August 2011 - Pharo-dev - lists.pharo.org

Re: [Pharo-project] Releasing 1.3: TODOs

by Marcus Denker

On Aug 8, 2011, at 10:39 AM, Tudor Girba wrote: > Great! As soon as you release 1.3, we will release Moose 4.6 based on it, so I hope it will be soon :) > It will be this week... maybe tomorrow? I only need to figure out the VM story... Marcus > Cheers, > Doru > > > On 8 Aug 2011, at 08:51, Marcus Denker wrote: > >> TODOs to get 1.3 released: >> >> 1) store a 1.3Core on gforge build with an old vm. Double check it works with old VM. >> >> It is likely that, again, I did not think about this for some of the images on gforge... it might >> mean that we need to re-generate images and re-build the Full image based on that. >> I should again stress that this situation is sucking the live out of people (at least me) and >> we need to *simplify* our story *considerably*. This is *not* sustainable like this. >> >> 2) store a 1.3 on gforge (take form Hudson). double check with old vm >> >> 3) update the one-click with reasonable Vms. Which ones? I am confused wrt to VMs, so I need help here. >> >> 4) update the website. >> - especially regarding VMs >> >> >> For 1.4, we should *really* *really* make sure that we auto-generate the *final* *unchanged* release artefact... >> and *one* *defined* family of VMs, with the one-click (and just one one-click, not two) build from the latest VM. >> >> Marcus >> >> -- >> Marcus Denker -- http://marcusdenker.de >> >> > > -- > www.tudorgirba.com > > "No matter how many recipes we know, we still value a chef." > > > > > > > -- Marcus Denker -- http://marcusdenker.de

Aug. 8, 2011

Re: [Pharo-project] Releasing 1.3: TODOs

by Tudor Girba

Great! As soon as you release 1.3, we will release Moose 4.6 based on it, so I hope it will be soon :) Cheers, Doru On 8 Aug 2011, at 08:51, Marcus Denker wrote: > TODOs to get 1.3 released: > > 1) store a 1.3Core on gforge build with an old vm. Double check it works with old VM. > > It is likely that, again, I did not think about this for some of the images on gforge... it might > mean that we need to re-generate images and re-build the Full image based on that. > I should again stress that this situation is sucking the live out of people (at least me) and > we need to *simplify* our story *considerably*. This is *not* sustainable like this. > > 2) store a 1.3 on gforge (take form Hudson). double check with old vm > > 3) update the one-click with reasonable Vms. Which ones? I am confused wrt to VMs, so I need help here. > > 4) update the website. > - especially regarding VMs > > > For 1.4, we should *really* *really* make sure that we auto-generate the *final* *unchanged* release artefact... > and *one* *defined* family of VMs, with the one-click (and just one one-click, not two) build from the latest VM. > > Marcus > > -- > Marcus Denker -- http://marcusdenker.de > > -- www.tudorgirba.com "No matter how many recipes we know, we still value a chef."

Aug. 8, 2011

Re: [Pharo-project] Growl in Pharo

by Tudor Girba

On 8 Aug 2011, at 09:15, StÃ©phane Ducasse wrote: > > On Aug 7, 2011, at 11:45 PM, Tudor Girba wrote: > >> Thanks, Stef. >> >> This is cool. I will use it in Glamour :) > > feel free to add more classVariable as custom hooks. > I will check the alp with igor. What is alp? Doru > >> >> Cheers, >> Doru >> >> >> On 7 Aug 2011, at 19:10, StÃ©phane Ducasse wrote: >> >>> Hi >>> >>> I was brainstorming for an example to illustrate announcements and I wanted to have a Growl feature. >>> So I looked at Snarl from Tony Garnock-Jones and I redesigned a simpler Morph. >>> >>> It could be more generic with better default handled default. >>> I do not understand why the color of the text is ignored but I can not want to spend more time on it now. >>> Apparently the first time the text is read and when the background or the color of the border are set the blue get propagated. :( >>> >>> GrowlMorph openWithLabel: 'The time' contents: (TimeStamp now)) >>> >>> If somebody would like to glue together Growl and the available announcements it would be fun to check. >>> >>> Gofer new >>> squeaksource: 'Growl'; >>> package: 'Growl'; >>> load >>> >>> GrowlMorph openWithLabel: 'The time' contents: (TimeStamp now) >>> >>> Stef >>> >>> Something changed between 14042 and 14077 because I do not have the same alpha for the handle but I do not have the time to check. >>> I do not understand why round corners are not taken into account. >>> >>> >>> >>> >>> <Screen shot 2011-08-07 at 6.55.07 PM.pdf><Screen shot 2011-08-07 at 6.56.40 PM.pdf> >>> >> >> -- >> www.tudorgirba.com >> >> "We can create beautiful models in a vacuum. >> But, to get them effective we have to deal with the inconvenience of reality." >> >> > > -- www.tudorgirba.com "Reasonable is what we are accustomed with."

Aug. 8, 2011

[Pharo-project] Summary with UUID not so unique.

by Mariano Martinez Peck

Hi guys. Can someone do a summary of the problem of UUID not so unique? because I have been bitten again. In my image, primMakeUUID is still calling the primitive: primMakeUUID <primitive: 'primitiveMakeUUID' module: 'UUIDPlugin'> UUIDGenerator default generateBytes: self forVersion: 4. By my VM is still broken with this aspect. So....how should we deal with it? a) Change/Commmit/Integrate this: primMakeUUID UUIDGenerator default generateBytes: self forVersion: 4. b) there are new Cog VMs somewhere that I can use with this problem fixed? Thanks -- Mariano http://marianopeck.wordpress.com

Aug. 8, 2011

Re: [Pharo-project] Releasing 1.3: TODOs

by Marcus Denker

On Aug 8, 2011, at 8:51 AM, Marcus Denker wrote: > TODOs to get 1.3 released: > > 1) store a 1.3Core on gforge build with an old vm. Double check it works with old VM. > > So the first question is: to which VMs exacly do we need to be compatibe? I just use the ones build by the build server... works fine for me, but I think we decided that these will be the official vms from 1.4 onwards. So what are the VMs for 1.3? Marcus -- Marcus Denker -- http://marcusdenker.de

Aug. 8, 2011

Re: [Pharo-project] audio and pharo

by StÃ©phane Ducasse

We should have a look at it. Argh we should really improve the way we manage the image after RPackage I will put that top of my priority. stef On Aug 8, 2011, at 9:51 AM, Henrik Johansen wrote: > > On Aug 8, 2011, at 3:00 49AM, Brad Fuller wrote: > >> Has pharo improved/added any audio related classes since the fork? >> >> Thanks, >> brad >> > > Improved, no. > Kept what you'd find in Sound-* in Squeak up to date? Sort of. > Though there were problems with loading it in 1.2/1.3 I'm not sure was resolved correctly, you can find the code in PharoSound repository on Squeaksource. > > As for improvements, you could check out http://forum.world.st/ANN-SqueakMovieMorph-Alpha-plays-any-video-file-playa… > (make sure to use a VM including the plugin) > > Cheers, > Henry

Aug. 8, 2011

Re: [Pharo-project] Web app security

by laurent laffont

Thanks for answers. What we are currently doing: - integrate some vm patches (thanks Mariano :) from netstyle / seaside hosting which limit file system / socket access - try to run hosted images in another account It seems chrooting each account is not so easy. Yes, would be nice to make SmallHarbour running on FreeBSD. Laurent. On Mon, Aug 8, 2011 at 9:37 AM, Miguel Moquillon <miguel.moquillon(a)gmail.com > wrote: > If the host of SmallHarbour is running with FreeBSD 8 or Solaris, you can > use the "capabilities" feature to give restrictive priviledges to the > program or to some parts of the program. In short a capability is a pair of > a reference to an object in the system with the rights on that object. You > can allocate to the program a set of capabilities that define the security > environment within which it will run. > > Mig > > Le 06/08/2011 14:31, Dale Henrichs a Ã©crit : > > Laurent, >> >> I think that the best defense is the limited access/rights unix account, >> perhaps even a separate unix user per account (to provide isolation between >> accounts) ... I think this is what VMware does in in its Cloud Foundry ... >> to be completely safe you'd have to turn off the ability to read and write >> files and turn off socket access (this is what javascript in the browser >> does), but going this far severely limits what you can do in the image ... I >> would think that you could screw things down pretty tight just using unix >> permissions .... >> >> Dale >> >> ----- Original Message ----- >> | From: "laurent laffont"<laurent.laffont(a)**gmail.com<laurent.laffont(a)gmail.com> >> > >> | To: "Seaside - developer list"<seaside-dev(a)lists.**squeakfoundation.org<seaside-dev(a)lists.squeakfoundation.org>>, >> "An open mailing list to discuss any topics >> | related to an open-source Smalltalk"<pharo-project@** >> lists.gforge.inria.fr <pharo-project(a)lists.gforge.inria.fr>> >> | Sent: Saturday, August 6, 2011 3:06:38 AM >> | Subject: [Pharo-project] Web app security >> | >> | Hi, >> | >> | >> | with a public SmallHarbour (public fork of SeasideHosting - >> | smallharbour.org ) people can upload images that do bad things: >> | change filesystem, run commands, .... >> | >> | >> | Actually, what are the ways of securing a server so people can't do >> | bad things ? >> | >> | >> | I'm thinking of: >> | - run the vm/image within a low right unix account >> | - remove dangerous plugins (OSProcess, ?) >> | >> | >> | Can we easily chroot ? >> | >> | >> | what are known solutions ? >> | >> | >> | Laurent. >> >> > >

Aug. 8, 2011

Re: [Pharo-project] Thoughts about software refactoring

by Johannes Rasche

indeed Stef, though with software it's good too to think before and try to guess right :) :) anyway for me it's a fascinating aspect of our profession we need only tools but no material or to put it into other words there is always enough raw material available and independent of the quality of tools what we can do is only limited by our imagination Johannes Am 07.08.2011 um 16:42 schrieb StÃ©phane Ducasse: > Hi guys > > What is cool with software refactoring is that we have tests, and even if we break it to death, them we can undo... > This morning I was trying to open wood boxes of my old bow window and this is another story. > No debugger, no test, no undo. Just think before, try to guess right and do it slowly to avoid to break for real. > > Stef > > >

Aug. 8, 2011

Re: [Pharo-project] audio and pharo

by Henrik Johansen

On Aug 8, 2011, at 3:00 49AM, Brad Fuller wrote: > Has pharo improved/added any audio related classes since the fork? > > Thanks, > brad > Improved, no. Kept what you'd find in Sound-* in Squeak up to date? Sort of. Though there were problems with loading it in 1.2/1.3 I'm not sure was resolved correctly, you can find the code in PharoSound repository on Squeaksource. As for improvements, you could check out http://forum.world.st/ANN-SqueakMovieMorph-Alpha-plays-any-video-file-playa… (make sure to use a VM including the plugin) Cheers, Henry

Aug. 8, 2011

Re: [Pharo-project] Web app security

by Miguel Moquillon

If the host of SmallHarbour is running with FreeBSD 8 or Solaris, you can use the "capabilities" feature to give restrictive priviledges to the program or to some parts of the program. In short a capability is a pair of a reference to an object in the system with the rights on that object. You can allocate to the program a set of capabilities that define the security environment within which it will run. Mig Le 06/08/2011 14:31, Dale Henrichs a Ã©crit : > Laurent, > > I think that the best defense is the limited access/rights unix account, perhaps even a separate unix user per account (to provide isolation between accounts) ... I think this is what VMware does in in its Cloud Foundry ... to be completely safe you'd have to turn off the ability to read and write files and turn off socket access (this is what javascript in the browser does), but going this far severely limits what you can do in the image ... I would think that you could screw things down pretty tight just using unix permissions .... > > Dale > > ----- Original Message ----- > | From: "laurent laffont"<laurent.laffont(a)gmail.com> > | To: "Seaside - developer list"<seaside-dev(a)lists.squeakfoundation.org>, "An open mailing list to discuss any topics > | related to an open-source Smalltalk"<pharo-project(a)lists.gforge.inria.fr> > | Sent: Saturday, August 6, 2011 3:06:38 AM > | Subject: [Pharo-project] Web app security > | > | Hi, > | > | > | with a public SmallHarbour (public fork of SeasideHosting - > | smallharbour.org ) people can upload images that do bad things: > | change filesystem, run commands, .... > | > | > | Actually, what are the ways of securing a server so people can't do > | bad things ? > | > | > | I'm thinking of: > | - run the vm/image within a low right unix account > | - remove dangerous plugins (OSProcess, ?) > | > | > | Can we easily chroot ? > | > | > | what are known solutions ? > | > | > | Laurent. >

Aug. 8, 2011