »

u_fucking_dork wrote: post #473
dotancohen wrote: post #336

Earlier quoted context omitted.

> setting this up is well beyond the capabilities of most students. Setting up custom email filters is beyond the capabilities of most students? What are they learning? Where will they be qualified to work?

Anywhere. I straight up don’t check my email at work. If people need me they have to teams message me to tell me they emailed me. Don’t have time to sift through all the bullshit generated emails. Jira, GitHub, confluence, servicenow, workday, etc. amounts to an incredible amount of junk I just can’t be bothered with.

[deleted]

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#482

Post by morning-coffee »

phainopepla2 wrote: post #112
parliament32 wrote: post #106

Earlier quoted context omitted.

> It should be illegal It should be illegal to host insecure services, especially when you're dealing with PII. Breaches keep happening and nobody gives a fuck, because the worst that'll happen is you might lose a handful of customers and buy some "credit monitoring". Incidents like this should be followed by an audit and charges being laid. Send corp officers to jail for negligent security failures. If you can go to…

How could you possibly make it illegal to host insecure services? Is any service 100% secure? And if it were how would we know? I do agree with the audit and punishments for clear failure to adhere to established standards.

"established standards" - now who has the incentive to run shitty services? those big enough to control the "established standards".

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#483

Post by butlike »

dotancohen wrote: post #336
gucci-on-fleek wrote: post #315

Earlier quoted context omitted.

I've never used Canvas before, but all the LMSes that I've used allow students to enable emails whenever anything is updated, including when grades are posted. This is off by default because it's often 10+ emails a day, because many teachers post notes once a day, and with 5 classes, that adds up pretty quick. I personally have it enabled because it's pretty manageable with some custom Outlook rules, but setting this…

> setting this up is well beyond the capabilities of most students. Setting up custom email filters is beyond the capabilities of most students? What are they learning? Where will they be qualified to work?

Didn't you hear? Chat apps and iMessage (SMS included) is the new email.

Delete

Delete and Report Spam

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#484

Post by varun_ch »

jameshart wrote: post #204
hsbauauvhabzb wrote: post #124

Earlier quoted context omitted.

No building has a 100% chance of not caving in, yet somehow I think charges would be laid if a skyscraper caved in.

This analogy seems to be portraying 'ransomware hackers' as an unstoppable force of nature akin to gravity . I'm not sure that's a fair analogy.

I think it’s a very fair analogy. The _only_ way to stop them is to make your stuff secure. That’s literally the only way.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#485

Post by dboreham »

p-e-w wrote: post #399
setopt wrote: post #383

Earlier quoted context omitted.

Just to add one more data point, we also use Canvas at my university. The deadline for submitting who are eligible (i.e. passed compulsory assignments and labs) to take the exam was yesterday, and I couldn’t meet that deadline because Canvas went down. I usually do corrections offline so I have backups of my own evaluations, but these are courses with many teachers and many TAs, so Canvas is the way we sync our asses…

I guess what surprises me the most is that it’s even legal for schools to outsource the core of what they do to some random tech company. Either way, they were under no obligation to adopt this garbage technology regardless of whether it’s available, so this is 110% on them.

Um. This is the forum for an industry that outsourced its entire core of what they do to Microsoft (GitHub).

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#486

Post by cube00 »

BooneJS wrote: post #150

My kids are in the middle of their finals week. What a mess. Universities know nothing, Canvas claims to be in a "scheduled maintenance", and one Prof claims to "not have any copies of material offline" which seems pretty negligent. Sounds like one section of a popular class will be doing paper exams while other sections had Canvas-based "half points for 2nd attempt"-type exams earlier today. How soon before names &…

> one Prof claims to "not have any copies of material offline" which seems pretty negligent

It's not unreasonable that non-technical people would expect paid cloud services to be good custodians of the data entrusted to them.

These services also do everything they can to encourage you to work within the online platform rather then working offline and then uploading.

For example, there's no easy way to author a quiz, set up the answers offline and then later upload it.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#487

Post by itsalwaysgood »

myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

It's not necessarily a lack of investment. Cyber security researchers are using AI to discover and post very serious Linux vulnerabilities that give root. We should expect to see more of this type of activity for a while.

We're talking about vulnerabilities that have existed 10+ years but nobody noticed until AI.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#488

Post by bitfilped »

user_7832 wrote: post #408
metaengies wrote: post #370

Earlier quoted context omitted.

> Where will they be qualified to work? Going by a certain story 2 years ago, their concern should be that they're overqualified for Meta. It doesn't help that gmail, which is the only serious direct competition to outlook, straight up doesn't do "folders" and instead goes with markers. So you can't really just put a filter that drags all the 100 low-priority alerts in what would count as a first degree abstraction o…

> It doesn't help that gmail, which is the only serious direct competition to outlook, straight up doesn't do "folders" and instead goes with markers. While true, unless I'm mistaken, markers (I assume you're referring to tags) can be nested to provide a pseudo-folder hierarchy, and with proper filters you can remove the "inbox" tag and have the mail only show up under the specific tag. TBH I don't fully mind it, it…

They can be nested, the one thing I have never been able to figure out though is how to get alerts of receiving a message while also filing away in a sub folder. You get one or the other in outlook, as a result I rarely check my work email anymore cause I either get the fire hose of spam or miss everything entirety because it's going to a folder and not passing along an alert about a new message.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#489

Post by altcognito »

chrisjj wrote: post #418
rixed wrote: post #328

Earlier quoted context omitted.

When you picture the attacker, don't picture a bored nerdy teanager. Picture a selfish, $$ motivated psychopath. Let's not side with the parasites.

And lets not side with Canvas PR.

He didn't really side with Canvas PR, he just said these were not good people. They aren't.

What did Canvas PR do except do a poor job? Doing a poor job of PR is a whole, whole lot less worse than actively destroying people's lives for profit.

Post reply on HN