jthompson

This perfectly illustraties my earlier point about non-vanilla TOTP 'authenticator' app functions muddying the waters.

Presumably, as long as python can access the local filesystem, then a script would be able to work with mapped network drives, without needing to perform any networking in and of itself.

How did it take us this long to notice the literal log table?

Given the prevalence of T-OTP these days, I'd be reluctant to not make that an option for staff on their main accounts. If you're staff don't already encounter T-OTP in some way, I'd be very surprised. For a relatively simple concept (stored secret + current time = 6-digit code) it devilishly tricky to communicate clearly to end users. That's not helped when certain companies (*cough* Pearson *cough* Microsoft *cough*) decide to go a bit rogue and roll their own flavour of it in a self-branded app that doesn't quite behave like vanilla T-OTP. Yes, the MS app can do vanilla T-OTP, but it'll try some passkey stuff in the first instance with MS accounts, which although 'fine' will generally just muddy the water for less confident users. It's not really practical for us to mandate 2FA for our students sadly, because we're using Google Workspace and we have a mobile phone ban in classrooms. When the time comes, though, it's going to test my instruction-writing skills to the max.

That's what I was thinking, yes. It might break it's utility too much in terms of classroom tasks, I don't know, but worth exploring I guess.

You can also get some AppLocker rules set up that would give the the ability to allow python (or whatever) to be executed only by members of a particular security group. You can then restrict that membership just to the students who need it (if that's meaningful) and also gives you a ban hammer to wield in case anyone prats about. "Blocked.. VM only for you!".

How about some kind of compromise? Retain the VM as a full-fat option, but locally installed python has various libraries blocked out by filesystem privileges to prevent abuse of subprocess, etc. With kids of that age, I'd reckon the most likely risk is infinite loops spawing calc.exe, stuff like that, which will prompt ungraceful shutdowns of hosts. Worth throwing in an argument for a sandbox vm being more conducive to students' confidence to try things out without the risk of 'breaking' the computer.

Please could you convert those grades into Emerging, Expected and Exceeding?

You may also need the end user to have write access to the secure client install location. That's just a hunch but worth checking. We deploy ours to something like "C:\surpass" to allow for that. When deploying the software, we use a transform file to specify the install location (/forums/educational-software/226780-secureclient-surpass-update-loop.html#post1945610)

The only update for V3 that I can remember having to roll out was to fix something relating to the licensing/activation aspect of it, rather than the core application.

We have it, but only because our LA was running some attendance-related initiative and was pressing hard to have schools install the sync agent. Can't speak to how well it works as we're not really the end users.

Really? Printing?! Our VirtualBox VMs use the shared folders feature, such that whatever files they create in the VM are going to live in their regular home folders anyway, so no barrier to printing. Mild simplification of sending something to a printer is no reason at all to argue for arbitrary code execution. If you're not sandboxing in some way, then you're doing it wrong IMHO. I appreciate that that's not addressing your actual question, but hey, I wanted to vent

Totally hadn't noticed that Canva had video stuff.

We're using Datto Backupify at an approximate cost of £1 per user per month.

No, but if they're already signed on when the network goes down, they can carry on using the machine with EWP saving automatic backups locally, which an exam officer would then retrieve after the fact. They wouldn't be able to print if the network is not available. We use a computer startup script to copy down the EWP config file. That means that if/when we adjust the config, machines would pick it up at their next reboot.

V3 has a Linux version, iirc. Does that make running it on a Mac more achievable?

Testing a bit further, Google Authenticator works correctly with Pearson accounts, but Microsoft Authenticator does not. Microsoft Authenticator generates codes using SHA1 only, it would seem, whereas Google Authenticator read in the correct algorithm to use (SHA256) from the QR scan.

I've used a generic T-OTP authenticator (FreeOTP+) with Pearson, and it does work. One slight difference I noticed was that where T-OTP tends to use SHA1, in Pearson's case they're using SHA256 so I had to adjust that manually for an authenticator app (KeePassXC) where the setup was done manually rather than via a QR scan.

Yes, you do need to back it up. You may decide to just do the staff accounts though, because cost per user per month is challenging calculus when including all of the students. We're backing up Workspace staff accounts using Datto here. Very few restores ever done from it, but it's there to restore stuff in bulk in case some major error or incident were to occur. Recovering stuff in bulk is not really possible using just the first-party Workspace tools. Google Vault gives you e-discovery of long-deleted files and emails but there's no snapshotting or restore capabilities there.

I don't know how many of my colleagues are using it but I do remember some surprisingly progressive attitudes around it when ChatGPT first emerged a year ago. I don't use it much but may use it for an initial starting off point when doing some coding mini projects. I do wonder about the environmental cost of these generative models, though. Is my using GPT4-Turbo to produce a relatively simple PowerShell script the equivalent of me popping to the shops in an F-22 Raptor?

I agree with this. If the power is out for a prolonged period then it may just become a general site safety issue anyway.

By "desktops" do you mean the Desktop folder of the local profile? Ours is too, along with Documents, Pictures, etc. but we have the following setting in our EWP config file: { "Setting_Name": "DefaultBackupPath", "Setting_Value": "%USERPROFILE%\\ExamWritePad_backups" } It's been a while since I tested it, so can't remember if EWP gets the grump if the main save path (i.e. on the network) becomes unavailable for the regular autosaves.

We use the webUI for our Hikvision box. Ours doesn't seem to be conducive to Chrome offering to remember/autofill credentials, though. In fact, the password field doesn't allow pasting, which is obviously quite crap and not based in any recognised UX convention. Not wanting to be sinophobic, but it's as though the things like password managers and estalished usability conventions that Western tech users have become accustomed to are largely absent in Chinese software development. Oh and the plugin also adds itself in registry to auto launch every time a user signs into Windows, raising a UAC prompt that it doesn't actually need anyway. As I said... quite crap.

We use ExamWritePad currently, too. The candidates use individual exam accounts. The EWP file is saved/autosaved to their network home folder, with the automatic backups saving locally in the local profile. That allows for continuity in case of a device failure or in caes of a network/server issue. In case of a general power cut, the servers are on UPS but the majority of edge switches around the site aren't. If the exam is being done on a laptop, then it'll continue on battery power, but if it's on desktop, then obviously that would lose power. I imagine the exam would only be stopped if the power was out for an extended period.

Not a Zabbix or MicroTik user, but did your checking of settings include any IP restrictions on which IPs can make SNMP connections to the device?