[sharkweek]

My wife is in grad school at a major university and is dealing with this right now the week of midterms for spring quarter.

I totally understand why a university wouldn’t want to bake their own learning portals but just feels like such a single point of risk to use third party solutions for something like this.

Back in my day… all we had was a school email via on-premise services. I guess we registered for classes in a web portal but that’s about it. The idea of online class was entirely foreign at the time. Ain’t nobody hacking a blue book.

[gdhkgdhkvff]

It’s wild to me that people in this comment section are suggesting that schools should improve their security by rolling their own platform, which is bound to be filled with security holes, instead of using a popular, maintained, open source option.

[nazgul17]

To be fair to the idea, though, while this would make individual instances less secure, it would drastically decrease the leverage for the work bad actors put in.

There is a saying in the software security industry that (I'm paraphrasing from rusty memories) a system is secure if the cost of hacking it is higher than the value it protects.

Each system being completely distinct from another means that the cost of hacking the average student goes up by 9000 (from the article, Canvas is used by 9000 schools).

Still not saying that rolling out your own is the preferred solution, but the idea is not as ludicrous as it would seem, and should definitely be entertained and discussed, at least.

[mingus88]

Put it another way; the blast radius from any vulnerability is much smaller.

But also, the cost is much, much higher to the institutions, which is the salient point. You're going to spend years developing a system, deploying it, training staff and students, supporting it. I see mentions here of in-house systems being developed much more cheaply and I don't believe it. The economies of scale are at work.

I worked at a university for many years and I can't recall anyone I'd consider to be a competent software architect working for the IT department. Hell, we had students writing major webapps that kinda sorta worked well enough.

[forgetfreeman]

Maybe. I still remember the Drupal community sneering at the New York Times when they unveiled their homegrown online news platform bitd. After 15 years of recursively scraping ad-hoc porn sites off of server hard drives when clients dragged their feet on migrating to latest versions I 'm less certain the assumption that homegrown == less secure is as valid as it sounds.

[shnock]

Could you explain the last sentence a bit more? I don’t follow

[forgetfreeman]

Back before the Laravel folks utterly misguided but weirdly popular attempts at turning PHP into JavaScript gutted the Drupal community (your boos mean nothing, I've seen what makes you cheer) one of the most common outcomes of a site getting hacked was malware-infested porn sites would be uploaded to the site server. This failure mode wasn't particular to Drupal, it's just what happened when websites got hacked. This was the same period of time when the Drupal project was reporting ~16M active installs, had literally thousands of developers volunteering code to the core development project, a dedicated security team, and an automated test suite that ran around the clock.

[asdff]

Universities used to do this sort of stuff themselves. Then it became a business handled by purchasing rather than needs met by the department themselves.

[avs733]

Because faculty didn’t want to do it anymore. They want it handled by others but also they want oversight and veto power but also they don’t want to be bothered. But it better always work, and if they make a mistake the software is broken because don’t tell them it’s a user error they used to write Fortran.

As a faculty member at a large university…I have a deep respect for the impossible job of university IT departments.

We originally rolled our on LMS decades ago. When we switched to canvas we kept the home brew running for five years past its expiration date because faculty refused to remove their files. Finally each one was manually moved by IT for the recalcitrant old faculty.

[asdff]

It is kind of funny when these LMS tools with 100+ functions are being used for little more than what email, a grades spreadsheet, and maybe a shared drive would do. University might even ask for the final grades in spreadsheet format by the end of the term anyhow, so data goes into the LMS just to come back out again.

[avs733]

In a sense you aren’t wrong but those analogies fail at scale. It’s like saying you could replace all hr functions with a spreadsheet.

They are large databases yes but they do a lot of small and large things that that analogy glosses over

[asdff]

Well, whatever the large and small things they do are that aren't bound within I described, no one really articulates what they really are. I mean there's like wiki functionality built in. A whole forum system built in. That isn't necessary for education. It is an extra song and dance we might play just because we can, shoehorning some lesson into having to use the forum system or make some dumb wiki page instead of a good old fashioned essay or in class discussion, which no one had a problem with and still doesn't have a problem with. I remember there being like multiple different ways one could go about copying content from one course to another. And that was sort of indicative of the whole software suite. Just keep adding functionality. Never mind if it is redundant. Pure bloatware. A dozen ways to do the basic thing. No one sits there and cuts features because the incentives are the opposite with this software. If canvas can do 105 things, blackboard wants to show the software purchasers at the school they can do 106 things. Doesn't matter if no one uses 103 of them. Doesn't matter that no one even gets trained in how to use these 105 functions.

[Mezzie]

This is a lot of it.

I used to work in academia and am now an LMS admin (in private industry). I've interviewed for LMS admin positions at educational institutions and each time I've ended up walking away. The questions I was asked at the last interview revealed what a ridiculously unplanned, spiraling mess their system was and that I would have no agency over it. No, thanks. And it was clear the reason for this was faculty recalcitrance and an inability to tell them no. Each one wanted a special plugin/special way of doing things, causing a giant mess of insecure bloat, and a fair amount of interview questions always amount to 'how do you wheedle faculty into doing things/placate their egos to keep things running?'

I'm not a rockstar candidate either: I'm a disabled, geographically-constrained, self-taught(ish) sort-of techie. The disability means I have substantial holes in my resume/work history, etc. I don't have a CS degree or any kind of formal IT education. If people at my level of knowledge are looking at these jobs and passing because they're not worth it, I can't imagine the actual pool of people who get hired is great.

LMS admins in particular are going to be harder to find/retain because we tend to have options we can jump to that would be less onerous than doing LMS admin for a dumpster fire. I could go straight IT or full Instructional Design, for example.

In private industry, I can tell people to kick rocks if they want to do something that the system doesn't support/is a really bad idea. And if I can't, I'm not held responsible for the consequences.

[afavour]

In fairness in the era where universities did it themselves the tech requirements and expectations were dramatically lower.

[asdff]

Tech requirements are the same as they always were. One needs to ask whether they need so many frameworks to host some files on the internet and submit some files and perform spreadsheet calculations. We still used one of those First Age 1990s websites for sort of pre lab quizzes this one class when I was going through it, and it might have looked a little "old" but I mean it did the thing and worked for years and will continue to do the thing and work for years.

[internetter]

You're being deliberately obtuse. Canvas has many many features. Wikis and discussion boards and quizzes (with some anticheat) and groups and the list goes on and on. Furthermore, while it was never the flashiest thing, it did it better than many of its predecessors. Yes, an individual class may not use all of these features, and yes canvas has suffered feature creep even over my time as a student and yes canvas is not doing anything technically challenging, but there is enough of it that each school rolling their own everything would be a drastic waste of everybody's time and money.

[asdff]

Those are the exact features I think are stupid and wastes of time both on the educators trying to bake a lesson into these clumsy interfaces, and also the students who have to use this feature once and only once and never again for this dumb assignment in one class. They merely serve to entrench educators into using the canvas system but they offer no added functionality to education.

Canvas quizzes cannot beat the anticheat of having another screen out of view. Lock down the browser all you want, it is pure security theater.

Best anticheat is still taking the quiz on paper in the classroom. Best way to engage with students is to still speak with them and ask that they might speak up.

[clipsy]

Have these dramatically higher tech requirements and expectations improved the quality of education whatsoever?

[jagged-chisel]

> Ain’t nobody hacking a blue book.

Well not with that attitude

[walrus01]

A university doesn't need to bake its own learning portal, Moodle exists and is used by a lot of large schools.

[ibgeek]

Moodle is an open-source LMS that can be self-hosted.

https://moodle.org/

[hoppyhoppy2]

Another open-source LMS that can be self-hosted is... Canvas.

[wmoxam]

Almost no one does

[ibgeek]

Didn't realize that. Thanks for the info!

[userbinator]

I totally understand why a university wouldn’t want to bake their own learning portals

They used to, in the pre-cloud/SaaS era; and they were much simpler and better UX than the slop that they're renting today, because the actual users were not far from the developers.

[oezi]

Counterpoint: I was a PhD student in 2004 and on the universities board* which oversaw the roll-out of the campus management system. It cost > 10m EUR to implement a shitty system with the worst UX and years of stabilizing to make it somewhat work.

The amount of corner cases and performance requirements during rush times (semester start) made it really infeasible for a university to roll their own.

* German universities have this funny system where 51% of such boards are controlled by the professors and the rest is made up of other employees/staff and students. They call it academic participation.