- Pharo-dev - lists.pharo.org

ANN: pharo bindings for QREncode
by Esteban Lorenzano June 22, 2026

June 22, 2026

Hello, Looking for small examples for (one of) my ESUG talks, I generate bindings forÂ this small tool: https://fukuchi.org/en/works/qrencode/ You can have things like this: https://github.com/pharo-cig/pharo-libqrencode I think it can be pretty useful :) Cheers ! Esteban

1 0

"Claude, My New Pair Programming Partner" â New blog post on all: objects all: theTime
by Koen De Hondt June 7, 2026

June 7, 2026

Dear Pharo users and developers, I posted a first article in a series about using AI in Pharo development. After seeing the world embrace agentic development tools, I decided it was time to look into them and see how they can be used for software development in Pharo. https://all-objects-all-the-time.st/#/blog/posts/24 As always, all feedback is welcome. Happy reading! Ciao, Koen

8 9

"Logging Interactions with the Iris MCP Server" â New blog post on all: objects all: theTime
by Koen De Hondt June 3, 2026

June 3, 2026

Dear Pharo users and developers, I posted the fourth article in a series about using AI in Pharo development. After building the MCP server and pair programming with Claude to write code in a Pharo image, I decided to add logging to the MCP server to keep an eye on what Claude is doing. https://all-objects-all-the-time.st/#/blog/posts/27 As always, all feedback is welcome. Happy reading! Ciao, Koen

1 0

Pre-Pre-Announce: High Performance Parallel Smalltalk Achieved, Seek Donating Subscribers
by John B Thiel June 2, 2026

June 2, 2026

= Pre-Pre-Announce: High Performance Parallel Smalltalk Achieved, Seek Donating Subscribers John B. Thiel 2026-june Contents: ABSTRACT OVERVIEW SEEK DONATING SUBSCRIBERS FOOTNOTE: SPECIAL NOTE TO PROFESSORS / ACADEMICS DISCLAIMER COPYRIGHT == ABSTRACT A High Performance Multi-Core Parallel Smalltalk System is under development and operational. I am seeking donating subscribers to begin support now, to reward my work to date and encourage bringing the system into existence and availability. Subscribers *may* be eligible for early access and news (no guarantees). == OVERVIEW The system expresses a multi-year design effort, has succeeded operational bringup, and feature buildout is proceeding. It has baseline performance comparable to Squeak/Cog, plus near linear Nx speedups across N cores for suitable algorithms. It is a well-grounded design, with reference to standards and theoretical foundations, and selection of high quality substrates. The system has been designed from day 1 for threadsafe, high performance parallelism including such iconic capabilities as efficient Threadsafe #Become, and is true multi-core -- a single process can use all cores. It is an entirely new design and re-imagining of a Smalltalk system. Not VM/Bytecode-based, nor an engine for any existing system. The system transpiles to an intermediate language/substrate, which is itself a powerful dynamic language, and thence to Native Machine Code. It is not Image-based in the classical sense of "snapshot the world". Objects must be manually persisted, and code is maintained in external files. I consider this a preferable model, to leverage the wide array of tools, editors, VCS, etc. The system does have a live running image, and classes, methods and objects can be dynamically loaded, defined and re-defined on-the-fly. As a fundamental design feature, there is a comprehensive portable external object format, capable to store/load most objects and arbitrary complex *graphs of objects*. The overall vision is a SYNTHESIS of two platforms: Smalltalk pure OOP, message-passing, class library and dynamism, coupled with the performance, features, native types and theoretical foundation of the substrate language. By deep design, essentially all native types of the substrate are visible to the Smalltalk layer as Immediates, *including the types the system is built with*. And likewise, all Smalltalk objects are visible and can be messaged from the substrate language, so the entire class library may eventually become available to programmers in the latter. The Smalltalk layer is intended as First Class Citizen, eventually fully self-contained, and programmers will not have to know the intermediate language at all. Knowing it will avail certain additional capabilities like defining new primitives on-the-fly, and fine tuned optimizing. * * * No release-able product is available at this time. There are major components and features remaining to be built, plus porting and development of class libraries. I estimate a timeframe of perhaps a couple years, maybe less, until an experimental release suitable for expert developers. However, the system is running on the bench with already many capabilities, including object model, dispatch, subclassing, core classes, Immediates, method definition, parallel thread fork, etc. There is a 50+ page Design Manual, and several 100s R&D notes. Measured performance: 160M+ sends/sec (peak seen is 210M+ sends/sec) actual dispatched sends (i.e. not inlined) to a standard object instance on the fastest code path (all cache hits) on a 1.6 GHz base i5-8265U (3.9 GHz boost). Optimizations like inlining, no lookup, fast accessors, etc, are designed and can yield even higher effective throughput. Plus the Nx parallel multiplier across N cores. == SEEK DONATING SUBSCRIBERS This system likely cannot be free or open-source, at least initially. It's extremely advanced, solves design challenges that other top minds in computing have not accomplished in 50 years, and has taken years of intensive research, design and development, unfunded, and personally funded and initiated. Prior Smalltalk parallel efforts involve greatly reduced single-core performance (e.g. RoarVM at 22%), or cumbersome multi-process approaches. Whereas this system is running at near 100% baseline on single core (ref. Squeak/Cog), transpiles at a high language level, and ultimately compiles to native machine code. If you are interested in this technology, I request you become a donating subscriber now, to reward my work to date, and encourage and fund bringing the system into existence and availability. I'm inclined to a subscriber model because I want you to have ongoing interest, and I intend that if and when the technology is ready for wider release, first consideration, news and availability will be offered to long-term subscribers in good standing (and you will be expected to continue funding under some subscription license terms and/or royalties) (but no guarantees in any case). You can of course alter or suspend your subscription at any time. Also I welcome and request your funding even if you don't have a personal immediate use for this system, or prefer a 1-time donation for now. A suggested contribution is 1% of your "seat" for individuals, or department headcount or project budget, with any amount appreciated. Please contact me with your contribution schedule and preferred channel, and indicate if you would like news updates. Thank you! I can accept most cryptocoins (preferred), or Paypal, bank wire transfers, mailed paper checks, or set up whatever service like Patreon / Ko-Fi you are familiar with. Note that you are making strictly a donation, gift, research and development grant, regardless of amount. It is not a purchase or investment, and does not entail any rights whatsoever -- not use, access, support or any other return. If you would like to do development work on this system, it's not ready for that, even if you are willing to contribute for free. There may be a tiered model in future with open-source class libraries you could work on. If your organization is interested in special license or acquiring the whole IP outright, it's in the realm of possible. Contact me with offers and inquiries, bearing in mind this is a high ehd design and system, which I believe advances the state-of-art, and there are few or zero precursors or comparable technologies available. A substantial non-refundable payment will be required to even start talking on this level, plus NDAs, so structure any dialog accordingly. Thank you for your consideration, and feel free to forward this message to other potential supporters. This is JBThiel. (Linux '92, and lots else). -- JBThiel jbthiel(a)gmail.com jbthiel(a)pobox.com (Paypal) Cryptocoin addresses avail on request. == FOOTNOTE: SPECIAL NOTE TO PROFESSORS / ACADEMICS If you are in academia, I request you to grant me some graduate degrees from your related programs. My work and this system solves challenges the industry at large has not achieved in 50 years. There are a number of extremely complex issues to making Smalltalk simultaneously multi-core, threadsafe, and high-performance, readily PhD level theses and beyond, and I believe to have identified and solved many or all of them with this design and implementation. For example, the esoteric #Become capability alone is a basket of theses, extremely complex to achieve safely and efficiently under multi-thread, non-stop-the-world conditions. It permeates and induces requirements across the entire system and object model. The ANSI Smalltalk Spec and prior technology does not even contemplate the semantics of such situations, let alone solutions. In this system I have worked out a meaningful semantics and robust, high performance approach to such cases, and others, that does not stop-world. I probably don't have time to write conventional papers for your department and publications. The substantiation of my theses is that no generally viable solutions have been produced by other top researchers and developers in the industry over prior decades, and this technology is now designed, built, and working on my bench. This work may be included by reference. I have a strong academic background, and experienced and expert in computing theory and practice, but don't have any doctorates yet despite completing most of a graduate program, due to the buffets of history and economy, plus the entire graduate institute I attended folded before I finished, and it irks me. I may actually make this a requirement for use by any professors or academics, so saddle your posse and grant me some PhD's or similar credential from your organization (can be honorary). As further incentive, I may offer a free license to your institution, or credits, promotion, or other benefits. Open to your suggestions and collaboration. Thank you for your consideration. -- JBThiel == DISCLAIMER NOTE CAREFULLY: There is no release-able product currently. There may never be. If there is, it may not be released to you, or at a suitable price or terms or capability for your purposes or expectations, regardless of your support or contribution level. The project could be dropped, encounter unsolvable difficulties, be sold to private investors, etc. The foregoing presentation, while believed correct, may contain errors in perspective, design, measurement, etc. You are being asked to support this author, research and development, with voluntary gifts, donations, research grants, with the sole motivation of rewarding efforts to date and encourage bringing the technology into existence, with no specific return to you of any kind. Your contribution is *not an investment, not a purchase*. There is no guarantee, rights, license or expectation of any product, results, profits, usage, news, access, priority, support, or any other return or interest of any kind for yourself, organization, or at large. == COPYRIGHT The foregoing material and announcement is Copyright 2026, JBThiel, all rights reserved, and may not be copied, modified or adapted for any purpose, except to support promotion and funding of this system and author. The mentioned softwares and designs are wholly owned confidential technologies of JBThiel. == END, PRE-PRE-ANNOUNCE

1 0

New VM Release - v12.0.2-beta
by Guille Polito June 2, 2026

June 2, 2026

Hi all, We wanted to share a new VM release, aimed at Pharo 14 images. https://github.com/pharo-project/pharo-vm/releases/tag/v12.0.2-beta Besides many cleanups and small improvements, this enables a soon-to-come stack overflow support. For those interested in more details, I allowed myself to generate a digested changes log with some AI. Those using zeroconf will see this change effective immediately. Launcher users, do not forget to update your VMs. Please consider this is a beta release. Do not hesitate to communicate any issues you may find. Cheers, G Highlights This is a major release featuring: Frame unification and stack management improvements, delivering substantial interpreter and execution engine cleanups. RISC-V JIT support, expanding platform coverage and future-proofing VM development. New memory management capabilities, including direct old-space allocation and numerous GC and allocation improvements. Extensive compiler and Slang/C translation work, with many correctness fixes, new tests, and improved inspection tools. Platform and build modernization, including SDL updates, improved CI, cross-build support, and updated third-party dependencies. Large-scale cleanup and refactoring efforts across the VM, interpreter, Cogit, PICs, and infrastructure. VM Runtime, Interpreter & JIT Frame unification (#602 <https://github.com/pharo-project/pharo-vm/pull/602>) Improvements in stack management (#710 <https://github.com/pharo-project/pharo-vm/pull/710>) Initialize stack pages during simulation (#853 <https://github.com/pharo-project/pharo-vm/pull/853>) Robust cannotInterpret: in the interpreter (#641 <https://github.com/pharo-project/pharo-vm/pull/641>) Simplify stack-to-register mapping API (#627 <https://github.com/pharo-project/pharo-vm/pull/627>) Improve and use unreachable (#630 <https://github.com/pharo-project/pharo-vm/pull/630>) Clean up Interpreter State (#658 <https://github.com/pharo-project/pharo-vm/pull/658>) Void the instructionPointer systematically when creating a base frame (#914 <https://github.com/pharo-project/pharo-vm/pull/914>) Cleanup make base frame when compacting code (#943 <https://github.com/pharo-project/pharo-vm/pull/943>) Fix meta try primitive (#968 <https://github.com/pharo-project/pharo-vm/pull/968>) Feature: thisProcess JIT (#1037 <https://github.com/pharo-project/pharo-vm/pull/1037>) OpenPIC / Megamorphic IC work (#1067 <https://github.com/pharo-project/pharo-vm/pull/1067>) PIC Cleanup (#889 <https://github.com/pharo-project/pharo-vm/pull/889>) Cleanup PIC (#1021 <https://github.com/pharo-project/pharo-vm/pull/1021>) Allow Cogit>>#mnuMethodOrNilFor: to return non-CompiledMethod oops (#936 <https://github.com/pharo-project/pharo-vm/pull/936>) Remove entry alignment (#934 <https://github.com/pharo-project/pharo-vm/pull/934>) Mark debugging overrides in Cogit as #debuggerCompleteToSender (#1035 <https://github.com/pharo-project/pharo-vm/pull/1035>) Memory Management & Garbage Collection Do not unlink all sends on GC (#503 <https://github.com/pharo-project/pharo-vm/pull/503>) Improving perm space P12 (#621 <https://github.com/pharo-project/pharo-vm/pull/621>) Added new primitive for allocating directly in the old space (#701 <https://github.com/pharo-project/pharo-vm/pull/701>) Adding test to test Ephemerons in the Old Space (#702 <https://github.com/pharo-project/pharo-vm/pull/702>) Clean special object array a little (#640 <https://github.com/pharo-project/pharo-vm/pull/640>) Collapse allocation logs (#913 <https://github.com/pharo-project/pharo-vm/pull/913>) Only scan the class table if become: was performed to an active class object (#1023 <https://github.com/pharo-project/pharo-vm/pull/1023>) Set the size of larger indexable objects allocated in young space (#976 <https://github.com/pharo-project/pharo-vm/pull/976>) Fix LargeIntegers segfault on allocation failure (#1040 <https://github.com/pharo-project/pharo-vm/pull/1040>) Compiler, Slang & Code Generation Reject reserved words (#613 <https://github.com/pharo-project/pharo-vm/pull/613>) Rename reserved words: selectors, locals and instance variables (#624 <https://github.com/pharo-project/pharo-vm/pull/624>) Rename conflicting identifiers (#646 <https://github.com/pharo-project/pharo-vm/pull/646>) Validate if locals/args exist when adding a type declaration (#603 <https://github.com/pharo-project/pharo-vm/pull/603>) Check structs' instance variable type declarations (#607 <https://github.com/pharo-project/pharo-vm/pull/607>) Redundant type declaration linter rule (#662 <https://github.com/pharo-project/pharo-vm/pull/662>) Fix cast tests (#660 <https://github.com/pharo-project/pharo-vm/pull/660>) Fix and test inlinings with ifs and right shifts not translated (#667 <https://github.com/pharo-project/pharo-vm/pull/667>) Add tests and fix incorrectly generated inlined C code from CCodeGenerator (#666 <https://github.com/pharo-project/pharo-vm/pull/666>) C AST translation right-side parenthesis in expression (#685 <https://github.com/pharo-project/pharo-vm/pull/685>) Add a palette with the C translation of any inspected C node (#686 <https://github.com/pharo-project/pharo-vm/pull/686>) Add C source code inspection tab for TParseNode (#687 <https://github.com/pharo-project/pharo-vm/pull/687>) Created new package CAST-Tests (#679 <https://github.com/pharo-project/pharo-vm/pull/679>) Better dead code elimination (#915 <https://github.com/pharo-project/pharo-vm/pull/915>) Fix issue #822 <https://github.com/pharo-project/pharo-vm/issues/822>: remove unused argument for functionPointerFor:inClass: (#956 <https://github.com/pharo-project/pharo-vm/pull/956>) Fix CASTParserTests>>#testParseSizeofTypeInt (#965 <https://github.com/pharo-project/pharo-vm/pull/965>) Refactor inlining code and add tests for it (#987 <https://github.com/pharo-project/pharo-vm/pull/987>) Suppress the old inlining implementation (#1000 <https://github.com/pharo-project/pharo-vm/pull/1000>) Fix small bug related to method inlining and comments (#957 <https://github.com/pharo-project/pharo-vm/pull/957>) Remove the idea that we might have a different bytecode set (#927 <https://github.com/pharo-project/pharo-vm/pull/927>) Add a dumb isNotNil implementation (same as notNil) (#890 <https://github.com/pharo-project/pharo-vm/pull/890>) Platform Support & Portability RISC-V JIT Support (#932 <https://github.com/pharo-project/pharo-vm/pull/932>) Initial work on W^X for Linux systems (#905 <https://github.com/pharo-project/pharo-vm/pull/905>) Add Windows support for non-ASCII filenames in basicImageFileExists (#922 <https://github.com/pharo-project/pharo-vm/pull/922>) Fix the Windows build (#938 <https://github.com/pharo-project/pharo-vm/pull/938>) Windows improvements (#1062 <https://github.com/pharo-project/pharo-vm/pull/1062>) Make next non-blocking on Linux (#1065 <https://github.com/pharo-project/pharo-vm/pull/1065>) Support x86_64 musl cross-build smoke testing with QEMU (#1069 <https://github.com/pharo-project/pharo-vm/pull/1069>) Updating versions for OSX (ARM / Intel) (#937 <https://github.com/pharo-project/pharo-vm/pull/937>) Build System, CI & Dependencies Update SDL (#615 <https://github.com/pharo-project/pharo-vm/pull/615>) Remove strange SDL2_copy CMake target (#620 <https://github.com/pharo-project/pharo-vm/pull/620>) Forward VM build parameters from CMake (#654 <https://github.com/pharo-project/pharo-vm/pull/654>) Use Pharo 11 on CI (#669 <https://github.com/pharo-project/pharo-vm/pull/669>) Use Pharo file server @ Inria (#868 <https://github.com/pharo-project/pharo-vm/pull/868>) Extract full semantic version from git (#870 <https://github.com/pharo-project/pharo-vm/pull/870>) Remove old versions of libgit in new builds (#902 <https://github.com/pharo-project/pharo-vm/pull/902>) Update CMake minimal version for recent CMake compatibility (#945 <https://github.com/pharo-project/pharo-vm/pull/945>) Updating LibGit2 build to use new OpenSSL and libssh2 (#1033 <https://github.com/pharo-project/pharo-vm/pull/1033>) SDL2 2.32.6 update for Windows and macOS (#978 <https://github.com/pharo-project/pharo-vm/pull/978>) Fix OBS build (#981 <https://github.com/pharo-project/pharo-vm/pull/981>) Add FEATURE_JIT_SIMD option (#966 <https://github.com/pharo-project/pharo-vm/pull/966>) Fix Linux compilation error (#1053 <https://github.com/pharo-project/pharo-vm/pull/1053>) Plugins, I/O & Networking New file plugin (#1024 <https://github.com/pharo-project/pharo-vm/pull/1024>) Fix missing socket accept on Pharo 12 (#1005 <https://github.com/pharo-project/pharo-vm/pull/1005>) Move warnings to debug when loading plugins (#675 <https://github.com/pharo-project/pharo-vm/pull/675>) Testing & Simulation Small stack interpreter tests (#690 <https://github.com/pharo-project/pharo-vm/pull/690>) Simulator fixes (#1025 <https://github.com/pharo-project/pharo-vm/pull/1025>) Fix VM tests: specialObjectsArrayAddress (#1056 <https://github.com/pharo-project/pharo-vm/pull/1056>) Fix broken GC tests (#917 <https://github.com/pharo-project/pharo-vm/pull/917>) Fix some Slang tests (#891 <https://github.com/pharo-project/pharo-vm/pull/891>) Redo ML localization test fixes (#1064 <https://github.com/pharo-project/pharo-vm/pull/1064>) Bug Fixes Resolved UUID primitive bug (#610 <https://github.com/pharo-project/pharo-vm/pull/610>) Make instantiateClass more robust when format is missing (#629 <https://github.com/pharo-project/pharo-vm/pull/629>) Revert #629 <https://github.com/pharo-project/pharo-vm/pull/629> (#631 <https://github.com/pharo-project/pharo-vm/pull/631>) Revert the revert and restore primitive failure handling (#634 <https://github.com/pharo-project/pharo-vm/pull/634>) Add getClass for Pharo 12 compatibility (#651 <https://github.com/pharo-project/pharo-vm/pull/651>) Fix warning absolute value (#782 <https://github.com/pharo-project/pharo-vm/pull/782>) Fix load 32 bits (#920 <https://github.com/pharo-project/pharo-vm/pull/920>) Fix headerAt:put: (#919 <https://github.com/pharo-project/pharo-vm/pull/919>) Fix sign coercion warnings (#950 <https://github.com/pharo-project/pharo-vm/pull/950>) Fix int boxing/loading (#1066 <https://github.com/pharo-project/pharo-vm/pull/1066>) VM version primitive (#1050 <https://github.com/pharo-project/pharo-vm/pull/1050>) Profile data extraction from PIC cache tags (#969 <https://github.com/pharo-project/pharo-vm/pull/969>) Refactoring, Cleanup & Maintenance Added comments and renamed methods during dojo (#623 <https://github.com/pharo-project/pharo-vm/pull/623>) Fixing categorization P12 (#626 <https://github.com/pharo-project/pharo-vm/pull/626>) Updating P12 with changes from P10 branch (#733 <https://github.com/pharo-project/pharo-vm/pull/733>) Forward porting P10 â P12 (#851 <https://github.com/pharo-project/pharo-vm/pull/851>) Forward port 10 â 12 (#893 <https://github.com/pharo-project/pharo-vm/pull/893>) Forward port 10.3.3 â Pharo 12 (#903 <https://github.com/pharo-project/pharo-vm/pull/903>) Realign P12 branch to P10 (#1057 <https://github.com/pharo-project/pharo-vm/pull/1057>) Removing duplicated code (#857 <https://github.com/pharo-project/pharo-vm/pull/857>) Cleanups and improvements (#871 <https://github.com/pharo-project/pharo-vm/pull/871>) Lots of cleanups (#874 <https://github.com/pharo-project/pharo-vm/pull/874>) Cleaning (#881 <https://github.com/pharo-project/pharo-vm/pull/881>) Cleanup dead code (#961 <https://github.com/pharo-project/pharo-vm/pull/961>) Cleanup warnings (#906 <https://github.com/pharo-project/pharo-vm/pull/906>) Fix warnings (#1034 <https://github.com/pharo-project/pharo-vm/pull/1034>) Remove debugging code (#911 <https://github.com/pharo-project/pharo-vm/pull/911>) Remove unused variables (#930 <https://github.com/pharo-project/pharo-vm/pull/930>) Normalize variable (#897 <https://github.com/pharo-project/pharo-vm/pull/897>) Remove gcMode because getGCMode is used (#963 <https://github.com/pharo-project/pharo-vm/pull/963>) Remove ceShortCutTraceStore: and simulation guard users (#960 <https://github.com/pharo-project/pharo-vm/pull/960>) Simplify signal handler space calculation using POSIX SIGSTKSZ (#910 <https://github.com/pharo-project/pharo-vm/pull/910>) Documentation & Developer Experience README: Developer documentation is not a link (#637 <https://github.com/pharo-project/pharo-vm/pull/637>) Update README (#878 <https://github.com/pharo-project/pharo-vm/pull/878>) Add default values to --help parameters (#872 <https://github.com/pharo-project/pharo-vm/pull/872>) Fix typos in comments (#958 <https://github.com/pharo-project/pharo-vm/pull/958>) New Contributors @Mathilde411 <https://github.com/Mathilde411> @LucFabresse <https://github.com/LucFabresse> @ivojawer <https://github.com/ivojawer> @Gabriel-Darbord <https://github.com/Gabriel-Darbord> @iglosiggio <https://github.com/iglosiggio> @rolandbernard <https://github.com/rolandbernard> @fouziray <https://github.com/fouziray> @kilian-kier <https://github.com/kilian-kier> @NathanMalenge <https://github.com/NathanMalenge> @FedeLoch <https://github.com/FedeLoch> @Ducasse <https://github.com/Ducasse> @takano32 <https://github.com/takano32>

1 0

"My First Pair Programming Session with Claude in Pharo" â New blog post on all: objects all: theTime
by Koen De Hondt May 29, 2026

May 29, 2026

Dear Pharo users and developers, I posted the third article in a series about using AI in Pharo development. After building the MCP server together, it was time to pair program with Claude to write some code in a Pharo image. In the new post, I share my experience of working with Claude and how it has impacted my development process. https://all-objects-all-the-time.st/#/blog/posts/26 As always, all feedback is welcome. Happy reading! Ciao, Koen

3 2

Pharo-LLM in Pharo-Launcher
by omar abedelkader May 28, 2026

May 28, 2026

Hello everyone, You can now officially download the development version of Pharo-LLM, which currently includes ChatPharo, directly from Pharo Launcher. In the future, Pharo-LLM will also include additional tools that you will be able to use within an already built-in Pharo image. ï¿¼ Enjoy :) â Omar AbedelKader https://github.com/pharo-llm

1 0

"Building an MCP Server with Claude" â New blog post on all: objects all: theTime
by Koen De Hondt May 20, 2026

May 20, 2026

Dear Pharo users and developers, I posted the second article in a series about using AI in Pharo development. This article is a transcript of a large part of a pair programming session with Claude to build an MCP server for Pharo, called Iris. The transcript is very long. If it is too long, jump to the end of the article to read lessons learned and find links to the Iris project page and the code. https://all-objects-all-the-time.st/#/blog/posts/25 As always, all feedback is welcome. Happy reading! Ciao, Koen

1 0

need early testers for micro python 3 for freed
by Aaron Wohl May 19, 2026

May 19, 2026

I (pronounced claude.ai) have been working on a port of the current micropython to FreeDOS. It is fairly complete but untested by users. Manuals: https://avwohl.github.io/freedos_micro_python/ Sources: https://github.com/avwohl/freedos_micro_python To extend the tests, I implemented wget, scp, and sftp, which are working. It is supposed to work with mTCP and any NIC, but I have only tested NE2000 There was some recent talk about a good language for FreeDOS. This doesn't have an IDE. But it does have a modern higher network stack (SSH, SSL, HTTPS).

1 0

Fwd: claude.ai code review of pharo-v
by Aaron Wohl May 16, 2026

May 16, 2026

I regularly have Claude.AI review my code https://awohl.com, I pointed Claude at the Pharo-VM to see what it could see. A lot of the issues it found are things like strcpy without bounds checks with strings no one would ever make that big. However, it found some issues that are always triggered. Full list of issues https://github.com/avwohl/iospharo/blob/main/docs/pharo-vm-code-reivew-2026… I did not make an AI-generated patch list. stephane.ducasse(a)free.fr mentioned copyright concerns by guillermo.polito(a)inria.fr of accepting AI code. I assume this is due to the inability to copyright AI-generated work and to AI's tendency to steal others' work and lie about its origins. However, a lot of the fixes are so trivial, like off-by-one errors, that I don't know how much of an issue it is. If you want me to PR fixes and or tests that trigger for the full list, or always list, let me know. Many of the issues would only happen if someone were trying to break things (MAXLEN symlinks, damaged image files). If one were a mindset, it could be called AI slop. However, here is a short list of things that always cause issues in everyday operation: for example, every plugin loaded damages heap memory, or the nightly build of signed code disables SSL checks, so a simple DNS hack could get malicious code signed. Source: ~/pharo.md (review of /Users/wohl/esrc/pharo-vm @ pharo-10, 2026-05-11) Filter: only items that fire in normal benign operation, not edge cases requiring huge/crafted strings or attacker-chosen sizes. ================================================================ A. ALWAYS â MEMORY DAMAGE / UNDEFINED BEHAVIOR ================================================================ 1. sqNamedPrims.c:56-57 â calloc(sizeof(ModuleEntry)+strlen(name)) then strcpy writes strlen+1; 1-byte heap overflow on every plugin load. [#3.26] 2. ffi/callbacks/callbacks.c:14-32 â stack-allocated CallbackInvocation registered in runner->callbackStack/global queue; sig_longjmp exit leaves dangling stack pointer after every same-thread callback. [#2.8] 3. ffi/typesPrimitives.c:174-188 â setHandler(receiver, structType) stores pointer before failed()/ffi_get_struct_offsets checks; any error path frees memory while receiver still holds the dangling handle. [#2.6] 4. threadSafeQueue.c:113-137 â queue->first and node->element read outside the mutex; lock-holder's free(node) leaves the other consumer walking freed memory on every concurrent dequeue (hit by every FFI workload). [#3.21] 5. SocketPluginImpl.c:1109-1123 â sqSocketDestroy frees PSP(s) after sqSocketAbortConnection queues a closeHandler against pss; AIO dispatch fires on freed memory. [#3.22] 6. ffi/utils.c:43-50 â readString returns an un-pinned image-memory pointer; GC between strlen() and the caller's strcpy invalidates the length and the address. [#5.27] 7. ffi/callbacks/callbacks.c:24-29 â runner->callbackStack chain updated without any lock; reentrant callbacks from multiple threads on the same Runner corrupt the linked list. [#5.4] 8. pathUtilities.c:233-237 â strrchr(name,'.') result stored in fileExtension, but the NULL guard tests the unrelated `extension` variable; strcmp(NULL,...) crashes on any directory entry without a dot (e.g. "Makefile"). [#4.2] 9. pathUtilities.c:163 â first[strlen(first)-1] reads first[-1] (one byte before the buffer) whenever first is "", reachable from parameters.c:210-212 fallback. [#4.3] 10. externalPrimitives.c:57,66 â module path assembled in a file-static moduleNameBuffer with no lock; concurrent loads scribble each other's path and dlopen/LoadLibrary sees a torn string. [#5.3] 11. debugUnix.c:88-95,122-162 â SIGSEGV/SIGBUS/SIGFPE handler calls fopen/vfprintf/backtrace_symbols_fd/ctime_r/semaphore_wait (none async-signal-safe) and uses SA_NODEFER so the handler can re-enter itself on every crash. [#5.1] 12. debugUnix.c:123,144,154 â sigaction.sa_mask never initialized via sigemptyset for term_handler_action and sigpipe_handler_action; kernel reads uninitialized stack to decide what to mask on every install. [#5.2] 13. debug.c:57-66 â glibc strerror_r returns a pointer that may not write to the supplied buffer; caller prints the buffer unconditionally, leaking uninitialized stack bytes on every error path. [#5.7] 14. SocketPluginImpl.c:2494-2496 â sqSocket lastError stored in a file-static, clobbered across sockets; every concurrent socket failure overwrites another socket's error state. [#5.17] 15. aioWin.c:457/465 â heap-interior alias into allHandles transiently equals a freshly malloc'd region; any early return between the two assignments leaves a free-of-interior or double-use hazard. [#1/Â§9 PARTIAL] ================================================================ B. ALWAYS â SECURITY / CORRECTNESS (NOT MEMORY DAMAGE) ================================================================ TLS / SqueakSSL --------------- 1. sqUnixSSL.c:89-143 â SSL_CTX_set_verify never called; SSL_get_verify_result returns X509_V_OK by default â no certificate validation on any TLS connection. [#2.9] 2. sqUnixSSL.c:102-107 â SSLv23_method with only SSLv2/v3 disabled; TLS 1.0 and 1.1 still accepted on every handshake. [#2.9 / #6.3] 3. sqUnixSSL.c:115 â cipher list "!ADH:HIGH:MEDIUM:@STRENGTH" permits MEDIUM ciphers. [#2.9] 4. sqUnixSSL.c:107 â no SSL_OP_NO_COMPRESSION (CRIME), no SSL_OP_NO_RENEGOTIATION, no SSL_OP_CIPHER_SERVER_PREFERENCE. [#6.3] 5. sqWin32SSL.c:269-275,215,349-353 â sqExtractPeerName copies serverName verbatim into peerName instead of extracting the cert subject; epp.pwszServerName=NULL disables SChannel's hostname check, so image-side peerName==serverName is meaningless on every connection. [#3.19] 6. sqMacSSL.c:154-201,262-272,363-383 â kSSLSessionOptionBreakOnServerAuth disables auto verification; manual SecTrustEvaluate runs with no SSL policy carrying the hostname, so hostname is never checked. [#3.20] 7. sqWin32SSL.c:216-218 â SP_PROT_TLS1_0/1_1/1_2 enabled for both client and server roles. [#6.1] 8. sqMacSSL.c:154-164 â SSLSetProtocolVersionMin(ctx, kTLSProtocol1) sets minimum to TLS 1.0. [#6.2] VM internals ------------ 9. memoryUnix.c:66-89,109-111 â JIT pages mmap'd PROT_READ|PROT_WRITE|PROT_EXEC permanently; sqMakeMemoryExecutableFromTo / NotExecutable hooks are commented out, so W^X is defeated on Linux/FreeBSD. [#5.24] 10. debug.c:45 â error(char*) forwards the argument as the format string into the vfprintf-style logger; exported API contract leaks a %n/%s primitive to any future caller-controlled string. [#4.10] 11. ffi/typesPrimitives.c:170-172 â getHandler() returns the first slot of any oop with no class tag check; libffi consumes attacker-shaped ffi_type fields on every struct cif build, giving a controlled-dispatch primitive to anyone who can register an FFI struct. [#2.5] Build / supply chain (every build / every CI run) ------------------------------------------------- 12. Jenkinsfile:84,249 â fetch-and-execute installer via `wget â¦ | bash` over plain HTTP. [#7] 13. scripts/runTests.sh:31 â `wget -O - https://get.pharo.org/64/80 | bash`, executed from PR workflows. [#7] 14. scripts/installCygwin.ps1:7-9 â Cygwin installer + mirror retrieved over plain HTTP. [#7] 15. cmake/importLibFFI.cmake / importLibGit2.cmake / importSDL2.cmake â dependencies pinned to mutable git tags, no commit-SHA. [#7] 16. macros.cmake:69-103 + every cmake/import*.cmake using files.pharo.org â DownloadProject calls omit URL_HASH for libgit2, libssh2, openssl, zlib, SDL2, cairo, pixman, libpng, freetype, fontconfig, harfbuzz, gcc-runtime. [#7] 17. cmake/importFreetype2.cmake:47-49 â direct savannah.gnu.org download with no URL_HASH. [#7] 18. docker/ubuntu-arm64/Dockerfile, docker/debian10-armv7/Dockerfile â base images unpinned (no @sha256 digest). [#7] 19. Jenkinsfile:97-403 â every upload uses `scp -o StrictHostKeyChecking=no` against files.pharo.org. [#7] 20. Jenkinsfile:138 + cmake/sign.cmake:8-11 â SIGN_CERT_PASSWORD passed through environment under a broad withCredentials() block. [#7] 21. .github/workflows/continuous-integration-workflow.yaml:2 â `on: [push, pull_request]` with no `permissions:` block; fork PRs can edit runTests.sh and execute with the workflow GITHUB_TOKEN scope. [#7] 22. .github/workflows/...:11,14,68 â EOL runners (ubuntu-18.04, windows-2016) and EOL actions (checkout@v1, upload-artifact@v1). [#7] 23. cmake/packaging.cmake:92 â CPACK_PACKAGE_CHECKSUM "SHA1". [#7] 24. scripts/installCygwin.ps1:35-48 â `cygwin -q` suppresses signature warnings during install. [#7] 25. CMakeLists.txt:206,266-296 + cmake/Linux.cmake:1 â no -D_FORTIFY_SOURCE=2, no -fstack-protector-strong, no -fPIE/-pie, no -Wformat-security, no -Wl,-z,relro / -z,now / -z,noexecstack on Linux release builds. [#7] 26. CMakeLists.txt:206,266-296 â -Wno-int-conversion and -Wno-pointer-sign actively silenced; both classes of warning catch real bugs. [#7] 27. cmake/Linux.cmake:1 â Linux rpath set to "." (relative to CWD) instead of "$ORIGIN". [#7] 28. CMakeLists.txt:206 â Windows/Cygwin builds lack /GS, /guard:cf, /DYNAMICBASE, /NXCOMPAT. [#7]

5 8