A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Why give your students a way to get RCE on your institutions servers through anything less than perfect file upload implementation.
For a .tar? I wish you the best...
Instead of that, simplify.
Use unique salts for each assignment per student.
Align hashes with those salts to check the outcome for each students assignment.
Literally have them send you a CTF style sha256 string.
Do it step by step where each step doesn't depend on the next, grade as a percentage of flags accurately procured.
Absolutely this. Even if you had fancy jails or docker setups for each submission, this will be a nightmare to properly handle. Students DOSing each other exactly before the submission deadline, too.
I mean just for the love of God don't spin up something on your company's infrastructure that accepts file uploads.
Just don't.
If you're reading this and going "well, it's just internal," or "well, it doesn't do much it just accepts this exact file type." My god. Ask your CISA. And if they're okay with it, cool. That's on them.
Unless your whole business is transferring files, don't. And even then... Don't.
And if you're still confused, the answer is to use another company's infrastructure for this. Use Azure. Use AWS. Use Google cloud or even g suites. Don't accept that liability. Let the trillionaires do it.
You can accept them on internal networks, just have a file size limit and don't extract them locally, but send to some cloud service for handling. You could even have it work with email attachments if you want.
Basically:
My first method eliminates waiting to see if your students code runs fast enough. Unless complexity is part of the assignment, I'd still say go for the hash.
It's also less work for the professor/grader.
I mean if you put up an Internet-facing unauthenticated file acceptor it will quickly become stuffed with all sorts of garbage and aspiring malware. You definitely don't want to hook that up to an untar and exec loop, even with some notion of sandboxing. It will just start mining Bitcoins or sending spam or something.
But if it is built properly, with only authorized users being able to upload stuff, and a basic understanding of not dropping stuff where the web server will happily execute every PHP web shell someone sticks in the slot, and the leverage to threaten people into not uploading pictures of their own or others' butts or Iron Man (2009), I don't see why all but the file-uploading professionals should immediately give up.
This is basically what CI/CD pipelines do.
Compile the code, run tests, run static analysis. If results pass, submit the code. If results fail, reject it with an explanation.
Idk the details of how you'd implement this for a class, without letting everyone see eachother's completed work, but I'm sure it could be done.
You could use automated testing tools to do the work for you. You define your requirements as individual tests and every input is tested separately giving you a report which tests failed and which succeeded.
If you use moodle, it has a plugin for that, with instructions.
If you don't use moodle, you may want to check the instructions on the plugin anyway.
Did a takehome for a company recently that did it well. They required that I make a docker file (you could give them one if you wanted) where when ran it would run tests. It was a neat use of docker IMO, it standardized that builds were just "build the docker file" and running was just "run the dockerfile". You would t have to deal with tar or anything then.
Thousand ways to skin a cat there
My university used Artemis to do basically what you're describing. Files are uploaded via git. But it seems like selfhosting would be a lot of work.
Hey, that was made at my former uni. And now I'm wondering whether other unis adopted it. It always seemed like a neat solution.
When I was in college, I took a 100-level CS course that required me to ssh into a server and run a command to submit my homework. It's not crazy.
That sounds like build automation. You can use some Git forge software.
Charles university uses and develops something called ReCodex, and it is available on GitHub. As a student, it was very nice to use.
You could definitely build something like this. You definitely want either human review before execution or a fair amount of sandboxing for whatever your students submit.
Do you want students trying to brute force or exfiltrate whatever test data lives in the server? If not, either they should just have the test cases already, or they can get back how many/which of the secret test cases they passed along with their grade, so showing them the results live might not be so important. Unless you want something like "you have 3 tries to pass the secret tests so you can get a hint that your own tests missed a case and go back and try to guess what it was".
You also might want to invest time first in test harnesses for the students to run themselves, because you want them to learn good practices like coding against a test suite. If nothing else it makes it easier to make the auto-grader later if the students' code is all already hooked up to the same test framework.
Teaching students how to use fully use a multi-user Unix system can for some topics put unnecessary faffing about between the students and what they are trying to learn (are you teaching front-end web dev or something?), but in a lot of cases your students might actually be better served by something that makes them touch the deep magic than by a slick web UI that handles everything for them, as long as you turn it into a learning experience and not a protracted period of bafflement.
Does your school not already have some kind of shared CD department server/Unix environment for the students that could get you out of account management?
Also, the Right Way to get the code to the server is probably going to be Git and not a tarball. The students could/should be set up with a Git forge and indoctrinated in never leaving their code on their laptop to be sat upon and lost.
I actually work for a large university in the digital education department. We do have tools like this but I’m pretty sure it’s for python. It could probably be modified for other uses however. I’m a hardware guy or I’d know more about it. If you’re interested I could probably get some more info or get you in touch with the devs that created it. DM if you want some more details.