December 2016 - Pharo-users

Re: [Pharo-users] Password storage options

by Paul DeBruicker

I think I last used this in Pharo 1.3 #greaseString is just a cross platform #asString so you could change those for your updated package. here's a version of #randomBCryptSalt: that will work OK. randomBCryptSalt: saltSize | combined targetStream char random | combined:='0123456789ABCDEFGHIJKLMNOPQRSTUVWXZYabcdefghijklmnopqrstuvwxyz'. targetStream := WriteStream on: (String new: saltSize ). random := Random new. [targetStream contents size <= saltSize] whileTrue: [char :=combined at: (random next * (combined size - 1)) rounded + 1. char isAlphaNumeric ifTrue: [targetStream nextPut: char]]. ^targetStream contents After implementing that you could change #randomBCryptSaltData to randomBCryptSaltData ^self randomBCryptSalt: self saltDataLength To load FFI into old pharo its probably not a good idea to use #lastVersion but instead #stableVersion. Gofer new squeaksource: 'MetacelloRepository'; package: 'ConfigurationOfFFI'; load. (Smalltalk at: #ConfigurationOfFFI) project stableVersion load Let me know what other issues you run into. Jan BlizniÄenko wrote > Ah, it seems I just did not switched it on - it does not work after all. > > I tried it with PasswordHashingFFI-PaulDeBrulcker.16.mcz, but also with 15 > and 8. > > On Pharo 5, it calls many methods which I do not have in my environment, > for example in BCryptLinuxFFI>>#generateBCryptSalt: there is line with > "self randomBCryptSalt: saltSize", but there is no implementor of > "randomBCryptSalt:". Also, in many methods of BCryptLinuxFFI there are > message sends "greaseString" to variables cointaining probably integers, > but there is also no implementor of greaseString. > > So I tried it on Pharo 4 - it does not even load, because it needs class > ExternalStructure. So I found I need to download the FFI, I tried to do so > using code below, but loading failed with MessageNotUnderstood: receiver > of "selector" is nil. > > Gofer new > squeaksource: 'MetacelloRepository'; > package: 'ConfigurationOfFFI'; > load. > (Smalltalk at: #ConfigurationOfFFI) project lastVersion load > > So, I'm not sure what to try next to make it work. > > Jan > Jan BlizniÄenko wrote >> Thank you a lot! :) >> >> I tried it in Pharo 5 and everything seems to be working (I just had to >> apt-get install libxcrypt:i386, load packages Cryptography, Blowfish (not >> sure if really needed though) and PasswordHashingFFI and manually create >> link in directory where it expected libxcrypt.so.1). About the FFI for >> Pharo 5/6, maybe that's what Esteban Maringolo did in commit >> "Cryptography-EstebanMaringolo.50" on 15 September 2016 "Version ready to >> be loaded in Pharo 5.0 without affecting Kernel or System packages.". >> >> Scrypt would be even better to have, but I'm grateful enough for now >> since it was all easier and faster than I expected. >> >> Jan >> Paul DeBruicker wrote >>> And to add scrypt to that FFI library would be trivial if you have a >>> 32bit version of scrypt but I don't think there is one. I'd be happy to >>> learn I'm wrong though. And thats assuming you're using 32 bit pharo, >>> which is whats stable/released right now. >>> >>> >>> >>> >>> Paul DeBruicker wrote >>>> I made a crypt/bcrypt ffi library for older versions of Pharo that >>>> sounds like it meets your needs and is in the cryptography project >>>> here: >>>> >>>> http://smalltalkhub.com/#!/~Cryptography/Cryptography >>>> >>>> But I have not updated it for the new FFI versions in Pharo 5/6. >>>> >>>> >>>> >>>> And Pierce Ng made a blog post and library about his own set up here: >>>> http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html >>>> >>>> >>>> >>>> >>>> Jan BlizniÄenko wrote >>>>> Hello >>>>> >>>>> I'm working on Pharo-based webserver and right now I got to the topic >>>>> of >>>>> storing user passwords. I found SHA256 integrated in Pharo, but >>>>> hashing with >>>>> SHA is far from enough. I also looked around the mailing list history >>>>> to >>>>> find few posts from 2011 about bcrypt using Linux libraries. I'd like >>>>> to ask >>>>> what is current status - what are my options under following >>>>> conditions: >>>>> >>>>> I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use >>>>> beta >>>>> Pharo 6, but latest stable relase is preferred. >>>>> >>>>> I require at least bcrypt or PDKBF2, but I much more prefer >>>>> GPU-attack-resistant solutions like scrypt or Argon2. >>>>> >>>>> I require Linux compatibility, but platform independent solution would >>>>> be >>>>> kinda nice (we could use the same algorithm on our local machines with >>>>> Mac >>>>> and Win for development). >>>>> >>>>> Thank you >>>>> Jan >>>>> >>>>> >>>>> >>>>> -- >>>>> View this message in context: >>>>> http://forum.world.st/Password-storage-options-tp4927471.html >>>>> Sent from the Pharo Smalltalk Users mailing list archive at >>>>> Nabble.com. -- View this message in context: http://forum.world.st/Password-storage-options-tp4927480p4927603.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Dec. 20, 2016

Re: [Pharo-users] Password storage options

by Esteban A. Maringolo

Hello Jan, The latest commit of the Cryptography package loads in Pharo 5 without affecting existing packages, but it does not guarantee that all the methods are working. The FFI related packages will likely not work out of the box, because there was a change in the FFI interface from Pharo 4 to Pharo 5, so the FFI calls should be adapted to use UFFI (new FFI framework). I'd also like to have Scrypt and ECDSA. Regards, Esteban A. Maringolo 2016-12-19 22:54 GMT-03:00 Jan BlizniÄenko <bliznjan(a)fit.cvut.cz>: > Ah, it seems I just did not switched it on - it does not work after all. > > I tried it with PasswordHashingFFI-PaulDeBrulcker.16.mcz, but also with 15 > and 8. > > On Pharo 5, it calls many methods which I do not have in my environment, for > example in BCryptLinuxFFI>>#generateBCryptSalt: there is line with "self > randomBCryptSalt: saltSize", but there is no implementor of > "randomBCryptSalt:". Also, in many methods of BCryptLinuxFFI there are > message sends "greaseString" to variables cointaining probably integers, but > there is also no implementor of greaseString. > > So I tried it on Pharo 4 - it does not even load, because it needs class > ExternalStructure. So I found I need to download the FFI, I tried to do so > using code below, but loading failed with MessageNotUnderstood: receiver of > "selector" is nil. > > Gofer new > squeaksource: 'MetacelloRepository'; > package: 'ConfigurationOfFFI'; > load. > (Smalltalk at: #ConfigurationOfFFI) project lastVersion load > > So, I'm not sure what to try next to make it work. > > Jan > > > Jan BlizniÄenko wrote >> Thank you a lot! :) >> >> I tried it in Pharo 5 and everything seems to be working (I just had to >> apt-get install libxcrypt:i386, load packages Cryptography, Blowfish (not >> sure if really needed though) and PasswordHashingFFI and manually create >> link in directory where it expected libxcrypt.so.1). About the FFI for >> Pharo 5/6, maybe that's what Esteban Maringolo did in commit >> "Cryptography-EstebanMaringolo.50" on 15 September 2016 "Version ready to >> be loaded in Pharo 5.0 without affecting Kernel or System packages.". >> >> Scrypt would be even better to have, but I'm grateful enough for now since >> it was all easier and faster than I expected. >> >> Jan >> Paul DeBruicker wrote >>> And to add scrypt to that FFI library would be trivial if you have a >>> 32bit version of scrypt but I don't think there is one. I'd be happy to >>> learn I'm wrong though. And thats assuming you're using 32 bit pharo, >>> which is whats stable/released right now. >>> >>> >>> >>> >>> Paul DeBruicker wrote >>>> I made a crypt/bcrypt ffi library for older versions of Pharo that >>>> sounds like it meets your needs and is in the cryptography project >>>> here: >>>> >>>> http://smalltalkhub.com/#!/~Cryptography/Cryptography >>>> >>>> But I have not updated it for the new FFI versions in Pharo 5/6. >>>> >>>> >>>> >>>> And Pierce Ng made a blog post and library about his own set up here: >>>> http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html >>>> >>>> >>>> >>>> >>>> Jan BlizniÄenko wrote >>>>> Hello >>>>> >>>>> I'm working on Pharo-based webserver and right now I got to the topic >>>>> of >>>>> storing user passwords. I found SHA256 integrated in Pharo, but hashing >>>>> with >>>>> SHA is far from enough. I also looked around the mailing list history >>>>> to >>>>> find few posts from 2011 about bcrypt using Linux libraries. I'd like >>>>> to ask >>>>> what is current status - what are my options under following >>>>> conditions: >>>>> >>>>> I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use >>>>> beta >>>>> Pharo 6, but latest stable relase is preferred. >>>>> >>>>> I require at least bcrypt or PDKBF2, but I much more prefer >>>>> GPU-attack-resistant solutions like scrypt or Argon2. >>>>> >>>>> I require Linux compatibility, but platform independent solution would >>>>> be >>>>> kinda nice (we could use the same algorithm on our local machines with >>>>> Mac >>>>> and Win for development). >>>>> >>>>> Thank you >>>>> Jan >>>>> >>>>> >>>>> >>>>> -- >>>>> View this message in context: >>>>> http://forum.world.st/Password-storage-options-tp4927471.html >>>>> Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. > > > > > > -- > View this message in context: http://forum.world.st/Password-storage-options-tp4927480p4927538.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. >

Dec. 20, 2016

Re: [Pharo-users] FFI on MacOS 10.12 using Pharo 5

by Esteban Lorenzano

Hi, I never tested it with a âbundleâ plugin. But if before it worked like this: someNumber <cdecl: int 'someNumber' () module: 'ThePlugin'> ^self externalCallFailed Now it should work like this: someNumber ^ self ffiCall: #(int someNumber () ) module: âThePluginâ. and: a) you can do that with a FFILibrary child, in which case it will be something like this: ThePlugin>>macModuleName ^ âThePlugin' someNumber ^ self ffiCall: #(int someNumber () ) module: ThePlugin. âClass reference, no need to put uniqueInstanceâ b) bundles needs to be put where bundles go: Pharo.app/Contents/Resources cheers, Esteban > On 20 Dec 2016, at 02:41, jjjhhh <jayhardesty(a)gmail.com> wrote: > > Hello, > > I need help rescuing code that has dependencies on FFI. I just downloaded > the latest Pharo 5 vm in order to run Pharo under MacOS 10.12. Now the > FFI-based code in my image no longer works (or is viewable). > > What worked before (for years, up through MacOS 10.11) is as follows: > > I have a 32-bit lib (i386) called ThePlugin.bundle (C code compiled w/ > Xcode). I put it in Pharo.app/Contents/MacOS/Contents/Plugins/. > > The lib has a C function like: > int someNumber() { return 123; } > > In Smalltalk I have a class ThePluginFFI with the class method: > someNumber > <cdecl: int 'someNumber' () module: 'ThePlugin'> > ^self externalCallFailed > > And if I typed "ThePluginFFI someNumber" I got 123 > > Now I get "External module not found". If I try to view the method > "someNumber" I get an MNU from RBFFLCallPragma>>selectorParts (receiver of > "keywords" is nil), and the image hangs. > > I tried rewriting the method someNumber to look like this: > someNumber > ^self ffiCall: #( int someNumber() ) module: ThePlugin uniqueInstance > > where ThePlugin is a subclass of FFILibrary with an instance method: > macModuleName > ^'ThePlugin.bundle' > > but this still gets "External module not found" > > > Is there some new way of doing all this? Or some new trick to loading > libraries (I tried dylibs as well as bundles). > > I couldn't find a recent > summary/update. > > Thanks for any help! > Jay > > > > -- > View this message in context: http://forum.world.st/FFI-on-MacOS-10-12-using-Pharo-5-tp4927537.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. >

Dec. 20, 2016

Re: [Pharo-users] [Vm-dev] ptsd rage

by phil＠highoctane.be

There is a #random channel on slack, one can do a #politics one if so needed. Phil On Tue, Dec 20, 2016 at 5:36 AM, Tudor Girba <tudor(a)tudorgirba.com> wrote: > Indeed, please letâs focus on Pharo issues on this mailing list. > > Cheers, > Doru > > > > On Dec 20, 2016, at 1:25 AM, Travis Ayres <trayres(a)gmail.com> wrote: > > > > Totally agreed. > > > > On Mon, Dec 19, 2016 at 4:17 PM, Brad <bsselfridge(a)gmail.com> wrote: > > Don't know about anyone else, but I would appreciate it if this kind of > commentary never made it to this email list. This topic is so > inappropriate. Let's keep the discussion about Pharo. If you feel you must > go down the political route, then please be gracious enough to find another > venue. > > > > Brad Selfridge > > 913-269-2385 > > > > On Dec 19, 2016, at 6:48 PM, Charlie Robbats <charlie.robbats(a)gmail.com> > wrote: > > > >> Alright, one more sad observation. Of all the Law Enforcement violence, > either perpetrated by LEOs against citizens or by citizens against LEOs, in > all cases I am aware or recall having heard, all of these involve police > officers. No violence, or very little, is perpetrated against or by Sheriff > Deputies. As counties are a good and proper and consistent scope of crime > administration, regardless of the density, police ought to report to the > Sheriffs and let's put and end to broken windows policy and discriminatory > enforcement. Police are always in our shit, and have their egos to boot. > Sheriff Deputies, by comparison, are laid back and easy to talk to. They > engage the public in respect, without attitude. > >> > >> Bob didn't shoot the deputy. > >> > >> On 12/17/2016 10:11 PM, Charlie Robbats wrote: > >>> Last bit, a mantra: Crime & Punishment creates massive mental illness > in our society. Ask the Russians. > >>> > >>> On 12/17/2016 10:05 PM, Charlie Robbats wrote: > >>>> > >>>> > >>>> > >>>> Well, my paranoia is kicking. I spoke too broadly of police, I have > interacted with many and they do a lot of good. A bad apple spoils the > whatever and their code of silence allows for that sort of rot. I tell it > straight, because they monitor the list. I pissed them off! Do you think it > passed the sanity test that cops run all street drugs with their felon > database in hand? Damn! All those Fellas are going to turn and bite their > masters' hand, you watch! Stacking these grown men like Twinkies in > overcrowded prisons. There is a debt that needs to be paid and the > righteous are those in prison on a bunch of bullshit paper. Vive la > revolucion! Ok, sorry I went political. I am done. > >>>> > >>>> On 12/17/2016 9:49 PM, Charlie Robbats wrote: > >>>>> I am sad with you in your diagnosis. I get that too, the blues. I > get high if I am holding and listen to "Kind of Blue" or deep house or > reggae. Some X would be good, but herbage is my mainstay to drop my > constant threat mode (hypervigilence). I do not want a repeat of what > happened! Unfortunately I drive people away to make sure of that. I > appreciate your alls kindness. I wanted to share a solid explanation of why > I am such a dick at times. I flip to active threat mode, I struggle to > control this. It doesn't help that the police have been stalking me for 2 > years, I am all caught up in their noise. Don't believe a word of their > truthfulness. The blue wall of silence breaks God's commandment thou shalt > not bear false witness. Police violate that daily, protecting their > brothers who shoot unarmed black men in the back and claim they are fearing > for their lives. Really? No, really? Well, that is a different story. That > just freaking triggers me. And my opinion makes me their target. At least > in my C-PTSD befuddled mind. > >>>>> Be well all! > >> > > > > -- > www.tudorgirba.com > www.feenk.com > > "Things happen when they happen, > not when you talk about them happening." > > > >

Dec. 20, 2016

Re: [Pharo-users] FFI on MacOS 10.12 using Pharo 5

by Dimitris Chloupis

I recently worked with UFFI for making a shared memory library, the very first thing I have done is to do everything first with C code , to make sure things work at the C side. Its so easy to mess up things at C code. So first make sure that the library actually works, because if it does not work inside a C program it wont work with UFFI either. The library may have to be rebuilt in Sierra , I think Sierra changed several things so just because the library worked on El Capitan does not mean it will work on Sierra. This is why its paramount you test the library inside a C application. Another thing is to make sure UFFI can locate the library , there is LibC class inside the Pharo image that gives an example on how to add paths that UFFI will search to find the library, I think its the linux side of the class but it should work the same on MacOS too. Last but not least I am not sure a bundle would work with UFFI but once more testing this with C code is the safest way to locate the problem. Old FFIs still work in Pharo 6 because there are things that UFFI cannot do like call Objective C libraries. So I doubt your problem is UFFI related most likely you need to build the library for Sierra. On Tue, Dec 20, 2016 at 3:57 AM jjjhhh <jayhardesty(a)gmail.com> wrote: > Hello, > > I need help rescuing code that has dependencies on FFI. I just downloaded > the latest Pharo 5 vm in order to run Pharo under MacOS 10.12. Now the > FFI-based code in my image no longer works (or is viewable). > > What worked before (for years, up through MacOS 10.11) is as follows: > > I have a 32-bit lib (i386) called ThePlugin.bundle (C code compiled w/ > Xcode). I put it in Pharo.app/Contents/MacOS/Contents/Plugins/. > > The lib has a C function like: > int someNumber() { return 123; } > > In Smalltalk I have a class ThePluginFFI with the class method: > someNumber > <cdecl: int 'someNumber' () module: 'ThePlugin'> > ^self externalCallFailed > > And if I typed "ThePluginFFI someNumber" I got 123 > > Now I get "External module not found". If I try to view the method > "someNumber" I get an MNU from RBFFLCallPragma>>selectorParts (receiver of > "keywords" is nil), and the image hangs. > > I tried rewriting the method someNumber to look like this: > someNumber > ^self ffiCall: #( int someNumber() ) module: ThePlugin uniqueInstance > > where ThePlugin is a subclass of FFILibrary with an instance method: > macModuleName > ^'ThePlugin.bundle' > > but this still gets "External module not found" > > > Is there some new way of doing all this? Or some new trick to loading > libraries (I tried dylibs as well as bundles). > > I couldn't find a recent > summary/update. > > Thanks for any help! > Jay > > > > -- > View this message in context: > http://forum.world.st/FFI-on-MacOS-10-12-using-Pharo-5-tp4927537.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. > >

Dec. 20, 2016

Re: [Pharo-users] FFI on MacOS 10.12 using Pharo 5

by Ben Coman

Previously with NativeBoost, Pharo FFI diverged from the mainline VM, which made support from vm-devs a bit harder. In Pharo 5 we've returned to the fold with UFFI, but there are some changes required. I recorded my own learning of UFFI here... http://blog.openinworld.com/2016/09/pharo-libclang-ffi-part-1-preamble/ cheers -ben On Tue, Dec 20, 2016 at 9:41 AM, jjjhhh <jayhardesty(a)gmail.com> wrote: > Hello, > > I need help rescuing code that has dependencies on FFI. I just downloaded > the latest Pharo 5 vm in order to run Pharo under MacOS 10.12. Now the > FFI-based code in my image no longer works (or is viewable). > > What worked before (for years, up through MacOS 10.11) is as follows: > > I have a 32-bit lib (i386) called ThePlugin.bundle (C code compiled w/ > Xcode). I put it in Pharo.app/Contents/MacOS/Contents/Plugins/. > > The lib has a C function like: > int someNumber() { return 123; } > > In Smalltalk I have a class ThePluginFFI with the class method: > someNumber > <cdecl: int 'someNumber' () module: 'ThePlugin'> > ^self externalCallFailed > > And if I typed "ThePluginFFI someNumber" I got 123 > > Now I get "External module not found". If I try to view the method > "someNumber" I get an MNU from RBFFLCallPragma>>selectorParts (receiver of > "keywords" is nil), and the image hangs. > > I tried rewriting the method someNumber to look like this: > someNumber > ^self ffiCall: #( int someNumber() ) module: ThePlugin uniqueInstance > > where ThePlugin is a subclass of FFILibrary with an instance method: > macModuleName > ^'ThePlugin.bundle' > > but this still gets "External module not found" > > > Is there some new way of doing all this? Or some new trick to loading > libraries (I tried dylibs as well as bundles). > > I couldn't find a recent > summary/update. > > Thanks for any help! > Jay > > > > -- > View this message in context: http://forum.world.st/FFI-on-MacOS-10-12-using-Pharo-5-tp4927537.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. >

Dec. 20, 2016

Resetting Ring ?

by Sven Van Caekenberghe

In a 4.0 image I got in a situation where it seems Ring is out of sync (I am getting errors of missing meta classes on each accept). I vaguely remember there being an expression to reset/reinitialise Ring ? Does anyone remember ? Thx, Sven

Dec. 20, 2016

Re: [Pharo-users] Protego - smart way to manage NIL's in business calculations

by Stephane Ducasse

Yes this is why it would be a good addition to protego On Sun, Dec 18, 2016 at 8:21 PM, Denis Kudriashov <dionisiydk(a)gmail.com> wrote: > > 2016-12-18 20:19 GMT+01:00 Denis Kudriashov <dionisiydk(a)gmail.com>: > >> >>> What is the main difference between proposed MissingValue and >>> UndefinedObject? >> >> >> MissingValue you will set up according to your business logic. While nil >> is just default value of variable which could be in your object by some >> incident, bug of application. > > > And it makes impossible to distinguish bug from normal application state > related to missing value >

Dec. 20, 2016

Re: [Pharo-users] [Vm-dev] ptsd rage

by Tudor Girba

Indeed, please letâs focus on Pharo issues on this mailing list. Cheers, Doru > On Dec 20, 2016, at 1:25 AM, Travis Ayres <trayres(a)gmail.com> wrote: > > Totally agreed. > > On Mon, Dec 19, 2016 at 4:17 PM, Brad <bsselfridge(a)gmail.com> wrote: > Don't know about anyone else, but I would appreciate it if this kind of commentary never made it to this email list. This topic is so inappropriate. Let's keep the discussion about Pharo. If you feel you must go down the political route, then please be gracious enough to find another venue. > > Brad Selfridge > 913-269-2385 > > On Dec 19, 2016, at 6:48 PM, Charlie Robbats <charlie.robbats(a)gmail.com> wrote: > >> Alright, one more sad observation. Of all the Law Enforcement violence, either perpetrated by LEOs against citizens or by citizens against LEOs, in all cases I am aware or recall having heard, all of these involve police officers. No violence, or very little, is perpetrated against or by Sheriff Deputies. As counties are a good and proper and consistent scope of crime administration, regardless of the density, police ought to report to the Sheriffs and let's put and end to broken windows policy and discriminatory enforcement. Police are always in our shit, and have their egos to boot. Sheriff Deputies, by comparison, are laid back and easy to talk to. They engage the public in respect, without attitude. >> >> Bob didn't shoot the deputy. >> >> On 12/17/2016 10:11 PM, Charlie Robbats wrote: >>> Last bit, a mantra: Crime & Punishment creates massive mental illness in our society. Ask the Russians. >>> >>> On 12/17/2016 10:05 PM, Charlie Robbats wrote: >>>> >>>> >>>> >>>> Well, my paranoia is kicking. I spoke too broadly of police, I have interacted with many and they do a lot of good. A bad apple spoils the whatever and their code of silence allows for that sort of rot. I tell it straight, because they monitor the list. I pissed them off! Do you think it passed the sanity test that cops run all street drugs with their felon database in hand? Damn! All those Fellas are going to turn and bite their masters' hand, you watch! Stacking these grown men like Twinkies in overcrowded prisons. There is a debt that needs to be paid and the righteous are those in prison on a bunch of bullshit paper. Vive la revolucion! Ok, sorry I went political. I am done. >>>> >>>> On 12/17/2016 9:49 PM, Charlie Robbats wrote: >>>>> I am sad with you in your diagnosis. I get that too, the blues. I get high if I am holding and listen to "Kind of Blue" or deep house or reggae. Some X would be good, but herbage is my mainstay to drop my constant threat mode (hypervigilence). I do not want a repeat of what happened! Unfortunately I drive people away to make sure of that. I appreciate your alls kindness. I wanted to share a solid explanation of why I am such a dick at times. I flip to active threat mode, I struggle to control this. It doesn't help that the police have been stalking me for 2 years, I am all caught up in their noise. Don't believe a word of their truthfulness. The blue wall of silence breaks God's commandment thou shalt not bear false witness. Police violate that daily, protecting their brothers who shoot unarmed black men in the back and claim they are fearing for their lives. Really? No, really? Well, that is a different story. That just freaking triggers me. And my opinion makes me their target. At least in my C-PTSD befuddled mind. >>>>> Be well all! >> > -- www.tudorgirba.com www.feenk.com "Things happen when they happen, not when you talk about them happening."

Dec. 20, 2016

Re: [Pharo-users] Password storage options

by Jan BlizniÄenko

Ah, it seems I just did not switched it on - it does not work after all. I tried it with PasswordHashingFFI-PaulDeBrulcker.16.mcz, but also with 15 and 8. On Pharo 5, it calls many methods which I do not have in my environment, for example in BCryptLinuxFFI>>#generateBCryptSalt: there is line with "self randomBCryptSalt: saltSize", but there is no implementor of "randomBCryptSalt:". Also, in many methods of BCryptLinuxFFI there are message sends "greaseString" to variables cointaining probably integers, but there is also no implementor of greaseString. So I tried it on Pharo 4 - it does not even load, because it needs class ExternalStructure. So I found I need to download the FFI, I tried to do so using code below, but loading failed with MessageNotUnderstood: receiver of "selector" is nil. Gofer new squeaksource: 'MetacelloRepository'; package: 'ConfigurationOfFFI'; load. (Smalltalk at: #ConfigurationOfFFI) project lastVersion load So, I'm not sure what to try next to make it work. Jan Jan BlizniÄenko wrote > Thank you a lot! :) > > I tried it in Pharo 5 and everything seems to be working (I just had to > apt-get install libxcrypt:i386, load packages Cryptography, Blowfish (not > sure if really needed though) and PasswordHashingFFI and manually create > link in directory where it expected libxcrypt.so.1). About the FFI for > Pharo 5/6, maybe that's what Esteban Maringolo did in commit > "Cryptography-EstebanMaringolo.50" on 15 September 2016 "Version ready to > be loaded in Pharo 5.0 without affecting Kernel or System packages.". > > Scrypt would be even better to have, but I'm grateful enough for now since > it was all easier and faster than I expected. > > Jan > Paul DeBruicker wrote >> And to add scrypt to that FFI library would be trivial if you have a >> 32bit version of scrypt but I don't think there is one. I'd be happy to >> learn I'm wrong though. And thats assuming you're using 32 bit pharo, >> which is whats stable/released right now. >> >> >> >> >> Paul DeBruicker wrote >>> I made a crypt/bcrypt ffi library for older versions of Pharo that >>> sounds like it meets your needs and is in the cryptography project >>> here: >>> >>> http://smalltalkhub.com/#!/~Cryptography/Cryptography >>> >>> But I have not updated it for the new FFI versions in Pharo 5/6. >>> >>> >>> >>> And Pierce Ng made a blog post and library about his own set up here: >>> http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html >>> >>> >>> >>> >>> Jan BlizniÄenko wrote >>>> Hello >>>> >>>> I'm working on Pharo-based webserver and right now I got to the topic >>>> of >>>> storing user passwords. I found SHA256 integrated in Pharo, but hashing >>>> with >>>> SHA is far from enough. I also looked around the mailing list history >>>> to >>>> find few posts from 2011 about bcrypt using Linux libraries. I'd like >>>> to ask >>>> what is current status - what are my options under following >>>> conditions: >>>> >>>> I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use >>>> beta >>>> Pharo 6, but latest stable relase is preferred. >>>> >>>> I require at least bcrypt or PDKBF2, but I much more prefer >>>> GPU-attack-resistant solutions like scrypt or Argon2. >>>> >>>> I require Linux compatibility, but platform independent solution would >>>> be >>>> kinda nice (we could use the same algorithm on our local machines with >>>> Mac >>>> and Win for development). >>>> >>>> Thank you >>>> Jan >>>> >>>> >>>> >>>> -- >>>> View this message in context: >>>> http://forum.world.st/Password-storage-options-tp4927471.html >>>> Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. -- View this message in context: http://forum.world.st/Password-storage-options-tp4927480p4927538.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Dec. 20, 2016