Scrambled json

[schloerke]

@garrettgman

With the current htmlwidget implementation, the JSON text is provided in plain text. This contains information of "This answer is the correct answer".

Should this be scrambled / hidden from the users?

(I don't know of a direct way to do this without also exposing this to the users as well.)

[jjallaire]

I think it's okay as quiz questions are mostly just to check/verify understanding (so there is no point to gaming it by splunking around for answers in the json)

[coatless]

@jjallaire the assumption I think a lot of faculty are making is the solution is largely hidden from students on a server-side implementation (e.g. via Shiny Server / shinyapps). As a result, they may be relying on learnr guides to assess students via checkr in place of a traditional LMS multiple choice quiz.

[jjallaire]

Okay, that's fair. But I do wonder how many students will figure out how to game things in this fashion (perhaps I'm unrealistic about the lengths that people can/will go to!)

[coatless]

@jjallaire When you visit UIUC, I'll show you the logs of attacks against our docker grading setup.

Only one student needs to find this as a vulnerability and it spreads. What's more problematic is this is now a google-able issue meaning the barrier has just dropped tremendously. I would equate this with having a vault-like door to enter a safe but dry wall surrounding it.

[schloerke]

I had a fellow student ace a lengthy 10 question web-based quiz in a few seconds.

---

Is it a fair assumption that a shiny backend would always be run with the quiz? If this is the case, we could turn in into a shiny app vs an htmlwidget. Everything could easily be hidden away from the users.

[jjallaire]

Yes, there will indeed always be a shiny back end so we could store the answers server-side.

I know that we have talked about re-writing the quiz module entirely to accommodate more flexible types of quiz questions. Perhaps as part of this re-write we could implement server-side checking.

[schloerke]

@jjallaire Sounds good. I'm currently in the process of doing re-writing them. (To remove slick quiz and then to add open text answers.) Glad I caught this before I've gone too far!