December 2008 - Pharo-dev - lists.pharo.org

Re: [Pharo-project] Impressed, overwhelmed, and a little confused

by Damien Cassou

On Wed, Dec 3, 2008 at 7:24 AM, Bill Schwab <BSchwab(a)anest.ufl.edu> wrote: > As Pharo 1.0 takes shape, what is the plan for getting packages loaded > the way each of us wants? Is Installer the preferred route? Would I be > expected to script it (I find myself hoping so - load the latest of > this, that, specific version of this other thing, etc.)? I tried to > quickly load Shout and the SM package loader was not happy, but that > could easily be my fault. > > More questions and comments, but first, I need to get some overdue > sleep. The tools referenced at http://code.google.com/p/pharo/wiki/Packages will be included by default (this includes Shout, eCompletion, OB...). Installer and Universe will probably be both available to install other things. -- Damien Cassou http://damiencassou.seasidehosting.st

Dec. 3, 2008

Re: [Pharo-project] about vm dropping privileges

by Igor Stasenko

2008/12/3 Adrian Lienhard <adi(a)netstyle.ch>: > On Dec 2, 2008, at 23:04 , Alexandre Bergel wrote: > >> Yes, I read that. But is there any conceptual implication to have the port >> 80 accessible only by root? >> This looks like to be very arbitrary no? > > I don't think so. The lower port numbers are used for common services like > http or mail for which always the same ports are used by convention. You > wouldn't want to allow potentially highjacked processes to be able to bind > to such a ports (e.g., pretending to be your mail server). > what if your mail server bound to port 9999? :) i don't see how disallowing binding a non-root process to ports less than 1024 improves security much. As well, as i don't see why squeak vm should care about such details. > Adrian > >> >> >> Alexandre >> >> >> On 2 Dec 2008, at 18:59, Janko MivÅ¡ek wrote: >> >>> >>> >>> Alexandre Bergel wrote: >>>>> >>>>> Unix blocks port 1 - 1024 for non root users. Running a Smalltalk >>>>> image as root is obviously a very bad idea, especially when used for >>>>> web services. Smalltalk is full of security holes (for example Object >>>>> class>>#readFrom: uses the compiler) that would allow a smart person >>>>> to gain root rights. It is always good idea to run anything that is >>>>> publicly reachable in some sort of a sandbox, even if this is just by >>>>> using a non-privileged user. >>>> >>>> Hi Lukas, >>>> I read the thread you mentioned. Isn't it feasible to make the port 80 >>>> accessible for a non-root process? >>>> This is probably hardcoded in the kernel, but since this problem has >>>> been around for years in most communities, but not to fix this in the >>>> kernel? >>>> Just a very naive question :-) >>> >>> From recent thread on squeak-dev you can see that we actually came to the >>> solution of how to run on port 80 without being root. And solution is as >>> Apache is doing: starting with root then dropping the privilege level to the >>> normal user. >>> >>> [squeak-dev] smalltalk and Web stuff >>> >>> http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html >>> >>> Best regards >>> Janko >>> >>> >>> -- >>> Janko MivÅ¡ek >>> AIDA/Web >>> Smalltalk Web Application Server >>> http://www.aidaweb.si >>> >>> _______________________________________________ >>> Pharo-project mailing list >>> Pharo-project(a)lists.gforge.inria.fr >>> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project >>> >> >> -- >> _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: >> Alexandre Bergel http://www.bergel.eu >> ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;. >> >> >> >> >> >> >> _______________________________________________ >> Pharo-project mailing list >> Pharo-project(a)lists.gforge.inria.fr >> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > -- Best regards, Igor Stasenko AKA sig.

Dec. 3, 2008

[Pharo-project] Impressed, overwhelmed, and a little confused

by Bill Schwab

Hello all, I grabbed 10183, hacked it into a one-click image on my Ubuntu box at home, and found the Polymorph is indeed in the image. Frankly, I suspect I might have missed it once before, possibly mistaking the watery theme for the default look. It's great to see it included. As Pharo 1.0 takes shape, what is the plan for getting packages loaded the way each of us wants? Is Installer the preferred route? Would I be expected to script it (I find myself hoping so - load the latest of this, that, specific version of this other thing, etc.)? I tried to quickly load Shout and the SM package loader was not happy, but that could easily be my fault. More questions and comments, but first, I need to get some overdue sleep. Congratulations and thanks all around! Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bschwab(a)anest.ufl.edu Tel: (352) 273-6785 FAX: (352) 392-7029

Dec. 3, 2008

Re: [Pharo-project] Fwd: Trying to install Magma r41.1 throught Monticello installation 1.5+

by Rob Rothwell

I don't know if it helps or not, but if I load the following: (2008.10.01 17:13:50 22,203) MonticelloConfigurations-cmm.44.mcz (2008.10.01 17:13:33 201,923) Monticello-SR.315.mcz and then load Magma r41.1 from squeaksource.com/MagmaTester, it installed fine (minus the eToys cautions). Didn't know if there is a clue there or not; I am not very savvy with Workspace/scripted installations! Whether it works or not, I have yet to test! Take care, Rob On Tue, Dec 2, 2008 at 9:49 AM, Hilaire Fernandes <hilaire(a)ofset.org> wrote: > ---------- Forwarded message ---------- > From: Hilaire Fernandes <hilaire(a)ofset.org> > Date: 2008/12/2 > Subject: Trying to install Magma r41.1 throught Monticello installation > 1.5+ > To: Pharo Development <pharo-project(a)lists.gforge.inria.fr>, > magma(a)lists.squeakfoundation.org > > > I am CC to the Magma list as it may be more a problem from SqueakMap > dependencies. > > On a freshly updated Pharo image, I install Magma r41.1 with: > > Installer universe install: 'Magma 1.41(r41.1)'. > > At first MC1.5+ is first installed, at it is marked as a prerequisite. > > But an error is raised, indeed it looks like MC1.5+ override of the method > > httpGetDocument: url args: args accept: mimeType request: requestString > > is incompatible with Pharo > > -- > http://blog.ofset.org/hilaire > > > > -- > http://blog.ofset.org/hilaire > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > >

Dec. 3, 2008

Re: [Pharo-project] about vm dropping privileges

by Alexandre Bergel

>> This looks like to be very arbitrary no? > > I don't think so. The lower port numbers are used for common > services like http or mail for which always the same ports are used > by convention. You wouldn't want to allow potentially highjacked > processes to be able to bind to such a ports (e.g., pretending to be > your mail server). But we could imagine that the root password is necessary to open the port. Now, the root password is necessary to give all permissions to the process, whereas only opening once the port 80 is necessary. I am sure a better design could be done. Capabilities maybe... Alexandre >> >> >> Alexandre >> >> >> On 2 Dec 2008, at 18:59, Janko MivÅ¡ek wrote: >> >>> >>> >>> Alexandre Bergel wrote: >>>>> >>>>> Unix blocks port 1 - 1024 for non root users. Running a Smalltalk >>>>> image as root is obviously a very bad idea, especially when used >>>>> for >>>>> web services. Smalltalk is full of security holes (for example >>>>> Object >>>>> class>>#readFrom: uses the compiler) that would allow a smart >>>>> person >>>>> to gain root rights. It is always good idea to run anything that >>>>> is >>>>> publicly reachable in some sort of a sandbox, even if this is >>>>> just by >>>>> using a non-privileged user. >>>> Hi Lukas, >>>> I read the thread you mentioned. Isn't it feasible to make the >>>> port 80 accessible for a non-root process? >>>> This is probably hardcoded in the kernel, but since this problem >>>> has been around for years in most communities, but not to fix >>>> this in the kernel? >>>> Just a very naive question :-) >>> >>> From recent thread on squeak-dev you can see that we actually came >>> to the solution of how to run on port 80 without being root. And >>> solution is as Apache is doing: starting with root then dropping >>> the privilege level to the normal user. >>> >>> [squeak-dev] smalltalk and Web stuff >>> http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html >>> >>> Best regards >>> Janko >>> >>> >>> -- >>> Janko MivÅ¡ek >>> AIDA/Web >>> Smalltalk Web Application Server >>> http://www.aidaweb.si >>> >>> _______________________________________________ >>> Pharo-project mailing list >>> Pharo-project(a)lists.gforge.inria.fr >>> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project >>> >> >> -- >> _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: >> Alexandre Bergel http://www.bergel.eu >> ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;. >> >> >> >> >> >> >> _______________________________________________ >> Pharo-project mailing list >> Pharo-project(a)lists.gforge.inria.fr >> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > -- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.

Dec. 3, 2008

Re: [Pharo-project] Seaside29 and pharo

by David Pennell

I managed to load Seaside 2.9 in a Pharo image (current as of today). All tests are green, but when I try to open http://localhost:8080/seaside/config, I get "MessageNotUnderstood: WAKom>dispatchRequest:". Any suggestions? BTW - I just installed the changesets from [3]. -david On Sat, Nov 22, 2008 at 7:04 PM, Torsten Bergmann <astares(a)gmx.de> wrote: > Since the pharo website [1] proposes that an important test for Pharo is > running > Seaside applications there is now a new Script Loader package 669 for > loading > Seaside 2.9/Comanche in the pharo inbox [2]. It's based on [3], but always > loads newest Seaside packages. > > BTW: only one test failed so far WAColorTest>>testFromStringThreeDigit - > which > is OK according to [4]. Nice! > > Have fun > Torsten > > [1] http://pharo.googlecode.com > [2] http://www.squeaksource.com/PharoInbox.html > [3] > http://lists.squeakfoundation.org/pipermail/seaside-dev/2008-November/00187… > [4] > http://lists.squeakfoundation.org/pipermail/seaside-dev/2008-November/00198… > -- > Sensationsangebot nur bis 30.11: GMX FreeDSL - Telefonanschluss + DSL > fÃ¼r nur 16,37 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project >

Dec. 3, 2008

Re: [Pharo-project] Monticello configuration still broken

by Keith Hodges

StÃ©phane Ducasse wrote: > It depends on what is inside MC1.5 It should not. > When you load a package you load all the extensions. When you load a package like MC1.5 you are buying into to the philosophy, you would be joining a collaborative venture to benefit all. The philosophy being that it should work for as many people as possible, be as backwardly compatible as possible, incorporate as many fixes as possible for everyone and provide a basis for moving forward. If within the actual code there is something you dont like then you can join in with the effort and fix it, because it is a collaborative effort moving forward. Keith

Dec. 2, 2008

Re: [Pharo-project] about vm dropping privileges

by Adrian Lienhard

On Dec 2, 2008, at 23:04 , Alexandre Bergel wrote: > Yes, I read that. But is there any conceptual implication to have > the port 80 accessible only by root? > This looks like to be very arbitrary no? I don't think so. The lower port numbers are used for common services like http or mail for which always the same ports are used by convention. You wouldn't want to allow potentially highjacked processes to be able to bind to such a ports (e.g., pretending to be your mail server). Adrian > > > Alexandre > > > On 2 Dec 2008, at 18:59, Janko MivÅ¡ek wrote: > >> >> >> Alexandre Bergel wrote: >>>> >>>> Unix blocks port 1 - 1024 for non root users. Running a Smalltalk >>>> image as root is obviously a very bad idea, especially when used >>>> for >>>> web services. Smalltalk is full of security holes (for example >>>> Object >>>> class>>#readFrom: uses the compiler) that would allow a smart >>>> person >>>> to gain root rights. It is always good idea to run anything that is >>>> publicly reachable in some sort of a sandbox, even if this is >>>> just by >>>> using a non-privileged user. >>> Hi Lukas, >>> I read the thread you mentioned. Isn't it feasible to make the >>> port 80 accessible for a non-root process? >>> This is probably hardcoded in the kernel, but since this problem >>> has been around for years in most communities, but not to fix this >>> in the kernel? >>> Just a very naive question :-) >> >> From recent thread on squeak-dev you can see that we actually came >> to the solution of how to run on port 80 without being root. And >> solution is as Apache is doing: starting with root then dropping >> the privilege level to the normal user. >> >> [squeak-dev] smalltalk and Web stuff >> http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html >> >> Best regards >> Janko >> >> >> -- >> Janko MivÅ¡ek >> AIDA/Web >> Smalltalk Web Application Server >> http://www.aidaweb.si >> >> _______________________________________________ >> Pharo-project mailing list >> Pharo-project(a)lists.gforge.inria.fr >> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project >> > > -- > _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: > Alexandre Bergel http://www.bergel.eu > ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;. > > > > > > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project

Dec. 2, 2008

Re: [Pharo-project] about vm dropping privileges

by Alexandre Bergel

Yes, I read that. But is there any conceptual implication to have the port 80 accessible only by root? This looks like to be very arbitrary no? Alexandre On 2 Dec 2008, at 18:59, Janko MivÅ¡ek wrote: > > > Alexandre Bergel wrote: >>> >>> Unix blocks port 1 - 1024 for non root users. Running a Smalltalk >>> image as root is obviously a very bad idea, especially when used for >>> web services. Smalltalk is full of security holes (for example >>> Object >>> class>>#readFrom: uses the compiler) that would allow a smart person >>> to gain root rights. It is always good idea to run anything that is >>> publicly reachable in some sort of a sandbox, even if this is just >>> by >>> using a non-privileged user. >> Hi Lukas, >> I read the thread you mentioned. Isn't it feasible to make the port >> 80 accessible for a non-root process? >> This is probably hardcoded in the kernel, but since this problem >> has been around for years in most communities, but not to fix this >> in the kernel? >> Just a very naive question :-) > > From recent thread on squeak-dev you can see that we actually came > to the solution of how to run on port 80 without being root. And > solution is as Apache is doing: starting with root then dropping the > privilege level to the normal user. > > [squeak-dev] smalltalk and Web stuff > http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html > > Best regards > Janko > > > -- > Janko MivÅ¡ek > AIDA/Web > Smalltalk Web Application Server > http://www.aidaweb.si > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > -- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.

Dec. 2, 2008

Re: [Pharo-project] about vm dropping privileges

by Janko MivÅ¡ek

Alexandre Bergel wrote: >> >> Unix blocks port 1 - 1024 for non root users. Running a Smalltalk >> image as root is obviously a very bad idea, especially when used for >> web services. Smalltalk is full of security holes (for example Object >> class>>#readFrom: uses the compiler) that would allow a smart person >> to gain root rights. It is always good idea to run anything that is >> publicly reachable in some sort of a sandbox, even if this is just by >> using a non-privileged user. > > Hi Lukas, > > I read the thread you mentioned. Isn't it feasible to make the port 80 > accessible for a non-root process? > This is probably hardcoded in the kernel, but since this problem has > been around for years in most communities, but not to fix this in the > kernel? > Just a very naive question :-) From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user. [squeak-dev] smalltalk and Web stuff http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html Best regards Janko -- Janko MivÅ¡ek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si

Dec. 2, 2008