Isn’t it sad that the software we’re paying millions for has such elementary mistakes?
Is this just a case of ‘Nobody ever got fired for choosing Blackboard’?
Is this just a case of ‘Nobody ever got fired for choosing Blackboard’?
I would say it's more a case of "Nobody ever got fired"
As a former high-school hacker, I routinely reported major holes to District IT. No one gave a damn. Only once I started poking around private financial data did they raise hell, and even then it was "Show us what you have, tell us how you did it, and we'll let you walk. Otherwise we'll get the police involved."
Handed over my laptop, the IT guy managed to play some Rammstein accidentally but otherwise found nothing of note. I was banned from bringing, touching, or even being near a computer, my assigned seating was moved in all classes directly to the front, and that was that.
Kept in touch with a few of the tech-interested Freshman I knew during my Senior year, nothing was ever patched, nothing changed over the ensuing years. The exact same exploits I informed them of were not touched.
There is simply no culture of accountability.
To contrast I was arrested and sent to county jail, charged as an adult on a "distrubing the peace" style charge, by the same school for telling an administrator, in-private, to fuck off in response to a punishment levied without being told what I had actually done.
Schools, eh?
The lesson that many in positions of authority are petty-minded fools is a valuable part of your education.
Who knows, maybe they were just running a honey-pot pretending and pretending to be outraged.
Some time back, I found multiple critical vulnerabilities in the most used school database system in the Czech Republic. The whole software is a mishmash of native Windows apps in Delphi and Visual FoxPro and an ASP.NET web interface built in a combination of VB, C# and WebForms. The desktop apps access MS SQL Server directly and security seems to have been done by a very uninformed person (the functionality is only a little better).
I first told my school's network admin, who contacted the developers, who fixed the issues relatively quickly. Everything went relatively smoothly for me, but I know this depends mainly on the individual people involved.
In university where they still had HPUX I asked the IT department if I could get printer credits in exchange for exploits I report and he immediately got angry saying I should be proud to report them.
Needless to say I ended up not reporting anything and just keeping them to myself. Thinking back I guess reporting it somewhere(maybe not in school) could have gotten me more opportunities, but who knows. I kinda wish there was some sort of mechanism to push people to make something out of their talents instead of suffocating them.
There's no incentive for one to give a damn, and we can't rely on good IT to be present in any given organization.
Senior year they got some software that would allow a teacher to monitor all classroom computer screens thus precluding our being able to play anymore. So the same buddy of mine behind the Counter-Strike copies made a wallpaper that was a screenshot of all kinds of infosec tools, WireShark, MetaSploit, etc.
They didn't like that one either.
What I didn't know is that I would pick a random address that would knock off one of the higher ups net. Let me tell you, they did not like that one bit.
I came back one day to my room mate saying that they raided my room trying to get into my pc. I ended up walking into the Dean's office of student Life and ended up explaining how I got back online. The head of IT didn't believe me saying you couldn't change your IP by changing your Mac address let alone that changing your Mac address was even possible. I didn't even bother trying to prove it. Mind you they also printed out like 200 pages of IRC logs.. I kept that open all day while in class so who knows what it captured.
In the end I got the Kevin Mitnick treatment and they prevented me from using my dorm net as well as any campus PC. I just got a long cat 5 cable and ran it into the other room. What was odd was they were ok with letting me do my work study which gave me access to the school website. I guess they rather let me do that then fool around with other stuff.
Fun times.
Sadly I believe it is. My school recently moved off Blackboard for Canvas after at least ten years. While some teachers were relieved to move to a more modern system that supposedly offers them a better experience (it certainly offers students a better experience), many teachers rejected it as they did not want to learn a new system. My older instructors hardly ever post to Canvas besides updating grades saying they just don't want to learn it.
Luckily for whoever setup Canvas at our school I don't think they will get fired over it, but the resistance from staff makes me understand why other schools would feel hesitant to switch off Blackboard.