Is jupyter appmode with the "Edit App" button disabled secure? - security

Scenario: I use ipywidgets and appmode in a jupyter notebook to develop a web app. I want to expose this to the public (let's say a Docker container running the jupyter server, living on an AWS instance or whatever).
If I make the server settings such that the "Edit App" button for the appmode view is disabled, is that all that's required to prevent folks from accessing the notebook source and running arbitrary python code? Could they still go to the original notebook by changing the url? I found the documentation slightly unclear on that.

Im in your same situation #lagerbaer. I decided to look elsewhere for the solution since appmode is not a real security layer, its more for to give a frontend feel to the script imo.
I found anvil.works ...100% python fullstack web app builder/libraries, and yday I shot a question to them in re to libraries in my script to know which issues I could expect, and it was the founder, Meredydd Luff, that replied and answered my question. I would suggest looking into anvil.works if your concern is security of your notebook after sharing.

Related

How to make a python application distributable

My question pertains to distributing a python application the proper way. i have done research, but the answers appear to be vague and usually instruct the user to upload projects to the python package index. I simply want to make sure i research the proper methods instead of steering in the wrong direction.
I have been writing a stock analysis application with stored text files, and a dozen or so python scripts that interact with each other. Outside computers are to communicate with my servers through a random port (not the internet ports). all the imports work properly and the communication works properly, but i have no clue how to approach the distribution/setup or the GUI.
As an application with dozens of python scripts, should i write each script as an executable via pyInstaller, or should i add a python environment to the application to install python on all the user systems?
I need to add 'README', and 'LICENSE' to the application. What is the point of set up? is that a resource so python knows what is going on or does it actually setup the application? Does it need a URL, and what is the point of using the URL? Do i need anything else for the setup tools?
How do i package the entire application to download on user systems? I want the software to be uploaded via a URL link or from a USB. Do i have to make a tar file? i can do it automatically by writing my own python setup script, but i believe python has an easier way. Do i put a function in the setup to send an executable file to the desktop as a controller so the users don't open all the folders? How do i install from a link on a website?
For a graphical interface for the users on python applications, do most programmers use tkinter, or python integration into HTML, CSS? I do not want this application to be live in a website, but rather as a desktop application. Do i need to use a framework, such as django, to implement python into my html code?
I apologize if this is all unorganized. Ive always coded my own programs and never distributed or put a GUI on any of the scripts, so i just want to make sure i approach the task the right way.

How to get Selenium working with Jenkins2 in GCP

I'm trying to get Selenium Grid and Jenkins working together in GKE.
I found the Selenium plugin (https://plugins.jenkins.io/selenium) for Jenkins, but I'm not sure it can be used to get what I want.
I stood Jenkins up by following the steps here:
https://github.com/GoogleCloudPlatform/kube-jenkins-imager
( I changed the image for the jenkins node to use Jenkins 2.86 )
This creates an instance of Jenkins running in kubernetes that spawns slaves into the cluster as needed.
But I don't believe that this is compatible with the Selenium plug-in. What's the best way to take what I have and get it working with this instance of Jenkins?
I was also able to get an instance of Selenium up and going in the same cluster using this:
https://gist.github.com/elsonrodriguez/261e746cf369a60a5e2d
( I dropped the version 2.x from the instances to pull in the latest containers. )
I had to bump the k8s nodes up to n1-standard-2 (2 vCPUs, 7.5 G Memory ) to get those containers to run.
For this proof of concept, the SE nodes don't need to be ephemeral. But I'm unsure what kind of permanent node container image I can deploy in k8s that would have the necessary SE drivers.
On the other hand, maybe it would be easier to just use the stand-alone SE containers that I found. If so, how do I use them with Jenkins2?
Has anyone else gone down this path?
Edit: I'm not interested in third-party selenium services at this time.
SauceLabs is a selenium grid in the cloud.
I wrote Saucery to make integrating from C# or Java with NUnit2, NUnit3 or JUnit 4 easy.
You can see the source code here, here and here or take a look at the Github Pages site here for more information.
Here is what I figured out.
I saw many indications that it was a hassle to run your own instance of Selenium grid. Enough time may have passed for this to be a little easier than it used to be. There seem to be a few ways to do it.
Jenkins itself has a plugin that is supposed to turn your Jenkins cluster into a Selenium 3 grid: https://plugins.jenkins.io/selenium . The problem I had with this is that I'm planning on hosting these instances in the cloud, and I wanted the Jenkins slaves to be ephemeral. I was unable to figure out how to get the plugin to work with ephemeral slaves.
I was trying to get this done as quickly as I could, so I only spent three days total on this project.
These are the forked repos that I'm using for the Jenkins solution:
https://github.com/jnorment-q2/kube-jenkins-imager
which basically implements this:
https://github.com/jnorment-q2/continuous-deployment-on-kubernetes
I'm pointing to my own repos to give a reference to exactly what I used in late October 2017 to get this working. Those repos are forked from the main repos, and it should be easy to compare the differences.
I had contacted google support with a question, they responded that this link might actually be a bit clearer:
https://cloud.google.com/solutions/jenkins-on-container-engine-tutorial
From what I can tell, this is a manual version of the more automated scripts I referenced.
To stand up Selenium, I used this:
https://github.com/jnorment-q2/selenium-on-k8s
This is a project I built from a gist referenced in the Readme, which references a project maintained by SeleniumHQ.
The main trick here is that Selenium is resource hungry. I had to use the second tier of google compute engines in order for it to deploy in Kubernetes. I adapted the script I used to stand up Jenkins to deploy Selenium Grid in a similar fashion.
Also of note, there appear to be only Firefox and Chrome options in the project from SeleniumHQ. I have yet to determine if it is even possible to run an instance of Safari.
For now, this is what we're going to go with.
The piece left is how to make a call to the Selenium grid from Jenkins. It turns out that selenium can be pip-installed into ephemeral slaves, and webdriver.Remote can be used to make the call.
Here is the demo script that I wrote to prove that everything works:
https://github.com/jnorment-q2/demo-se-webdriver-pytest/blob/master/test/testmod.py
It has a Jenkinsfile, so it should work with a fresh instance of Jenkins. Just create a new pipeline, change definition to 'Pipeline script from SCM', Git, https://github.com/jnorment-q2/demo-se-webdriver-pytest, then scroll up and click 'run with parameters' and add the parameter SE_GRID_SERVER with the full url ( including port ) of the SE grid server.
It should run three tests and fail on the third. ( The third test requires additional parameters for TEST_URL and TEST_URL_TITLE )

Running Selenium in Azure Function

I want to periodically scrape a website with Selenium and a headless PhantomJS driver.
My boss wants me to run it "in the cloud" for reasons, and a serverless Azure Function looks like it could be a useful way to do it, instead of having to run a VM or something.
I've got my VS.net code to do the scraping mostly done, but I just realized that I'm not sure if I can actually deploy it as a function, since it looks like it wants me to include the phantomjs.exe in my project in order to run, which may not work in a Azure Function...
Can I do what I wanted to do, or should I explore other options?
PhantomJS is a known unsupported framework in App Service, which is the same environment Azure Functions runs on.
You can find more information here: https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox#unsupported-frameworks

IBM Watson Speech to Text with diarization, language dropdown selector not working

I have downloaded and trying to check the new added feature of Speaker Diarization. Since it has some limitation that it will work only with language models (en-US_NarrowbandModel, es-ES_NarrowbandModel, ja-JP_NarrowbandModel), I am trying to change the drop down. But it's not changing and remain fixed at "US Broadband Model (16KHz)".
Please let me know in case I am doing any thing wrong.
After downloading the source code, I did "npm install" and run the server "npm start", then from Firefox "http://localhost:3000/" it's working correctly. But, after deployment in Bluemix, the language selector is not working. The screen comes correctly but language model is not changing. I am not able to select language models other than "US Broadband Model (16KHz)".
Please advice if I am doing anything wrong.
[Note: The previous version (without Speaker Diarization feature) downloaded and it work correctly i.e. the screen comes correctly as well as language model is changing.]
Also answered on DeveloperWorks Answers - https://developer.ibm.com/answers/questions/337891/ibm-watson-speech-to-text-with-diarization-languag.html
I think, based on your post that you have downloaded and modified a sample application. When you run the modified application locally your changes take effect, but when you deploy to bluemix they don't. In which case you need to work out what is different. Without seeing your modifications everything else is speculation.
Since your modified code would be browser side I suspect that they are not the same application as you would be running the code in the same browser. As your changes would be browser side, open up a developer view, and check the source on the page, to verify that your modified code is being returned. If isn't then you need to check how, where and what you are trying to deploy.
If you do see your modified code being returned then you will need to step through it to work out why it isn't being invoked correctly, possibly because of the side effect of other bluemix only scripts being invoked on the page.

What is Python Anywhere used for?

I recently opened an account with PythonAnywhere and learnt it is an online IDE and web hosting service but as a beginner in python 3.4, what exactly can i do with it?
PythonAnywhere dev here,
You can use PythonAnywhere to do most of the things you can do on your own computer with Python
start a Python interactive console (from the "Consoles" tab)
edit a python file and run it (from the "Files" tab)
The exception is that, if you want to do things with graphics, like use pygame, that won't work on PythonAnywhere. But most text-based console things will work.
You can also do some more funky things, like host a web application ("Web"), and schedule tasks to run at regular intervals ("Schedule"). If you upgrade to a premium account, you can also run "Jupyter Notebooks", which are popular in the scientific commmunity.
If you need help with anything, drop us a line to support#pythonanywhere.com
Pythonanywhere is a cloud PAAS, what that means is you can just worry about coding and leave the headache of hosting, platform, DB and PAAS considerations on pythonanywhere. Anyone who has tried to deploy a website prior to the cloud days can attest to how many more things developers had to worry about
A good example to get started
https://technovechno.com/free-website-creation-hosting-publishing-in-the-cloud-using-pythonanywhere/

Resources