Computer Science and Teaching Python and its many, many modules

[Warwick_Tech]

Hi All,

 

I thought I'd start a new thread to discuss Computer Science and its minefield of legislation -

 

I'm finding it difficult to navigate through what is/isn't required and how best to allow the code safely; so, for example in its base version; 'Python'

 

* Should this be run isolated or just installed natively

* Should students have access to install new modules (pygame etc)

* How do you mitigate the risks of students running code/programs on your network (please don't discuss the overall security of a network, this is irrelevant to the question)

 

I've always been a fan of sites like Replit.com where they can code online, but I'm being told these are 'restrictive' and 'distracting' (I know these are individual issues, but must be given merit for the sake of this discussion) and I'm also a big fan of providing Rpi5 units to each student so they can essentially be the Admin of their own device; but this comes with KCSIE risks (e.g. providing a school device that must be secure) and the added complication of throwing in a Linux based OS when they are taught on Windows

 

I've dabbled with VM machines running fat python on an unrestricted OS so we could also teach 'ethical hacking' but despite them working there are complaints of crashes, freezes and unsuitability with the curriculum.

 

How does everyone else deal with this minefield? We need a sensible balance of getting the best for students, but also following the layers of legislation based around this curriculum.

[mavhc]

There's no risk to running programs on the network because firewalls exist, they can't get to a network device they can't access without python

 

Assuming you're also blocking websites at the router level as well as locally, there's a slight risk

 

Are you letting student computers connect to the internet without going via a proxy? Can they open a tcp connection/send udp packets to non allow-listed IPs?

 

Main problem is more flooding/DoS, eg creating millions of files (do you have a quota system), filling up the local disk (are you monitoring disk usage/preventing that with a quota system), or monitoring for DoS? When you do get ping'd that ip X is DoS'ing ip Y what happens? Do you know which student it is, what happens when you report them?

[dhicks]

How do you mitigate the risks of students running code/programs on your network

 

We can put pupil devices on our network in "guest" mode, which isolates individual devices on the network, just giving them access to the internet rather then letting them see other network devices. You could add further restrictions if you have gateway filtering, possibly only allowing access to a whitelist of approved sites.

 

I've always been a fan of sites like Replit.com where they can code online

 

PythonAnywhere might be worth a look, users get a managed Python environment with a whole bunch of common libraries already installed - I think they do discounts for educational customers.

 

I'm also a big fan of providing Rpi5 units to each student so they can essentially be the Admin of their own device

 

Raspberry Pi have just released their for-organisations version of their Remote Desktop system, which might be helpful - previous post:

 

https://www.edugeek.net/forums/raspberry-pi-arduino-other-sbcs/240898-rpi-noob-needs-help-connecting-pi-4-windows.html#post2060418

 

I've dabbled with VM machines running fat python on an unrestricted OS so we could also teach 'ethical hacking' but despite them working there are complaints of crashes, freezes and unsuitability with the curriculum.

 

Hmm - sounds like it should work, it might be worth re-visiting the idea. If you were having trouble running the VMs on local desktops, you could try having them all hosted on a server. We have a remote desktop server accessible via web browser, so you could have a remote desktop server that could connect to a "programming" virtual machine for each user, then you'd be able to reset / restore the VM if needed per pupil.

[Chris_Cook]

We install natively. Students can't install their own modules, the security incidents around the pypi website should be enough to put anyone off that. More than happy for requests to come in via teachers for projects etc. and these are evaluated as best as we can.

 

We push both out with a script, and probably update about once a term. Teaching staff need to be on board as upgrades can break programs and scripts. I'd avoid Python 2 for anything new.

 

There does need to be a bit of a change in mindset around Computer science - Maybe going more along the lines of the DT dept. For example, at some point you need to teach the kids how to use a hammer or a drill, so there is lots of guidance, scaffolding, risk assessment etc around that. We don't just lock the hammers in a cupboard and never let the students near them, but we do provide a safe-ish environment for them to learn in. If we don't teach risky/dangerous skills then we won't have prepared these kids with the skills we need them to have for the future. At some point everyone hits their thumb with a hammer.

 

Another risk not mentioned about student managed devices is rogue DHCP servers. A properly segmented network is key, as well as enabling options like firewalls, STP and DHCP guarding etc. Computer science labs should have an isolated network so they can only break their own stuff.

 

Probably not an option for most schools, but at college we had a room full of old PCs and IT kit that students could play round with. Unfortunately they didn't do anything about DHCP and apparently the year group after mine managed to bring the whole college down. This was also the last room the IT team checked.

 

Even if you don't use RPis for T&L, then you still need to have the proper security in place as what's to stop a student plugging in their own one from home and hiding it behind a PC or plant pot? Its a similar risk with USB key loggers as well. Gone are the days of being able to say every device on the school network is managed by IT and is secure and not a risk.

[mavhc]

Private VLAN would stop DHCP working, Or look into dhcp snooping on your switches, or block the ports