Python IDLE

[Sheridan]

We're looking to install Python with the IDLE into some of our ICT suites so the students can do some programming. Sounds great but has anyone done this and if so what issues have you have with security policies etc?

 

My concern is that Python will not obey ntfs permissions/group policies etc correctly and students could write scripts to access system files and so on, not being a Python programmer I've not had a lot to do with it!

 

I'm all for getting the students programming but I'm conscious of the pitfalls.

[Chris_Cook]

Python is like any other windows program. It has to obey ntfs permissions. The only problems are if the permissions arn't set properly, or when code is submitted to a teacher. If a teacher (or admin) runs a students program, then it will run with the teachers permissions. Practically I don't think there is much chance of this being a problem, but the risk is there. The best solution to that is if the member of staff reads the code before running it. most stuff should be obvious.

[Sheridan]

Thats a good start anyway - I had intended to put a windows firewall rule in to block python.exe from any network access as they don't need to do it.

 

I'm not being deliberately awkward, but we do need to pre-empt any problems that can causes issues. Teachers and students have broadly similar permissions on networked PCs anyway so that shouldn't be too much of an issue.

[Oaktech]

I'm not being deliberately awkward

 

Yeah you are... but that's your job

 

I'm following this with interest as i'm doing some reading try to pre-empt the inevitable. The ICT guys are dabbling with KODU and scratch, but it's only a matter of time!

[Sheridan]

We already have scratch in use and Kodu is being looked at (althought that seems pretty safe anyway)

 

We also looked into the Pi's - but availability seems to be an issue!

[Oaktech]

Indeed... I'm still waiting for my Pi, when it arrives we'll sit down and work out if we can create a scheme of work to use it.

[Sheridan]

Actually if the python IDE does obey NTFS permissions, and I block python.exe from any network traffic that would probably secure it enough for most users.

 

Not being a python programmer I haven't got the knowledge to test it, bit of a VB man myself!

[Chris_Cook]

I doubt they would be able to do much damage with network stuff. I would be more concerned with running other programs, using the subprocess module or the os module. But this is common to most, if not all, other serious programming languages. It probably depends on your staff and students as to how much you need to secure it. In terms of security, python and vb have fairly similar security issues.

 

I'm also waiting on my pi.

[Sheridan]

Yes thats the bit I don't understand. Policy prevents them from running regedit (for example) but does that mean it could be started from python instead?

[jonspurs]

Hey..just curious on the latest with this? We've been asked to roll out Python...but I'm looking for the security holes too...

 

Cheers,

Jon

[SimpleSi]

Your probably not programmers so I'll explain

 

If you give people a tool (such as sharp knives or Python) then what you need is for people to take responsibility for using them - trying to restrict their usage (such as anchoring the knives via a piece of chain to a table or restricting permissions on share access) negates the usefulness of the tool.

 

What you need is social behaviour policies/rules/policing/sanctions not physical restrictions

 

Simon

[holyshmokes]

very cool

[jonspurs]

Cheers SimpleSi...but in a school it is simplier said than done...

[bede]

We are looking at rolling out python to some areas for same reasons.

 

I acknowledge SimpleSi's principle and this will apply in 95+% cases at our school. However every so often we get someone who wants to 'experiment' (not a bad thing), but they may also be someone who knows less than they think they do and/or someone who is relatively immature in applying such principles (the nature of [some] school students).

 

So - just wondering if people have now tried this, before we have a go and reinvent the wheel.

Also if any particular distribution of python is better to deploy on a curriculum network than others ('vanilla', ActiveState, Portable etc) and any pitfalls to avoid ....

 

[personally prefer PyScripter to IDLE]

 

TIA

Edited October 10, 2012 by bede

[catchpolej]

Hi, "It's only a matter of time...I think you are right.

I have asked our technicians (yes I'm a teacher - just ducking to avoid shrapnel now) to install Python (IDLE) and it is blocked by group policy for everyone except Admin. We were not sure why. Can anyone help us?

Also I was not sure whether the Python IDLE runs an executable if you stay within the IDE.

Up to know we have been doing all our "proper" programming using JAVA so this issue has been avoided.

Any pointers appreciated.

[Steve21]

Hi, "It's only a matter of time...I think you are right.

I have asked our technicians (yes I'm a teacher - just ducking to avoid shrapnel now) to install Python (IDLE) and it is blocked by group policy for everyone except Admin. We were not sure why. Can anyone help us?

Also I was not sure whether the Python IDLE runs an executable if you stay within the IDE.

Up to know we have been doing all our "proper" programming using JAVA so this issue has been avoided.

Any pointers appreciated.

 

I'm slightly confused as to what you're asking exactly...

 

If it's being blocked by GPO it's blocked because it's set to block exe's. Unless the technicians have installed it somewhere that the GPOs aren't blocking, or give you a way to elevate your rights there isn't anything you can do. Think by default Python drops itself into C:\, which by default isn't a "safe" area for GPOs (Normally it's program files etc). The technicians need to change the settings.

 

"Python IDLE" is an exe, so I'm not sure what you're asking in terms of does it run an exe if you stay within the IDE. It's just the python exe with a pretty GUI. A python script that is run within it won't spawn a secondary exe if that's what you mean? (Not like how a programming language will create an exe, scripting just interprets it)

 

Steve

[CyberNerd]

@catchpolej

 

If your already programming in JAVA then chances are you are using Eclipse.

There is a Python plugin for it here.. It works with Python, IronPython and Jython

[catchpolej]

Thanks Steve.

 

The GPO is set to block exe's. I will see if your advice about changing the settings of where Python installs itself work.

 

"A python script that is run within it won't spawn a secondary exe if that's what you mean?"

 

Yes that is what I meant by my question.

 

Steve

[catchpolej]

We are using Greenfoot and BlueJ for the moment for JAVA - less options to distract from the coding but thanks for the tip.