Teaching programming in schools

[polarlemniscate]

Probably a silly question, but most of the programming environments that we would like to use give students unacceptable access to the C: drive and other areas. This is a problem for our technicians, because as a teacher of AS/A2 computing I need my students to be able to program at school. We have one great big CC3 network and no "safe" rooms. Where do we go from here?

 

Jim

[autismuk]

Well, if things like Netbeans and so on don't work, what about using VirtualBox ?

[Batman]

I know a couple of lads (couple as in two of them, they're not lovers or anything...) who did a bit of programming at a college. The college gave them access to a virtual machine to do it. Pretty sensible, you could do it easily with VirtualBox... in fact, you could build the VM on your clean machine, make a package and deploy it (albeit slowly) quite easily.

 

Have you used VMs?

[polarlemniscate]

Haven't tried VirtualBox , but we HAVE tried a linux VM running in VMware player and Micro$oft Virtual PC - our lessons are only 35 minutes and after logging into CC3, then starting a VM, then loading the SW we don't have enough time to do anything useful.

 

Jim

[Potato-Peeler]

What we did was make a user account soley for VB, with 10 accounts and only allowed to use in the time they were supposed to be doing it, all other times the account was locked. This has so far worked quite well. They are also allowed access to near nothing else.

Though as above, on my CCNA course we are given a virtual machine to prat about with

[polarlemniscate]

I had thought about special accounts..I may pursue this further..thanks! Anyone else have any other views?

 

Jim

[teejay]

VitualBox is they way to go, pretty snappy and if they suspend the virtual machine rather than switching it off then they are running in about 10-20 seconds. Also gives them chance to try various O/S's to check cross compatibility etc and also if they are testing a program they can snapshot the image so if the program does anything weird then it can quickly be reverted back.

Personally I wouldn't go the special accounts route as you are still then giving them access to the C drive in a programming environment which makes it very easy to stuff the machine.

Your other options are to investigate VDI's, use some software which restores machine state on reboot (completely forgotten the name of it!), seperate desktops/laptops soley for programming.

[polarlemniscate]

OK thanks!

[srochford]

What about teaching the programming using web tools? Write the code in VB.Net, PHP etc but running on a web server? This is both really good (because web coding is useful) and you can have loads of people putting their code on one machine. Even if someone does manage to mess it up (and it's much harder to have web code causing harm; it will run as a low privilege user with relatively little access to the file system) it shouldn't be too hard to just fix the one machine (need to make sure users copy their code to home drives so that the web server is sacrificial!)

 

I don't think you should worry too much about what users can do with a programming language. Most simply won't have the skill to do anything bad (they might think they can do clever stuff - eg bring up a listing of all files on drive C:) but if the permissions are half decent they won't be able to break anything! Those who do have the skill will do it whatever tools you make available - you need to get them on your side and benefit from their ability.

 

If you don't want to go the web route and you can't get reasonable VMs on the desktop machines, can you put a batch of VMs on central boxes? A desktop class machine with 4Gb of RAM should comfortably host 8 VMs running XP. VMWare Server and MS Virtual Server will allow you to have the machine on one box but the user accessing it on another (both can use a web client to do this)

Edited July 8, 2009 by srochford

[CyberNerd]

environments that we would like to use give students unacceptable access to the C: drive

 

Every time this question comes up, I always ask what can student do in the C;\ drive that is such a problem?

 

I'd be really grateful if someone could explain the security implications of giving someone (read) access to the system files. is windows that insecure, or are the technicians? I hide the C:\ drive, but purely for an aesthetic point of view.

 

To answer the original question, php just requires a webserver and bluej is designed for teaching (mostly at uni) BlueJ - Teaching Java - Learning Java

[techie08]

The ICT teacher brought up this subject and said he will be teaching GCSE computing and programming in September, probably with Visual Basic.

Would it be wise not to let this run on the network? possibly standalone machines? Virtual machines?

Im not really that clued up with visual basic and not sure what damage it would do with the wrong student

 

Thanks

[p858snake]

When i did VB.net in class it was fine on the network, there was just some security issues and we couldn't create the installers.

[srochford]

Would it be wise not to let this run on the network? possibly standalone machines? Virtual machines?

I'm not really that clued up with visual basic and not sure what damage it would do with the wrong student

 

The answer (as others have said) is "not much damage"

 

Realistically, if they're going to do damage, they'll do it without the programming tools and access to the command prompt.

 

Do you, for example, remove the VBA environment from Word, Excel etc? If not, you're at exactly the same level of risk and I suspect that VBA is present for most users.

 

I know we have school and college students on this forum - perhaps one of them would like to explain what they can do when they have access to a programming environment. I suspect that they're able to do very little that they shouldn't be able to do if the network is reasonably well locked down.

[pete]

90% of ours spend their time attempting one of two things:

 

1) Making a web browser that they believe will get them a direct route to the Internet

2) Making games / level designs.

 

Anyone trying truly malicious stuff gets picked up quickly and beaten with the AUP.

 

Have you considered (assuming non-vb development) just using a vm they can ssh into with putty? Or maybe LTSP?

[Netman]

Another way to do it would be to give free access to the machines and just re-image them every night or if there is a gap between lessons. A little FOG server on the same network segment could do the job quickly and could be scheduled so would be relatively hands-off.

 

Or, look at products like Deep Freeze - a simple reboot and any changes to the PC are wiped out...

[Chunky]

Possibly overkill, but have yo thought of dual booting the PC into a vanilla xp image?

 

Alternatively, maybe booting XP from an external hard drive / having drives that can be removed (in caddys) at all other times?

 

Just a thought,

 

Chunks.

[p858snake]

Just remember, whatever they program can only do what they would normally be able to do (unless they program it to run as another user).

 

PHP/MySQL doesn't need to be run from C:, for example there is a portableapps version of XMPP, and I know both the XMPP/WAMP packages can be run from other drives, you just need to make sure you fix up all the references in the config files.

 

During learning PHP and MySQL in class I never really had a issue except for creating the Installers in VB.Net but that might be because my teacher wrote the textbooks for both (he also sells them online, if anyone wants a link).

 

Also we used the normal user login environments for this as well (but got given C: access because the wamp packages were last minute rollouts).

Edited January 27, 2010 by p858snake

[Chunky]

Just remember, whatever they program can only do what they would normally be able to do (unless they program it to run as another user).

 

Correct in theory, but not in practice. When code is written to utilize vunerabilities, it is often done in a way that negates the issue of permissions. (hence why it's a vunerability).

Sorry if it appears a bit picky - you're right in general, but with respect, thought it was worth pointing out.

 

Chunks

[fafster]

Teaching web programming may be a good route. They can still learn the fundamentals (recursion, selection etc) but they'll also see immediate results. It's easy enough then to create subfolders within the web directory the server uses, and set up folder permissions so that they can only access their own folder via the filesystem.

[srochford]

Correct in theory, but not in practice. When code is written to utilize vunerabilities, it is often done in a way that negates the issue of permissions. (hence why it's a vunerability).

Sorry if it appears a bit picky - you're right in general, but with respect, thought it was worth pointing out.

 

Chunks

 

But that vulnerability is there whether or not you allow them access to programming tools.

 

Many of the Internet Explorer vulnerabilities give elevated rights when you visit a "bad" website - your pupil hacker doesn't need programming facilities in school, they just need to set up a web page elsewhere (even on their home PC) which they then visit from school.

 

Stopping kids doing programming will rarely protect you against vulnerabilities.

[Chunky]

But that vulnerability is there whether or not you allow them access to programming tools.

 

Many of the Internet Explorer vulnerabilities give elevated rights when you visit a "bad" website - your pupil hacker doesn't need programming facilities in school, they just need to set up a web page elsewhere (even on their home PC) which they then visit from school.

 

Stopping kids doing programming will rarely protect you against vulnerabilities.

 

I never said it would. Giving them programming tools massively increases their arsenal of ways to access these, and in different ways. You can limit the number though, by not doing this, or doing it on a non-live system. (such as an external rebuildable drive, or a Virtual image)

 

What was originally said was that "Just remember, whatever they program can only do what they would normally be able to do (unless they program it to run as another user)."

 

Where this is invorrect by the virtue that without the programming facilities, the number of ways to access vunerabilities is massively reduced, and that the dependance of users permissions can largely be negated) - It's far easier to target vunerabilities via programs than simple web-page hacks.

 

Chunks.

[garethEds]

For those who are interested in coding at school there is a group:

 

Computing At School

 

Which looks at this sort of thing. It's run by Simon Peyton Jones of Microsoft. There is a Google group which houses a lot of programming links suitable for kids etc.

 

Regards

 

GJE

[StewartKnight]

Laptops?

[Ric_]

Small Basic works as limited users and AFAIK shouldn't open up any vulnerabilities. It also offers a transition to VB when required.

[srochford]

Where this is invorrect by the virtue that without the programming facilities, the number of ways to access vunerabilities is massively reduced, and that the dependance of users permissions can largely be negated) - It's far easier to target vunerabilities via programs than simple web-page hacks.

 

Chunks.

 

I think you're completely mis-understanding the kind of vulnerability which is most common. If I want to hack into "your" computer, I don't sit down at your computer and write code. I sit down at my computer and write code which I put on a web site. I then persuade "you" to visit my web site and that then exploits the vulnerability on your computer and gives me control.

 

Stopping kids programming at school simply has no effect on that attack vector and I really don't like the "we can't allow programming at school because kids might do something bad" attitude!