- Pharo-dev - lists.pharo.org

[Pharo-project] [update 1.3] #13296

by Marcus Denker

13296 ----- Issue 4596: WeakOrderedColllection array is replaced by an Array instead of a WeakArray (Part3) - put back #grow and #growSize -- Marcus Denker -- http://marcusdenker.de

Aug. 8, 2011

Re: [Pharo-project] Web app security

by laurent laffont

It is done like that. There's a setting (open setting browser, small harbour group) to tell which VM to start for SmallHarbour itself and which VM to run hosted image. Default is to use the same VM, but for public server we want to run another one. Laurent. On Mon, Aug 8, 2011 at 4:45 PM, Torsten Bergmann <astares(a)gmx.de> wrote: > >What we are currently doing: > >- integrate some vm patches (thanks Mariano :) from netstyle / seaside > >hosting which limit file system / socket access > > Yes seasidehosting.st is running a modified VM to provide > a more sandbox like environment. > > But one problem of port limitation is that it is not possible to > send mails from the seasidehosting app (for instance for a registration > step). That's OK since the hosting is free and it could be abused > to send spam - but if you want to form a new Smalltalk based business > and create a seaside app using SmallHarbour this may be something you > will not miss in your shiny new online application. > > Maybe there could be two versions of SmallHarbour - an edition > with limited rights for all and one with more rights for people/developers > the community knows longer and trusts. > Developers have to "earn" the second status (by providing extensions, > code fixes,...) - this would also help moving Pharo/Seaside forward. > > It may also help to distinguish between "I just played with this stuff" > (like most inactive accounts on seasidehosting prove) and real active > users who may provide the next success story. > > Bye > T. > > > -- > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir > belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de > >

Aug. 8, 2011

Re: [Pharo-project] Questions about Ocean

by Noury Bouraqadi

On 6 aoÃ»t 2011, at 00:56, Igor Stasenko wrote: > From user's POV, socket should support certain protocol. Period. > Nobody interesting where it comes from, who creating it and where Exactly, this is why we will have constructor methods. So, creating a socket will be simply as : OCNConversationSocket new OCNConversationSocket connectedTo: 'someserverNameOrIP' port: portNumber But, we didn't implement these yet. > A server socket has to provide only few things to users (after it > bound and started listening): > - accept new connection > - close > > The rest of socket protocol is useless and will produce the errors if > you use it. > >> Users of Ocean are not supposed to subclass these classes. >> If you want to implement a protocol, you need to go through a decorator pattern or a similar solution. >> > Yes, and i am asking, why these two subclasses are not decorators themselves? > Because they are using only a subset of socket's functionality (you > cannot connect once you already connected, > you cannot send or receive data using socket which listening connections etc). > Yes. There is a lifecycle. We are aware of this problem. We write extensive tests for it. There are explicit exceptions to signal missuses, instead of a doesNotUnderstand. Anyway, we definetely have to pair-program a bit. Let's do it during the camp preceeding the ESUG conf. Noury http://car.mines-douai.fr/noury -- -19Ã¨mes JournÃ©es Francophones sur les SystÃ¨mes Multi-Agents (JFSMAâ11) http://www.univ-valenciennes.fr/congres/jfsma2011/ 17-19 Octobre 2011, Valenciennes, France -5th International Conference on Smalltalk Technologies http://www.fast.org.ar November 3th - 5th, 2011 Universidad Nacional de Quilmes (Argentina)

Aug. 8, 2011

[Pharo-project] Web app security

by Torsten Bergmann

>What we are currently doing: >- integrate some vm patches (thanks Mariano :) from netstyle / seaside >hosting which limit file system / socket access Yes seasidehosting.st is running a modified VM to provide a more sandbox like environment. But one problem of port limitation is that it is not possible to send mails from the seasidehosting app (for instance for a registration step). That's OK since the hosting is free and it could be abused to send spam - but if you want to form a new Smalltalk based business and create a seaside app using SmallHarbour this may be something you will not miss in your shiny new online application. Maybe there could be two versions of SmallHarbour - an edition with limited rights for all and one with more rights for people/developers the community knows longer and trusts. Developers have to "earn" the second status (by providing extensions, code fixes,...) - this would also help moving Pharo/Seaside forward. It may also help to distinguish between "I just played with this stuff" (like most inactive accounts on seasidehosting prove) and real active users who may provide the next success story. Bye T. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

Aug. 8, 2011

Re: [Pharo-project] UTF-8 support when exporting to XML

by Hilaire Fernandes

Steph, The problem is I am using the previous API because as far as I can understand the recent version of ParseXML has a new API (ie does not work with the newset API). May be asking to the artisans of the new API, thought, there are some useful comments in the classes. Hilaire Le 08/08/2011 12:23, StÃ©phane Ducasse a Ã©crit : > Hilaire > > we will start to write a chapter on string encoding with henrik and I would like to have an example on XML > could you send me the snippet of code that saved you :) > > Tx > > On Aug 5, 2011, at 5:23 PM, Hilaire Fernandes wrote: > >> So far it was an orthogonal problem to XML Parser. >> >> I have to submit to XMLWriter a stream with UTF8 converter. >> >> StandardFileStream does not handle it, but MultiByteFileStream does. >> >> Thanks Henrik. It avoids me to check with latest XMLParser. >> >> Hilaire >> >> Le 05/08/2011 13:21, Hilaire Fernandes a Ã©crit : >>> Hello, >>> >>> I am wondering, does latest XML Parser get the string value really >>> exported to UTF-8. >>> I am still using an old version #20 of XMLParser (for code >>> compatibility) and I noted that Pharo accented string (still in 8 bits >>> forms as far as I can see) are not converted to UTF-8 when exported in >>> the XML file. >>> >>> Is it still the case with latest XML Parser? >>> >>> Hilaire >>> >> >> >> -- >> Education 0.2 -- http://blog.ofset.org/hilaire >> >> > > > -- Education 0.2 -- http://blog.ofset.org/hilaire

Aug. 8, 2011

Re: [Pharo-project] Debug it from browser, menu consistency, merged Inspector

by Alexandre Bergel

http://code.google.com/p/pharo/issues/detail?id=4605 Alexandre On 6 Aug 2011, at 16:17, StÃ©phane Ducasse wrote: > > On Aug 6, 2011, at 9:39 PM, Janko MivÅ¡ek wrote: > >> Hi guys, >> >> I just noticed that there is no 'Debug it' in browser's right-click >> menu, but it is on Workspace. It would be nice to be there too, and >> there is a place for it. But not need to add Profile it and Watch it in >> browser's one. Debug it is important for "through debugger" development >> style .. :) > > open an issue > and try to add it and send code. > It should not be that difficult > >> Second usability suggestion: please put Cut/Copy/Paste/Undo section >> consistently on the same place, or always on the top, or always >> somewhere else. Not on the bottom as is in context menu in Workspace >> while in browser it is on top. Same goes with DoIt/PrintIt/DebugIt block. > > ok open a bug entry > >> Third: how is the state with merging Inspector and Explorer? Wasn't >> there already a nice tree-view Inspector in some older Pharo? > > NewInspector was an attempt, I personally added it in Pharo 1.1 or so > but I finally could not use it at all. I was like finger cut with this tool. > So another version will have to be done first. > > Stef > > >> >> Best regards >> Janko >> >> -- >> Janko MivÅ¡ek >> Svetovalec za informatiko >> Eranova d.o.o. >> Ljubljana, Slovenija >> www.eranova.si >> tel: 01 514 22 55 >> faks: 01 514 22 56 >> gsm: 031 674 565 >> > > -- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.

Aug. 8, 2011

[Pharo-project] [update 1.4] #14078

by Marcus Denker

14078 ----- - add ensureCr for vmmaker compatibility to Transcript -- Marcus Denker -- http://marcusdenker.de

Aug. 8, 2011

Re: [Pharo-project] Web app security

by GastÃ³n Dall' Oglio

Hi. with a public SmallHarbour (public fork of SeasideHosting - smallharbour.org) > people can upload images that do bad things: change filesystem, run > commands, .... , users, services... I don't know about freebsd, but I hear about jails and its advantages over chroot. http://www.freebsd.org/doc/handbook/jails-intro.html 2011/8/8 Miguel Moquillon <miguel.moquillon(a)gmail.com> > If the host of SmallHarbour is running with FreeBSD 8 or Solaris, you can > use the "capabilities" feature to give restrictive priviledges to the > program or to some parts of the program. In short a capability is a pair of > a reference to an object in the system with the rights on that object. You > can allocate to the program a set of capabilities that define the security > environment within which it will run. > > Mig > > Le 06/08/2011 14:31, Dale Henrichs a Ã©crit : > > Laurent, >> >> I think that the best defense is the limited access/rights unix account, >> perhaps even a separate unix user per account (to provide isolation between >> accounts) ... I think this is what VMware does in in its Cloud Foundry ... >> to be completely safe you'd have to turn off the ability to read and write >> files and turn off socket access (this is what javascript in the browser >> does), but going this far severely limits what you can do in the image ... I >> would think that you could screw things down pretty tight just using unix >> permissions .... >> >> Dale >> >> ----- Original Message ----- >> | From: "laurent laffont"<laurent.laffont(a)gmail.com> >> | To: "Seaside - developer list"<seaside-dev(a)lists.squeakfoundation.org>, >> "An open mailing list to discuss any topics >> | related to an open-source Smalltalk"< >> pharo-project(a)lists.gforge.inria.fr> >> | Sent: Saturday, August 6, 2011 3:06:38 AM >> | Subject: [Pharo-project] Web app security >> | >> | Hi, >> | >> | >> | with a public SmallHarbour (public fork of SeasideHosting - >> | smallharbour.org ) people can upload images that do bad things: >> | change filesystem, run commands, .... >> | >> | >> | Actually, what are the ways of securing a server so people can't do >> | bad things ? >> | >> | >> | I'm thinking of: >> | - run the vm/image within a low right unix account >> | - remove dangerous plugins (OSProcess, ?) >> | >> | >> | Can we easily chroot ? >> | >> | >> | what are known solutions ? >> | >> | >> | Laurent. >> >> > >

Aug. 8, 2011

[Pharo-project] Be careful, problem with WeakOrderedCollection in Pharo (there is a fix)

by Mariano Martinez Peck

Hi Chris. We found a problem with WeakOrderedCollection in Pharo which may cause problems in Magma users in Pharo. Basically, once a WeakOrderedCollection needed to #grew, it stops being weak because the internal array was replaced by a Array instead of a WeakArray. (WeakOrderedCollection new instVarNamed: 'array') class ->>>> WeakArray (WeakOrderedCollection new grow instVarNamed: 'array') class ->>>> Array So....I can imagine that some applications running magma may grow a lot due to this bug. Just to check whether someone is having this bug or not, you may want to execute: WeakOrderedCollection allInstances select: [:each | (each instVarNamed: 'array') class = Array ] if you have instances, then that's a problem ;) To fix it, you can fileine the changes of the issue tracker: http://code.google.com/p/pharo/issues/detail?id=4596 and then you should fix the already created instances. cheers ps: I have no idea how much Magma uses WeakOrderedCollection, but I thought it was just worth it to raise a warning. -- Mariano http://marianopeck.wordpress.com

Aug. 8, 2011

Re: [Pharo-project] Web app security

by laurent laffont

On Mon, Aug 8, 2011 at 1:11 PM, StÃ©phane Ducasse <stephane.ducasse(a)inria.fr>wrote: > laurent > > are you doing that in a clone of the git vm because it would be good for > traceability? > We will. Laurent. > > Stef > > On Aug 8, 2011, at 10:09 AM, laurent laffont wrote: > > > Thanks for answers. > > > > What we are currently doing: > > - integrate some vm patches (thanks Mariano :) from netstyle / seaside > hosting which limit file system / socket access > > - try to run hosted images in another account > > > > It seems chrooting each account is not so easy. > > > > Yes, would be nice to make SmallHarbour running on FreeBSD. > > > > Laurent. > > > > > > On Mon, Aug 8, 2011 at 9:37 AM, Miguel Moquillon < > miguel.moquillon(a)gmail.com> wrote: > > If the host of SmallHarbour is running with FreeBSD 8 or Solaris, you can > use the "capabilities" feature to give restrictive priviledges to the > program or to some parts of the program. In short a capability is a pair of > a reference to an object in the system with the rights on that object. You > can allocate to the program a set of capabilities that define the security > environment within which it will run. > > > > Mig > > > > Le 06/08/2011 14:31, Dale Henrichs a Ã©crit : > > > > Laurent, > > > > I think that the best defense is the limited access/rights unix account, > perhaps even a separate unix user per account (to provide isolation between > accounts) ... I think this is what VMware does in in its Cloud Foundry ... > to be completely safe you'd have to turn off the ability to read and write > files and turn off socket access (this is what javascript in the browser > does), but going this far severely limits what you can do in the image ... I > would think that you could screw things down pretty tight just using unix > permissions .... > > > > Dale > > > > ----- Original Message ----- > > | From: "laurent laffont"<laurent.laffont(a)gmail.com> > > | To: "Seaside - developer list"<seaside-dev(a)lists.squeakfoundation.org>, > "An open mailing list to discuss any topics > > | related to an open-source Smalltalk"< > pharo-project(a)lists.gforge.inria.fr> > > | Sent: Saturday, August 6, 2011 3:06:38 AM > > | Subject: [Pharo-project] Web app security > > | > > | Hi, > > | > > | > > | with a public SmallHarbour (public fork of SeasideHosting - > > | smallharbour.org ) people can upload images that do bad things: > > | change filesystem, run commands, .... > > | > > | > > | Actually, what are the ways of securing a server so people can't do > > | bad things ? > > | > > | > > | I'm thinking of: > > | - run the vm/image within a low right unix account > > | - remove dangerous plugins (OSProcess, ?) > > | > > | > > | Can we easily chroot ? > > | > > | > > | what are known solutions ? > > | > > | > > | Laurent. > > > > > > > > > > >

Aug. 8, 2011