December 2017 - Pharo-users

Re: [Pharo-users] HMAC-SHA512

by Ben Coman

2017-12-10 6:01 GMT-03:00 Ben Coman <btc(a)openinworld.com>: > Can anyone recommend libraries (native Smalltalk or via FFI) > to do generate a HMAC-SHA512 ? On 11 December 2017 at 01:30, HernÃ¡n Morales Durand < hernan.morales(a)gmail.com> wrote: > Hi Ben, > > I would use NaCl: http://cr.yp.to/highspeed/coolnacl-20120725.pdf > which you can install from the Pharo Project Catalog in Pharo 6.x Thanks Henry. That looks like path of least resistance. I hit a stumbling block that took a short while to understand. The library binary downloaded specified by ConfigruationOfNacl>>platformLibraryUrl is libsodium: ELF 32-bit LSB shared object whereas I'm using 64bit Linux. I have the following system library preinstalled... /usr/lib/x86_64-linux-gnu/libsodium.so.18.0.1: ELF 64-bit LSB shared object However its api is slightly different. Pharo Nacl makes this call out... crypto_hash_sha512_ref() but the system library provides... 56: 0000000000014dc0 175 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512_final 81: 0000000000014c40 384 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512_update 154: 0000000000014bd0 106 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512_init 233: 0000000000014e70 114 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512 342: 0000000000012330 6 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512_bytes 351: 0000000000012340 6 FUNC GLOBAL DEFAULT 11 crypto_hash_sha512_statebytes The canonical source doesn't seem to have the function https://github.com/jedisct1/libsodium/search?utf8=%E2%9C%93&q=+crypto_hash_… so I'm curious where the "_ref" comes from. My options seem... * Compile a 64-bit libsodium from source which includes "_ref" functions. Where is such source? * Use the system libsodium and define an FFI callout just for the one function I need. cheers -ben

Dec. 11, 2017

Re: [Pharo-users] OSEnvironment issue

by Eno

yes, you are right, it's caused by wrong VM, since by default, my images are opened by pharo 5 VM, I cann't change to pharo 6.1 anyway without manual effort. I would easily miss this point while saving to new image and reopen. BTW, another wierd error occured frequently, nearly everytime, i.e. system font error while runing IDEs. Error message: FT2Error: Freetype2 primitive failed[error 2][unknown file format] while calling FreeTypeFace>>create. The system would halt complete at that point and the debugger window also failed since they all depended upon the font to show. I tried to change the system via Setting Browser, but it was locked due to the same reason. -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

Dec. 11, 2017

Re: [Pharo-users] HMAC-SHA512

by Ben Coman

On 11 December 2017 at 03:08, henry <henry(a)callistohouse.club> wrote: > > -------- Original Message -------- > Subject: Re: [Pharo-users] HMAC-SHA512 > Local Time: December 10, 2017 1:20 PM > UTC Time: December 10, 2017 6:20 PM > From: sven(a)stfx.eu > To: Any question about pharo is welcome <pharo-users(a)lists.pharo.org> > > > On 10 Dec 2017, at 17:46, Ben Coman btc(a)openinworld.com wrote: > Thanks Sven. Its interesting to trace that through to put other stuff I've > read about HMAC into perspective. > However SHA256 != SHA512 which is a defined requirement of the site I'm > accessing. > > I was too quick. > > There is also http://www.samadhiweb.com/blog/2017.02.18.shacrypt.html > > I prefer code written in Pharo, but if you need real performance, then > native code will be needed. Are you sure SHA512 is not in the Cryptography > package ? > > > SHA512 is not in the Cryptography package, but it would be great to see it > there, with an appropriate plugin, of course, for performance. I am toying > with the idea of extending SSL to include TLS 1.3, and that would require > SHA512, plus it would be great to keep the Cryptography package current. > Adding TLS 1.3 would be a fair amount of work requiring Diffie-Hellman > group extensions to ephemeral elliptic curves, in addition. I am unsure > what symmetric ciphers are used by TLS 1.3 also. The advantage is that it > is automatically cross-platform, even with plugin generation, such that > Cryptography could be used on the big 3 as well as on ARM, Android and iOS. > I'll keep dreaming about it. > Given that SSL is "so last century" [ https://www.polyglotdeveloper.com/timeline/2015-07-01-ssl-tls-timeline/] with security issues [Section 2.2 https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practi… ] and latency improvements in upcoming TLS1.3 [ https://www.keycdn.com/blog/tls-1-3] perhaps this would make a good bounty to be done outside the current planned work for engineering resources. There seem several potential resources available [ http://www.squeaksource.com/Cryptography.html] Could a plan be made to address TLS? cheers -ben

Dec. 11, 2017

Why do downloads not use HTTPS by default?

by Silent Walls

Today I visited https://pharo.org/gnu-linux-installation-64 to download the zip file containing the executable. To my surprise, the download is not carried out over HTTPS. The download link is http://files.pharo.org/platform/Pharo6.1-64-linux.zip. I ended up downloading the zip file using https://files.pharo.org/platform/Pharo6.1-64-linux.zip. The point is: if HTTPS downloads are supported, why is it not the default on the download pages of the Pharo website?

Dec. 10, 2017

Re: [Pharo-users] Using a TreePresenter

by Nicolai Hess

2017-11-27 20:40 GMT+01:00 Prof. Andrew P. Black <black(a)cs.pdx.edu>: > I'm trying to use a (subclass of a) TreePresenter that is populated with > FileReferences. I see that the current selection is, reasonably enough, a > TreeNodePresenter, so I'm assuming that to *set* a selection > programatically, I'm going to have to find the right TreeNodePresenter. > > So I've assumed a method allItemsDo: that I'm trying to write on my > subclass of TreePresenter that will iterate through all of the TreeNodes > and let me do stuff, such as looking at their #content to see if this is a > node that I'm interested in. > > But I can't! The #roots method of TreePresenter doesn't give me the root > TreeNodePresenters; it gives me the file references that they contain. How > do I iterate over the TreeNodePresenters? Or am I going about this in > entirely the wrong way? > I find the way the TreeNodeModel (or TreeNodePresenter) is used strange too. I think it is to tightly bound to the underlaying morphic tree ui. (seems a TreeNode is only created during morphic interaction). What I have seen on some other projects (pharo launcher for example). They are creating a TreeNode when building the root of the tree itself. tree roots: (something that creates the root "raw nodes") collect:[:item | build a TreeNode with this content]. But this does not fully work, as for example tree root last selected:[true] "< really selects the item" tree root last selectAllChildren "< still does not change the selection of the nodes in the tree morph." > > Andrew > >

Dec. 10, 2017

Re: [Pharo-users] HTTP request question for an arango driver

by Norbert Hartl

> Am 10.12.2017 um 20:35 schrieb Yann Lesage <yannlesag(a)gmail.com>: > > > >> Le 10/12/2017 Ã 19:18, Sven Van Caekenberghe a Ã©crit : >> >>>> On 9 Dec 2017, at 18:34, Yann Lesage <yannlesag(a)gmail.com> wrote: >>>> >>>> >>>> >>>> Le 09/12/2017 Ã 15:52, Sven Van Caekenberghe a Ã©crit : >>>> Hi Yann, >>>> >>>> Zinc HTTP Components can do 1000s of requests per second, to localhost (so excluding a real network) and using a single ZnClient instance with a reused connection (HTTP/1.1's default). Of course, data size is also a factor, I am talking about small requests/responses. >>>> >>>> I browsed your code a bit on GitHub. You do reuse an instance, so that is good. But I think you are using HTTPS (TLS), which is a real slowdown (encryption is native, but costs real resources). Also, your data payload is using JSON which also adds a cost (parsing, generating). >>> Thanks for this review. >>>> So what you measured sounds about right. You might be able to optimise a bit, but that won't give you a factor 10 improvement, IMHO. The trick is usually to make as few requests as possible. >>> A factor of 10 maximum ? Ok, this indication help me. >> If you cache and reuse a single ZnClient instance, that is already good. Maybe try once without SSL to see how much difference that makes. You could also try to disable logging. As in >> >> ZnClient new in: [ :client | >> [ client get: 'http://localhost:8080' ] benchFor: 5 seconds ]. >> >> vs. >> >> ZnClient new in: [ :client | >> client loggingOff. >> [ client get: 'http://localhost:8080' ] benchFor: 5 seconds ]. >> >> You can also try to run in a Time profiler, but the server time is hard to abstract away from. > Use SSL or not is set by ZNCLient in fonction of url (http or https), no ? If there an option to set completely off SSL, I don't think is a good idea to use it. SSL is a real improve in security when we connect to a distant server. > It depends on what need. If you try to get maximum performance you should try without SSL to see the difference and tell us ;) Be able to use SSL enables easy setups of multiple hosts with a standalone application. If you need maximum performance the apllication setup might be different. The OS can add encryption transparently and much faster. What we use is several machines with a second network card and a private switch where they are attached to. So no need to add extra security > For the logs, I did not see that they were active by default. LoggingOff improve the perf thanks. > > I have already look with a TimeProfiler, and yes, it's difficult to extract an information. > >> >>> For the trick, I know it. But it's must be performed by user no ? >> Yes, the more you do in a single netwerk round trip, the better. Aggregation is good. > > Aggregation is possible for user with AQL(Arango Query Langage). > >>>> Sven >>>> >>>>> On 8 Dec 2017, at 16:32, Yann Lesage <yannlesag(a)gmail.com> wrote: >>>>> >>>>> Hello, >>>>> >>>>> >>>>> I write an driver for Arangodb . So like it's indicated in Arango documentation, I use the HTTP API. The repo is https://github.com/Valtena/Pharango >>>>> >>>>> >>>>> Now, the problem : Arango using Znclient make around 1 000 requests/second. >>>>> >>>>> >>>>> And the question : Are there any recommended pratice to have the better performance with ZNClient or a better way to perform lot of HTTP requests ? >>>>> >>>>> >>>>> Thanks for your attention, >>>>> >>>>> Yann Lesage >>>>> >>>>> >>>>> >>> >> >

Dec. 10, 2017

Re: [Pharo-users] HTTP request question for an arango driver

by Stephan Eggermont

Op 10-12-2017 om 20:35 schreef Yann Lesage: > ? If there an option to set completely off SSL, I don't think is a good > idea to use it. SSL is a real improve in security when we connect to a > distant server. Depending on what you need to secure against, using a single or a few secure shared tunnel(s) might be good enough Stephan

Dec. 10, 2017

Re: [Pharo-users] HTTP request question for an arango driver

by Yann Lesage

Le 10/12/2017 Ã 19:18, Sven Van Caekenberghe a Ã©critÂ : > >> On 9 Dec 2017, at 18:34, Yann Lesage <yannlesag(a)gmail.com> wrote: >> >> >> >> Le 09/12/2017 Ã 15:52, Sven Van Caekenberghe a Ã©crit : >>> Hi Yann, >>> >>> Zinc HTTP Components can do 1000s of requests per second, to localhost (so excluding a real network) and using a single ZnClient instance with a reused connection (HTTP/1.1's default). Of course, data size is also a factor, I am talking about small requests/responses. >>> >>> I browsed your code a bit on GitHub. You do reuse an instance, so that is good. But I think you are using HTTPS (TLS), which is a real slowdown (encryption is native, but costs real resources). Also, your data payload is using JSON which also adds a cost (parsing, generating). >> Thanks for this review. >>> So what you measured sounds about right. You might be able to optimise a bit, but that won't give you a factor 10 improvement, IMHO. The trick is usually to make as few requests as possible. >> A factor of 10 maximum ? Ok, this indication help me. > If you cache and reuse a single ZnClient instance, that is already good. Maybe try once without SSL to see how much difference that makes. You could also try to disable logging. As in > > ZnClient new in: [ :client | > [ client get: 'http://localhost:8080' ] benchFor: 5 seconds ]. > > vs. > > ZnClient new in: [ :client | > client loggingOff. > [ client get: 'http://localhost:8080' ] benchFor: 5 seconds ]. > > You can also try to run in a Time profiler, but the server time is hard to abstract away from. Use SSL or not is set by ZNCLient in fonction of url (http or https), no ? If there an option to set completely off SSL, I don't think is a good idea to use it. SSL is a real improve in security when we connect to a distant server. For the logs, I did not see that they were active by default. LoggingOff improve the perf thanks. I have already look with a TimeProfiler, and yes, it's difficult to extract an information. > >> For the trick, I know it. But it's must be performed by user no ? > Yes, the more you do in a single netwerk round trip, the better. Aggregation is good. Aggregation is possible for user with AQL(Arango Query Langage). >>> Sven >>> >>>> On 8 Dec 2017, at 16:32, Yann Lesage <yannlesag(a)gmail.com> wrote: >>>> >>>> Hello, >>>> >>>> >>>> I write an driver for Arangodb . So like it's indicated in Arango documentation, I use the HTTP API. The repo is https://github.com/Valtena/Pharango >>>> >>>> >>>> Now, the problem : Arango using Znclient make around 1 000 requests/second. >>>> >>>> >>>> And the question : Are there any recommended pratice to have the better performance with ZNClient or a better way to perform lot of HTTP requests ? >>>> >>>> >>>> Thanks for your attention, >>>> >>>> Yann Lesage >>>> >>>> >>>> >> >

Dec. 10, 2017

Re: [Pharo-users] HMAC-SHA512

by henry

> -------- Original Message -------- > Subject: Re: [Pharo-users] HMAC-SHA512 > Local Time: December 10, 2017 1:20 PM > UTC Time: December 10, 2017 6:20 PM > From: sven(a)stfx.eu > To: Any question about pharo is welcome <pharo-users(a)lists.pharo.org> > >> On 10 Dec 2017, at 17:46, Ben Coman btc(a)openinworld.com wrote: >> Thanks Sven. Its interesting to trace that through to put other stuff I've read about HMAC into perspective. >> However SHA256 != SHA512 which is a defined requirement of the site I'm accessing. >> >> I was too quick. >> >> There is also http://www.samadhiweb.com/blog/2017.02.18.shacrypt.html >> >> I prefer code written in Pharo, but if you need real performance, then native code will be needed. Are you sure SHA512 is not in the Cryptography package ? SHA512 is not in the Cryptography package, but it would be great to see it there, with an appropriate plugin, of course, for performance. I am toying with the idea of extending SSL to include TLS 1.3, and that would require SHA512, plus it would be great to keep the Cryptography package current. Adding TLS 1.3 would be a fair amount of work requiring Diffie-Hellman group extensions to ephemeral elliptic curves, in addition. I am unsure what symmetric ciphers are used by TLS 1.3 also. The advantage is that it is automatically cross-platform, even with plugin generation, such that Cryptography could be used on the big 3 as well as on ARM, Android and iOS. I'll keep dreaming about it.

Dec. 10, 2017

Re: [Pharo-users] HMAC-SHA512

by Sven Van Caekenberghe

> On 10 Dec 2017, at 17:46, Ben Coman <btc(a)openinworld.com> wrote: > > Thanks Sven. Its interesting to trace that through to put other stuff I've read about HMAC into perspective. > However SHA256 != SHA512 which is a defined requirement of the site I'm accessing. I was too quick. There is also http://www.samadhiweb.com/blog/2017.02.18.shacrypt.html I prefer code written in Pharo, but if you need real performance, then native code will be needed. Are you sure SHA512 is not in the Cryptography package ?

Dec. 10, 2017