%auto does not work in notebook in there is descriptive text above the cell

[Chris Seberino]

Rolf and I have had a thread going on sage-support about issues with
%auto.

Rolf found out that adding text above a cell with %auto makes that
cell NOT be automatically run when worksheet is loaded.

The temporary workaround is to add an additional blank cell between
descriptive text and a cell with %auto.

I have Sage 4.6.2.

cs

[kcrisman]

On Jun 28, 10:32 am, Chris Seberino <cseber...@gmail.com> wrote:
> Rolf and I have had a thread going on sage-support about issues with
> %auto.
>
> Rolf found out that adding text above a cell with %auto makes that
> cell NOT be automatically run when worksheet is loaded.
>

I cannot replicate this in Sage 4.7. What do you mean by "adding
text"? Here is the beginning of a worksheet where this does not
happen, even after quitting and reloading. I used TinyMCE to add the
text, but I doubt that matters.

If you were adding # comments in the same cell I could imagine a
problem, though.

{{{id=45|

///
}}}

<p>Here is some text.</p>

{{{id=46|
%auto
f(x) = x^2
///
}}}

{{{id=47|
f(3)
///
9
}}}

[Chris Seberino]

krisman...

See this worksheet to recreate the problem....

http://seberino.org/share/Not_Automatic.sws

I can't get this simple interact function to automatically run when I
load that worksheet.

(This one has not descriptive text above the cell and it *still* does
not run automatically!)

cs

[Rolf]

This is very strange.

There is something hidden in Seberino's worksheets that prevents them
from being executed automatically.
First I thought it is the comment added above the first cell. But his
new example demonstrates that this is obvious not core of the problem.
Both his example woksheets don't work on my system either, but if I
transfer all that is visible to a new worksheets the code works
perfectly.

Unfortunately, it is impossible to debug a worksheet or to read it
'manually' as a text file.

I wonder if it is possible to send viruses by worksheets?

As worksheets may contain hidden information, can be automatically
executed, and cannot be read as a simple text file, all this raises
grave security concerns.

Best R.

[kcrisman]

On Jun 29, 3:11 am, Rolf <kamha...@googlemail.com> wrote:
> This is very strange.
>
> There is something hidden in Seberino's worksheets that prevents them
> from being executed automatically.
> First I thought it is the comment added above the first cell. But his
> new example demonstrates that this is obvious not core of the problem.
> Both his example woksheets don't work on my system either, but if I
> transfer all that is visible to a new worksheets the code works
> perfectly.
>
> Unfortunately, it is impossible to debug a worksheet or to read it
> 'manually' as a text file.

Not quite! The worksheet has a folder in your .sage/
sage_notebook.sagenb/home/ directory (usually e.g. admin/175 or
something).

>
> I wonder if it is possible to send viruses by worksheets?

Good question. http://www.sagemath.org/files/thesis/aner-thesis-2009.pdf
has looked at some things like that, maybe this specific question?

> As worksheets may contain hidden information, can be automatically
> executed, and cannot be read as a simple text file, all this raises
> grave security concerns.

I don't see any hidden information here at all, though.

I do see someone using

%auto
%hide

and expecting something to appear. The interact does run, by the way
- that should be clear from the green bar along the side and the
progress indicator in your browser's title area.

I'm not sure whether this is a feature or a bug, though. Ordinarily
we would want 'auto' and 'hide' to do those things, but it appears
here that it hides even output we normally want to appear.

What do you think the "right" behavior should be for %auto && %hide?
I'm really not sure, because I thought in the past that it should just
hide the input cell, but maybe it should also hide the output, as
seems to be happening here. I've never tried to use %hide for a cell
that had output before, I usually just use it for background
definitions. Input welcome!

- kcrisman

[Jason Grout]

On 6/29/11 2:11 AM, Rolf wrote:
> This is very strange.
>
> There is something hidden in Seberino's worksheets that prevents them
> from being executed automatically.
> First I thought it is the comment added above the first cell. But his
> new example demonstrates that this is obvious not core of the problem.
> Both his example woksheets don't work on my system either, but if I
> transfer all that is visible to a new worksheets the code works
> perfectly.
>
> Unfortunately, it is impossible to debug a worksheet or to read it
> 'manually' as a text file.
>
> I wonder if it is possible to send viruses by worksheets?

I'm sure this is possible. For example, it would be trivial to write a
worksheet that does 'rm -rf $HOME' inside an autoexecute cell. If that
worksheet was downloaded and opened on a user's local computer, it would
be very bad.

>
> As worksheets may contain hidden information, can be automatically
> executed, and cannot be read as a simple text file, all this raises
> grave security concerns.

One thing we should provide is an "open and don't execute any %auto
cells". I think that should allow you to inspect the code before
running it. Great idea. In fact, when a worksheet is uploaded, it
probably should have a 'don't execute' bit set. Before any cells are
executed, a warning box is popped up, like happens in OSX, for example,
telling the user that it is a new worksheet and are they sure they want
to execute things from it.

Can you file a google issue for this on the sage notebook code site?

Jason

[kcrisman]

On Jun 29, 9:00 am, Jason Grout <jason-s...@creativetrax.com> wrote:
> On 6/29/11 2:11 AM, Rolf wrote:
>
> > This is very strange.
>
> > There is something hidden in Seberino's worksheets that prevents them
> > from being executed automatically.
> > First I thought it is the comment added above the first cell. But his
> > new example demonstrates that this is obvious not core of the problem.
> > Both his example woksheets don't work on my system either, but if I
> > transfer all that is visible to a new worksheets the code works
> > perfectly.
>
> > Unfortunately, it is impossible to debug a worksheet or to read it
> > 'manually' as a text file.
>
> > I wonder if it is possible to send viruses by worksheets?
>
> I'm sure this is possible.  For example, it would be trivial to write a
> worksheet that does 'rm -rf $HOME' inside an autoexecute cell.  If that
> worksheet was downloaded and opened on a user's local computer, it would
> be very bad.
>

But wouldn't that ordinarily require a sudo and password? I mean
under permissions that 'most' people have. Now you have me wary of
downloading worksheets...

- kcrisman

[Jason Grout]

Nope. If someone is running a worksheet on their personal Sage install,
it runs as themselves. Notice I didn't type "sudo" in the command
above. All I'm doing is deleting the entire home directory.

You *should* be wary of downloading untrusted worksheets and executing
them on your personal Sage install. You're executing arbitrary code
from untrusted sources.

Apparently we should implement this "don't execute uploaded worksheets
by default" and advertise this warning better.

Thanks,

Jason

[kcrisman]

> Nope.  If someone is running a worksheet on their personal Sage install,
> it runs as themselves.  Notice I didn't type "sudo" in the command
> above.  All I'm doing is deleting the entire home directory.

As opposed to the system directories... I see.

> Apparently we should implement this "don't execute uploaded worksheets
> by default" and advertise this warning better.

Yes.

[Rolf]

> Apparently we should implement this "don't execute uploaded worksheets
> by default" and advertise this warning better.

Probably this is already implemented.

When I compare the notebook directories that contain the two
worksheets that hold exactly the same code but mine being executed
automatically and Seberino's not, the only difference that I can find
is in worksheet_conf.pickle file. Mine says, as far as I can
understand, that I'm the proper owner.

Also, when I create a copy of Seberino's worksheet it again is
automatically executed because by copying I become the owner.

I cannot find a documatation about %auto, %hide etc.

Best
R.

[Chris Seberino]

On Jun 29, 7:50 am, kcrisman <kcris...@gmail.com> wrote:
>  The interact does run, by the way
> - that should be clear from the green bar along the side and the
> progress indicator in your browser's title area.

Why does the green bar appear but we don't see the output of the
evaluation?

I removed the %hide and it *still* doesn't automatically appear when
uploaded!

> I'm not sure whether this is a feature or a bug, though.  Ordinarily
> we would want 'auto' and 'hide' to do those things, but it appears
> here that it hides even output we normally want to appear.
>
> What do you think the "right" behavior should be for %auto && %hide?
> I'm really not sure, because I thought in the past that it should just
> hide the input cell, but maybe it should also hide the output, as
> seems to be happening here.

I think just hiding the input is fine. The logic to me is that we
want to hide the implementation details from students who don't know
and/or don't care. A teacher may want to keep the students focused on
the mathematics rather than the Python/Sage source.

cs

[Chris Seberino]

On Jun 29, 2:11 am, Rolf <kamha...@googlemail.com> wrote:
> This is very strange.
>
> There is something hidden in Seberino's worksheets that prevents them
> from being executed automatically.
> First I thought it is the comment added above the first cell. But his
> new example demonstrates that this is obvious not core of the problem.
> Both his example woksheets don't work on my system either, but if I
> transfer all that is visible to a new worksheets the code works
> perfectly.

Hmm. That is odd. What version of Sage are you running? Perhaps you
have a newer version that silently fixed my problem?

I compiled Sage 4.6.2 from source to run on Ubuntu 10.10.

I haven't really made any changes. I deleted my init_sage and
confirmed the problem still appears without that file.

cs