- Pharo-dev - lists.pharo.org

Re: [Pharo-project] Web app security

by Igor Stasenko

On 6 August 2011 12:06, laurent laffont <laurent.laffont(a)gmail.com> wrote: > Hi, > with a public SmallHarbour (public fork of SeasideHosting - > smallharbour.org) people can upload images that do bad things: change > filesystem, run commands, .... > Actually, what are the ways of securing a server so people can't do bad > things ? > I'm thinking of: > - run the vm/image within a low right unix account > - remove dangerous plugins (OSProcess, ?) you don't need to remove dangerous plugins. What you can do (with latest VMs) is to use 'disable module loading' mechanism. http://code.google.com/p/cog/issues/detail?id=13 > Can we easily chroot ? > what are known solutions ? > Laurent. -- Best regards, Igor Stasenko AKA sig.

Aug. 6, 2011

Re: [Pharo-project] [Pharo-coral] about coral

by Sean P. DeNigris

StÃ©phane Ducasse wrote: > > We want Coral to be loadable in Pharo core but not included by default at > least for now. > What is the status of Coral? Is it usable? Thanks. Sean -- View this message in context: http://forum.world.st/about-coral-tp3723018p3723265.html Sent from the Pharo Smalltalk mailing list archive at Nabble.com.

Aug. 6, 2011

Re: [Pharo-project] Web app security

by Dale Henrichs

Laurent, I think that the best defense is the limited access/rights unix account, perhaps even a separate unix user per account (to provide isolation between accounts) ... I think this is what VMware does in in its Cloud Foundry ... to be completely safe you'd have to turn off the ability to read and write files and turn off socket access (this is what javascript in the browser does), but going this far severely limits what you can do in the image ... I would think that you could screw things down pretty tight just using unix permissions .... Dale ----- Original Message ----- | From: "laurent laffont" <laurent.laffont(a)gmail.com> | To: "Seaside - developer list" <seaside-dev(a)lists.squeakfoundation.org>, "An open mailing list to discuss any topics | related to an open-source Smalltalk" <pharo-project(a)lists.gforge.inria.fr> | Sent: Saturday, August 6, 2011 3:06:38 AM | Subject: [Pharo-project] Web app security | | Hi, | | | with a public SmallHarbour (public fork of SeasideHosting - | smallharbour.org ) people can upload images that do bad things: | change filesystem, run commands, .... | | | Actually, what are the ways of securing a server so people can't do | bad things ? | | | I'm thinking of: | - run the vm/image within a low right unix account | - remove dangerous plugins (OSProcess, ?) | | | Can we easily chroot ? | | | what are known solutions ? | | | Laurent.

Aug. 6, 2011

Re: [Pharo-project] Managing logos and backgrounds IN the image

by Lukas Renggli

Have a look at the Smalltalk scripts of the Jenkins builder. There are various examples that do exactly that (Seaside, Pier, Pharo, PetitParser, ...). Some use the #storeString of Form instances, others use ByteArrays, but the simplest is if you just load the image from a webserver. Lukas On Saturday, 6 August 2011, Mariano Martinez Peck <marianopeck(a)gmail.com> wrote: > Hi guys. I want to do two things: > > 1) set a custom logo and background for my images. > 2) I want to do 1) from my ConfigurationOfMariano > 3) I want to have the logo and background picture as a ByteArray/Bitmap or whatever but inside the image (not needing an external file). > > For 1) I know I can do for the background image: > > World backgroundImage: (ImageReadWriter formFromFileNamed: 'whatever.png') layout: #scaled. > > And for the logo: > > LogoImageMorph default: (ImageMorph withForm: (ImageReadWriter formFromFileNamed: 'whatever')) > > > Now....I need the second part, how to read it from file and store it as an image directly in the image. Something similar as icons are stored. > And of course, then how to read them and set it to the background and logo. > > > Thanks in advance, > > -- > Mariano > http://marianopeck.wordpress.com > > -- Lukas Renggli www.lukas-renggli.ch

Aug. 6, 2011

[Pharo-project] Managing logos and backgrounds IN the image

by Mariano Martinez Peck

Hi guys. I want to do two things: 1) set a custom logo and background for my images. 2) I want to do 1) from my ConfigurationOfMariano 3) I want to have the logo and background picture as a ByteArray/Bitmap or whatever but inside the image (not needing an external file). For 1) I know I can do for the background image: World backgroundImage: (ImageReadWriter formFromFileNamed: 'whatever.png') layout: #scaled. And for the logo: LogoImageMorph default: (ImageMorph withForm: (ImageReadWriter formFromFileNamed: 'whatever')) Now....I need the second part, how to read it from file and store it as an image directly in the image. Something similar as icons are stored. And of course, then how to read them and set it to the background and logo. Thanks in advance, -- Mariano http://marianopeck.wordpress.com

Aug. 6, 2011

[Pharo-project] Web app security

by laurent laffont

Hi, with a public SmallHarbour (public fork of SeasideHosting - smallharbour.org) people can upload images that do bad things: change filesystem, run commands, .... Actually, what are the ways of securing a server so people can't do bad things ? I'm thinking of: - run the vm/image within a low right unix account - remove dangerous plugins (OSProcess, ?) Can we easily chroot ? what are known solutions ? Laurent.

Aug. 6, 2011

Re: [Pharo-project] [Pharo-coral] about coral

by StÃ©phane Ducasse

Something I forgot to say is that we can have a squeak package in the ConfigurationOfCoral. We want Coral to be loadable in Pharo core but not included by default at least for now. We should first close the doors that we opened. Stef > Hi frank > > Oscar is not in charge since a long time about coral. In fact it had always been my iea, and since oscar like scripting language > he was participating. Now Damien is helping a lot. > If you have changes that you think can go in our version please send them. > I do not know why the REPL is not working anymore and probably that we should use the stdout that were introduced in 1.3 > > This has been years that I want a smalltalk with a scripting layer and if you want to join you are welcome. > > Stef > > > > ---------- Forwarded message ---------- > From: Frank Shearar <frank.shearar(a)gmail.com> > Date: Fri, Aug 5, 2011 at 6:33 PM > Subject: [squeak-dev] "Pharoism" package? > To: The general-purpose Squeak developers list <squeak-dev(a)lists.squeakfoundation.org> > > > Hi, > > I did some work yesterday [1] getting Coral (a scripting framework for > Pharo: http://www.squeaksource.com/Coral.html) working in Trunk. I > made a few adjustments to Coral itself, mailing Oscar Nierstrasz the > changes (what look to be getting Coral to work with the latest > Filesystem code, post-large-refactor), and had to add a few methods to > Squeak that Coral was expecting. Presumably these were methods renamed > by Pharo: > > Character >> join: > String >> join: > Class >> addInstVarNamed: > MetaClass >> addInstVarNamed: > Class >> subclass: > SmalltalkImage >> vmFullPath > Symbol >> isBinary > > My question's a bit broader: there are many more Pharo developers than > Squeak developers, it seems. They're doing lots of cool stuff. We can > easily port these cool things to Squeak (at least, at the moment). If > anyone else is doing this kind've thing, perhaps it's worthwhile > either adding these kinds of methods to Grease, or having a general > "Pharoisms" package. > > It's not all one-way, of course: having things easily loadable into > Squeak means that Squeak hackers (like me) can more easily contribute > to interesting packages (like Coral) without having to keep track of > two communities. (Coral could, with some love, become a full REPL, > which is something I really want.) > > frank > > [1] http://stackoverflow.com/questions/6938114/a-smalltalk-implementation-with-… > > > > > -- > Mariano > http://marianopeck.wordpress.com > > _______________________________________________ > Pharo-coral mailing list > Pharo-coral(a)lists.gforge.inria.fr > http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-coral

Aug. 6, 2011

Re: [Pharo-project] [Esug-list] Preparing my presentation of NativeBoost

by StÃ©phane Ducasse

+ 10 :) On Aug 5, 2011, at 1:24 PM, Henrik Johansen wrote: > I don't think you need more implementation details than a brief overview of how it works (store machine generated from smalltalk assembly code in methods with a special tag, execute that instead of method body if it's been generated). > > Then spend the rest of the time on how you use that, starting at the bottom and building some NB-versions of normal smalltalk methods directly, then how you've implement an FFI on top of it, and how it could fit into a JIT/other interesting stuff written entirely image-side. > > IE. focus on "how do/can I use it?" rather than "how does it work?"

Aug. 6, 2011

Re: [Pharo-project] Questions about Ocean

by StÃ©phane Ducasse

When? we can also organise a party with wifes after. Stef >> Cool! We do like NativeBoost. >> We can pair program a bit together next time we meet. >> At least in the Esug confo @ Edinburgh :-) >> > Yes. We can :)

Aug. 6, 2011

Re: [Pharo-project] A tip of the day: how to see all uses of variable

by StÃ©phane Ducasse

add a bug entry and we will fix it :) On Aug 5, 2011, at 8:13 PM, Igor Stasenko wrote: > just select it in source code and press Cmd-Shift-N (Alt-Shift-N). > > In Pharo browser/inspector/debugger it works not just for global > variables (like classes), but also for: > - Class variables > - Pool variables > - instance variables > > - but not for class instance variables (we should fix that!) ;) > > -- > Best regards, > Igor Stasenko AKA sig. >

Aug. 6, 2011