2

In my university, we've been using Moodle for many years (>5y). There was a general negative opinion on the Moodle for very different reasons, from "it's ugly" to "it's not up to date", going through "everyone thinks it's crap, me too". Since 2 years I've been pushing the staff to update it, and hopefully fix all the concerns raised by the student and staff using it; and more importantly, fix all security issues that have been patched in the 7 new versions. (We're using version 1.9, and the latest release is 2.8).

At the beginning of this year, a new staff responsible for coordinating the teaching, set up Google ClassRoom as a mean to fix the general issue that people were not happy with the Moodle. But leaving the security issue of the Moodle which is still used as Google ClassRoom doesn't provide everything Moodle provided.

Eventually, an administrative staff worked the estimates on how much it would cost to perform the upgrade, and everything is ready to be updated. We just need the permission of one or two people, who keep saying that it can wait, or that's not the priority, and security issues are not really an issue.

How can I convince people to update Moodle? Am I paranoid on the security issue?

Improve this question
3
  • I have taken the liberty of rewording your question on the security update. I have tried to keep your original intent as much as possible, feel free to revert some of these changes if I got anything wrong. I have also remove the part comparing Moodle and Google Classroom because it is a different question that should be, at least, asked independently (and is borderline OT, in my opinion).
    – Davidmh
    Mar 10, 2015 at 12:54
  • @Davidmh, thanks for the rewording. I thought Google ClassRoom was relevant since it's also what makes the process slower, but you're right, it was a bit OT the way I formulated. I just add back the fact that it exists.
    – anon
    Mar 10, 2015 at 13:16
  • A white-hat way to point out security issues is to do a cost-benefits analysis. Show the inherent costs of upgrade vs the potential damages from not upgrading.
    – Compass
    Mar 10, 2015 at 13:22

1 Answer 1

Reset to default
2

How can you convince the higher authorities that security holes are a risk? Read up on the vulnerabilities and send them a list of concrete examples. No "an attacker could gain access to the database", but "someone could hack in and change all the passwords, and on the internet you can find a script to do this [link]". Your word may not carry much weight, so try to get the tech guys to sign it too.

Another option is to find a security expert at the CS department. They should be able to put a stronger, more authoritative word.

Of course, do not attack the server yourself, even if you don't change anything. That is more likely to upset people and backfire. But you could suggest the tech support to do it themselves as proof.

Improve this answer

You must log in to answer this question.