python

[chazzy2501]

Teacher wants a Python editor that has a debugger in it and suggested "MU". I've resisted any program that can compile as a pupil could in theory copy and paste code that is malicious and run on the PC. I've always pointed them to online editors.

 

 

Am I being overly cautious?

[dhicks]

I've always pointed them to online editors.

 

That also, of course, has the advantage that pupils can access the environment from home or other locations, they don't have to be on a specific device. General practice (from a couple of previous threads) here seems to be to provide a virtual machine for pupils to use for development purposes, which means they can have a nicely-configured development environment that can be reset back to defaults easily. If I was doing that I'd aim for the VMs to be centralised on a server somewhere and for the pupils to be able to remote in, then they could use it from home as well.

[dmj]

You could self host an online editor with Jupyter notebooks if the server load for VDI is too high.

Jupyter notebooks is used a lot in industry, especially with data scientists.

They are particularly well suited to education because the notebooks contain runable code, along with explanations, diagrams etc which you don't get with other editors.

 

Test it out for free https://github.com/jupyterhub/jupyterhub

[mavhc]

Teacher wants a Python editor that has a debugger in it and suggested "MU". I've resisted any program that can compile as a pupil could in theory copy and paste code that is malicious and run on the PC. I've always pointed them to online editors.

 

 

Am I being overly cautious?

 

Yes, there's a million ways to run code, not having a python editor (which doesn't compile btw, python runs as bytecode on a virtual machine) is just avoiding the problem that your computers are insecure.

 

VBA, cmd, powershell, wscript, jscript, webassembly, command.com, vbscript.

 

Given children don't know what a filesystem is, and they need to know to do CS, let them learn real coding

[chazzy2501]

I've disabled most of the other things you just listed from running as a pupil.

 

So the editor does not compile and execute, the chance of a breakout, overflow etc, then is not likely. (any more than any other program?)

 

virtual computers are a no go, I've heard of red pill code that can breakout of a VM years ago.

[mavhc]

Even then the program is running as the user, the worst they can do is anything the user can do, but a bit faster

 

Again, breaking out of a VM just lands you in the user's privilege, and breaking out of a vm is a massive bug that'll be patched rapidly.

[jthompson]

IME it's the nuisance factor that is the main reason for not providing a python instance directly on the host computers. Infinite loops launching the notepad ending up with an ungraceful reboots, or creating endlessly recursing folder structures in user areas, etc. VMs and/or online IDEs give your computers an easier ride.

[mavhc]

But the computers aren't there to be easy, they're providing a service, to teach children how to program is one of those services. Actually using a real computer is part of learning to make programs, dealing with files and filesystems etc. If someone causes a nuisance then give them the same punishment as in any other lesson.

 

Security flaws are IT's problem, nuisance is the teacher's problem

[jthompson]

But the computers aren't there to be easy, they're providing a service, to teach children how to program is one of those services. Actually using a real computer is part of learning to make programs, dealing with files and filesystems etc.

 

That's why a sandbox VM is nice.

[chazzy2501]

can someone tell me where "import module xxxx" is coming from and what about "pip install xxxxx"? what is to stop a malicious download? Edited October 21, 2024 by chazzy2501

[mavhc]

Import: When a module named spam is imported, the interpreter first searches for a built-in module with that name. These module names are listed in sys.builtin_module_names. If not found, it then searches for a file named spam.py in a list of directories given by the variable sys.path. sys.path is initialized from these locations:

 

The directory containing the input script (or the current directory when no file is specified).

 

PYTHONPATH (a list of directory names, with the same syntax as the shell variable PATH).

 

The installation-dependent default (by convention including a site-packages directory, handled by the site module).

 

Pip: By default pip will install packages from the Python Package Index https://pypi.org/ PyPi monitors for bad modules: https://pypi.org/help/#project_in_quarantine

[machy]

If you are still looking,

Thonny is a good editor for python code, we're using it across my trust and generally favourable.

 

Installable via PIP Too if you use that for packages

[mavhc]

If you are still looking,

Thonny is a good editor for python code, we're using it across my trust and generally favourable.

 

Installable via PIP Too if you use that for packages

 

It does seem to like installing per user though, how do you deploy it?

[willtech]

We use: https://vscodeedu.com/ its usefull for chrome books we have on site. Edited November 4, 2024 by willtech

[CHiLL]

It does seem to like installing per user though, how do you deploy it?

This is the command we are using:

"thonny-3.3.13.exe" /ALLUSERS /VERYSILENT

We did run into an issue that wasn't very well documented regarding using other Python modules within Thonny that are already deployed. We deployed OpenPyXL by pushing it as a pip installation via Python and it installs into Python's directory. However, when trying to access this module using Thonny, it wouldn't detect OpenPyXL, despite is being able to be called from IDLE. It turns out that Thonny comes with it's own integrated version of Python and it uses it's own interpreter, which doesn't have anything to do with regular Python. Instead, while in Thonny, you need to tell it to use the system interpreter from one of the options in the app and you can then import other Python modules as normal.

[machy]

This is the command we are using:

"thonny-3.3.13.exe" /ALLUSERS /VERYSILENT

We did run into an issue that wasn't very well documented regarding using other Python modules within Thonny that are already deployed. We deployed OpenPyXL by pushing it as a pip installation via Python and it installs into Python's directory. However, when trying to access this module using Thonny, it wouldn't detect OpenPyXL, despite is being able to be called from IDLE. It turns out that Thonny comes with it's own integrated version of Python and it uses it's own interpreter, which doesn't have anything to do with regular Python. Instead, while in Thonny, you need to tell it to use the system interpreter from one of the options in the app and you can then import other Python modules as normal.

 

Same Command for us

 

If you deploy Thonny via Pip then it uses the local / normal python stuff

If you install it standalone then it comes with its own python install.

 

(we install via Pip and Thonny picks up all the packages we use)

[Julian]

Our Head of IT really likes PyCharm Community edition (free) by JetBrains. It an .exe, so requires a script to install, but will install silently.

[dmj]

Our Head of IT really likes PyCharm Community edition (free) by JetBrains. It an .exe, so requires a script to install, but will install silently.

 

IIRC the professional licenses are free for edu if you open a ticket with Jetbrains

[chazzy2501]

My issue with Thonny like a few of these editors is that there is no legal entity behind them (no accountability). No one has audited the software, checked the licensing and the data collection. These softwares are updated by unverified users on the internet with what you hope is altruistic intensions. Also a windows update could stop them from functioning and good luck getting support in a timely manner..

 

I'm surprised so many people are happy running these unverified programs on the network. I have the EDExcel people tell me 80,000 users with Thonny on school networks! UNVERIFIED AUTHORS, NO INDEPENDENT AUDIT, NO ACCOUNTABILITY?!

[machy]

My issue with Thonny like a few of these editors is that there is no legal entity behind them (no accountability). No one has audited the software, checked the licensing and the data collection. These softwares are updated by unverified users on the internet with what you hope is altruistic intensions. Also a windows update could stop them from functioning and good luck getting support in a timely manner..

 

I'm surprised so many people are happy running these unverified programs on the network. I have the EDExcel people tell me 80,000 users with Thonny on school networks! UNVERIFIED AUTHORS, NO INDEPENDENT AUDIT, NO ACCOUNTABILITY?!

 

 

 

You have the exact same issue with any Python Module though

 

 

Thonny is on Github https://github.com/thonny/thonny it lists 74 of its contributors, Among which is University of Tartu and Cybernetica AS.

 

Its licence is on Github, and your free to Audit the code if you wish to.

 

i don't believe it collects any data, but the code is there for you to check what if any.

 

Can you point to the independent audits of Jetbrains? VS?

[mavhc]

Based on https://github.com/thonny/thonny/graphs/contributors it's mostly https://github.com/aivarannamaa who works for Cybernetica https://en.wikipedia.org/wiki/Cybernetica_(Estonian_company)

 

the licence is MIT https://github.com/thonny/thonny

 

It doesn't collect data, it's not a Microsoft product

 

Who's audited Windows?

 

Windows updates don't stop open source software running, because they're not doing weird things with drivers and rootkits

[dmj]

I'm surprised so many people are happy running these unverified programs on the network. I have the EDExcel people tell me 80,000 users with Thonny on school networks! UNVERIFIED AUTHORS, NO INDEPENDENT AUDIT, NO ACCOUNTABILITY?!

 

I guess you are immune from this.

[chazzy2501]

I don't have to audit Windows, that is Microsoft's job, they have legal accountability for Windows. This is the crux of my point, I don't have the resources to check what the software is doing, who claims they are who they are and what information is collected. You assume that Thonny have used no other opensource software or otherwise that requires it's own licensing adherence.

 

I've seen a Windows update break Outlook! Also as no one has done an independent audit you also don't know what is in there. (probably nothing, but I don't want to look pretty daft, pointing at a website saying "they said it didn't have a virus", look a university logo from 2016, daftbum64 is a trustworthy coder)

 

I ask myself: would I accept a parachute under these same conditions?

[mavhc]

So you're saying that Microsoft updates break Microsoft software? Why is that better than Thonny not breaking? Why would I care if they've used incorrectly licenced code anyway? Not my problem, but it will be obvious as all the code is public and people will be searching for code their company hasn't licenced.

 

It's an IDE, it's not going to save your life.

 

If you want you can pay me £1000 and I'll take all the blame if Thonny ever fails.

[dmj]

@chazzy2501

 

Python itself is open source. All the arguments that you put forward for not using Thonny apply equally (and moreso because of the quantity of code) to python.

Are you really not going to use a chrombook, piece of network equipment, 0365 because Google/MS/network vendor don't have control of the kernel they use?

I really don't understand your logic.