March 2011 - Pharo-dev - lists.pharo.org

Re: [Pharo-project] [squeak-dev] Security Vunerability in SqueakSource

by Tobias Pape

Am 2011-03-21 um 03:24 schrieb Matthew Fulmer: > As demonstrated by the VMMaker team, SqueakSource has a rather > serious security vunerability: > > http://bugs.squeak.org/view.php?id=7617 > > Below is the dialog that led to this discovery: > Note that SqueakSource 2 and 3 are unaffected of this bug. Moreover, find attached a quick fix that is a backport of the conflict handling in SqueakSource 2 to the original SqueakSource. HTH So Long, -Tobias

March 21, 2011

Re: [Pharo-project] Security Vunerability in SqueakSource

by Marcus Denker

On Mar 21, 2011, at 3:24 AM, Matthew Fulmer wrote: > As demonstrated by the VMMaker team, SqueakSource has a rather > serious security vunerability: > Serious security problems are normally send to the admins of a website first (so they fix it) instead of sending it to a mailinglist... Marcus -- Marcus Denker -- http://www.marcusdenker.de INRIA Lille -- Nord Europe. Team RMoD.

March 21, 2011

Re: [Pharo-project] Issue 3754 in pharo: Omnibrowser's an extra horizontal scrollbar

by pharo＠googlecode.com

Updates: Labels: -Milestone-1.3-DevImage Milestone-1.2-DevImage Comment #6 on issue 3754 by marcus.d...(a)gmail.com: Omnibrowser's an extra horizontal scrollbar http://code.google.com/p/pharo/issues/detail?id=3754 (No comment was entered for this change.)

March 21, 2011

Re: [Pharo-project] Issue 3830 in pharo: [Failing Test] Autotes TestHitCounter.testHitCountIncrements

by pharo＠googlecode.com

Updates: Status: Closed Comment #8 on issue 3830 by marcus.d...(a)gmail.com: [Failing Test] Autotes TestHitCounter.testHitCountIncrements http://code.google.com/p/pharo/issues/detail?id=3830 Works!

March 21, 2011

Re: [Pharo-project] [Pharo-users] Do you have a tool that works on Pharo ?

by laurent laffont

Mariano, I've added Autotest. I've seen a lot of Configuration example which won't work because of missing parenthesis: (Smalltalk at: #ConfigurationOfOCompletion) project version: '1.1.2' load. should be ((Smalltalk at: #ConfigurationOfOCompletion) project version: '1.1.2') load. I cannot fix it now - must go to work. Laurent On Sun, Mar 20, 2011 at 11:40 PM, Mariano Martinez Peck < marianopeck(a)gmail.com> wrote: > I've added: > > - Gofer > - Monticello > - Metacello > - Fuel > > If you can check and improve it..please do. It only took me 30 mins. > > Cheers > > Mariano > > > On Sun, Mar 20, 2011 at 11:12 PM, Mariano Martinez Peck < > marianopeck(a)gmail.com> wrote: > >> I forgot...If someone answer "but you can browse the MetecelloRepository" >> or "XX" or "blah"....the answer is that we are not targeting the same >> people. Someone that knows how that he has to browse MetacelloRepository, >> probably knows how to install the software, what it is, etc. >> With this page (after, moved to the pharo website) we want to targe >> business and new comers. Imagine someone arriving to Pharo and asking >> himseld "mmmmm does Pharo have XXX that I have in YYY language? ". So the >> idea is to show all the available tools. >> >> Cheers >> >> Mariano >> >> >> On Sun, Mar 20, 2011 at 10:42 PM, StÃ©phane Ducasse < >> stephane.ducasse(a)inria.fr> wrote: >> >>> thanks mariano this is a good initiative. >>> >>> Stef >>> >>> On Mar 20, 2011, at 10:22 PM, Mariano Martinez Peck wrote: >>> >>> > ifTrue: [ self writeOnPharoBook: aTool] >>> > >>> > We need to improve our documentation. Right now, we have a >>> collaborative book where everyone can join and write: >>> http://book.pharo-project.org/ >>> > >>> > Here we have a list of tools that run on Pharo: >>> http://book.pharo-project.org/book/PharoTools >>> > and it is REALLY important to have such list updated and maintained. >>> > >>> > So, if you have a tool that works in pharo and it is not there, please >>> add it. If you don't have a user, I can create one for you. If you are TOO >>> lazy, you can send by email the text to me and I write it. >>> > >>> > Thanks >>> > >>> > Mariano >>> >>> >>> >> >

March 21, 2011

Re: [Pharo-project] [ANN 1.2.1a] towards 1.2.1

by Michael Roberts

umm... i don't think it is wrong. I just could not find any senders of the message which is why i commented it. The only thing it does is delete the internal set of updates but i don't know enough about the update architecture to know if that matters. i will have a look. cheers, Mike On Sun, Mar 20, 2011 at 11:03 PM, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > On Mar 20, 2011, at 11:44 PM, Michael Roberts wrote: > >> Hi, a meta question... >> >> when i made changes to SystemVersion I put a comment in that method >> thinking it would not make sense to use it. > > I did not know. I just did what we did when changing the version in the past. > (copy and paste from the postscript... same as Â setting the version to 1.2) > It worked... > >> You have published a use >> for it ;-) >> > I just changed the version number the same way it was done before. > It did not give an error message, the version looks good. > > If this is not correct, the method should react by telling me. > How can I know else? > > Â Â Â Â Marcus > > > -- > Marcus Denker Â -- http://www.marcusdenker.de > INRIA Lille -- Nord Europe. Team RMoD. > > >

March 21, 2011

[Pharo-project] [COTDC] 34 - MCSystemCategoryParser

by laurent laffont

Today: MCSystemCategoryParser Comment Of The Day Contest - One Day One Comment Rules: #1: Each day a not commented class is elected. Each day the best comment will be integrated with name of the author(s). #2: If you cannot comment it, deprecate it. Results: http://code.google.com/p/pharo/wiki/CommentOfTheDayContest Laurent

March 21, 2011

[Pharo-project] Security Vunerability in SqueakSource

by Matthew Fulmer

As demonstrated by the VMMaker team, SqueakSource has a rather serious security vunerability: http://bugs.squeak.org/view.php?id=7617 Below is the dialog that led to this discovery: On Sun, Mar 20, 2011 at 11:26:20AM -0700, Eliot Miranda wrote: > > > Hmm, wouldn't applying the ï¿½defaultï¿½ naming scheme prevent such > > overwrites? > > > > > > That is, now there would be > > > VMMaker-oscog-eem.52 > > > for Elliots version and > > > VMMaker-oscog-IgorStasenko.52 > > > for Igors version. > > > What would prevent us from that? > > > > > > I don't see a naming conflict. I've been using VMMaker-oscog.NN since > > the beginning and Igor has been using VMMaker-oscog-IgorStasenko.NN. This > > isn't about names, it's about content. Igor is miffed I didn't merge in > > some changes he made when I published VMMaker-oscog.52, right Igor? > > > > > > > No, youï¿½obviously accidentallyï¿½overwrote his version of the 18th of March: > > > > So how did Monticello allow me to do that? That's a /bad/ bug. > > > > > > >>> > > Name: VMMaker-oscog.52 > > Author: IgorStasenko > > Time: 18 March 2011, 12:45:14 am > > UUID: a2810aac-4423-6740-b70e-7e821b979cb4 > > Ancestors: VMMaker-oscog-IgorStasenko.50, > > VMMaker-oscog-EstebanLorenzano.50, VMMaker-oscog.51 > > > > Merge with oscog-49-51 & Esteban-50 > > <<<< > > > > which has the same file name as yours: > > > > >>> > > Name: VMMaker-oscog.52 > > Author: eem > > Time: 20 March 2011, 9:31:20 am > > UUID: 1241a856-8570-4725-a069-a6d3d8a8a222 > > Ancestors: VMMaker-oscog.51 > > > > Fix primitiveFlushCacheByMethod for objects-as-methods. > > <<<< -- Matthew Fulmer (a.k.a. Tapple)

March 21, 2011

Re: [Pharo-project] [squeak-dev] [UPD] NativeBoost runs on new Cog VMs

by Igor Stasenko

On 21 March 2011 02:43, Levente Uzonyi <leves(a)elte.hu> wrote: > On Sun, 20 Mar 2011, Igor Stasenko wrote: > >> Hello, >> i just wanna to inform you that i adopted NativeBoost plugin for >> building with latest Cog vms. > > Great. > >> >> To build VM, you should have an image with VMMaker + CMakeVMMaker >> packages installed. >> >> Then load NBIntaller package and do: >> NBInstaller installCogPlugin >> >> There are new cmake configurations i added to build VMs with NB plugin >> support. > > It's an old question, but I don't remember your answer, so: wouldn't it > be better to add a command line switch for enabling NB? So even if a VM is > compiled with NB, I can still turn it off if I want to. > It is disabled by default, when you starting a new image. This allows me to not care if some of the methods were carrying native code saved into an image. For enabling a native code, one should invoke #primitiveEnable first. You can customize a mechanism of enabling it in NativeBoost class>>enableNativeCode and put checking of command-line argument(s) there. And yes, i am against putting extra logic at plugin side :) The reason is simple: if you using it, then you know what you doing, and if you don't - then you safe anyways. Also, plugin can be made external, if you want. But there is certainly some intimate connection with VM, so i wouldn't recommend making it external, because it can easy break things, if you mismatch VM/plugin pairs. I am also looking forward for making JITted code to make direct calls to NB native code. In a way, that JIT code would not call #primitiveNativeCall (and only then enter native code) but instead directly call the native code which method contains. It will , of course, bypass all logic placed in #primitiveNativeCall, like checking if NB is enabled etc.. and could be dangerous.. but the speed will be... :) In a longer perspective this means that eventually JIT compiler could be moved from VM to language side (like Exupery does). -- Best regards, Igor Stasenko AKA sig.

March 21, 2011

Re: [Pharo-project] [squeak-dev] Re: [Vm-dev] VM Maker: VMMaker-oscog.52.mcz

by Igor Stasenko

On 21 March 2011 02:16, Matthew Fulmer <tapplek(a)gmail.com> wrote: > On Sun, Mar 20, 2011 at 10:02:05PM +0100, Igor Stasenko wrote: >> I agree that having different repos could simplify things. >> Except things which will otherwise complicate them: >> Â - publishing new VMMaker version sends nice email to mailing list > > This is just a setting in SqueakSource that can be set for any > repository. Just have both repositories notify this list > >> Â - configuration(s) to automatically load VMMaker with all >> dependencies relying on having VMMaker package at certain known >> location, >> not at multiple ones. > > If you want to load a working VMMaker, you aren't going to mix > stuff from cog and stable VMMaker repositories without a manual > merge first. And if you are talking about .mcm files, they > support multiple repositories, as long as package names are not > duplicated (like, if there are two different packages named > VMMaker-oscog.52 in each repo, it's undefined which one mcm will > load) > No i'm talking about Metacello configuration, which currently used to load VMMaker. But you are right, i still manually control each update, so i can always change the location & packages which should be loaded for new version(s). > -- > Matthew Fulmer (a.k.a. Tapple) > > -- Best regards, Igor Stasenko AKA sig.

March 21, 2011