September 2009 - Pharo-dev - lists.pharo.org

Re: [Pharo-project] Added package Network-MIME-PeterHugossonMiller.11.mcz

by Peter Hugosson-Miller

On Fri, Sep 4, 2009 at 2:31 AM, Peter Hugosson-Miller <oldmanlink(a)gmail.com>wrote: > Name: Network-MIME-PeterHugossonMiller.11 > Author: PeterHugossonMiller > Time: 4 September 2009, 2:31:05 am > UUID: c3fc2fdc-5305-46e7-bc4e-189647fe2261 > Ancestors: Network-MIME-PeterHugossonMiller.10 > > Fix for Issue 1151 - broken method RFC2047MimeConverter>>#readWord > > -- > Cheers, > Peter > Oops, forgot link to the issue: http://code.google.com/p/pharo/issues/detail?id=1151

Sept. 4, 2009

[Pharo-project] Added package Network-Protocols-PeterHugossonMiller.14.mcz

by Peter Hugosson-Miller

Name: Network-Protocols-PeterHugossonMiller.14 Author: PeterHugossonMiller Time: 4 September 2009, 2:39:49 am UUID: 4b7c90af-93e4-420d-bbad-1022646f967c Ancestors: Network-Protocols-PeterHugossonMiller.13 Fix for Issue 1152 - HTTPSocket>>#getResponseUpTo: and HTTPSocket>>#getResponseUpTo:ignoring: are ugly and misleading http://code.google.com/p/pharo/issues/detail?id=1152 -- Cheers, Peter

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Schwab,Wilhelm K

Ok. Please note that your package system and limits it imposes might affect "market share". Bill ________________________________ From: pharo-project-bounces(a)lists.gforge.inria.fr [mailto:pharo-project-bounces@lists.gforge.inria.fr] On Behalf Of Peter Hugosson-Miller Sent: Thursday, September 03, 2009 7:00 PM To: Pharo-project(a)lists.gforge.inria.fr Subject: Re: [Pharo-project] [ANN] 2009/9/4 Michael van der Gulik <mikevdg(a)gmail.com<mailto:mikevdg@gmail.com>> Argh. Please reply below other people's emails. Bill ________________________________ From: pharo-project-bounces(a)lists.gforge.inria.fr<mailto:pharo-project-bounces@lists.gforge.inria.fr> [mailto:pharo-project-bounces@lists.gforge.inria.fr<mailto:pharo-project-bounces@lists.gforge.inria.fr>] On Behalf Of Michael van der Gulik Sent: Thursday, September 03, 2009 5:54 PM To: Pharo-project(a)lists.gforge.inria.fr<mailto:Pharo-project@lists.gforge.inria.fr> Subject: Re: [Pharo-project] [ANN] 2009/9/4 Miguel Enrique CobÃ¡ Martinez <miguel.coba(a)gmail.com<mailto:miguel.coba@gmail.com>> El vie, 04-09-2009 a las 09:33 +1200, Michael van der Gulik escribiÃ³: > > > On Fri, Sep 4, 2009 at 3:21 AM, StÃ©phane Ducasse > <stephane.ducasse(a)inria.fr<mailto:stephane.ducasse@inria.fr>> wrote: > - Issue 1144: Many occurrences of "ReadStream on: > aCollection" which > can be replaced with "aCollection readStream" > > > For what it's worth, I prefer the style of "ReadStream on: xxx". I > prefer to choose the stream class rather than let the collection > choose it for me. But don't you always have the option to call ReadStream on: object, even though object class has a readStream method? In Pharo, sure. However, in SecureSqueak, there won't be >>readStream methods. I'll spare the details because I hate multi-page emails. Ask me if you're interested. 2009/9/4 Schwab,Wilhelm K <bschwab(a)anest.ufl.edu<mailto:bschwab@anest.ufl.edu>> Ok, I'm interested :) Is there a security argument? Off the top, it does not sound like something I would want to use. If you can make a case that #readStream is dangerous, I'm all ears. If it is simply that it closes off modifications to the base classes, it is probably too restictive for my tastes. Locking it down **after** I add the missing methods and deploy on a server, that's another matter. But then, there would be #readStream methods... Excuse the funny formatting. GMail sometimes doesn't cooperate. Also, this is getting a bit off topic on the Pharo list. No, it's not really to do with security. It's to do with this package system I invented. Basically, I want to reduce package dependencies. Putting >>readStream in kernel classes would make a package dependency between the Collection package and the Stream package. If the Collections package was loaded into SecureSqueak, the package architecture would be forced to load the Stream package as well even if it isn't used. If your own package depended on both Collection and a different Streams package, anybody who loaded your code would need to load two Streams packages. There's no reason that >>readStream couldn't be included in a Collections package, provided that it's not in the Collections package provided with the SecureSqueak Kernel. I want the Kernel package to have as few dependencies as possible. Packages are read-only in SecureSqueak and the Kernel package contains special objects, meaning that Kernel and its dependencies can not be upgraded without distributing a new image. Collections would be a non-upgradable dependency of Kernel, so I'd be trying hard to not also make Streams also a non-upgradable dependency. More info: http://gulik.pbwiki.com/Namespaces http://gulik.pbwiki.com/Packages Gulik. -- http://gulik.pbwiki.com/ _______________________________________________ Pharo-project mailing list Pharo-project(a)lists.gforge.inria.fr<mailto:Pharo-project@lists.gforge.inria.fr> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project Michael, This is one of those cases that really makes me miss ENVY, and its Class extentions. Under that system you would avoid the problem completely, by extending the Collection class in the Stream package and adding the methods that depend on Streams in that package. I guess everyone knows what ENVY Class extensions are, but just in case someone doesn't, they are basically collections of methods to be added to a Class already in the image (i.e. not subclasses), when the extension is loaded. -- Cheers, Peter

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Schwab,Wilhelm K

I'd love to - how do you get LookOut! 2003 to comment text? It amazes me that people who write software for a living don't grok the need for that ability, but I've been saddled with this piece of junk, and the piece of junk before it, that appear to be unable to do it. ________________________________ From: pharo-project-bounces(a)lists.gforge.inria.fr [mailto:pharo-project-bounces@lists.gforge.inria.fr] On Behalf Of Michael van der Gulik Sent: Thursday, September 03, 2009 6:51 PM To: Pharo-project(a)lists.gforge.inria.fr Subject: Re: [Pharo-project] [ANN] Argh. Please reply below other people's emails. Bill ________________________________ From: pharo-project-bounces(a)lists.gforge.inria.fr<mailto:pharo-project-bounces@lists.gforge.inria.fr> [mailto:pharo-project-bounces@lists.gforge.inria.fr<mailto:pharo-project-bounces@lists.gforge.inria.fr>] On Behalf Of Michael van der Gulik Sent: Thursday, September 03, 2009 5:54 PM To: Pharo-project(a)lists.gforge.inria.fr<mailto:Pharo-project@lists.gforge.inria.fr> Subject: Re: [Pharo-project] [ANN] 2009/9/4 Miguel Enrique CobÃ¡ Martinez <miguel.coba(a)gmail.com<mailto:miguel.coba@gmail.com>> El vie, 04-09-2009 a las 09:33 +1200, Michael van der Gulik escribiÃ³: > > > On Fri, Sep 4, 2009 at 3:21 AM, StÃ©phane Ducasse > <stephane.ducasse(a)inria.fr<mailto:stephane.ducasse@inria.fr>> wrote: > - Issue 1144: Many occurrences of "ReadStream on: > aCollection" which > can be replaced with "aCollection readStream" > > > For what it's worth, I prefer the style of "ReadStream on: xxx". I > prefer to choose the stream class rather than let the collection > choose it for me. But don't you always have the option to call ReadStream on: object, even though object class has a readStream method? In Pharo, sure. However, in SecureSqueak, there won't be >>readStream methods. I'll spare the details because I hate multi-page emails. Ask me if you're interested. 2009/9/4 Schwab,Wilhelm K <bschwab(a)anest.ufl.edu<mailto:bschwab@anest.ufl.edu>> Ok, I'm interested :) Is there a security argument? Off the top, it does not sound like something I would want to use. If you can make a case that #readStream is dangerous, I'm all ears. If it is simply that it closes off modifications to the base classes, it is probably too restictive for my tastes. Locking it down **after** I add the missing methods and deploy on a server, that's another matter. But then, there would be #readStream methods... Excuse the funny formatting. GMail sometimes doesn't cooperate. Also, this is getting a bit off topic on the Pharo list. No, it's not really to do with security. It's to do with this package system I invented. Basically, I want to reduce package dependencies. Putting >>readStream in kernel classes would make a package dependency between the Collection package and the Stream package. If the Collections package was loaded into SecureSqueak, the package architecture would be forced to load the Stream package as well even if it isn't used. If your own package depended on both Collection and a different Streams package, anybody who loaded your code would need to load two Streams packages. There's no reason that >>readStream couldn't be included in a Collections package, provided that it's not in the Collections package provided with the SecureSqueak Kernel. I want the Kernel package to have as few dependencies as possible. Packages are read-only in SecureSqueak and the Kernel package contains special objects, meaning that Kernel and its dependencies can not be upgraded without distributing a new image. Collections would be a non-upgradable dependency of Kernel, so I'd be trying hard to not also make Streams also a non-upgradable dependency. More info: http://gulik.pbwiki.com/Namespaces http://gulik.pbwiki.com/Packages Gulik. -- http://gulik.pbwiki.com/

Sept. 4, 2009

[Pharo-project] Added package Network-MIME-PeterHugossonMiller.11.mcz

by Peter Hugosson-Miller

Name: Network-MIME-PeterHugossonMiller.11 Author: PeterHugossonMiller Time: 4 September 2009, 2:31:05 am UUID: c3fc2fdc-5305-46e7-bc4e-189647fe2261 Ancestors: Network-MIME-PeterHugossonMiller.10 Fix for Issue 1151 - broken method RFC2047MimeConverter>>#readWord -- Cheers, Peter

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Igor Stasenko

2009/9/3 Michael van der Gulik <mikevdg(a)gmail.com>: > Argh. Please reply below other people's emails. > > >> Bill >> >> ________________________________ >> From: pharo-project-bounces(a)lists.gforge.inria.fr >> [mailto:pharo-project-bounces@lists.gforge.inria.fr] On Behalf Of Michael >> van der Gulik >> Sent: Thursday, September 03, 2009 5:54 PM >> To: Pharo-project(a)lists.gforge.inria.fr >> Subject: Re: [Pharo-project] [ANN] >> >> >> >> 2009/9/4 Miguel Enrique CobÃ¡ Martinez <miguel.coba(a)gmail.com> >>> >>> El vie, 04-09-2009 a las 09:33 +1200, Michael van der Gulik escribiÃ³: >>> > >>> > >>> > On Fri, Sep 4, 2009 at 3:21 AM, StÃ©phane Ducasse >>> > <stephane.ducasse(a)inria.fr> wrote: >>> > Â Â Â Â - Issue 1144: Â Many occurrences of "ReadStream on: >>> > Â Â Â Â aCollection" which >>> > Â Â Â Â can be replaced with "aCollection readStream" >>> > >>> > >>> > For what it's worth, I prefer the style of "ReadStream on: xxx". I >>> > prefer to choose the stream class rather than let the collection >>> > choose it for me. >>> >>> But don't you always have the option to call ReadStream on: object, >>> even though object class has a readStream method? >> >> >> In Pharo, sure. >> >> However, in SecureSqueak, there won't be >>readStream methods. I'll spare >> the details because I hate multi-page emails. Ask me if you're interested. > > >> >> 2009/9/4 Schwab,Wilhelm K <bschwab(a)anest.ufl.edu> >> Ok, I'm interested :)Â Is there a security argument?Â Off the top, it does >> not sound like something I would want to use.Â If you can make a case that >> #readStream is dangerous, I'm all ears.Â If it is simply that it closes off >> modifications to the base classes, it is probably too restictive for my >> tastes.Â Locking it down **after** I add the missing methods and deploy on >> a server, that's another matter.Â But then, there would be #readStream >> methods... > > > Excuse the funny formatting. GMail sometimes doesn't cooperate. Also, this > is getting a bit off topic on the Pharo list. > > No, it's not really to do with security. It's to do with this package system > I invented. > > Basically, I want to reduce package dependencies. Putting >>readStream in > kernel classes would make a package dependency between the Collection > package and the Stream package. If the Collections package was loaded into > SecureSqueak, the package architecture would be forced to load the Stream > package as well even if it isn't used. If your own package depended on both > Collection and a different Streams package, anybody who loaded your code > would need to load two Streams packages. > > There's no reason that >>readStream couldn't be included in a Collections > package, provided that it's not in the Collections package provided with the > SecureSqueak Kernel. I want the Kernel package to have as few dependencies > as possible. Packages are read-only in SecureSqueak and the Kernel package > contains special objects, meaning that Kernel and its dependencies can not > be upgraded without distributing a new image. Collections would be a > non-upgradable dependency of Kernel, so I'd be trying hard to not also make > Streams also a non-upgradable dependency. > Interesting dilemma. Right thing, that the package who responsible for implementing #readStream should be the one, who defines any streams of sort. So, then collection could delegate to specific class the responsibility for returning a stream. Following the same logic, an Object class should not contain things like #isCollection, if we imagine things w/o collections, and then load a Collections package, it should provide this method by extending existing behavior. But the problem is, that you need to extend an existing behavior, and once you'll allow that, you are not in secure shell anymore. I think there is solution. By example: The Collection class , in Collection class could define a class var, like ReadStreamDelegate and then a simple method which allows to assign object to it. And then, #readStream could be implemented as: readStream ^ ReadStreamDelegate on: self just don't say that classvars is read-only as well :) You still have to make something non-readonly. So, if classvar is readonly, then i could use one of a slots of an object held in classvar to keep value there :) > More info: > http://gulik.pbwiki.com/Namespaces > http://gulik.pbwiki.com/Packages > > Gulik. > > -- > http://gulik.pbwiki.com/ > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > -- Best regards, Igor Stasenko AKA sig.

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Peter Hugosson-Miller

2009/9/4 Michael van der Gulik <mikevdg(a)gmail.com> Yes, my answer was meant for you. > > 2009/9/4 Peter Hugosson-Miller <oldmanlink(a)gmail.com> > >> >> Michael, >> > > Assuming you're referring to me. There're lots of Michaels around. > > >> >> This is one of those cases that really makes me miss ENVY, and its Class >> extentions. Under that system you would avoid the problem completely, by >> extending the Collection class in the Stream package and adding the methods >> that depend on Streams in that package. >> >> I guess everyone knows what ENVY Class extensions are, but just in case >> someone doesn't, they are basically collections of methods to be added to a >> Class already in the image (i.e. not subclasses), when the extension is >> loaded. >> > > > Unless there's more magic here than I understand, Monticello also does > this. > I'm *really* new to PharO and Squeak, Monticello and lots of other things, so I don't feel qualified to say one way or the other. > > My package system can't do that. I can't work out a way to modify existing > classes that won't cause complete chaos. SecureSqueak is designed to run > completely untrusted code loaded from the Internet; allowing loaded code to > override methods in other packages allows for too much bad stuff to happen. > It isn't a question of overriding specifically, but of adding methods to classes (which may then of course override methods in their superclasses). But since I don't know enough about SecureSqueak either, I don't really understand what your packaging system is intending to do either. But now I'm afraid I've really dragged the discussion off-topic, for which I apologise :-) > > If you can think of a way to do that securely, I'm all ears. > > > Gulik. > > -- > http://gulik.pbwiki.com/ > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > -- Cheers, Peter

Sept. 4, 2009

[Pharo-project] Added package KernelTests-PeterHugossonMiller.145.mcz

by Peter Hugosson-Miller

Name: KernelTests-PeterHugossonMiller.145 Author: PeterHugossonMiller Time: 4 September 2009, 2:11:41 am UUID: 1bab2752-fa51-48ab-a64d-569f6ceda5bd Ancestors: KernelTests-PeterHugossonMiller.144 Fix for Issue 1150 - Incorrect test that was meant to test Duration>>#storeOn: actually tested #printOn: instead -- Cheers, Peter

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Michael van der Gulik

2009/9/4 Peter Hugosson-Miller <oldmanlink(a)gmail.com> > > Michael, > Assuming you're referring to me. There're lots of Michaels around. > > This is one of those cases that really makes me miss ENVY, and its Class > extentions. Under that system you would avoid the problem completely, by > extending the Collection class in the Stream package and adding the methods > that depend on Streams in that package. > > I guess everyone knows what ENVY Class extensions are, but just in case > someone doesn't, they are basically collections of methods to be added to a > Class already in the image (i.e. not subclasses), when the extension is > loaded. > Unless there's more magic here than I understand, Monticello also does this. My package system can't do that. I can't work out a way to modify existing classes that won't cause complete chaos. SecureSqueak is designed to run completely untrusted code loaded from the Internet; allowing loaded code to override methods in other packages allows for too much bad stuff to happen. If you can think of a way to do that securely, I'm all ears. Gulik. -- http://gulik.pbwiki.com/

Sept. 4, 2009

Re: [Pharo-project] [ANN]

by Peter Hugosson-Miller

2009/9/4 Michael van der Gulik <mikevdg(a)gmail.com> > Argh. Please reply below other people's emails. > > > Bill >> >> >> >> ------------------------------ >> *From:* pharo-project-bounces(a)lists.gforge.inria.fr [mailto: >> pharo-project-bounces(a)lists.gforge.inria.fr] *On Behalf Of *Michael van >> der Gulik >> *Sent:* Thursday, September 03, 2009 5:54 PM >> *To:* Pharo-project(a)lists.gforge.inria.fr >> *Subject:* Re: [Pharo-project] [ANN] >> >> >> >> 2009/9/4 Miguel Enrique CobÃ¡ Martinez <miguel.coba(a)gmail.com> >> >>> El vie, 04-09-2009 a las 09:33 +1200, Michael van der Gulik escribiÃ³: >>> > >>> > >>> > On Fri, Sep 4, 2009 at 3:21 AM, StÃ©phane Ducasse >>> > <stephane.ducasse(a)inria.fr> wrote: >>> > - Issue 1144: Many occurrences of "ReadStream on: >>> > aCollection" which >>> > can be replaced with "aCollection readStream" >>> > >>> > >>> > For what it's worth, I prefer the style of "ReadStream on: xxx". I >>> > prefer to choose the stream class rather than let the collection >>> > choose it for me. >>> >>> But don't you always have the option to call ReadStream on: object, >>> even though object class has a readStream method? >>> >> >> >> In Pharo, sure. >> >> However, in SecureSqueak, there won't be >>readStream methods. I'll spare >> the details because I hate multi-page emails. Ask me if you're interested. >> > > >> 2009/9/4 Schwab,Wilhelm K <bschwab(a)anest.ufl.edu> >> Ok, I'm interested :) Is there a security argument? Off the top, it >> does not sound like something I would want to use. If you can make a case >> that #readStream is dangerous, I'm all ears. If it is simply that it closes >> off modifications to the base classes, it is probably too restictive for my >> tastes. Locking it down **after** I add the missing methods and deploy on >> a server, that's another matter. But then, there would be #readStream >> methods... >> >> > Excuse the funny formatting. GMail sometimes doesn't cooperate. Also, this > is getting a bit off topic on the Pharo list. > > No, it's not really to do with security. It's to do with this package > system I invented. > > Basically, I want to reduce package dependencies. Putting >>readStream in > kernel classes would make a package dependency between the Collection > package and the Stream package. If the Collections package was loaded into > SecureSqueak, the package architecture would be forced to load the Stream > package as well even if it isn't used. If your own package depended on both > Collection and a different Streams package, anybody who loaded your code > would need to load two Streams packages. > > There's no reason that >>readStream couldn't be included in a Collections > package, provided that it's not in the Collections package provided with the > SecureSqueak Kernel. I want the Kernel package to have as few dependencies > as possible. Packages are read-only in SecureSqueak and the Kernel package > contains special objects, meaning that Kernel and its dependencies can not > be upgraded without distributing a new image. Collections would be a > non-upgradable dependency of Kernel, so I'd be trying hard to not also make > Streams also a non-upgradable dependency. > > More info: > http://gulik.pbwiki.com/Namespaces > http://gulik.pbwiki.com/Packages > > Gulik. > > -- > http://gulik.pbwiki.com/ > > _______________________________________________ > Pharo-project mailing list > Pharo-project(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project > Michael, This is one of those cases that really makes me miss ENVY, and its Class extentions. Under that system you would avoid the problem completely, by extending the Collection class in the Stream package and adding the methods that depend on Streams in that package. I guess everyone knows what ENVY Class extensions are, but just in case someone doesn't, they are basically collections of methods to be added to a Class already in the image (i.e. not subclasses), when the extension is loaded. -- Cheers, Peter

Sept. 3, 2009