The research report attached to this post was published in the “International Journal of Information Technology and Knowledge Management, January-June 2011, Volume 4, No. 1, pp. 233-238“. It covers some major security flaws in Moodle that will not surprise anyone who has been following Moodle security issues for the past few years. I no longer need to use Moodle, but for those of you who do rely on it, don’t be fooled…just because I’m no longer dedicating time and effort to publically demonstrate major security flaws in the Moodle code and design, don’t take that as a sign that those problems no longer exist! I know of at least two major security holes in the latest version of Moodle and one of them is just as bad as this one I publicized not long ago…and like that vulnerability, it has been discussed in the Moodle forums for months and has received no attention by the devs. If that security issue is not addressed in the next few months, then I may do another “open demonstration” for the public…that seems to be the only way to force action by the Moodle lead dev.

In the meantime, you may want to read this study on Moodle security. Below are some of the more interesting excerpts from the paper.

LMS Moodle has much vulnerability like authentication, availability, confidentiality and integrity attacks. So, it is necessary to develop a mechanism that defends these security flaws of LMS Moodle.

Moodle is only for IT experts. It is complex for normal users to use and more than 66% of them are teachers, researchers and administrators [11]. It is difficult for beginner technicians to install and use Moodle [9], because there are many technical word lists in installation instructions.

It [Moodle] does not support the SSL implementation all over the site.

It stores the user data into cache which can be later used by the attacker to launch the attack for next session.

Brute force attack is possible on Moodle as the attacker may try different keys for several numbers of times.

We have determined following security attacks on Moodle such as session attack; design attack and user log out, session not closed. Session attack which is effective against Moodle is session hijacking. As per the concern of design attacks, Moodle is vulnerable to password prediction and user name prediction. Another, security vulnerability is that when the user logout still the session is not closed. When the user clicks on the back button then he reaches the page which was logged out earlier.

Moodle (modular object oriented dynamic learning environment) is defenseless to password prediction and username prediction.

I thought the last quote above about the modular object oriented design being “defenseless” deserves special attention. If you accept this conclusion, then what that really means is that Moodle is fatally flawed since that is the foundation of Moodle’s design–Modular Object Oriented Dynamic Learning Environment–is Moodle! So, to conclude that entire approach to LMS design is “defenseless” when it comes to security issues is quite damming.

Moodle = 1990′s Technology in 2012

Related posts:

1. Moodle at North Carolina State University: Report of Two Instructors’ Experiences TweetWARNING: This report is (NSFMD), Not Safe for Moodle Disciples....
2. New Moodle Leadership: Larry, Mo, and Curly leading moodle into the future ;-) TweetIt’s official…Larry, Mo, and Curly leading Moodle into the future...
3. Another damning indictment of Moodle 2 TweetI have so many Moodle 2 nightmare stories bookmarked, it’s...

I am a senior this year and getting to know a new program just to check my grades and post papers is ridiculous. Blackboard had become a friend to me; I knew everything about it and how to get to where I needed to be. Moodle is a stranger, one that I care not to know. You may say I am one of those people who does not like change, which is wrong: I love change, just not when it deals with my school work.

There is even a Facebook page called “Moodle Sucks.” If there are enough people to make a Facebook group dedicated to the hatred of Moodle, then something is obviously wrong. If you go to Google and type in “why Moodle sucks,” there will be an endless number of pages to scroll through and hear everyone’s opinion on the matter.

I say bring Blackboard back, we are paying over 30 thousand dollars a year to go to a private college, where is all of that money going? You would think they had a couple extra nickels and dimes to spare in order to keep Blackboard up and running.

Source: http://www.weathervane.emu.edu/radiant/archives/volume-57/2/opinion/blackboard-better-than-moodle/

No related posts.

This is  becoming an everyday thing now. I’m not sure I’ll be able to keep up with all the colleges, universities, and K12 systems that have decided to dump Moodle and move into the 21st century with their LMS, but whether I post about it or not, the move is happening.

For all you out there who are on Moodle 1.9.x now and are thinking about “upgrading” to 2.x, you should really think about making the move to an LMS that was designed for this century. Canvas is open source and is light years ahead of Moodle in about every way. Upgrading to Moodle 2.x will get you no increased functionality; you will have a much more complicated and slower system; and you will still have one of the most insecure systems on the net. If you’re happy with 1990′s technology, then stay with Moodle, but if you want an open source LMS that was designed for this century, then Canvas is the way to go.

A university in Fredericksburg, VA has begun its move to a new open source, SaaS-based learning management system. Several instructors at the University of Mary Washington have started using Instructure Canvas in place of Blackboard software for their summer courses. The campus, whose Blackboard contract ends in August 2011, will move fully to Canvas in the fall semester.

An LMS committee of faculty and students had been meeting since spring 2010 to evaluate alternatives to Blackboard. The college had been running version 8, which was initially released in early 2008. Finalists under consideration included Blackboard, Desire2Learn, Moodlerooms, and Instructure. In January 2011 each vendor gave a two-hour presentation, in which they were expected to enter a syllabus, upload and manage media, control course and guest access, use built-in and third-party tools, and demonstrate other aspects of the applications. Instructure was announced as the winner in February.

http://campustechnology.com/articles/2011/06/07/u-mary-washington-begins-move-to-instructure-lms.aspx?sc_lang=en

Moodle–1990′s technology in 2011!

Related posts:

1. San Antonio Community College Adopts Canvas — Moodle not even mentioned TweetI’m reminded of a line in that commercial…Lost another to...
2. “Moodle fell right off the radar of pretty much everyone” TweetI thought for sure we were headed for a showdown...
3. Auburn U Moves to Canvas LMS — Moodle doesn’t even make short-list TweetIt shouldn’t surprise anyone that Moodle with its outdated 1990′s...

Hawaii Department of Education Selects Blackboard Learn 9.1 to Replace Open Source LMS.

The Hawaii Department of Education’s Extended Learning Opportunities and Student Support section has chosen Blackboard Learn™ 9.1 to replace an open source learning management system (LMS) Blackboard Inc. (Nasdaq: BBBB) announced today. The platform provides online courses for over 1,200 students through the Hawaii Virtual Learning Network-ESchool (HVLN-ESchool) and over 500 teachers annually through the HVLN-Project Inspire program.

Prior to moving to Release 9.1, HVLN utilized an open source platform to deliver online content. But the need for additional features, easy customizations, and greater functionality prompted them to explore options for a more robust LMS platform. HLVN also anticipated an increase in student and teacher enrollments, suggesting the need for an enterprise capable implementation.

Read more: http://www.sacbee.com/2011/09/20/3925118/hawaii-department-of-education.html#ixzz1ZN9eFQo1

Simply put, you can’t effectively educate 21st century students using a platform grounded in 1990s technology.

“The evaluation conducted by HVLN was a complete assessment of teaching and learning needs, cost comparisons and product performance,”

Moodle: Serving all your 1990′s learning needs in 2011….no thanks, says Hawaii

Related posts:

1. University of Mary Washington Selects Canvas Over Moodle TweetThis is  becoming an everyday thing now. I’m not sure...
2. Canvas LMS goes open source — Moodle is “kind of kludgy” TweetThis could be the sign of a real competitor for...
3. San Antonio Community College Adopts Canvas — Moodle not even mentioned TweetI’m reminded of a line in that commercial…Lost another to...

The news that someone has offered to buy Blackboard is causing quite a bit of chatter in LMS circles today…not to mention a big boost to some who may own stock. My advice…sell now before the hype wears off Of course, I never was good at reading the stock market–I guess if the phantom buyer turns out to be a big player–think Google, Microsoft, or even a huge textbook publisher, then holding onto that stock may prove to be a very good idea. I love it that the CNBC article mentioned Instructure as one of the most interesting competitors and completely ignores Moodle…maybe they’ve been talking to those who have upgraded to Moodle 2.0 However, just so Moodle Disciples out there don’t feel completely left out, I think the announcement by Instructure last week that it has raised $8 million in capital and is in this for the long haul, did contain several references to Moodle, without mentioning it by name.

The following statements from that announcement has Moodle written all over them…

“Our mission is to relieve teachers and students in all levels of education of antiquated technology.”

– Antiquated/Moodle — synonymous

““We were compelled by Josh and his team’s vision of delivering outstanding user experiences to those in the education market,”

– Checked the Moodle 2.0 satisfaction meter lately? Even some of the hardest of the hard-core disciples, are starting to see the light.

“The LMS market is long overdue for a new learning platform built on the latest Web-based technologies.”

– Yea, that’s what the disciples over in moodleland were saying about Moodle 2.0 during it’s 3+ years in development…are you feeling it yet Moodlers?

“At EPIC, we were searching for a disruptive play to serve the dynamic needs of students in the 21st century,” said Nick Efstratis of EPIC Ventures. “Instructure is that company.”

A “disruptive play”…I love it!

“Canvas leverages the leading edge of web technologies by embracing features such as drag-and-drop file uploads, HTML5 video and automatic speech-to-text conversion.”

Humm…well, Moodle 2.0 has a “new” file system as well, doesn’t it — I don’t think it’s drag-and-drop and I’m not hearing a lot of love out there for it…in fact, it’s reducing  die-hard disciples to tears.

If BB does get bought by a tech giant and if Instructure does push forward aggressively with it’s mission, I’m going to thoroughly enjoy watching Moodle with its 1990′s look, feel, and functionality die a slow death over the next few years.

Related posts:

1. University of Mary Washington Selects Canvas Over Moodle TweetThis is  becoming an everyday thing now. I’m not sure...
2. New Mexico State University Moves to Canvas — Moodle Stuck in the 1990′s TweetNMSU will be replacing Blackboard CE 8 with Instructure Canvas...
3. San Antonio Community College Adopts Canvas — Moodle not even mentioned TweetI’m reminded of a line in that commercial…Lost another to...

After over three years of development and nearly four months after the Moodle lead dev declared Moodle 2.0 Stable, 14 independent colleges have concluded that Moodle 2.0 is “Not production ready”…in fact, it’s far from being suitable for any real production environment.

Moodle2-Status-Report

I think the only people who are actually in denial of that fact by now are the disciples over in moodleland. Although Mo, continues to tout the fact that moodle.org is running 2.0, what he and his disciples have always failed to comprehend is that a social site that only uses discussion forums (such as moodle.org) is not even remotely close to being the equivalent of what is needed in a production, educational environment. Heck…as I’ve pointed out here on several occasions, moodle.org doesn’t even use the Moodle wiki, relying instead on Mediawiki for moodle documentation (see at about 30 seconds into this video). I love the comment in the report about the wiki upgrade failing and all the wiki problems highlighted…guess that wasn’t a problem during the upgrade to 2.0 on moodle .org–irony you think?

Some of the major findings in the report:

After careful assessment, CLAMP has concluded that Moodle 2.0.1 is not production ready.

Major issues that will likely prevent colleges from upgrading to Moodle 2.0 include:

● Grade data is purged when a student is removed from the course
● Moodle 2.0 upgrades from 1.9 often fail or require manual intervention
● Moodle 1.9 backups can not be restored to Moodle 2.0 installations.
● Administrators can no longer perform mass uploads of files to courses.

In addition, several important modules or blocks are not yet ready for Moodle 2.0 and would
prevent the upgrade for schools who rely on them. These modules include:

● Quickmail block
● Feedback module
● Scheduler module
● Shopping Cart module
● Banner IMS Enrollment plug-in

There have also been significant interface changes to the administration and faculty navigation
menus. This necessitates reworking or rewriting existing documentation and will likely require
retraining faculty and staff as well.

• In Moodle 2.0, when a student is unenrolled from a course, their grade data is deleted.
• There is not a good method for administrators to mass upload files to a course. This is because administrators can no longer simply copy files into a course folder within moddata; instead every file must be added through the file interface so that Moodle can create a hashed-reference to the file. We are evaluating workarounds.
• Moodle 2.0 upgrades from 1.9 often fail or require manual intervention
• Wiki Upgrade Fails
• JMeter load tests of Moodle 1.9 and 2.0 have revealed that Moodle 2.0 can be significantly slower at the same tasks than it’s 1.9 counterpart.
• Moodle 1.9 course backups can not be restored in Moodle 2.0

Related posts:

1. Disciple pride and confidence in Moodle 2.0 — Can you feel it? :-) TweetI can just feel the pride and confidence oozing from...
2. Upgraded to Moodle 2.0 — Data “mangled” in over 200 courses TweetThis morning’s Moodle 2.0 upgrade disaster has left one poor...
3. Use the HotPot mod & upgrading to Moodle 2.0 “stable”? — Think again! Tweet The HotPot module is one of the most popular...

A couple days ago, I reported about the hair-brained idea of ending support for the latest stable version of moodle — moodle 1.9.x — in December of this year. Seems that resulted in a lot of backlash for Moodle HQ. So today, Mo announced support would continue through June 2012 and in the same announcement, stated the following:

I hope this assuages any fears anyone had (possibly having the misleading “End of Life” in the title of this thread wasn’t helping much!)

Source: http://moodle.org/mod/forum/discuss.php?d=168021#p738502

Yea…it was the title of the post that caused all the problems…I’m sure it had nothing to do with his own, bold statement in that same thread:

I plan to keep putting resources into supporting 1.9.x until December 2011.  I doubt we can stretch beyond that, because it’s getting harder and harder for our developers to remember how to write code for 1.9 

Of course anyone else can jump up and offer to maintain 1.9.x after December if they like. 

Source: http://moodle.org/mod/forum/discuss.php?d=168021#p737598

Come to think of it, Mo always did slap Larry and Curly around for his own stupidity!

But now to the real question….does this announcement really make you feel any better, safer, or securer? If so, you ain’t been paying attention

Related posts:

1. New Moodle Leadership: Larry, Mo, and Curly leading moodle into the future ;-) TweetIt’s official…Larry, Mo, and Curly leading Moodle into the future...
2. Moodle “End of Life” policy TweetNow there’s a question all Moodle users should be keen...
3. “The performance of Moodle 2.0 = modem connection to the Internet” TweetI usually only highlight one moodle 2.0 upgrade disaster from...

It’s official…Larry, Mo, and Curly leading Moodle into the future

The official advice being given for months on moodle.org has been, if you are planning on upgrading to Moodle 2.0–don’t! Anyone who has been following the moodle 2 saga, knows that’s good advice. Now, the moodle lead dev (aka Mo) chimes in and announces that support for moodle 1.9.x will cease less than a year from now, in Dec 2011.  So, let’s see where that puts you:

1. You are responsible for your institutions moodle install.
2. You are a responsible Moodle admin, so you’re not buying into the moodle 2.0 “stable” BS, and are content to wait until it’s proven to really be stable, so
3. You haven’t followed the disastrous path of upgraded your site to 2.0 in the middle of the school year–which most responsible admins wouldn’t do even if 2.0 was really stable.
4. You’ve decided that the general advice in the forums is correct and upgrading before at least summer 2012 would be irresponsible (and I would put it at even a year after that date), so
5. You’ve planned to upgrade in summer 2012 and go trough the process of re-training everyone on this completely “new and different system” as it is being described in the moodle forums.
6. But, now you learn….
7. If you follow your plan, your institution will be using an unsupported version of moodle for at least 6 months, so
8. Now what?
9. Upgrade from a stable version (even if the code is crappy, insecure, and Mo, Larry, and Curly want to run from it as fast as they can) to a newer, not better, more complicated, broken version less than 6 months from now?
10. Hummm…the delimma!

Okay, here is my advice–of course, as with all advice here, use at your own risk Forget about how long Larry, Mo, and Curly plan to “support” 1.9. Moodle security is an oxymoron anyway…even if you stay with 1.9 and “official” support stops in Dec of this year as Mo has announced, a year from now your site is going to be no less secure than it is today. Recognizing and responsibly addressing Moodle security issues hasn’t been one Moodle’s strongest points anyway.

Don’t be forced to make a bad decision by the illogical acts of the Vaudeville trio — stick with 1.9 and take a really hard look at where you want to go with the future of your LMS knowing that you next major “upgrade” will result in a transition to a new platform regardless of what you do–Moodle may not be your only or best choice these days.

Related posts:

1. Instructure to Moodle — “Kludgy” is so 1990′s ;-) Tweet A lot of people are posting and tweeting about...
2. University of Mary Washington Selects Canvas Over Moodle TweetThis is  becoming an everyday thing now. I’m not sure...
3. Auburn U Moves to Canvas LMS — Moodle doesn’t even make short-list TweetIt shouldn’t surprise anyone that Moodle with its outdated 1990′s...

WARNING: This report is (NSFMD), Not Safe for Moodle Disciples. Read at your own risk!

http://www4.ncsu.edu/~n51ls801/MoodleTwoNCSUCoursesFall2010Web.pdf

This is a “must read” report for anyone in a decision making position considering adopting Moodle as an institutional Learning Management System (LMS).

The very first line in the Introduction section of the 61 page report should serve to alert any reader that this is not your typical “I’m a blind Moodle lover and can’t see the flaws” type report that is prevalent on moodle.org.

Our experience with using Moodle as a Learning Management System contrasts sharply with the faculty experiences described in Vista to Moodle: Everybody’s Doing It2

I don’t think you will see this report showing up in the moodle news section over in moodle-land anytime soon…all the more reason you should read it! I’m highlighting some of what I think are the more interesting points in the report, but to get the full impact, you really must read the report for yourself. It chronicles months of first hand experience with using moodle.

Moodle suffers from flaws (bugs and deficiencies in design) that directly affected our and our students’ ability to use the system efficiently and effectively. Some of the bugs affect Moodle modules used in grade determinations, and this raises concerns about the university’s legal liability.

This is not the first time flaws in Moodle have raised concerns about an institutions legal liability…remember the porn issues and multiple security vulnerabilities that still plague an untold number of moodle sites throughout the world today.

There is good reason to doubt that it is feasible to repair Moodle’s flaws.

There is such a thing as something being “broken beyond repair”. I’m not sure I agree this “technically” applies to Moodle, but given the track record of Moodle developers under current leadership, and the complete disaster Moodle 2.0 has turned out to be, I can certainly see how a lack of confidence in the vision and competence of moodle development could lead many to draw that conclusion.

Some (not all) Moodle developers exhibit an almost evangelical attitude toward this open-source product, and thus tend to take a dismissive or hostile attitude towards some of the concerns noted herein – “kill the messenger” as some moodle.org fora participants have characterized responses to questions about some flaws and design decisions – but that of course does not invalidate the concerns.

I think they are being nice by using the qualifier “almost” when describing the evangelical attitude…there are some in the moodle “community” whom, it wouldn’t surprise me a bit if they have things like “Here lies the Moodleman” carved on their tombstones one day

If Moodle is flawed, why is it so well regarded and widely used?

While this question is strictly speaking outside of this report’s scope, it is so likely to be asked that a preliminary answer sketch might be of some interest. So here are four conjectures: (i) Moodle may be the least bad open-source alternative without being a good one. It might even be the least bad LMS. [It’s not for example unusual for technically sophisticated Windows users to express serious reservations about Windows, a product that has enjoyed considerably greater support and popularity than Moodle.] (ii) The vast majority of users rarely if ever avail themselves of the capabilities proffered by LMS’s, and individual sections are typically under the 60 or so beyond which the worst problems become more obvious. (iii) Antipathy towards commercial products and open source over-enthusiasm can foster the evangelical attitude mentioned above. (iv) Once on a large, heavy bandwagon, it can be difficult to jump off.

Very good points about Moodle being the least bad open-source product. While compared to open source PHP/MySQL software like WordPress, Moodle does look like something from the 1990′s that’s about one step ahead of pong in development and sophistication. However, when compared to other open source LMS’s like ATutor or even SAKAI, it does hold it’s own. However, that landscape is starting to change. I believe the recent announcement of Instructure’s Canvas LMS being released as open source is just the first in a new wave of real web 2.0 competitors we will see enter the LMS market in the next few years. Once thing is for sure…Moodle will not enjoy the empty playing field in the open source LMS game much longer–the field is going to get a bit more crowded, so Moodle had better get it’s game face on…and if Moodle 2.0 is it’s game face, it’s in for a very rough future

Finally: If you have made it this far and found the journey disheartening and numbing, imagine the effect on those who have been through the process described. Now, when I hear the term “workaround,” I naturally think of “death of a thousand cuts.” What all of us need is a system “around” which we don’t have to work, and that is designed for its users (not its developers), one that works reliably for students, faculty and staff.

Now, if that’s not an indictment of the pure mess that is dressed in orange and called Moodle, I don’t know what is.

I could write pages just commenting on the communications cited in the report, but I’ll leave that for some later blog postings…

Enjoy!

Disclaimer: I have no relationship with the authors of this report. To my knowledge we have never met or spoken with each other. I became aware of this report only a few days ago when it was sent to me via email. I contacted one of the authors for permission to post here and received that permission.

Related posts:

1. San Antonio Community College Adopts Canvas — Moodle not even mentioned TweetI’m reminded of a line in that commercial…Lost another to...
2. Hawaii Department of Education Drops Moodle for Blackboard TweetHawaii Department of Education Selects Blackboard Learn 9.1 to Replace...
3. Research Report: “Investigation on Security in LMS Moodle” Tweet The research report attached to this post was published...

More bad code from #moodle: "echo $spacer;". Guess what that outputs!

January 31, 2011 7:34 am via Seesmic twhirlReplyRetweetFavorite

@gatekiller

Stephen Hill

Related posts:

1. Quotable Tweets: Moodle 3? How about a functional Moodle 2 first ;-) Tweet...
2. Quotable Tweets: Moodle is a nightmare to use. Tweet...
3. Quotable Tweets: Will BB buy Moodle for $1.98 ;-) Tweet...