Chapter 3 — Programming foundations

Chapter 3 — Programming foundations

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Scripts for operations"]
  N2["Lab — Encoding is not encryption"]
  N3["3.2 Reading the encoding lab"]
  N4["3.3 Secrets in scripts"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Scripts for operations"]
  N2["Lab — Encoding is not encryption"]
  N3["3.2 Reading the encoding lab"]
  N4["3.3 Secrets in scripts"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Scripts for operations]
    |
    v
[Lab — Encoding is not encryption]
    |
    v
[3.2 Reading the encoding lab]
    |
    v
[3.3 Secrets in scripts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) write simple Python scripts for operations; (2) distinguish encoding from encryption; (3) handle secrets in scripts safely.

3.1 Scripts for operations

Technologists automate routine work with scripts. Rosa's first scripts read CSV exports of the council's certificate list and print those expiring within thirty days. She learns to use the standard library: csv for reading files, datetime for date arithmetic and argparse for command-line options. She writes small functions with clear names and tests each with sample data before running against real exports. Owen reviews her code and asks her to handle bad rows gracefully, since exports from older systems sometimes contain blank dates that would otherwise crash the script.

Lab — Encoding is not encryption

"""Encoding is not encryption: Base64 and hex are reversible by anyone (synthetic permit record)."""
import base64
REC = b"permit=PK-2291;plate=HRV-447;zone=4"

def main():
    b64 = base64.b64encode(REC).decode()
    print("base64:", b64)
    print("decoded without any key:", base64.b64decode(b64).decode())
    print("hex:", REC.hex()[:32], "...")
    print("length grows by", len(b64) - len(REC), "chars; secrecy added: none")

if __name__ == "__main__":
    main()

Run with python3 lab_encoding.py. Verified output:

base64: cGVybWl0PVBLLTIyOTE7cGxhdGU9SFJWLTQ0Nzt6b25lPTQ=
decoded without any key: permit=PK-2291;plate=HRV-447;zone=4
hex: 7065726d69743d504b2d323239313b70 ...
length grows by 13 chars; secrecy added: none

3.2 Reading the encoding lab

The lab Base64-encodes a synthetic permit record. The output looks scrambled, but decoding it needs no key and prints the original record exactly. Hex encoding likewise only changes representation. Base64 makes the text thirteen characters longer and adds no secrecy. Rosa finds a council integration that "protected" permit data in transit by Base64-encoding it inside an unencrypted HTTP request. She reports it, and the integration is moved to HTTPS with TLS. The lesson is simple but important: encoding is for transport and storage formats, while confidentiality needs encryption with a key.

3.3 Secrets in scripts

Rosa's next script calls an internal API that needs a token. Her first version writes the token directly in the code, which Owen rejects: code gets copied, shared and committed to repositories. She moves the token to an environment variable populated by the council's secret store and makes the script fail clearly if it is missing. She also avoids printing tokens in logs and uses the secrets module when a script must generate a random value, never the random module. These habits apply to every script she writes afterward.

Worked example

Rosa writes a certificate-expiry script with tolerant parsing, shows Base64 adds no secrecy, gets a Base64-over-HTTP integration moved to TLS and moves an API token out of code.

Synthetic case. The permit record and integration are invented.

Errors and limits

Obfuscation such as Base64 misleads people into thinking data is protected. Environment variables are better than code but still need a secret store behind them.

Exercises

• EX007 — Bad rows. What did Owen ask Rosa to handle in her expiry script? Rubric: 3 = blank or bad rows from older exports without crashing;; 2 = bad rows;; 1 = speed;; 0 = none.
• EX008 — Base64 finding. What did Rosa find and what fixed it? Rubric: 3 = permit data Base64-encoded over plain HTTP; moved to HTTPS;; 2 = finding and fix;; 1 = one;; 0 = none.
• EX009 — Token handling. Where did Rosa move the API token, and why? Rubric: 3 = to an environment variable from the secret store, since code is copied and committed;; 2 = env var;; 1 = left in code;; 0 = none.

Synthesis

Operational scripting needs clean data handling, a clear grasp that encoding is not encryption and disciplined handling of secrets.

Continue studying — chapter 03 of 30

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →