The Canvas hack turned out to be really interesting as more details emerge. For example, a lot of people going into HN, including me, don't know that Canvas is completely OSI open source, which is a frank example of how worthless that can be from a security and product POV.