June 2017 - Pharo-users - lists.pharo.org

Re: [Pharo-users] Are we able to run pharo images in a read only environment?

by Tim Mackinnon

Wow that's very promising - how do I get that setup? I also believe for lambda I need 64 bit as you have little control of the base image? I haven't had a chance to try marshalling results back to Alexa yet - but that's my goal. Tim Sent from my iPhone > On 30 Jun 2017, at 15:43, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:> > >> On 27 Jun 2017, at 21:15, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:>> >> >>> On 27 Jun 2017, at 21:00, Esteban A. Maringolo >>> <emaringolo(a)gmail.com> wrote:>>> >>> Interesting experiment. >>> >>> It would be good to know how fast does the image boot and start >>> execution in the context of a service billed at the sub second >>> scale.>> >> Sadly I have the impression we lost some speed: >> >> ~/pharo64$ ./pharo Pharo.image printVersion >> [version] 6.0 #60499 >> >> ~/pharo64$ time ./pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m1.276s >> user 0m0.985s >> sys 0m0.171s >> >> while before >> >> ~/pharo/build$ ../bin/pharo Pharo.image printVersion >> [version] 4.0 #40620 >> >> $ time ../bin/pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m0.526s >> user 0m0.434s >> sys 0m0.045s >> >> But it is really hard to find the cause. > > The good news is that the Pharo 7 minimal core is way faster > > $ time ./pharo ~/Downloads/Pharo7.0-core-32bit-b649ac6.image eval "42 > factorial"> 1405006117752879898543142606244511569936384000000000 > > real 0m0.262s > user 0m0.132s > sys 0m0.062s > > Which is good of course ! > >> That being said, these lambda servers can only work well if they keep >> instances alive for longer when there is enough traffic.>> >>> Esteban A. Maringolo >>> >>> >>> 2017-06-27 13:05 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >>>> Hi - I am trying to run a pharo image in lambda (as an experiment) >>>> - however>>>> I get an error from Pharo about not being able to write to the >>>> changes file?>>>> >>>> As I am just evaluating some code - Iâm not really coding, so donât >>>> need a>>>> changes file - is there a command line option to not require it? >>>> >>>> Also, am I running pharo the most efficient way - Iâm using eval >>>> on the>>>> command line and referencing a class with a class method - but is >>>> this the>>>> best way? >>>> >>>> Thanks, >>>> >>>> Tim >>>> >>>> "errorMessage": "Command failed: ./pharo Pharo.image eval \"Lambda>>>> processJSON: >>>> '{\"key3\":\"value3\",\"key2\":\"value2\",\"key1\":\"value1\"}'\"\- >>>> n'Pharo>>>> cannot write to the changes file named >>>> /var/task/Pharo.changes.\n\nPlease>>>> check that you have write permission for this file.\n\nYou won''t >>>> be able to>>>> save this image correctly until you fix this.'\n\u001b[31mError: >>>> Can't find>>>> the requested >>>> origin\n\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginErr- >>>> or\n[ self>>>> cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:- >>>> \nUnixResolver>>home\n[>>>> self home / '.config' ] in UnixResolver>>preferences in Block: [ >>>> self home />>>> '.config' >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver>>preferences\nUnixResolver(FileSystemResolver)>>r- >>>> esolve:\nSystemResolver(FileSystemResolver)>>unknownOrigin:\nSyste- >>>> mResolver(FileSystemResolver)>>resolve:\nInteractiveResolver>>unkn- >>>> ownOrigin:\n[>>>> self unknownOrigin: origin ] in InteractiveResolver>>resolve: in >>>> Block: [>>>> self unknownOrigin: origin >>>> ]\nIdentityDictionary(Dictionary)>>at:ifAbsent:\nInteractiveResolv- >>>> er>>resolve:\nFileLocator>>resolve\nFileLocator(AbstractFileRefere- >>>> nce)>>exists\nGlobalIdentifierStonPersistence(GlobalIdentifierPers- >>>> istence)>>shouldCallPreviousPersistence\nGlobalIdentifierStonPersi- >>>> stence(GlobalIdentifierPersistence)>>ensure:\nGlobalIdentifier>>en- >>>> sure\nGlobalIdentifier>>>> class>>initializeUniqueInstance\nGlobalIdentifier >>>> class>>uniqueInstance\nSystemSettingsPersistence >>>> class>>resumeSystemSettings\n[ :persistence | persistence >>>> resumeSystemSettings ] in PharoCommandLineHandler>>runPreferences >>>> in Block:>>>> [ :persistence | persistence resumeSystemSettings >>>> ...etc...\nBlockClosure>>cull:\nSystemDictionary(Dictionary)>>at:i- >>>> fPresent:\nSmalltalkImage>>at:ifPresent:\nPharoCommandLineHandler>- >>>> >runPreferences\nPharoCommandLineHandler>>activate\nPharoCommandLi- >>>> neHandler>>>> class(CommandLineHandler class)>>activateWith:\n\u001b[0m", >>>> "errorType": "Error", >>>> "stackTrace": [ >>>> "'Pharo cannot write to the changes file named >>>> /var/task/Pharo.changes.", >>>> "", >>>> "Please check that you have write permission for this file.", >>>> "", >>>> "You won''t be able to save this image correctly until you fix >>>> this.'",>>>> "\u001b[31mError: Can't find the requested origin", >>>> "\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginError", >>>> "[ self cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:",>>>> "UnixResolver>>home", >>>> "[ self home / '.config' ] in UnixResolver>>preferences in Block: >>>> [ self>>>> home / '.config' ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver>>preferences", >>>> "UnixResolver(FileSystemResolver)>>resolve:", >>>> "SystemResolver(FileSystemResolver)>>unknownOrigin:", >>>> "SystemResolver(FileSystemResolver)>>resolve:", >>>> "InteractiveResolver>>unknownOrigin:", >>>> "[ self unknownOrigin: origin ] in >>>> InteractiveResolver>>resolve: in>>>> Block: [ self unknownOrigin: origin ]", >>>> "IdentityDictionary(Dictionary)>>at:ifAbsent:", >>>> "InteractiveResolver>>resolve:", >>>> "FileLocator>>resolve", >>>> "FileLocator(AbstractFileReference)>>exists", >>>> >>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>sho- >>>> uldCallPreviousPersistence",>>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>en- >>>> sure:",>>>> "GlobalIdentifier>>ensure", >>>> "GlobalIdentifier class>>initializeUniqueInstance", >>>> "GlobalIdentifier class>>uniqueInstance", >>>> "SystemSettingsPersistence class>>resumeSystemSettings", >>>> "[ :persistence | persistence resumeSystemSettings ] in >>>> PharoCommandLineHandler>>runPreferences in Block: [ :persistence |>>>> persistence resumeSystemSettings ...etc...", >>>> "BlockClosure>>cull:", >>>> "SystemDictionary(Dictionary)>>at:ifPresent:", >>>> "SmalltalkImage>>at:ifPresent:", >>>> "PharoCommandLineHandler>>runPreferences", >>>> "PharoCommandLineHandler>>activate", >>>> "PharoCommandLineHandler class(CommandLineHandler >>>> class)>>activateWith:", >>>> "\u001b[0m", >>>> "ChildProcess.exithandler (child_process.js:204:12)", >>>> "emitTwo (events.js:106:13)", >>>> "ChildProcess.emit (events.js:191:7)", >>>> "maybeClose (internal/child_process.js:886:16)", >>>> "Process.ChildProcess._handle.onexit >>>> (internal/child_process.js:226:5)">>>> ] >>>> } >>>> >>>> >>> >> > >

June 30, 2017

Re: Validate password with PBKDF2

by Francis

Ah-ha! You are right, the proper way to encrypt is with the salt and then prepend the salt. Thanks Francis FIY does not give a ByteArray because UUID is a subclass of ByteArray and asByteArray returns self Erik Stel wrote > Francis, > > You're using an empty salt when creating the hash. Just prepending a > random number does not add much security. Anyone knowing your solution > will just prepend a random number. And creating only a few accounts in > your system will probably reveal that information as well. A wrong-doer > will just use a fake salt and will still be able to try a rainbow table > attack. > > Please use a real random value for the salt. And easiest would be to give > it a fixed size. > > (Don't have an image and/or code available, so this might lead to some > pseudo code ;-) > > To generate a safe password hash which you can store in your db, the > following method. It creates a random number (your example of a UUID of 16 > bytes) and uses that as a salt for the password hash. Both values are then > concatenated and returned as a 'safe' password. This can be stored in your > db. > > To validate a user's password you retrieve the safePasswordHash from your > db (based on the user's id) and validate the given password against it. > For this the salt is retrieved from the safePasswordHash (first 16 bytes > because UUID is 16 bytes) and it is then used to calculate the hash of the > given password. It should match the second part of the safePasswordHash. > > Hope this helps. > > For real safety, please add some checks for valid values. Did we receive a > valid password? Is the safePasswordHash the correct length (in this case > 32 bytes)? You might consider using another salt generator than UUID. > > Cheers, > Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953138.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] FUEL documentation

by Juraj Kubelka

Thank you! Juraj > El 30-06-2017, a las 22:55, Sven Van Caekenberghe <sven(a)stfx.eu> escribiÃ³: > > >> On 30 Jun 2017, at 22:40, Juraj Kubelka <juraj.kubelka(a)icloud.com> wrote: >> >> (sorry, I have accidentally pressed send button) >> >> Hi, >> >> Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. >> >> I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. >> >> So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. >> >> Thanks! >> Juraj > > FUEL documentation is actually very good: https://rmod.inria.fr/web/software/Fuel > >

June 30, 2017

Re: [Pharo-users] FUEL documentation

by Sven Van Caekenberghe

> On 30 Jun 2017, at 22:40, Juraj Kubelka <juraj.kubelka(a)icloud.com> wrote: > > (sorry, I have accidentally pressed send button) > > Hi, > > Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. > > I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. > > So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. > > Thanks! > Juraj FUEL documentation is actually very good: https://rmod.inria.fr/web/software/Fuel

June 30, 2017

FUEL documentation

by Juraj Kubelka

(sorry, I have accidentally pressed send button) Hi, Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. Thanks! Juraj

June 30, 2017

FUEL documentation

by Juraj Kubelka

Hi, Is there any documentation about FUEL? I would like to understand in more detail what data -- Juraj Kubelka

June 30, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Erik Stel

Francis, You're using an empty salt when creating the hash. Just prepending a random number does not add much security. Anyone knowing your solution will just prepend a random number. And creating only a few accounts in your system will probably reveal that information as well. A wrong-doer will just use a fake salt and will still be able to try a rainbow table attack. Please use a real random value for the salt. And easiest would be to give it a fixed size. (Don't have an image and/or code available, so this might lead to some pseudo code ;-) To generate a safe password hash which you can store in your db, the following method. It creates a random number (your example of a UUID of 16 bytes) and uses that as a salt for the password hash. Both values are then concatenated and returned as a 'safe' password. This can be stored in your db. To validate a user's password you retrieve the safePasswordHash from your db (based on the user's id) and validate the given password against it. For this the salt is retrieved from the safePasswordHash (first 16 bytes because UUID is 16 bytes) and it is then used to calculate the hash of the given password. It should match the second part of the safePasswordHash. Hope this helps. For real safety, please add some checks for valid values. Did we receive a valid password? Is the safePasswordHash the correct length (in this case 32 bytes)? You might consider using another salt generator than UUID. Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953129.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] [ANN] An evening with Pharo and the ESP32 microcontroller

by Ben Coman

On Fri, Jun 30, 2017 at 9:50 PM, Georges <gkgobith(a)gmail.com> wrote: > Cool stuff Ben! :) > > I dusted of my Arduino Uno and tried out reading the Serial Port using your > tutorial. > It would be nice for a follow up tutorial to write to the board and switch > the builtin led on/off ! > > Georges > Glad you liked it. Actually, I thought I might append to that article a section "Lets actually do something useful" to do that, and also read an analog input. The next article will be testing bulk analog data read over TCPIP WiFi connection. cheers -ben

June 30, 2017

Re: Validate password with PBKDF2

by Francis

Thanks Pierce and hernanmd I decided to adopt the solution of the prepended salt as Erik said in the previous post. Here is my code, I hope it can be useful for the community First I hash the password with an empty salt PBKDF2 derivedKeyHashFunction: SHA256 password: 'aSimplePassword' salt: '' iterations: 3000 length: 16 . I would have liked to avoid the empty salt but the message deriveKey needs it. Then I used UUID new as real salt and the string '$$' as separator between the salt and the hashed password. So here is the byte array I'm going to store in my db saltPlusHashedPassword := UUID new , '$$' asByteArray , (PBKDF2 derivedKeyHashFunction: SHA256 password: 'aSimplePassword' salt: '' iterations: 3000 length: 16 ). To validate the password, I retrieve the saltPlusHashedPassword from the db and splitting it hashedPassword := (saltPlusHashedPassword splitOn:('$$' asByteArray)) second. Finally the validation (PBKDF2 derivedKeyHashFunction: SHA256 password: 'aSimplePassword' salt: '' iterations: 3000 length: 16 ) = (ByteArray new, hashedPassword). Note, I have to concatenate ByteArray new with hashedPassword because hashedPassword is not a ByteAttay but a UUID, if you have a smarter way to do it you are welcome. HTH Francis Erik Stel wrote > Francis, > > The hashpw function returns a hash with the salt prepended. So it contains > both elements. (See for example explanation at: > https://stackoverflow.com/questions/27413248/why-can-bcrypt-hashpw-be-used-…) > > You can do the same thing here. Assuming you have a fixed size salt, just > prepend it before the hash value. Since the salt is (should be) random, > returning it's value does not weaken the security. Using a salt prevents > against rainbow table attacks: pre-generated hash values for many possible > passwords. (See https://en.wikipedia.org/wiki/Rainbow_table) > > Cheers, > Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953119.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] [ANN] An evening with Pharo and the ESP32 microcontroller

by Georges

Cool stuff Ben! :) I dusted of my Arduino Uno and tried out reading the Serial Port using your tutorial. It would be nice for a follow up tutorial to write to the board and switch the builtin led on/off ! Georges -- View this message in context: http://forum.world.st/ANN-An-evening-with-Pharo-and-the-ESP32-microcontroll… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] Validate password with PBKDF2

by HernÃ¡n Morales Durand

I guess I could integrate Udo's PBKDF2 into ApplicationSecurity. See under "Using the CheckPoint" if matches your API you're looking for: http://80738163270632.blogspot.com.ar/2014/10/application-security-2-checkp… Cheers, HernÃ¡n 2017-06-30 4:43 GMT-03:00 Francis via Pharo-users < pharo-users(a)lists.pharo.org>: > > > ---------- Mensaje reenviado ---------- > From: Francis <falzonidavide(a)libero.it> > To: pharo-users(a)lists.pharo.org > Cc: > Bcc: > Date: Fri, 30 Jun 2017 00:43:23 -0700 (PDT) > Subject: Re: Validate password with PBKDF2 > Thank you Paul, > Saving the salt is not a big issue but I'd like something more simple. > In python I can store the salt with the password > see:https://pypi.python.org/pypi/bcrypt/3.1.0 > > # Hash a password for the first time, with a randomly-generated salt > hashed = bcrypt.hashpw(password, bcrypt.gensalt()) > > and retrieve it subsequently > if bcrypt.checkpw(password, hashed): > ... print("It Matches!") > > Are you (smalltalkers) aware of something similar? > > Thanks again > Francis > > > > Paul DeBruicker wrote > > Looks like you'll have to store the salt when making the original hash of > > the password. > > > > With that you can do > > > > > > | salt originalPassword userInputPassword originalHash newHash secretKey > > | > > salt:='salt'. > > originalPassword:='password'. > > userInputPassword:='12345678'. > > originalHash:=PBKDF2 derivedKeySHA1Password: originalPassword salt: salt. > > newHash:=PBKDF2 derivedKeySHA1Password: userInputPassword salt: salt. > > > > secretKey:= SecureRandom new nextBytes: 16. > > > > ((SHA256 new hmac key: secretKey) digestMessage: originalHash) = ((SHA256 > > new hmac key: secretKey) digestMessage: newHash). > > > > > > > > We do the double SHA256 HMAC signing of the hashes because of > > https://www.nccgroup.trust/us/about-us/newsroom-and-events/ > blog/2011/february/double-hmac-verification/ > > > > You can store the #secretKey and each user should get a new #salt every > > time they change their password and you shouldn't reuse the salts for > > other users or password. > > > > For PBKDF2 there is probably a max (or recommended) salt length but I > > don't know it. > > > > I also don't know anything about the SecureRandom class but it says it on > > the tin, so maybe it is. Maybe not though. I don't know how to find > out. > > But I don't know that it matters in this instance as its only used for > the > > SHA256 HMAC internally in the comparison function. > > > > > > Hope this helps. > > > > > > Francis wrote > >> Hi folks > >> > >> I'm playing with the PBKDF2 package of Udo: > >> http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 > >> (thanks Udo), but I can't find how to validate a stored hash. > >> Can you point me in the right direction? > >> > >> Thanks > >> Francis > > > > > > -- > View this message in context: http://forum.world.st/ > Validate-password-with-PBKDF2-tp4952973p4953004.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. > > >

June 30, 2017

Re: [Pharo-users] Are we able to run pharo images in a read only environment?

by Sven Van Caekenberghe

> On 27 Jun 2017, at 21:15, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > >> On 27 Jun 2017, at 21:00, Esteban A. Maringolo <emaringolo(a)gmail.com> wrote: >> >> Interesting experiment. >> >> It would be good to know how fast does the image boot and start >> execution in the context of a service billed at the sub second scale. > > Sadly I have the impression we lost some speed: > > ~/pharo64$ ./pharo Pharo.image printVersion > [version] 6.0 #60499 > > ~/pharo64$ time ./pharo Pharo.image eval '42 factorial' > 1405006117752879898543142606244511569936384000000000 > > real 0m1.276s > user 0m0.985s > sys 0m0.171s > > while before > > ~/pharo/build$ ../bin/pharo Pharo.image printVersion > [version] 4.0 #40620 > > $ time ../bin/pharo Pharo.image eval '42 factorial' > 1405006117752879898543142606244511569936384000000000 > > real 0m0.526s > user 0m0.434s > sys 0m0.045s > > But it is really hard to find the cause. The good news is that the Pharo 7 minimal core is way faster $ time ./pharo ~/Downloads/Pharo7.0-core-32bit-b649ac6.image eval "42 factorial" 1405006117752879898543142606244511569936384000000000 real 0m0.262s user 0m0.132s sys 0m0.062s Which is good of course ! > That being said, these lambda servers can only work well if they keep instances alive for longer when there is enough traffic. > >> Esteban A. Maringolo >> >> >> 2017-06-27 13:05 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >>> Hi - I am trying to run a pharo image in lambda (as an experiment) - however >>> I get an error from Pharo about not being able to write to the changes file? >>> >>> As I am just evaluating some code - Iâm not really coding, so donât need a >>> changes file - is there a command line option to not require it? >>> >>> Also, am I running pharo the most efficient way - Iâm using eval on the >>> command line and referencing a class with a class method - but is this the >>> best way? >>> >>> Thanks, >>> >>> Tim >>> >>> "errorMessage": "Command failed: ./pharo Pharo.image eval \"Lambda >>> processJSON: >>> '{\"key3\":\"value3\",\"key2\":\"value2\",\"key1\":\"value1\"}'\"\n'Pharo >>> cannot write to the changes file named /var/task/Pharo.changes.\n\nPlease >>> check that you have write permission for this file.\n\nYou won''t be able to >>> save this image correctly until you fix this.'\n\u001b[31mError: Can't find >>> the requested >>> origin\n\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginError\n[ self >>> cantFindOriginError ] in >>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in Block: [ >>> self cantFindOriginError >>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:or:\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:\nUnixResolver>>home\n[ >>> self home / '.config' ] in UnixResolver>>preferences in Block: [ self home / >>> '.config' >>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:or:\nUnixResolver>>preferences\nUnixResolver(FileSystemResolver)>>resolve:\nSystemResolver(FileSystemResolver)>>unknownOrigin:\nSystemResolver(FileSystemResolver)>>resolve:\nInteractiveResolver>>unknownOrigin:\n[ >>> self unknownOrigin: origin ] in InteractiveResolver>>resolve: in Block: [ >>> self unknownOrigin: origin >>> ]\nIdentityDictionary(Dictionary)>>at:ifAbsent:\nInteractiveResolver>>resolve:\nFileLocator>>resolve\nFileLocator(AbstractFileReference)>>exists\nGlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>shouldCallPreviousPersistence\nGlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>ensure:\nGlobalIdentifier>>ensure\nGlobalIdentifier >>> class>>initializeUniqueInstance\nGlobalIdentifier >>> class>>uniqueInstance\nSystemSettingsPersistence >>> class>>resumeSystemSettings\n[ :persistence | persistence >>> resumeSystemSettings ] in PharoCommandLineHandler>>runPreferences in Block: >>> [ :persistence | persistence resumeSystemSettings >>> ...etc...\nBlockClosure>>cull:\nSystemDictionary(Dictionary)>>at:ifPresent:\nSmalltalkImage>>at:ifPresent:\nPharoCommandLineHandler>>runPreferences\nPharoCommandLineHandler>>activate\nPharoCommandLineHandler >>> class(CommandLineHandler class)>>activateWith:\n\u001b[0m", >>> "errorType": "Error", >>> "stackTrace": [ >>> "'Pharo cannot write to the changes file named >>> /var/task/Pharo.changes.", >>> "", >>> "Please check that you have write permission for this file.", >>> "", >>> "You won''t be able to save this image correctly until you fix this.'", >>> "\u001b[31mError: Can't find the requested origin", >>> "\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginError", >>> "[ self cantFindOriginError ] in >>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in Block: [ >>> self cantFindOriginError ]", >>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:or:", >>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:", >>> "UnixResolver>>home", >>> "[ self home / '.config' ] in UnixResolver>>preferences in Block: [ self >>> home / '.config' ]", >>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:or:", >>> "UnixResolver>>preferences", >>> "UnixResolver(FileSystemResolver)>>resolve:", >>> "SystemResolver(FileSystemResolver)>>unknownOrigin:", >>> "SystemResolver(FileSystemResolver)>>resolve:", >>> "InteractiveResolver>>unknownOrigin:", >>> "[ self unknownOrigin: origin ] in InteractiveResolver>>resolve: in >>> Block: [ self unknownOrigin: origin ]", >>> "IdentityDictionary(Dictionary)>>at:ifAbsent:", >>> "InteractiveResolver>>resolve:", >>> "FileLocator>>resolve", >>> "FileLocator(AbstractFileReference)>>exists", >>> >>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>shouldCallPreviousPersistence", >>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>ensure:", >>> "GlobalIdentifier>>ensure", >>> "GlobalIdentifier class>>initializeUniqueInstance", >>> "GlobalIdentifier class>>uniqueInstance", >>> "SystemSettingsPersistence class>>resumeSystemSettings", >>> "[ :persistence | persistence resumeSystemSettings ] in >>> PharoCommandLineHandler>>runPreferences in Block: [ :persistence | >>> persistence resumeSystemSettings ...etc...", >>> "BlockClosure>>cull:", >>> "SystemDictionary(Dictionary)>>at:ifPresent:", >>> "SmalltalkImage>>at:ifPresent:", >>> "PharoCommandLineHandler>>runPreferences", >>> "PharoCommandLineHandler>>activate", >>> "PharoCommandLineHandler class(CommandLineHandler >>> class)>>activateWith:", >>> "\u001b[0m", >>> "ChildProcess.exithandler (child_process.js:204:12)", >>> "emitTwo (events.js:106:13)", >>> "ChildProcess.emit (events.js:191:7)", >>> "maybeClose (internal/child_process.js:886:16)", >>> "Process.ChildProcess._handle.onexit (internal/child_process.js:226:5)" >>> ] >>> } >>> >>> >> >

June 30, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Erik Stel

Francis, The hashpw function returns a hash with the salt prepended. So it contains both elements. (See for example explanation at: https://stackoverflow.com/questions/27413248/why-can-bcrypt-hashpw-be-used-…) You can do the same thing here. Assuming you have a fixed size salt, just prepend it before the hash value. Since the salt is (should be) random, returning it's value does not weaken the security. Using a salt prevents against rainbow table attacks: pre-generated hash values for many possible passwords. (See https://en.wikipedia.org/wiki/Rainbow_table) Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953067.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] Logging in with VNC

by Pierce Ng

On Thu, Jun 29, 2017 at 08:59:18AM -0400, sergio ruiz wrote: > I need to be able to log in to my production image with VNC until i am > comfortable with the command line interface. I know that every time i have > had to do it, it seems like i used a different package. > > Which package is everyone using these days for remote GUI access? http://smalltalkhub.com/#!/~PharoExtras/RFB Tested working with X11 clients like Vinagre connecting to Pharo 5 in-image server. Pierce

June 30, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Pierce Ng

On Fri, Jun 30, 2017 at 12:43:23AM -0700, Francis via Pharo-users wrote: > Saving the salt is not a big issue but I'd like something more simple. > In python I can store the salt with the password > see:https://pypi.python.org/pypi/bcrypt/3.1.0 Hi, you could try PasswordCrypt: https://github.com/PierceNg/PasswordCrypt Pierce

June 30, 2017

Re: [Pharo-users] Custom Glamour browser for Dr. Geo scripting

by Hilaire

I extended the browser definition with: browser transmit from: #scripts; from: #categories; to: #methods; when: [ :a :b | a isMeta not ]; andShow: [:a | self methodsIn: a ]. browser transmit from: #scripts; from: #categories; to: #methods; when: [ :a | a isMeta ]; andShow: [:a | self classMethodsIn: a ]. However it does not work as #when: message always receive a class, so the wrong methods a re list in the method pane. I enclosed a Fileout of the browser. It works independently of DrGeo. When one select class methods, still the instance methods are displayed in right most pane. Any tips? Thanks Hilaire Le 29/06/2017 Ã 14:59, Hilaire a Ã©crit : > but something is missing to get the listed method right depending on the > category is instance or class side. I don't how to do it. -- Dr. Geo http://drgeo.eu

June 30, 2017

Re: Validate password with PBKDF2

by Francis

Thank you Paul, Saving the salt is not a big issue but I'd like something more simple. In python I can store the salt with the password see:https://pypi.python.org/pypi/bcrypt/3.1.0 # Hash a password for the first time, with a randomly-generated salt hashed = bcrypt.hashpw(password, bcrypt.gensalt()) and retrieve it subsequently if bcrypt.checkpw(password, hashed): ... print("It Matches!") Are you (smalltalkers) aware of something similar? Thanks again Francis Paul DeBruicker wrote > Looks like you'll have to store the salt when making the original hash of > the password. > > With that you can do > > > | salt originalPassword userInputPassword originalHash newHash secretKey > | > salt:='salt'. > originalPassword:='password'. > userInputPassword:='12345678'. > originalHash:=PBKDF2 derivedKeySHA1Password: originalPassword salt: salt. > newHash:=PBKDF2 derivedKeySHA1Password: userInputPassword salt: salt. > > secretKey:= SecureRandom new nextBytes: 16. > > ((SHA256 new hmac key: secretKey) digestMessage: originalHash) = ((SHA256 > new hmac key: secretKey) digestMessage: newHash). > > > > We do the double SHA256 HMAC signing of the hashes because of > https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/februa… > > You can store the #secretKey and each user should get a new #salt every > time they change their password and you shouldn't reuse the salts for > other users or password. > > For PBKDF2 there is probably a max (or recommended) salt length but I > don't know it. > > I also don't know anything about the SecureRandom class but it says it on > the tin, so maybe it is. Maybe not though. I don't know how to find out. > But I don't know that it matters in this instance as its only used for the > SHA256 HMAC internally in the comparison function. > > > Hope this helps. > > > Francis wrote >> Hi folks >> >> I'm playing with the PBKDF2 package of Udo: >> http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 >> (thanks Udo), but I can't find how to validate a stored hash. >> Can you point me in the right direction? >> >> Thanks >> Francis -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953004.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] Pharo6 playground saving semantics and .changes?

by Tim Mackinnon

Hi Offray - I hadn't understood your project was in this area, I'll have a look. It does sound like some tweaks in playground might be useful. Like many of these things though - you have to live with them for a while to really understand. Tim Sent from my iPhone Sent from my iPhone > On 29 Jun 2017, at 23:54, Offray Vladimir Luna CÃ¡rdenas <offray.luna(a)mutabit.com> wrote: > > Hi, > > Tim, I have made a project, called Grafoscopio, that, in its core, is > about saving playgrounds and embed them into bigger context/narratives. > You can see more details and examples here: > > [1] http://mutabit.com/grafoscopio/index.en.html > > Still needs work to do, for example improving English documentation and > discoverability, as Glenn suggested (Spanish page is better ranked in > search engines), but maybe you find it interesting for what you're > looking for. See the page at [1] and the examples, to see what is > possible at the moment. > > Cheers, > > Offray > > Ps: I share Esteban's concern on privacy and autosave feature, despite > of being useful, sometimes, for me and in the workshops. This behavior > should be disabled by default and turn on on user demand. (Maybe a tool > tip on first launch, like the one on anonymous metrics could help here > too). > >> On 29/06/17 15:55, Esteban A. Maringolo wrote: >> Please allow me a little rant here... >> >> I still find disturbing the"autosave" feature without having the >> option to explicitly save the contents in the filesystem as I did with >> Workspaces. Sometimes I don't want the contents of a file/tab updated >> by a criteria different than when to save the image, it is: my own >> when I consider appropriate. >> >> It's not I want to disable Playground by complete which I find useful >> when integrated with the inlined insector, but I want to keep the >> behavior of saving and restoring the contents under my control. >> >> Privacywise I don't like the "history" of previous contents in the >> Playground, the history it can be removed but it can't be disabled. I >> can condense the changes file, but the Playground history remains. >> >> Regards! >> >> >> Esteban A. Maringolo >> >> >> 2017-06-29 17:12 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >>> Cool - I was missing that insight. >>> >>> Tim >>> >>> Sent from my iPhone >>> >>>> On 29 Jun 2017, at 18:04, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >>>> >>>> One of the more hidden Playground features are named Pages. Double-click the page tab title and give it a name, it will then be saved automagically in pharo-local/play-stash (and auto saves on changes from then on). I use that all the time. >>>> >>>>> On 29 Jun 2017, at 16:45, Tim Mackinnon <tim(a)testit.works> wrote: >>>>> >>>>> Hi - I really like the playground metaphor, it really is such a nice way to experiment. >>>>> >>>>> However I've noticed that unlike older versions of Smalltalk, it seems that DoIt operations in playground don't end up in the .changes file anymore (which I guess is a mixed blessing when you want to recover). It seems that the new metaphor is that work you do is saved as a page and you can see versions of your page in the upper right menu? Well sort of - as I haven't quite understood when it saves or doesn't? Often I get duplicate looking pages in that menu and often I make a change and want to keep it but find it doesn't save and if I accidentally close my playground my changes in a page are lost? >>>>> >>>>> What are the semantics of page saving? >>>>> >>>>> An example - if you do a few gofer loads of utilities and the put a comment on the first line of the page (which gives it a nice title in the page dropdown), sometimes that comment will be saved other times not? >>>>> >>>>> I also think it might be nice to remove page versions to help tidy things up. I'm thinking of rolling my sleeves up on this idea - but wanted to understand the vision firsts >>>>> >>>>> Tim >>>>> >>>>> Sent from my iPhone >>>>> >>>>> >>>>> Sent from my iPhone > > >

June 30, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Paul DeBruicker

Looks like you'll have to store the salt when making the original hash of the password. With that you can do | salt originalPassword userInputPassword originalHash newHash secretKey | salt:='salt'. originalPassword:='password'. userInputPassword:='12345678'. originalHash:=PBKDF2 derivedKeySHA1Password: originalPassword salt: salt. newHash:=PBKDF2 derivedKeySHA1Password: userInputPassword salt: salt. secretKey:= SecureRandom new nextBytes: 16. ((SHA256 new hmac key: secretKey) digestMessage: originalHash) = ((SHA256 new hmac key: secretKey) digestMessage: newHash). We do the double SHA256 HMAC signing of the hashes because of https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/februa… You can store the #secretKey and each user should get a new #salt every time they change their password and you shouldn't reuse the salts for other users or password. For PBKDF2 there is probably a max (or recommended) salt length but I don't know it. I also don't know anything about the SecureRandom class but it says it on the tin, so maybe it is. Maybe not though. I don't know how to find out. But I don't know that it matters in this instance as its only used for the SHA256 HMAC internally in the comparison function. Hope this helps. Francis wrote > Hi folks > > I'm playing with the PBKDF2 package of Udo: > http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 > (thanks Udo), but I can't find how to validate a stored hash. > Can you point me in the right direction? > > Thanks > Francis -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4952985.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Validate password with PBKDF2

by Francis

Hi folks I'm playing with the PBKDF2 package of Udo: http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 (thanks Udo), but I can't find how to validate a stored hash. Can you point me in the right direction? Thanks Francis -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] Pharo6 playground saving semantics and .changes?

by Offray Vladimir Luna CÃ¡rdenas

Hi, Tim, I have made a project, called Grafoscopio, that, in its core, is about saving playgrounds and embed them into bigger context/narratives. You can see more details and examples here: [1] http://mutabit.com/grafoscopio/index.en.html Still needs work to do, for example improving English documentation and discoverability, as Glenn suggested (Spanish page is better ranked in search engines), but maybe you find it interesting for what you're looking for. See the page at [1] and the examples, to see what is possible at the moment. Cheers, Offray Ps: I share Esteban's concern on privacy and autosave feature, despite of being useful, sometimes, for me and in the workshops. This behavior should be disabled by default and turn on on user demand. (Maybe a tool tip on first launch, like the one on anonymous metrics could help here too). On 29/06/17 15:55, Esteban A. Maringolo wrote: > Please allow me a little rant here... > > I still find disturbing the"autosave" feature without having the > option to explicitly save the contents in the filesystem as I did with > Workspaces. Sometimes I don't want the contents of a file/tab updated > by a criteria different than when to save the image, it is: my own > when I consider appropriate. > > It's not I want to disable Playground by complete which I find useful > when integrated with the inlined insector, but I want to keep the > behavior of saving and restoring the contents under my control. > > Privacywise I don't like the "history" of previous contents in the > Playground, the history it can be removed but it can't be disabled. I > can condense the changes file, but the Playground history remains. > > Regards! > > > Esteban A. Maringolo > > > 2017-06-29 17:12 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >> Cool - I was missing that insight. >> >> Tim >> >> Sent from my iPhone >> >>> On 29 Jun 2017, at 18:04, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >>> >>> One of the more hidden Playground features are named Pages. Double-click the page tab title and give it a name, it will then be saved automagically in pharo-local/play-stash (and auto saves on changes from then on). I use that all the time. >>> >>>> On 29 Jun 2017, at 16:45, Tim Mackinnon <tim(a)testit.works> wrote: >>>> >>>> Hi - I really like the playground metaphor, it really is such a nice way to experiment. >>>> >>>> However I've noticed that unlike older versions of Smalltalk, it seems that DoIt operations in playground don't end up in the .changes file anymore (which I guess is a mixed blessing when you want to recover). It seems that the new metaphor is that work you do is saved as a page and you can see versions of your page in the upper right menu? Well sort of - as I haven't quite understood when it saves or doesn't? Often I get duplicate looking pages in that menu and often I make a change and want to keep it but find it doesn't save and if I accidentally close my playground my changes in a page are lost? >>>> >>>> What are the semantics of page saving? >>>> >>>> An example - if you do a few gofer loads of utilities and the put a comment on the first line of the page (which gives it a nice title in the page dropdown), sometimes that comment will be saved other times not? >>>> >>>> I also think it might be nice to remove page versions to help tidy things up. I'm thinking of rolling my sleeves up on this idea - but wanted to understand the vision firsts >>>> >>>> Tim >>>> >>>> Sent from my iPhone >>>> >>>> >>>> Sent from my iPhone >>>> >>> >> >

June 29, 2017

Solved: ZdcPluginMissing: SSL/TLS plugin initailization failed (VM plugin missing ? OS libraries missing ?)

by Offray Vladimir Luna CÃ¡rdenas

Hi, Thanks Sven. This solves the problem. The issue was the 32 bit library. I don't know if this should be added as some kind of annotation or footnode to [1], because the chapter suposse a 32-bit Ubuntu Gnu/Linux deployment, but some of us are going to try similar stuff in similar environment, forgetting to install the 32 bits libraries. Anyway, if there is any room for this, I would be happy to make the edition with the respective pull request. [1] https://github.com/SquareBracketAssociates/EnterprisePharo/blob/master/WebA… Cheers, Offray Ps: Sorry to open a new thread. My mail was having some issues and didn't get updated threads.

June 29, 2017

Re: [Pharo-users] Pharo6 playground saving semantics and .changes?

by Esteban A. Maringolo

Please allow me a little rant here... I still find disturbing the"autosave" feature without having the option to explicitly save the contents in the filesystem as I did with Workspaces. Sometimes I don't want the contents of a file/tab updated by a criteria different than when to save the image, it is: my own when I consider appropriate. It's not I want to disable Playground by complete which I find useful when integrated with the inlined insector, but I want to keep the behavior of saving and restoring the contents under my control. Privacywise I don't like the "history" of previous contents in the Playground, the history it can be removed but it can't be disabled. I can condense the changes file, but the Playground history remains. Regards! Esteban A. Maringolo 2017-06-29 17:12 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: > Cool - I was missing that insight. > > Tim > > Sent from my iPhone > >> On 29 Jun 2017, at 18:04, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> One of the more hidden Playground features are named Pages. Double-click the page tab title and give it a name, it will then be saved automagically in pharo-local/play-stash (and auto saves on changes from then on). I use that all the time. >> >>> On 29 Jun 2017, at 16:45, Tim Mackinnon <tim(a)testit.works> wrote: >>> >>> Hi - I really like the playground metaphor, it really is such a nice way to experiment. >>> >>> However I've noticed that unlike older versions of Smalltalk, it seems that DoIt operations in playground don't end up in the .changes file anymore (which I guess is a mixed blessing when you want to recover). It seems that the new metaphor is that work you do is saved as a page and you can see versions of your page in the upper right menu? Well sort of - as I haven't quite understood when it saves or doesn't? Often I get duplicate looking pages in that menu and often I make a change and want to keep it but find it doesn't save and if I accidentally close my playground my changes in a page are lost? >>> >>> What are the semantics of page saving? >>> >>> An example - if you do a few gofer loads of utilities and the put a comment on the first line of the page (which gives it a nice title in the page dropdown), sometimes that comment will be saved other times not? >>> >>> I also think it might be nice to remove page versions to help tidy things up. I'm thinking of rolling my sleeves up on this idea - but wanted to understand the vision firsts >>> >>> Tim >>> >>> Sent from my iPhone >>> >>> >>> Sent from my iPhone >>> >> >> > >

June 29, 2017

Re: [Pharo-users] Pharo6 playground saving semantics and .changes?

by Tim Mackinnon

Cool - I was missing that insight. Tim Sent from my iPhone > On 29 Jun 2017, at 18:04, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > One of the more hidden Playground features are named Pages. Double-click the page tab title and give it a name, it will then be saved automagically in pharo-local/play-stash (and auto saves on changes from then on). I use that all the time. > >> On 29 Jun 2017, at 16:45, Tim Mackinnon <tim(a)testit.works> wrote: >> >> Hi - I really like the playground metaphor, it really is such a nice way to experiment. >> >> However I've noticed that unlike older versions of Smalltalk, it seems that DoIt operations in playground don't end up in the .changes file anymore (which I guess is a mixed blessing when you want to recover). It seems that the new metaphor is that work you do is saved as a page and you can see versions of your page in the upper right menu? Well sort of - as I haven't quite understood when it saves or doesn't? Often I get duplicate looking pages in that menu and often I make a change and want to keep it but find it doesn't save and if I accidentally close my playground my changes in a page are lost? >> >> What are the semantics of page saving? >> >> An example - if you do a few gofer loads of utilities and the put a comment on the first line of the page (which gives it a nice title in the page dropdown), sometimes that comment will be saved other times not? >> >> I also think it might be nice to remove page versions to help tidy things up. I'm thinking of rolling my sleeves up on this idea - but wanted to understand the vision firsts >> >> Tim >> >> Sent from my iPhone >> >> >> Sent from my iPhone >> > >

June 29, 2017

[ANN] An evening with Pharo and the ESP32 microcontroller

by Ben Coman

Nothing too dramatic, but for a hardware hackathon I'm attending I wanted some online material I could expose to people to who hadn't heard of Pharo before. Maybe some Pharo regulars might also find it of interest. All comments welcome. http://blog.openinworld.com/2017/06/evening-with-pharo-esp32/ cheers -ben

June 29, 2017