[ ----------- 100% ------------ ]
Status: Completed
As a Teaching Assistant, there are a few categories of emails that constantly come up:
- “Why did I get a low score on _____?”
- “This doesn’t make sense, can you explain _____?”
- “What grade did I get on _____?”
- “AAAAAHHHHHHHHH!”
#1, #2, and #4 need to be handled for the most part on a case-by-case basis, but #3 could definitely be automated.
The idea behind a website that students can log into for their grades is fairly simple, but there were two aspects I wanted to focus on:
- Security – Abstracting a student’s grades away from their personal information, and keeping the full grade file offline
- Credentials that are easy to remember (for the right student), credentials that are not easily known (for a student trying to log in as someone else), and credentials that are readily available to me
To handle the security part, I split the task into two pieces – 1) Process the grade file, and 2) Display the grades.
The handle the credentials aspect, I use the student’s last name and their student ID (both of which are available to me in the class roster). Every student has a last name and a student ID, every student should have them memorized, and it is conceivable that most students wouldn’t know the student ID of someone else. For the students who do know someone else’s last name and student ID, the most they would be able to do would be to view the quiz/lab/test grades of that student. Not ideal, but short of creating, supporting, and maintaining a password-based system linked to email addresses, this seemed like the best bang-for-the-buck.
The current grade file is stored in a Google Docs spreadsheet, so processing first involves saving a comma delimited version of the Google Docs spreadsheet. This CSV file is read by a script that reads each of the relevant grade information, and then stores the data in a separate file indexed by a hash of the student’s last name with their student ID. The original grade file is kept in a directory owned by (and no read permissions for anyone except) my account so that any unknown bugs in the display code wouldn’t be able to access any sensitive information.
The display task is handled by a CGI script that inputs the student’s last name and ID through an HTML form, searches for a match between the hash of the inputted last name and ID and the pre-computed hashes in the processed file, and then displays the student’s grade information. In doing this, there is no connection between grades and a student’s information – only the hash of their information.
To add a bit of flair to the site, I raided the “Random Image” folder on my computer and have the display script show a random image to make the experience a bit more fun/comedic.
