- Pharo-dev - lists.pharo.org

[Pharo 8.0] Build #1146: Fix invalid (non-Boolean) return when CPU watcher is enabled

by ci-pharo-ci-jenkins2＠inria.fr

There is a new Pharo build available! The status of the build #1146 was: FAILURE. The Pull Request #10134 was integrated: "Fix invalid (non-Boolean) return when CPU watcher is enabled" Pull request url: https://github.com/pharo-project/pharo/pull/10134 Issue Url: https://github.com/pharo-project/pharo/issues/Pharo8.0 Build Url: https://ci.inria.fr/pharo-ci-jenkins2/job/Test%20pending%20pull%20request%2…

Oct. 12, 2021

Re: Hardening Zinc's Core HTTP Server

by Sven Van Caekenberghe

Here is an update on the status of both instances. A couple of people tried fiddling with invalid input which did result in exceptions, but everything was handled correctly so that the server kept on functioning. There were no spurious crashes. There was one attack by Levente Uzonyi that was successful though. He used the fact that Seaside sessions are long lived (cached for a certain time) combined with the fact that the Reddit.st app kept one GLORP database connection through P3 open to PostgreSQL and fired off a small denial of service (DOS) attack. Eventually either the VM ran out of space in the ExternalSemaphoreTable, making Socket creation, either for database connections or for handling new HTTP request impossible or the database's own connection limit was reached. At that point the HTTP server or the Pharo VM stopped functioning. Although Levente used a sequential number of requests, a concurrent number of request could cause similar problems (related, but differently). In looking at what he reported it also became clear that I accidentally left a debugging exception handler active, which is not good in a production image. Both instances are now redeployed with the following changes: - the Reddit.st code was changed to not keep the database connection open all the time, but instead connect/disconnect per request. this might be a bit slower, but it conserves resources much better and solves the original issue Levente reported https://github.com/svenvc/Reddit/commit/f2e0a0dc00b9cbb68cfa4fb007906365ae6… - a new feature was added to Zinc HTTP Components' ZnManagingMultiThreadedServer (the default) to enforce a maximum number of concurrent connections being allowed (the limit is 32 by default, but changeable if you know what you are doing). when the limit is reached, 503 Service Unavailable responses are sent to the excess clients and the connection is closed. this should help protect against concurrent connection DOS attacks https://github.com/svenvc/zinc/commit/ac0f06e74e7ab129610c466cb1d7ea9533d29… - the deploy script was changed to use the more primitive WAErrorHandler https://github.com/svenvc/Reddit/commit/874b631e6dc0c04c8c0b687ef770d00540d… Thanks again to Levente for taking the time to try an attack and for reporting it clearly. Sven > On 29 Sep 2021, at 17:10, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > Both instances have been up for 5 days now, looking for more testers. > >> On 23 Sep 2021, at 17:03, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Hi, >> >> Zinc HTTP Components [https://github.com/svenvc/zinc] has been a part of Pharo since version 1.3 (2011). It is an open-source framework to deal with the HTTP networking protocol, modelling all aspects involved. It also offers both client and server functionality. >> >> The reliability of the code base has improved steadily over the years, thanks to virtually all Pharo developers using it, directly or indirectly. Over the summer a number of issues that popped up after Pharo 9 was released were resolved. >> >> The robustness of the core HTTP server is one important aspect. To put this quality further to the test, I deployed two servers with the same demo Seaside application, Reddit.st, open to the internet, without any further protections. >> >> - On Amazon AWS: http://34.245.183.130:1701 >> >> - On Microsoft Azure: http://51.137.72.94:8080 >> >> The application's source code can be found at [https://github.com/svenvc/Reddit] For the technically curious there are also deploy instructions at [https://github.com/svenvc/Reddit/blob/main/DEPLOY.md] The demo app itself is described in an older article [https://medium.com/@svenvc/reddit-st-in-10-cool-pharo-classes-1b5327ca0740] Note that, by definition, there is no HTTPS/TLS variant. >> >> If you manage to break this server with (a) malicious request(s) in such a way that you can explain what you did for others to confirm your approach, you not only help me/us improve the code, but earn eternal fame as well ;-) >> >> Sven >> >> PS: I hope I won't regret this, I am looking for constructive criticism. >> >> >> -- >> Sven Van Caekenberghe >> Proudly supporting Pharo >> http://pharo.org >> http://association.pharo.org >> http://consortium.pharo.org >> >

Oct. 11, 2021

This week (40/2021) on the Pharo Issue Tracker MD

by Marcus Denker

We merged 23 PRs and fixed 19 Issue Tracker entries. Pharo9 ====== - Backport #10111: isReferenced-is-not-working-for-PoolVariables #10128 https://github.com/pharo-project/pharo/pull/10128 - 10123-Failing-test-Pharo9-ReleaseTesttestWorldMenuHasHelpForAllEntries #10127 https://github.com/pharo-project/pharo/pull/10127 - 10121-backport-Pharo9-Fix-failing-tests-in-CI-ZnHTTPSTesttestGForceInria #10122 https://github.com/pharo-project/pharo/pull/10122 - Fixes #10037. Now it only register world menu entries if the class "marked with praâ¦ #10055 https://github.com/pharo-project/pharo/pull/10055 - 9927-Check-Pharo9-Defining-variables-in-the-debugger-DNU-isForScripting-9925 #10120 https://github.com/pharo-project/pharo/pull/10120 - 10116-Backport-Pharo9-fixing-fuel-platform-dependency-10109 #10119 https://github.com/pharo-project/pharo/pull/10119 Fixes ===== - 10110-isReferenced-is-not-working-for-PoolVariables #10111 https://github.com/pharo-project/pharo/pull/10111 - Added two missing methods: tfPointerAddress https://github.com/pharo-project/pharo/pull/10099 - fixing-fuel-platform-dependency #10109 https://github.com/pharo-project/pharo/pull/10109 - 10067-CDClassDefinitionParserparseSelectorPartwithArgument-misses-subclass-definition-symbols #10092 https://github.com/pharo-project/pharo/pull/10092 - Fix failing tests in CI: ZnHTTPSTest>>testGForceInria #10091 https://github.com/pharo-project/pharo/pull/10091 Cleanups ========= - Cleanup-Unused-gtInspector-Rules #10112 https://github.com/pharo-project/pharo/pull/10112 - 10078-To-check-CompiledMethodlocalReadsSelf-does-isFFIMethod-check #10086 https://github.com/pharo-project/pharo/pull/10086 - ClassParser: Small Cleanup and Test for CompiledMethod #10097 https://github.com/pharo-project/pharo/pull/10097 - Deprecation-Rewrites-Ring #10115 https://github.com/pharo-project/pharo/pull/10115 - 10025-ObjectLayout-classlayoutForType-should-be-moved-to-the-Monticello-package #10087 https://github.com/pharo-project/pharo/pull/10087 - Cleanup Changeset class #10103 https://github.com/pharo-project/pharo/pull/10103 - Small cleanups: ByteString #10101 https://github.com/pharo-project/pharo/pull/10101 - Cleanup Color class #10105 https://github.com/pharo-project/pharo/pull/10105 - Deprecate #beginsWithEmpty:caseSensitive. Users should use beginsWithâ¦ #10016 https://github.com/pharo-project/pharo/pull/10016 - Fix #9907: improes DoesNotUnderstand exception's messageText #9982 https://github.com/pharo-project/pharo/pull/9982 - Use Jenkins git plugin #7141 https://github.com/pharo-project/pharo/pull/7141 - Small cleanups - AbstractWorldRenderer hierarchy #10082 https://github.com/pharo-project/pharo/pull/10082

Oct. 11, 2021

Re: Ephemeron Status?

by Esteban Lorenzano

hi Sean, I guess this enters in the "needing properly image support" part :) Esteban On Oct 10 2021, at 1:35 am, sean(a)clipperadams.com wrote: > Good news! Thanks for the update. Are blocks passed to announcements now weakly held/properly disposed of? IIRC this was on hold for many years pending proper ephemeron support

Oct. 10, 2021

Re: Ephemeron Status?

by sean＠clipperadams.com

Good news! Thanks for the update. Are blocks passed to announcements now weakly held/properly disposed of? IIRC this was on hold for many years pending proper ephemeron support

Oct. 9, 2021

Re: possible dates for Pharo Days 2022 :)

by Jonathan van Alteren

Hi Stef, Super nice to hear you're planning Pharo Days again! Both suggestions are good for us. We'll gladly make time for this :-) Good luck! Jonathan van Alteren Guild Partner | Object Guild B.V. Software die mÃ©t je werkt +316 22500930 jonathan(a)objectguild.com On 7 Oct 2021, 12:33 +0200, stephane ducasse <stephane.ducasse(a)inria.fr>, wrote: > Hello guys > > We are super excited because we want to organise PharoDays at Lille > We are checking some possible dates and we would like to know your point of view. > right now we were thinking that > 3/4 or 10/11 march would be good. > So let us know. > > S

Oct. 7, 2021

possible dates for Pharo Days 2022 :)

by stephane ducasse

Hello guys We are super excited because we want to organise PharoDays at Lille We are checking some possible dates and we would like to know your point of view. right now we were thinking that 3/4 or 10/11 march would be good. So let us know. S

Oct. 7, 2021

This week (39/2021) on the Pharo Issue Tracker MD

by Marcus Denker

We merged 21 Pull Requests and closed 20 issues this week: Fixes ===== - Add test for ZnBufferedReadStream>>setToEnd #10020 https://github.com/pharo-project/pharo/pull/10020 - Putting back the expectedFailure to test of write barrier #10057 https://github.com/pharo-project/pharo/pull/10057 - 10050-Failing-in-CI-CompiledMethodTrailerTesttestEmbeddingCompressedSourceCode #10058 https://github.com/pharo-project/pharo/pull/10058 - Fixing deprecation of currentPlatformName, it is the OS name #10056 https://github.com/pharo-project/pharo/pull/10056 - 10021 - Fixing the export of Monticello. #10038 https://github.com/pharo-project/pharo/pull/10038 - Fix #10026: Cannot use Iceberg - Pharo 10 Windows 64bits FFI #10028 https://github.com/pharo-project/pharo/pull/10028 Features ======== - Fixes #10042 enhance help system to be microdown based #10048 https://github.com/pharo-project/pharo/pull/10048 Cleanup ======= 10073-Cleanup-class-parser-support-for-slots-in-old-style-class-def-not-needed #10074 https://github.com/pharo-project/pharo/pull/10074 Small cleanups - Breakpoint #10084 https://github.com/pharo-project/pharo/pull/10084 Small cleanups AsyncFile #10072 https://github.com/pharo-project/pharo/pull/10072 Small cleanups in Balloon #10070 https://github.com/pharo-project/pharo/pull/10070 - Keep isQuick checks to the single place it matters #10040 https://github.com/pharo-project/pharo/pull/10040 - Integrate Roassal3 v0.9.9c #10064 https://github.com/pharo-project/pharo/pull/10064 - 9971 cleanup ring deprecate the meta class the non meta class base class #10045 https://github.com/pharo-project/pharo/pull/10045 - Fixed #9964. Refactored the hardcoded Ring method #kindOfSubclass using dispatch and moved it to the superclass #10039 https://github.com/pharo-project/pharo/pull/10039 - Small cleanup of useless pragmas #10047 https://github.com/pharo-project/pharo/pull/10047 Refactoring Engine ================== - Migrated RBRealizeClassRefactoring #10034 https://github.com/pharo-project/pharo/pull/10034 - Migrating RBRemoveHierarchyMethodRefactoring to RBRemoveHierarchyMethâ¦ #10032 https://github.com/pharo-project/pharo/pull/10032 Documentation ============= - Markdown documentation for regex #10049 https://github.com/pharo-project/pharo/pull/10049 - Fix #10029 - ProfStef P9/10 updates #10030 https://github.com/pharo-project/pharo/pull/10030 Pharo9 ====== - P9 backport - Fix #10029 - ProfStef P9/10 updates #10031 https://github.com/pharo-project/pharo/pull/10031

Oct. 1, 2021

Re: in the quest of cutOn:

by Esteban Maringolo

The where is a better suffix than the "on". I'd prefer something like: 'abcDefKjm' splitWhere: [:a | a isUppercase ] -> #('abc' 'Def' 'Kjm') Regards, Esteban A. Maringolo On Wed, Sep 29, 2021 at 1:58 PM stephane ducasse <stephane.ducasse(a)inria.fr> wrote: > > 'abcDefKjlkj' piecesCutWhere:[ :a :b | b isUppercase ] > > > > > On 29 Sep 2021, at 18:55, stephane ducasse <stephane.ducasse(a)inria.fr> wrote: > > > > 'abcDef' splitOn: [ :c | c isUppercase ] > >>>> âabcâ âefâ > > > > but I need > > > > 'abcDef' splitOn: [ :c | c isUppercase ] > >>>> âabcâ âDefâ > > > > :(

Sept. 29, 2021

Re: in the quest of cutOn:

by stephane ducasse

'abcDefKjlkj' piecesCutWhere:[ :a :b | b isUppercase ] > On 29 Sep 2021, at 18:55, stephane ducasse <stephane.ducasse(a)inria.fr> wrote: > > 'abcDef' splitOn: [ :c | c isUppercase ] >>>> âabcâ âefâ > > but I need > > 'abcDef' splitOn: [ :c | c isUppercase ] >>>> âabcâ âDefâ > > :(

Sept. 29, 2021