May 2020 - Pharo-dev - lists.pharo.org

Recommendation for password encryption?
by Mariano Martinez Peck Sept. 30, 2022

Sept. 30, 2022

Hi guys. Some time ago I asked about the best way to encrypt a password. Some of the recommendations I got was: 1) Generally for passwords you do not write a decrypt method for security purposes (eg you do not want people to be able to reverse engineer the encrypted password easily) 2) put a little salt 3) There is http://www.squeaksource.com/Cryptography/PasswordHashingFFI 4) I should not decrypt password but instead I should compare both encrypted versions to see if they are equal. My scenario is the following. I need to store database passwords in text files. So I don't want to let them as plain text. And while I understand 4), I think it's a different scenario than mine. I know that some database driver may allow you to directly send the encrypted password. But still...I have another similar scenario in which I have to store a password and then send it (unencrypted)...so I kind of really need a bi-directional encryption. Now..I would try to avoid having an external library + FFI. Any ideas what is the best thing I can do? And how could I solve 1) if I want bidirectional like in my case? Thanks in advance, -- Mariano http://marianopeck.wordpress.com

9 26

[ANN] Pharo Launcher 2.0 released!
by Christophe Demarey July 20, 2020

July 20, 2020

Hi all, Pharo Launcher 2.0 has just been released! It is available from http://pharo.org/download <http://pharo.org/download>. This new version introduces major changes: The UI has been fully rewritten using the new Spec2 framework <https://github.com/pharo-spec/Spec> and the Commander2 library <https://github.com/pharo-spec/Commander2>. UI has been revamped to increase usability, especially for newcomers. The main window is now composed of a toolbar and the list of images. The template list is now available when clicking on the new image button. Documentation web site : All Pharo Launcher features are now explained in the new documentation available at https://pharo-project.github.io/pharo-launcher. You can contribute easily by clicking the *edit on GitHub* button. You can now have many launch configurations for an image (VM to use, vm and image arguments). It means you can use headless Pharo VM from Pharo Launcher. When creating a new image, you can specify an initialisation script that will be run once at the first image launch. It is useful to load your project code in a stock Pharo image for example. See https://pharo-project.github.io/pharo-launcher/create-images/#image-initial… You can now define your own template sources in addition to official sources (see https://pharo-project.github.io/pharo-launcher/templates/#create-your-own-l…) including authenticated sources. Improved image metadata. Pharo Launcher now manages all image metadata in a single STON file (including description, Pharo version). Big thanks to all contributors, including issue reports. It is also the opportunity to thanks Damien Cassou, the original author of Pharo Launcher. Here is the changelog: Pharo Launcher v2.0 <https://github.com/pharo-project/pharo-launcher/releases/tag/2.0> The list of closed issue is too long (68) to be listed but you can browse it here: https://github.com/pharo-project/pharo-launcher/issues?q=is%3Aissue+is%3Acl… Here are some highlights: New features: Documentation web site Image initialisation script Launch configurations, headless VM support User template file in addition to the official template file Jenkins server template now support pipeline projects Support of private Jenkins server Support of authenticated HTTP server Improvements: Monitoring of image launch failures to give back the error message (if any) Newly created image is automatically selected in the image list Allow to set image description at creation time Better error management (you will have the choice to ignore them or debug them) Add a poor version column in image list Speedup (especially when image repository has a lot of images) Bug fixes: Fix use of system unzip on Windows Regards, The Pharo team.

6 8

Re: [Pharo-project] Parsing and navigating Html
by Paul DeBruicker July 16, 2020

July 16, 2020

On 12/05/2010 06:02 AM, pharo-project-request(a)lists.gforge.inria.fr wrote: > From: St?phane Ducasse<stephane.ducasse(a)inria.fr> > Subject: [Pharo-project] Parsing and navigating Html > To:"Pharo-project(a)lists.gforge.inria.fr Development" > <Pharo-project(a)lists.gforge.inria.fr> > Message-ID:<1C53DFD8-3021-4233-BC83-CE8C1EA8D103(a)inria.fr> > Content-Type: text/plain; charset=us-ascii > > Hi > > I would like extract partial information from HTML pages. > So I started to play and fix HTMLParser. > > Now does anybody know alternatives? > > Second, does anybody develop a lib to query HTML structure as with the XMLSupport package? > > Stef The Soup package on SqueakSource.com works OK.

3 4

Pharo 7.0.5
by Sven Van Caekenberghe June 29, 2020

June 29, 2020

Hi, Is there any intention of officially releasing Pharo 7.0.5 ? There are 18 commits after 7.0.4 https://github.com/pharo-project/pharo/compare/v7.0.4...Pharo7.0 I need the following https://github.com/pharo-project/pharo/pull/5079 which is one of the 18 commits Zinc HTTP Components is currently partially broken on Pharo 9 because #digitAt: was replaced by #byteAt: and #digitAt: is now removed. In order to fix this I could start using #byteAt: as far back as 7.0.5 and add it myself for even older Pharo versions using my Zinc-Pharo-Forward-Compatibility package. What has to happen to make it possible to release 7.0.5 ? More testing ? Where is the artefact to test ? Thx, Sven

2 7

About strange email related to smalltalkhub read-only on squeak-dev
by StÃ©phane Ducasse June 6, 2020

June 6, 2020

Hi all This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points. Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family). We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything. We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years. I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying. S > Hi all, > > I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care. > > BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD > > I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com or another location that is also properly registered. > > IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately. > > END BOLD! > > Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me! > > All the best, > > Ron Teitelbaum -------------------------------------------- StÃ©phane Ducasse http://stephane.ducasse.free.fr / http://www.pharo.org 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, BÃ¢t.A, Park Plaza Villeneuve d'Ascq 59650 France

6 8

question about Zinc ZnUrl or ZnResourceMetaUtils
by StÃ©phane Ducasse June 5, 2020

June 5, 2020

Hi sven Are the dictionaries for the query part conserving the order? Because this would be really nice. S. -------------------------------------------- StÃ©phane Ducasse http://stephane.ducasse.free.fr / http://www.pharo.org 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, BÃ¢t.A, Park Plaza Villeneuve d'Ascq 59650 France

2 2

Re: [Pharo-dev] [Pharo-users] About strange email related to smalltalkhub read-only on squeak-dev
by Richard Sargent May 31, 2020

May 31, 2020

Thanks, Bruce. The part about (the possibility that) squeak source is configured to restrict distribution was the missing piece for me. I had previously assumed (hah!) that it would be available to anyone anywhere. On Sun, May 31, 2020, 10:39 Bruce O'Neel <bruce.oneel(a)pckswarms.ch> wrote: > > Hi, > > So addressing only the crypto software issue and with the caveat that I am > also not a lawyer but I have had to deal with certain aspects of this in > the past.... > > Crypto software is one of those bizarre dual use items in terms of arms > imports and exports. While we as geeks just think of this is software or > mathematics and might be confused as to why governments care, governments > do care deeply about this. And their way of expressing how much they care > about this issue is by passing laws and prosecuting folks. > > One of the easiest ways to get in trouble is for one to make the software > available to residents and/or citizens of certain countries as well as > available to people on a long list kept by different governments. We can > have a long debate about the morality of this concept but those who make > the laws have decided that is the law. And often these laws are crafted > such that the executive can change important details on short notice and > that puts the risk of prosecution at the whims of different world leaders. > > The license that the software is released under is not important. > > What Ron is stating is that squeak source supplied some additional > protections to prevent accidentally making the software available to folks > who the US feels should not have access. > > If you have moved the software to another hosting provider without the > permission or knowledge of the author, and therefore the owner of the > software, you have put that person at additional risk. In addition you and > the hosting provider are taking on additional risk. > > If it was moved to GitHub I strongly recommend reviewing their policies on > trade controls and what risks you assume. > > https://help.github.com/en/github/site-policy/github-and-trade-controls > > > Finally I would strongly recommend talking to a competent legal advisor > who is deeply familiar with the details of these laws. They are complex > and highly variable between different parts of the world. > > I know this seems like a lot of trouble and wasted time but you can spend > a giant amount of time and money defending oneself from arms trafficking > charges. > > cheers > > bruce > > *30 May 2020 14:43 StÃ©phane Ducasse <stephane.ducasse(a)inria.fr > <stephane.ducasse(a)inria.fr>> wrote:* > > Hi all > > This is the week-end and we worked super well yesterday during the sprint. > Lot of good enhancements - Thanks a lot to all the participants. > I not really happy to be forced to do it on a sunny saturday but Iâm doing > it to clarify points. > > Esteban sent me this text that was posted on Squeak-Dev (I personally do > not read squeak related forums because > I have not the time and my focus is Pharo, its consortium, my team, my > research and my family). > > We have to react because > - We do not really at ***all** understand this email > - We did not kicked anybody from our mailing-list from ages - so ron is > lying. In the past we even had discussion with ron - so we do not > really understand. May be we got problem to log on our mailing-lists. > We have no idea because we are working and not looking at such things. > - When we migrated smalltalkhub to readonly we payed attention to make > sure that private projects stay private. > We did not migrated smalltalkhub for fun. We MUST do it or it will be done > by our infrastructure! > - Now the cryptography packages are MIT and they are public anyway. So > again we do not understand anything. > > We do not get why Ron contacted us because we announced the migration > publicly way in advance and we will keep > the Smalltalkhub frozen repo for at least next 5 years. > > I feel really sorry to hear such kind of email because we do not want to > fight with anybody. > Our goal is to make sure that people can work with Pharo and expand their > business and knowledge. > We are working hard to make sure that people can invent their future with > Pharo and people that know us personally > know that we are not lying. > > S > > > > Hi all, > > I've tried to work with the Pharo group but they keep kicking me out of > their mailing list. I've already mentioned this a number of times to the > Pharo group but nobody seems to care. > > BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD > > I am not a lawyer but we used very good lawyers to make the squeaksource > repository a safe place to do cryptography work. If you are working on > cryptography DO NOT POST your code anywhere except squeaksource. > Especially if you are in the USA. The ONLY repository that is approved to > host our cryptography code in the USA and therefore not subject to criminal > violations is squeaksource. It is a CRIME in the USA to move code and make > it available on the internet for everyone to download! It must be hosted > on squeaksoruce.com or another location that is also properly registered. > > IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT > REGISTERED I would recommend you delete it immediately. > > END BOLD! > > Please feel free to post this to the Pharo mailing list because they > apparently do not want to hear from me! > > All the best, > > Ron Teitelbaum > > > > -------------------------------------------- > StÃ©phane Ducasse > http://stephane.ducasse.free.fr / http://www.pharo.org > 03 59 35 87 52 > Assistant: Aurore Dalle > FAX 03 59 57 78 50 > TEL 03 59 35 86 16 > S. Ducasse - Inria > 40, avenue Halley, > Parc Scientifique de la Haute Borne, BÃ¢t.A, Park Plaza > Villeneuve d'Ascq 59650 > France > > >

1 0

[Pharo 9.0] Build #323: 6378-SmallInteger-methods-are-calling-for-test-and-executable-comment
by ci-pharo-ci-jenkins2＠inria.fr May 31, 2020

May 31, 2020

There is a new Pharo build available! The status of the build #323 was: FAILURE. The Pull Request #6465 was integrated: "6378-SmallInteger-methods-are-calling-for-test-and-executable-comment" Pull request url: https://github.com/pharo-project/pharo/pull/6465 Issue Url: https://github.com/pharo-project/pharo/issues/6378 Build Url: https://ci.inria.fr/pharo-ci-jenkins2/job/Test%20pending%20pull%20request%2…

1 0

[Pharo 9.0] Build #322: 6320-RBExtraBlockRule-does-not-check-for-cull--co
by ci-pharo-ci-jenkins2＠inria.fr May 29, 2020

May 29, 2020

There is a new Pharo build available! The status of the build #322 was: FAILURE. The Pull Request #6416 was integrated: "6320-RBExtraBlockRule-does-not-check-for-cull--co" Pull request url: https://github.com/pharo-project/pharo/pull/6416 Issue Url: https://github.com/pharo-project/pharo/issues/6320 Build Url: https://ci.inria.fr/pharo-ci-jenkins2/job/Test%20pending%20pull%20request%2…

1 0

[Pharo 9.0] Build #321: extract-return-from-conditionals-for-packages-s
by ci-pharo-ci-jenkins2＠inria.fr May 29, 2020

May 29, 2020

There is a new Pharo build available! The status of the build #321 was: SUCCESS. The Pull Request #6437 was integrated: "extract-return-from-conditionals-for-packages-s" Pull request url: https://github.com/pharo-project/pharo/pull/6437 Issue Url: https://github.com/pharo-project/pharo/issues/extract Build Url: https://ci.inria.fr/pharo-ci-jenkins2/job/Test%20pending%20pull%20request%2…

1 0