Damn, this is a big one. I’ve been watching since it started, and I hope it sends shockwaves through the SaaS model. Institutions learned overnight how by trusting one single private company that they were all screwed over, and probably made them even a bigger target. Hopefully they start re-evaluating.
Having worked ed-tech for a while, I’m not surprised. Blackboard, Canvas, all hot garbage. There’s a real need there, if someone can do a simple selfhosted (by the university) version with oauth/SSO to campus networks that lets them control their data? It’d be a no brainer, I think most campus IT networks would prefer that.
I was thinking about this exact problem, and I came up with a similar idea. There could be a parent company developing the core software and maybe even providing installation and setup services, but each campus ultimately maintains their own self-hosted, zero-trust instance. Each campus would be downstream implementations of the parent software and would only update or talk to other instances as needed.
Given how campuses operate, it seems like they would be great candidates for an optionally federated platform like that.
So just, Software as a Product (SaaP)?
So just traditional software?
Ha, think you just discovered the standard model from the 2000s!
But I agree.
The problem is CapEx vs OpEx.
My university used to only self host. Now they’re ditching self-hosting for cloud-based SaaS. 🤷♂️
It’s because doi g things on site requires CapEx, which then increases your tax liability.
By going SaaS, you offload the entirety of risk.
The problem is the morons who sign these contracts are fucking clueless about ensuring the liability is strong.
Important to define risk because a lot of software people here(me included) will immediately think “what do you mean their data was hacked”. However from a legal standpoint they get to point the finger at Canvas.
Paying out hacker ransom isn’t a particularly rare event. The hackers that do it professionally are… professional. If they don’t follow through on their side of the agreement then no one pays them.
This isn’t some “dangerous precedent” it’s a basic business decision that paying up would be cheaper than the alternative options. Normal cyber crime response and remediation shit.
Ha ha, what?
They’re criminals. They fucked shit up for money and then held the company hostage. If they don’t pay, the ransom group WILL release the data. If they do pay, they might release the data, but they’ll just quietly sell it rather than just dumping it.
They’re a business. It took time and effort to break in. They want to be paid. If you stiff them, they’re going to fuck you in the ear. If they sell your data after the fact, what are you going to do? Complain to the manager?
They’re not professional, they’re extortionists that don’t give two shits if they’re respected. They steal what’s previous and threaten to dump it or sell it back. Their reputation is already shit, why would they care otherwise? This is such a naive take.
I think this is the more naive take. If it was a given that the information would be public either way, noone would ever pay. Ransomware groups rely on a reputation of withholding their end of the arrangement or the corporate bean counters could never justify the payout to them.
There’s no honor among the dishonorable, as a Brazilian analyst would say:
I wouldn’t doubt the thieves are still holding to copies of the data they stole, just waiting either for another opportunity to blackmail those affected again, to use the data for other nefarious means as a shell group, or to sell it to another ill-intended group without leaving traces.
From stealing and putting a price on people’s private data and possibly their safety, and to the possibility of dishonoring a “sales” contract, the morality bar was already pretty low on the two concrete cases, so the third would be easy to do on this standpoint.
Ransomware gangs are actually normally pretty good about this. If they leak afterwards they lose all credibility to get another company to pay in the future.
