Security and user management

We just found out that I could delete files on a coworkers machine when he had running a dworker using something like

from distributed import Executor
from subprocess import check_call

e = Executor('schedulermachine')
e.submit(lambda: check_call(['rm', 'test_file']))

Is it planned to add some security features and/or user management to the library?

[minrk]

I think dask cluster per user is the right way to go for this, so user management is probably out of scope. If there is an appropriate security feature, perhaps a way to use PKI and client certificates to authenticate/encrypt communication would be appropriate.

The Jupyter protocol adds basic authentication using HMAC signatures and a secret key that lives in the connection file, but no encryption, so people with access to the socket can spy on results, but not run code. If you used zmq, your could turn on both authentication and encryption with its CURVE support.

[mrocklin]

Dask supports TLS. Closing.