- Pharo-dev - lists.pharo.org

This week (40/2022) on the Pharo Issue Tracker

by Marcus Denker

We merged 16 PRs this week: Fixes ===== - 11671-MetaLinks-on-methods-with-no-return-statement-implicit-self-are-called-twice #11759 https://github.com/pharo-project/pharo/pull/11759 - Fix "undo" operation erroneously removing the dirty flag when undo operation performed after saving #11655 https://github.com/pharo-project/pharo/pull/11655 - fix 11709: DTRFTPlugin class missing even though #11513 was merged #11736 https://github.com/pharo-project/pharo/pull/11736 - Remove unused refactor #11738 https://github.com/pharo-project/pharo/pull/11738 - Fix RefactoringChangeTests on fluid #11741 https://github.com/pharo-project/pharo/pull/11741 - Class definition popup uses the default class syntax (fluid with the new default) #11737 https://github.com/pharo-project/pharo/pull/11737 - Debugger selection messed up when using breakpoints in a block #11733 #11734 https://github.com/pharo-project/pharo/pull/11734 Features ======== - Add a browser tool to see package dependencies #11700 https://github.com/pharo-project/pharo/pull/11700 Speed ===== - Removing the reification of TFSameThreadCall #11739 https://github.com/pharo-project/pharo/pull/11739 Documentation ============= - Add executable comments on Collection for do: and stream related #11699 https://github.com/pharo-project/pharo/pull/11699 Cleanups ======== - Improve compiler plugin implementation for P11 #11761 https://github.com/pharo-project/pharo/pull/11761 - Rename AddClass refactoring/transformation to InsertClass and cleanup #11757 https://github.com/pharo-project/pharo/pull/11757 - 11753-Enhance-Breakpoint-API-with-enabled-method #11758 https://github.com/pharo-project/pharo/pull/11758 - Move nameToDisplay from Refactoring-Changes to Ring-Definitions-Core #11751 https://github.com/pharo-project/pharo/pull/11751 - Replace nested conditions with guard close #11754 https://github.com/pharo-project/pharo/pull/11754 - Refactoring engine small cleanup #11746 https://github.com/pharo-project/pharo/pull/11746

Oct. 10, 2022

Sponsoring our new mooc

by stephane ducasse

Since more than a year we have been working on a new mooc called: âAdvanced Object-oriented Design and Developmentâ It will be quite good. We are bullet proofing it with a new lecture here at Lille. It will not focus on Pharo but on object-oriented design, tests, design patterns. It will present - Test and test-driven - Essential aspects of OOP - Basic and universal principles - Double dispatch - Case studies in Pharo - Some design patterns - Some coding idioms and we will composed of 8 modules Currently it has around 50 lectures and we expect around 60 + exercises. You can access some drafts of the support here: https://rmod-files.lille.inria.fr/?dir=DesignCoffeeClub <https://rmod-files.lille.inria.fr/?dir=DesignCoffeeClub> The production cost of this mooc is around 200 K Euros financed by Inria and it will be filmed in January. We hope to deploy it in April or May 2023. The mooc will be produced in english (and may be dub in french). It occurred to me in this difficult time to find good developers that some of you may want to sponsor this mooc\to get exposure. You can be associated with some of the best OO teachers: me, Guillermo Polito and Pablo Tesone. We have cumulated more than 40 years of teaching experience. Several books... Yes at the end of the day we should sale a bit our expertise - check below our track record with the previous mooc. As a sponsor you will get your logo and links on all the supports: Slides and videos. Note that this mooc is designated to have a live time of 10 years or more. It is teaching fundamental points of OOP. So this is a unique opportunity to market your company to people wanted to learn advanced OOP Note that there are no other lectures like this one. We have two levels of sponsoring: 2000 Euros for platinum sponsor 1000 Euros for plain sponsor Let us know. Just a little reminder of the previous Mooc on Pharo. It has more than 8 years. For the record, some youtube videos (that we published after 4 years of running the pharo mooc) got more than 6000 views and this is by developers. We got around 10000 followers not counting the people watching the mooc on youtube and here are some of the testimonies we collected over the years. J'ai trouvÃ© Ã§a trÃ¨s intÃ©ressant, beaucoup plus que prÃ©vu ! je regrette de ne pas m'y Ãªtre mis plus tÃ´t. J'ai enfin l'impression de vraiment faire de la POO ! Ou Ã l'inverse je me rend que je n'en faisais pas vraiment... - Anonymous, 2019 I have just completed week seven of the Pharo Mooc (beginner and object oriented tracks) I am starting a redo of the Mooc with the web track (TinyBlog project). I have already learned so much ! I have spent the last 20 years or so in software development and, following this Mooc, I realized I hadnât really grasped the essence of object oriented design. - Anonymous Â« Really one of the best mooc I have ever attended. And I have attended quite a few (openSAP, openHPI). As an old fashioned ABAP developer I want to be reborn as Pharo developer in my next life :-) Â» - Anonymous Hi! I finished the MOOC some weeks ago and I would like to congratulate everybody involved! After a decade+ of Python programming I think I found my new favorite language :). I'm making a small Teapot server for Slack command bots, I'm goona push it to Github (yay Iceberg), if anyone is interested. - EduardoPadoan I just completed the @pharoproject Mooc the best investment I have ever made of my time. MAQBOOL Hey all - I've just finished the Mooc - thanks for an excellent course and a thouroughly interesting look at a new way to program :smile: Looking forward to starting to play with Pharo on some upcoming ideas I've had. - Tieryn As much as I thought I understand object-orientation, it is very clear NOW that without a truly useable Smalltalk, which Pharo is, it is impossible to really understand and exercise object-orientation. Thank you all soooo much. - Mike D. 06/12/2020 I finished the Pharo MOOC a few days ago. Thank you very much to Damien, Stephane, and Luc for their work on the material! I enjoyed it very much - Anonymous Hey all - I've just finished the Mooc - thanks for an excellent course and a thouroughly interesting look at a new way to program :smile: Looking forward to starting to play with Pharo on some upcoming ideas I've had ð3 - Anonymous I already had previous Smalltalk experience, but yes, I'm extremely happy Chapter 7 has been extremely fulfilling - Anonymous A general comment I wanted to make is that the MOOC so far has been great. Impressed with the quality and content, and grateful that it is available and free. Many thanks! - Aryeh IMHO the videos were very well done. I would even say shockingly well doneâ¦ for a bunch of programmers who are supposed to be clueless about design - SeanDeNigris - 10/26/2017 The more I learning about @pharoproject the more I appreciate it's beauty and simplicity, finally, object-oriented programming is done right - MAQBOOL Mooc absolument remarquable. Superbe voyage autour de Pharo. Le paradigme objet qui (re)prend enfin du sens ! - Anonymous - 01/03/2019

Oct. 5, 2022

Re: Recommendation for password encryption?

by sean＠clipperadams.com

Chris Muller wrote: > Ron Teitelbaum made a clever solution to resisting memory-scanning attacks Wow, that sounds really interesting! Probably overkill for my current use case, but happy to know thatâs available in case I ever need it. Thanks for the tip :)

Sept. 30, 2022

This week (39/2022) on the Pharo Issue Tracker

by Marcus Denker

This week (39/2022) on the Pharo Issue Tracker This week we merged 13 PRs: Fixes ===== Fixing ProfilerUI issues #11732 https://github.com/pharo-project/pharo/pull/11732 Prevent BlockClosure>>benchFor: to loop infinitely #11698 https://github.com/pharo-project/pharo/pull/11698 Integrate Roassal3 v0.9.9j #11728 https://github.com/pharo-project/pharo/pull/11728 Make title bar layout dependent on new settings option and OS #11719 https://github.com/pharo-project/pharo/pull/11719 11720-Improve-ReUtilityMethodsRule #11722 https://github.com/pharo-project/pharo/pull/11722 Upgrading the version of libgit2-bindings. #1616 https://github.com/pharo-vcs/iceberg/pull/1616 <https://github.com/pharo-vcs/iceberg/pull/1616> Speed ===== 11725-Startup-Slow-in-OSX-previous-to-Monterrey #11726 https://github.com/pharo-project/pharo/pull/11726 Faster Array>>asX and Array>>as: #11716 https://github.com/pharo-project/pharo/pull/11716 Features ======== Add Point>>#isInRectangle #11721 https://github.com/pharo-project/pharo/pull/11721 allow to specify accept callback on an option list #1315 https://github.com/pharo-spec/Spec/pull/1315 Cleanup ======= - Moving Deferred messages to instance side #11714 https://github.com/pharo-project/pharo/pull/11714 - 11631-Clarify-if-TViewModelMock3-is-in-correct-package #11690 https://github.com/pharo-project/pharo/pull/11690 Pharo10 ======= Pharo10: Bug fix + code cleanup for issue #11705: Error: Instances of RBProtocolEnvironment are not indexable #11706 https://github.com/pharo-project/pharo/pull/11706

Sept. 30, 2022

This week (38/2022) on the Pharo Issue Tracker

by Marcus Denker

We merged 13 PRs and closed 12 issues this week: There are many more PRs ready in need of a rieview: https://github.com/pharo-project/pharo/pulls Fixes ===== - Pharo11: Bug fix + code cleanup for issue #11705: Error: Instances of RBProtocolEnvironment are not indexable #11708 https://github.com/pharo-project/pharo/pull/11708 - Fix for segmentation fault issue on new Pharo 11 image #11715 https://github.com/pharo-project/pharo/pull/11715 - Integrate Roassal3 v0.9.9i2 #11711 https://github.com/pharo-project/pharo/pull/11711 https://github.com/pharo-project/pharo/pull/11704 - clean String reading from FFI to return bytes to allow decoding with any decoder. #11668 https://github.com/pharo-project/pharo/pull/11668 - DrTest see extension classes #11689 https://github.com/pharo-project/pharo/pull/11689 - fix testIconProvider #1314 https://github.com/pharo-spec/Spec/pull/1314 - Adds a setting to change the default playground cache directory. #419 https://github.com/pharo-spec/NewTools/pull/419 - [Debugger] Improving skipUpTo stability + reintegration in the advanced debugging tools #415 https://github.com/pharo-spec/NewTools/pull/415 Cleanups ======== - 11613-Review-RBLiteralNode-classvalue #11701 https://github.com/pharo-project/pharo/pull/11701 - 4995-Epicea-fix-EpApplyPreviewerTesttestTraitModification #11691 https://github.com/pharo-project/pharo/pull/11691 - deprecate taskbarIcon and systemIcon #11695 https://github.com/pharo-project/pharo/pull/11695 Websites ======== - Fixed SSL problems with https://consortium.pharo.org

Sept. 23, 2022

Re: Recommendation for password encryption?

by Chris Muller

Ron Teitelbaum made a clever solution to resisting memory-scanning attacks when using private keys in an image. Upon asking KeyHolder holdKey: yourPrivateKey, it forks off a while loop which generates a random sequence of bytes (ByteArray) to encrypt yourPrivateKey with it. It then delays 100ms, decrypts the key and immediately re-encrypts it with a new set of random bytes (two new memory locations), and wiping the old random and old key ByteArray's. Repeat. The result: a memory-scanner attack needs to find both pieces of information (the random number and the encrypted key) in the image memory within 100ms. Obviously this consumes some processing power and garbage collection, but it's not noticeable. On shutdown, all instances are automatically wiped, saved images are clean of private keys. It's part of the CryptographyCore package on SqueakSource. http://www.squeaksource.com/Cryptography/CryptographyCore-cmm.9.mcz On Tue, Sep 20, 2022 at 9:59 AM <sean(a)clipperadams.com> wrote: > I feel compelled to revive this old (almost 10 years!) thread because Iâm > faced with a similar problem and certain points seem unresolved. > > Assuming that one needs the actual password in the image (in my case to > authenticate via IMAP), Norbertâs suggestion to have a helper app that runs > with elevated privileges makes sense, but Iâm wondering about a few other > comments: > > - > > Sven mentioned that itâs common to have sensitive info âlying aroundâ > on the filesystem, with .ssh being an example. However, my (non-expert) > understanding is that the best practice to add a passphrase to oneâs > private key protects against just such situations as we consider here, no? > - > > There seems to be a hard distinction drawn between memory and disk > storage. However, this being Smalltalk, this seems only to be the case if > the image is guaranteed never to be saved, otherwise its memory, including > any plaintext sensitive information, would end up on disk. > > As I was thinking through my use case, I was considering, for example, > storing the password in a non-string collection e.g. ByteArray, so that I > could use the password and zero it out in memory right afterward. >

Sept. 20, 2022

Re: Recommendation for password encryption?

by Esteban Maringolo

If you use OpenSSL (or any other crypto library) they provide secure memory allocation that can be used to store sensitive data such as keys, initialization vectors, etc. You can even encrypt the data stored there. Once freed, that allocation wipes the memory used. Of course there would still be the case of the String/ByteArray in the image or in method contexts when passed as arguments, for that there isn't much to do except if you pass that "allocation object" as parameter and convert it right to a String at the moment of using it, or better, map it and pass it to another FFI call. Also there is the risk of stack traces leaking sensitive information. It would be convenient to have a "SecureString" that is never dumped (and also has its secure allocation outside of the heap). Depending on where you run your software, having a password in the heap that is read from a file with the right permissions is all you need. I never needed to do any of the above, but I know some people that do, especially for desktop apps. YMMV. Best regards! Esteban A. Maringolo On Tue, Sep 20, 2022 at 11:59 AM <sean(a)clipperadams.com> wrote: > > I feel compelled to revive this old (almost 10 years!) thread because Iâm faced with a similar problem and certain points seem unresolved. > > Assuming that one needs the actual password in the image (in my case to authenticate via IMAP), Norbertâs suggestion to have a helper app that runs with elevated privileges makes sense, but Iâm wondering about a few other comments: > > Sven mentioned that itâs common to have sensitive info âlying aroundâ on the filesystem, with .ssh being an example. However, my (non-expert) understanding is that the best practice to add a passphrase to oneâs private key protects against just such situations as we consider here, no? > > There seems to be a hard distinction drawn between memory and disk storage. However, this being Smalltalk, this seems only to be the case if the image is guaranteed never to be saved, otherwise its memory, including any plaintext sensitive information, would end up on disk. > > As I was thinking through my use case, I was considering, for example, storing the password in a non-string collection e.g. ByteArray, so that I could use the password and zero it out in memory right afterward.

Sept. 20, 2022

Re: Recommendation for password encryption?

by sean＠clipperadams.com

I feel compelled to revive this old (almost 10 years!) thread because Iâm faced with a similar problem and certain points seem unresolved. Assuming that one needs the actual password in the image (in my case to authenticate via IMAP), Norbertâs suggestion to have a helper app that runs with elevated privileges makes sense, but Iâm wondering about a few other comments: * Sven mentioned that itâs common to have sensitive info âlying aroundâ on the filesystem, with .ssh being an example. However, my (non-expert) understanding is that the best practice to add a passphrase to oneâs private key protects against just such situations as we consider here, no? * There seems to be a hard distinction drawn between memory and disk storage. However, this being Smalltalk, this seems only to be the case if the image is guaranteed never to be saved, otherwise its memory, including any plaintext sensitive information, would end up on disk. As I was thinking through my use case, I was considering, for example, storing the password in a non-string collection e.g. ByteArray, so that I could use the password and zero it out in memory right afterward.

Sept. 20, 2022

Weekly "what happend on the issue tracker" archive

by Marcus Denker

Hi, I am now archiving the weekly mails here: https://github.com/pharo-project/pharo-changelogs/tree/master/weekly/2022 (I will try to add the older ones slowly) We try to update the Release Changelog from the weekly all couple of weeks (just recording the important changes). This is now taking into account the weekly till 29/2022: https://github.com/pharo-project/pharo-changelogs/blob/master/Pharo110Chang…

Sept. 16, 2022

This week (37/2022) on the Pharo Issue Tracker

by Marcus Denker

Even though the CI setup could not check Pull Requests for some days (fixed), we merged 18 PRs this week: Features ======== - Creating a user interface for Time Profiler and Andreas Profiler #11673 https://github.com/pharo-project/pharo/pull/11673 - FileBrowser loadable again: P10+ updates, multiple fixes #409 https://github.com/pharo-spec/NewTools/pull/409 Fixes ===== - Improve FileReference>>= #11663 https://github.com/pharo-project/pharo/pull/11663 - Enabling formating of uncompiled method #11672 https://github.com/pharo-project/pharo/pull/11672 - Fix case insensitive auto-completion setting #11564 https://github.com/pharo-project/pharo/pull/11564 - SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR=0 on Linux #11664 https://github.com/pharo-project/pharo/pull/11664 - Reduce false positives of some general rules #11682 https://github.com/pharo-project/pharo/pull/11682 - Git: Make remote comparison work better between remotes with different urls https://github.com/pharo-vcs/iceberg/pulse - 97-Inspector-Meta-tab-Browse-on-class-opens-UndefinedObject #416 https://github.com/pharo-spec/NewTools/pull/416 Cleanup ======= - unify-category-Context #11686 https://github.com/pharo-project/pharo/pull/11686 - Corrected spelling per Issue #11674 #11675 https://github.com/pharo-project/pharo/pull/11675 - Cleaning CharacterSet class >> #allCharacters #11662 https://github.com/pharo-project/pharo/pull/11662 - Deprecated method Character class >> #allCharacters and replaced its references #11660 https://github.com/pharo-project/pharo/pull/11660 - Clean ast core #11681 https://github.com/pharo-project/pharo/pull/11681 Comments ======== - Expand Heap, Interval, LinkedList class comments #11667 https://github.com/pharo-project/pharo/pull/11667 - Adds executable comments to False and True classes #11666 https://github.com/pharo-project/pharo/pull/11666 Pharo 10 ======= - Revert "Creates Graphical UI for AndreasProfiler and TimeProfiler" #11676 https://github.com/pharo-project/pharo/pull/11676

Sept. 16, 2022