RE: [Aimmath-developers] setting the seed for students

[Gustav W D. <gw...@yo...>]

Hi Ken,

thanks for thinking about it so carefully. Your analysis shows that we can
only allow the "SetSeed" option if AiM can be sure that the request did not
originate from a hacking student. I therefore propose to ignore the
"SetSeed" option unless the request also includes a "SubjectPassword" option
giving the correct subject password.

Here in York we address your questions as follows:

> Questions that that come to mind: if we allow the student's to
> set the seed

The student does not set the seed directly. The student can only enter the
number from his problem sheet. The Moodle system then looks up the seed it
used to create that problem sheet.

> then more than one student could enter the same seed

Moodle checks that no two students enter the same number.

> Even at a university where the students can't enter the seed, if
> AIM has the
> parameter you are suggesting couldn't a clever student just edit his HTML
> page to change the seed to whatever he liked and resubmit?

The student can not access AiM directly because only Moodle knows the
student's password on AiM

> Are you suggesting that the student would enter the seed only
> once, or each
> time he logs into the system to request the quiz?

Only once.

> So I guess I'd be a little nervous about having the students be able to
> enter their own seeds unless we address these issues.

Quite right and many thanks for pointing that out. Would you be happy with
the modified proposal?

Gustav