February 2017 - Pharo-users

Re: [Pharo-users] Voyage hang..

by Hilaire

Got it! Hilaire Le 22/02/2017 Ã 15:22, Esteban Lorenzano a Ã©crit : > I know, but I donât know what it has or has not that version. -- Dr. Geo http://drgeo.eu

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Esteban Lorenzano

I know, but I donât know what it has or has not that version. Esteban > On 22 Feb 2017, at 15:15, Hilaire <hilaire(a)drgeo.eu> wrote: > > Here is the version I have, not sure it is the right way to get the > version number: > > ConfigurationOfVoyageMongo project currentVersion >=1.3.3 > [ConfigurationOfVoyageMongo] > > Le 22/02/2017 Ã 15:02, Esteban Lorenzano a Ã©crit : >> and probably the version for Pharo 4 does not have the fixâ¦ I do not remember exactly where was the problem, let me review a bit... > > -- > Dr. Geo > http://drgeo.eu > >

Feb. 22, 2017

Re: [Pharo-users] Data Encryption

by Alexandre Bergel

This is impressive Alejandro! Thanks for the explanation Alexandre > Le 22 fÃ©vr. 2017 Ã 01:17, Alejandro Infante <alejandroinfante91(a)gmail.com> a Ã©crit : > > Hi! > If it help Iâm using NaCl to do secure the passwords. You should not store the passwords of your users, not even encrypted. > > For securing the passwords I use Sha-512 over the salted password. > ââââââââââââ > User>>initialize > super initialize. > salt := (Nacl randomBytes: 16) > > User>>setPassword: aPassword > hashedPassword := Nacl hash: (salt , aPassword asByteArray) > > User>>validatePassword: aPassword > ^ hashedPassword asByteArray = (Nacl hash: salt asByteArray , aPassword asByteArray) > ââââââââââââ > > Notice that: > 1) I have a different salt for each password, if a bad guy want the passwords he is going to need a different rainbow table for each user. > 2) I do not store the password. I do not even store the hash of the plain password. > 3) Still Iâm able to validate the password. > > * Note that Iâm using Nacl>>randomBytes: to generate a cryptographically safe random value. Here is not really necessary, BUT you should use it if you are creating Session-IDs or Tokens. > > Encrypting the database is *tricky*. You not only have to encrypt the database, but also secure the key. First you need to know how much security you want: > 1) Be secure if someone hack into the user running pharo. > 3) Be secure if someone steal the server. > 4) Be secure if someone has physical access to the running server. (All your keys are in RAM) > 2) Be secure if someone hack root. (I doubt anything is going to save you here) > > For most projects/business (unless working with really sensitive data, such as medical data) securing the OS (users and root) and encrypting the hard-disk should be enough. Also do not forget to encrypt the connections. If everything is on the same server just use https. But you may need more if you use Load Balancers, multiple servers and databases. > > Cheers, > Alejandro > >> On Feb 21, 2017, at 9:11 AM, Mariano Martinez Peck <marianopeck(a)gmail.com> wrote: >> >> As for single username/pass encryption (not the whole DB), and assuming you want two-way encrypt (that you want to decrypt), I have used both, Rijndael and Blowfish, both in combination with SpsSplitPasswordStore. >> >> Cheers, >> >>> On Tue, Feb 21, 2017 at 8:20 AM, Pierce Ng <pierce(a)samadhiweb.com> wrote: >>> On Mon, Feb 20, 2017 at 05:34:41AM -0800, sergio ruiz wrote: >>> > I have been tasked with throwing together a small web app that will hold >>> > the passwords to different projects for my company. >>> >>> Here is a collection for reference. If one of these is suitable you can skip the >>> implementation and just deploy. >>> >>> http://opensourcepasswordmanager.com/ >>> >>> > - encrypt the entire database, so that if the machine was compromised >>> > physically, the data would be useless. >>> >>> The NativeBoost version of my SQLite library supports SQLcipher which adds >>> transparent full database encryption to SQLite. It is not in the UFFI version >>> yet though. >>> >>> http://sqlcipher.net >>> >>> > - encrypt the username and password fields to facilitate the above, also. >>> >>> If you are already familiar with using crypto API like OpenSSL or NaCl then >>> Pharo's FFI is easy to get this done too. >>> >>> Pierce >>> >>> >> >> >> >> -- >> Mariano >> http://marianopeck.wordpress.com >

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Hilaire

Here is the version I have, not sure it is the right way to get the version number: ConfigurationOfVoyageMongo project currentVersion >=1.3.3 [ConfigurationOfVoyageMongo] Le 22/02/2017 Ã 15:02, Esteban Lorenzano a Ã©crit : > and probably the version for Pharo 4 does not have the fixâ¦ I do not remember exactly where was the problem, let me review a bit... -- Dr. Geo http://drgeo.eu

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Esteban Lorenzano

yep, that can be the problem: symbol/string incompatibilities Esteban > On 22 Feb 2017, at 15:05, Hilaire <hilaire(a)drgeo.eu> wrote: > > So far, I edited this method, adding a final string conversion: > > voyageCollectionName > "This method can be overridden with a more meaningful collection name" > ^ (((self persistentClass name first: 3) allSatisfy: #isUppercase) > ifTrue: [ (self persistentClass name allButFirst: 2) ] > ifFalse: [ self persistentClass name ]) asString > > > > Le 22/02/2017 Ã 15:02, Esteban Lorenzano a Ã©crit : >> yes, there was a bug around that, now I remember. >> and probably the version for Pharo 4 does not have the fixâ¦ I do not remember exactly where was the problem, let me review a bit... > > -- > Dr. Geo > http://drgeo.eu > >

Feb. 22, 2017

Re: [Pharo-users] UFFI and ByteArray

by Raffaello Giulietti

Hi Esteban, not sure I'm understanding your snippet correctly. Below is my try. It throws a SubscriptOutOfBounds exception in the last line. The reason is that the implementation of ByteArray replaceFrom:to:with:startingAt: does not consider that ea is meant to be a pointer to a C byte array, not an object whose content is to be copied directly. | ea ba | ea := ExternalAddress gcallocate: 200. ba := ByteArray new: 100. ba replaceFrom: 1 to: 50 with: ea startingAt: 51. Am I missing some point? On 2017-02-21 17:20, Esteban Lorenzano wrote: > usually, something more or less like this: > > sourceByteArrayOrExternalAddress := â¦ some ... > destEnternalAddressOrByteArray > replaceFrom: 1 > to: sourceByteArrayOrExternalAddress size > with: sourceByteArrayOrExternalAddress > startingAt: 1 > > and or course you can play with the starting points and sizes. > > cheers, > Esteban > > >> On 21 Feb 2017, at 17:13, Raffaello Giulietti <raffaello.giulietti(a)lifeware.ch> wrote: >> >> Hi, >> >> I'm having a hard time finding documentation on how to copy a portion of a ByteArray to/from another portion of a heap allocated C byte array with UFFI. >> >> My current reference is https://ci.inria.fr/pharo-contribution/view/Books/job/PharoBookWorkInProgre… >> >> Thanks for directing me at relevant docs or examples and sorry in advance if I missed some important point in the docs. >> >> RG >> >> > >

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Hilaire

So far, I edited this method, adding a final string conversion: voyageCollectionName "This method can be overridden with a more meaningful collection name" ^ (((self persistentClass name first: 3) allSatisfy: #isUppercase) ifTrue: [ (self persistentClass name allButFirst: 2) ] ifFalse: [ self persistentClass name ]) asString Le 22/02/2017 Ã 15:02, Esteban Lorenzano a Ã©crit : > yes, there was a bug around that, now I remember. > and probably the version for Pharo 4 does not have the fixâ¦ I do not remember exactly where was the problem, let me review a bit... -- Dr. Geo http://drgeo.eu

Feb. 22, 2017

Re: [Pharo-users] Data Encryption

by Ben Coman

On Wed, Feb 22, 2017 at 9:21 PM, sergio ruiz <sergio.rrd(a)gmail.com> wrote: > > for whatever reason, they want something written from scratch.. in house.. are they aware of Schneier's Law... * https://www.schneier.com/blog/archives/2011/04/schneiers_law.html * https://www.schneier.com/essays/archives/1999/03/cryptography_the_imp.html cheers -ben

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Esteban Lorenzano

yes, there was a bug around that, now I remember. and probably the version for Pharo 4 does not have the fixâ¦ I do not remember exactly where was the problem, let me review a bit... Esteban > On 22 Feb 2017, at 14:51, Hilaire <hilaire(a)drgeo.eu> wrote: > > I though String may be problematic, so I try with Association. > The problem still occurs at, > self collectionAt: anObject class inDatabase: db > > There I can see at least a command failed error. > The collection can't be added. > > In addCollection: aString capped: aCapped size: aSize max: aMax, the > reply from DB is: > > a Dictionary('code'->15888 'errmsg'->'exception: must pass name of > collection to create' 'ok'->0.0 ) > > Le 22/02/2017 Ã 14:40, Esteban Lorenzano a Ã©crit : >> no, but String probably will be complicated to persist âas isâ (is not directly mappeable to a JSON/BSON object). Better to test with another object (like your original post). >> we need to see what is the error youâre gettingâ¦ the loop seems to be happening in a resignalAs: so there is an error somewhere (not that is good it resignal it instead showing it, but letâs go in parts :P) >> >> Esteban > > -- > Dr. Geo > http://drgeo.eu > >

Feb. 22, 2017

Re: [Pharo-users] Voyage hang..

by Hilaire

It looks like the collection name by default is a symbol, and Mongo does not like it. In my example aString = #Association A asString conversion seems to please it. addCollection: aString capped: aCapped size: aSize max: aMax | command reply | command := SmallDictionary new. command at: 'create' put: aString asString. Regarding default voyageCollectionName, it indeeds return a Symbol. Association voyageCollectionName. => #Association By an extraordinatry circumstance, when apply to my domain object, it returns a string, therefore I did not notice the problem before: CGOrganisation voyageCollectionName. => 'Organisations' Not sure it is the exact cause of the problem. Hilaire -- Dr. Geo http://drgeo.eu

Feb. 22, 2017