June 2017 - Pharo-users - lists.pharo.org

Custom Glamour browser for Dr. Geo scripting
by Hilaire July 2, 2017

July 2, 2017

Hi, I try to build a dedicated browser for user scripting on DrGeo. I am learning from the Deep into Pharo Glamour chapter, extending the given example. Regarding the method category pane, I need both instance and class side, so I write it like this: categoriesIn: constructor constructor list title: 'Methods'; display: [ :scriptClass | scriptClass organization categories]. constructor list title: 'Script data'; display: [ :scriptClass | scriptClass class organization categories] The browser is defined as: buildBrowser browser := GLMTabulator new. browser column: #scripts; column: #categories; column: #methods. browser transmit to: #scripts; andShow: [ :a | self scriptsIn: a ]. browser transmit from: #scripts; to: #categories; andShow: [ :a | self categoriesIn: a ]. browser transmit from: #scripts; from: #categories; to: #methods; andShow: [:a | self methodsIn: a ]. browser transmit from: #scripts; from: #categories; to: #methods; andShow: [:a | self classMethodsIn: a ]. browser transmit from: #scripts; toOutsidePort: #selectedScript. browser transmit from: #methods; toOutsidePort: #selectedMethod. ^ browser but something is missing to get the listed method right depending on the category is instance or class side. I don't how to do it. Any tips? Thanks Hilaire -- Dr. Geo http://drgeo.eu

4 5

Pharo6 bootstrap how to
by Hilaire July 1, 2017

July 1, 2017

Hi, I want to build a Pharo6 image from scratch for Dr. Geo. How to do it? Thanks Hilaire -- Dr. Geo http://drgeo.eu

7 33

FUEL documentation
by Juraj Kubelka July 1, 2017

July 1, 2017

(sorry, I have accidentally pressed send button) Hi, Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. Thanks! Juraj

3 3

Re: [Pharo-users] Are we able to run pharo images in a read only environment?
by Tim Mackinnon June 30, 2017

June 30, 2017

Wow that's very promising - how do I get that setup? I also believe for lambda I need 64 bit as you have little control of the base image? I haven't had a chance to try marshalling results back to Alexa yet - but that's my goal. Tim Sent from my iPhone > On 30 Jun 2017, at 15:43, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:> > >> On 27 Jun 2017, at 21:15, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:>> >> >>> On 27 Jun 2017, at 21:00, Esteban A. Maringolo >>> <emaringolo(a)gmail.com> wrote:>>> >>> Interesting experiment. >>> >>> It would be good to know how fast does the image boot and start >>> execution in the context of a service billed at the sub second >>> scale.>> >> Sadly I have the impression we lost some speed: >> >> ~/pharo64$ ./pharo Pharo.image printVersion >> [version] 6.0 #60499 >> >> ~/pharo64$ time ./pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m1.276s >> user 0m0.985s >> sys 0m0.171s >> >> while before >> >> ~/pharo/build$ ../bin/pharo Pharo.image printVersion >> [version] 4.0 #40620 >> >> $ time ../bin/pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m0.526s >> user 0m0.434s >> sys 0m0.045s >> >> But it is really hard to find the cause. > > The good news is that the Pharo 7 minimal core is way faster > > $ time ./pharo ~/Downloads/Pharo7.0-core-32bit-b649ac6.image eval "42 > factorial"> 1405006117752879898543142606244511569936384000000000 > > real 0m0.262s > user 0m0.132s > sys 0m0.062s > > Which is good of course ! > >> That being said, these lambda servers can only work well if they keep >> instances alive for longer when there is enough traffic.>> >>> Esteban A. Maringolo >>> >>> >>> 2017-06-27 13:05 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >>>> Hi - I am trying to run a pharo image in lambda (as an experiment) >>>> - however>>>> I get an error from Pharo about not being able to write to the >>>> changes file?>>>> >>>> As I am just evaluating some code - Iâm not really coding, so donât >>>> need a>>>> changes file - is there a command line option to not require it? >>>> >>>> Also, am I running pharo the most efficient way - Iâm using eval >>>> on the>>>> command line and referencing a class with a class method - but is >>>> this the>>>> best way? >>>> >>>> Thanks, >>>> >>>> Tim >>>> >>>> "errorMessage": "Command failed: ./pharo Pharo.image eval \"Lambda>>>> processJSON: >>>> '{\"key3\":\"value3\",\"key2\":\"value2\",\"key1\":\"value1\"}'\"\- >>>> n'Pharo>>>> cannot write to the changes file named >>>> /var/task/Pharo.changes.\n\nPlease>>>> check that you have write permission for this file.\n\nYou won''t >>>> be able to>>>> save this image correctly until you fix this.'\n\u001b[31mError: >>>> Can't find>>>> the requested >>>> origin\n\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginErr- >>>> or\n[ self>>>> cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:- >>>> \nUnixResolver>>home\n[>>>> self home / '.config' ] in UnixResolver>>preferences in Block: [ >>>> self home />>>> '.config' >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver>>preferences\nUnixResolver(FileSystemResolver)>>r- >>>> esolve:\nSystemResolver(FileSystemResolver)>>unknownOrigin:\nSyste- >>>> mResolver(FileSystemResolver)>>resolve:\nInteractiveResolver>>unkn- >>>> ownOrigin:\n[>>>> self unknownOrigin: origin ] in InteractiveResolver>>resolve: in >>>> Block: [>>>> self unknownOrigin: origin >>>> ]\nIdentityDictionary(Dictionary)>>at:ifAbsent:\nInteractiveResolv- >>>> er>>resolve:\nFileLocator>>resolve\nFileLocator(AbstractFileRefere- >>>> nce)>>exists\nGlobalIdentifierStonPersistence(GlobalIdentifierPers- >>>> istence)>>shouldCallPreviousPersistence\nGlobalIdentifierStonPersi- >>>> stence(GlobalIdentifierPersistence)>>ensure:\nGlobalIdentifier>>en- >>>> sure\nGlobalIdentifier>>>> class>>initializeUniqueInstance\nGlobalIdentifier >>>> class>>uniqueInstance\nSystemSettingsPersistence >>>> class>>resumeSystemSettings\n[ :persistence | persistence >>>> resumeSystemSettings ] in PharoCommandLineHandler>>runPreferences >>>> in Block:>>>> [ :persistence | persistence resumeSystemSettings >>>> ...etc...\nBlockClosure>>cull:\nSystemDictionary(Dictionary)>>at:i- >>>> fPresent:\nSmalltalkImage>>at:ifPresent:\nPharoCommandLineHandler>- >>>> >runPreferences\nPharoCommandLineHandler>>activate\nPharoCommandLi- >>>> neHandler>>>> class(CommandLineHandler class)>>activateWith:\n\u001b[0m", >>>> "errorType": "Error", >>>> "stackTrace": [ >>>> "'Pharo cannot write to the changes file named >>>> /var/task/Pharo.changes.", >>>> "", >>>> "Please check that you have write permission for this file.", >>>> "", >>>> "You won''t be able to save this image correctly until you fix >>>> this.'",>>>> "\u001b[31mError: Can't find the requested origin", >>>> "\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginError", >>>> "[ self cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:",>>>> "UnixResolver>>home", >>>> "[ self home / '.config' ] in UnixResolver>>preferences in Block: >>>> [ self>>>> home / '.config' ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver>>preferences", >>>> "UnixResolver(FileSystemResolver)>>resolve:", >>>> "SystemResolver(FileSystemResolver)>>unknownOrigin:", >>>> "SystemResolver(FileSystemResolver)>>resolve:", >>>> "InteractiveResolver>>unknownOrigin:", >>>> "[ self unknownOrigin: origin ] in >>>> InteractiveResolver>>resolve: in>>>> Block: [ self unknownOrigin: origin ]", >>>> "IdentityDictionary(Dictionary)>>at:ifAbsent:", >>>> "InteractiveResolver>>resolve:", >>>> "FileLocator>>resolve", >>>> "FileLocator(AbstractFileReference)>>exists", >>>> >>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>sho- >>>> uldCallPreviousPersistence",>>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>en- >>>> sure:",>>>> "GlobalIdentifier>>ensure", >>>> "GlobalIdentifier class>>initializeUniqueInstance", >>>> "GlobalIdentifier class>>uniqueInstance", >>>> "SystemSettingsPersistence class>>resumeSystemSettings", >>>> "[ :persistence | persistence resumeSystemSettings ] in >>>> PharoCommandLineHandler>>runPreferences in Block: [ :persistence |>>>> persistence resumeSystemSettings ...etc...", >>>> "BlockClosure>>cull:", >>>> "SystemDictionary(Dictionary)>>at:ifPresent:", >>>> "SmalltalkImage>>at:ifPresent:", >>>> "PharoCommandLineHandler>>runPreferences", >>>> "PharoCommandLineHandler>>activate", >>>> "PharoCommandLineHandler class(CommandLineHandler >>>> class)>>activateWith:", >>>> "\u001b[0m", >>>> "ChildProcess.exithandler (child_process.js:204:12)", >>>> "emitTwo (events.js:106:13)", >>>> "ChildProcess.emit (events.js:191:7)", >>>> "maybeClose (internal/child_process.js:886:16)", >>>> "Process.ChildProcess._handle.onexit >>>> (internal/child_process.js:226:5)">>>> ] >>>> } >>>> >>>> >>> >> > >

1 0

Re: [Pharo-users] Validate password with PBKDF2
by Erik Stel June 30, 2017

June 30, 2017

Francis, You're using an empty salt when creating the hash. Just prepending a random number does not add much security. Anyone knowing your solution will just prepend a random number. And creating only a few accounts in your system will probably reveal that information as well. A wrong-doer will just use a fake salt and will still be able to try a rainbow table attack. Please use a real random value for the salt. And easiest would be to give it a fixed size. (Don't have an image and/or code available, so this might lead to some pseudo code ;-) To generate a safe password hash which you can store in your db, the following method. It creates a random number (your example of a UUID of 16 bytes) and uses that as a salt for the password hash. Both values are then concatenated and returned as a 'safe' password. This can be stored in your db. To validate a user's password you retrieve the safePasswordHash from your db (based on the user's id) and validate the given password against it. For this the salt is retrieved from the safePasswordHash (first 16 bytes because UUID is 16 bytes) and it is then used to calculate the hash of the given password. It should match the second part of the safePasswordHash. Hope this helps. For real safety, please add some checks for valid values. Did we receive a valid password? Is the safePasswordHash the correct length (in this case 32 bytes)? You might consider using another salt generator than UUID. Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953129.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

2 1

FUEL documentation
by Juraj Kubelka June 30, 2017

June 30, 2017

Hi, Is there any documentation about FUEL? I would like to understand in more detail what data -- Juraj Kubelka

1 0

[ANN] An evening with Pharo and the ESP32 microcontroller
by Ben Coman June 30, 2017

June 30, 2017

Nothing too dramatic, but for a hardware hackathon I'm attending I wanted some online material I could expose to people to who hadn't heard of Pharo before. Maybe some Pharo regulars might also find it of interest. All comments welcome. http://blog.openinworld.com/2017/06/evening-with-pharo-esp32/ cheers -ben

2 2

Re: [Pharo-users] Validate password with PBKDF2
by Erik Stel June 30, 2017

June 30, 2017

Francis, The hashpw function returns a hash with the salt prepended. So it contains both elements. (See for example explanation at: https://stackoverflow.com/questions/27413248/why-can-bcrypt-hashpw-be-used-…) You can do the same thing here. Assuming you have a fixed size salt, just prepend it before the hash value. Since the salt is (should be) random, returning it's value does not weaken the security. Using a salt prevents against rainbow table attacks: pre-generated hash values for many possible passwords. (See https://en.wikipedia.org/wiki/Rainbow_table) Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953067.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

2 1

Re: [Pharo-users] Validate password with PBKDF2
by HernÃ¡n Morales Durand June 30, 2017

June 30, 2017

I guess I could integrate Udo's PBKDF2 into ApplicationSecurity. See under "Using the CheckPoint" if matches your API you're looking for: http://80738163270632.blogspot.com.ar/2014/10/application-security-2-checkp… Cheers, HernÃ¡n 2017-06-30 4:43 GMT-03:00 Francis via Pharo-users < pharo-users(a)lists.pharo.org>: > > > ---------- Mensaje reenviado ---------- > From: Francis <falzonidavide(a)libero.it> > To: pharo-users(a)lists.pharo.org > Cc: > Bcc: > Date: Fri, 30 Jun 2017 00:43:23 -0700 (PDT) > Subject: Re: Validate password with PBKDF2 > Thank you Paul, > Saving the salt is not a big issue but I'd like something more simple. > In python I can store the salt with the password > see:https://pypi.python.org/pypi/bcrypt/3.1.0 > > # Hash a password for the first time, with a randomly-generated salt > hashed = bcrypt.hashpw(password, bcrypt.gensalt()) > > and retrieve it subsequently > if bcrypt.checkpw(password, hashed): > ... print("It Matches!") > > Are you (smalltalkers) aware of something similar? > > Thanks again > Francis > > > > Paul DeBruicker wrote > > Looks like you'll have to store the salt when making the original hash of > > the password. > > > > With that you can do > > > > > > | salt originalPassword userInputPassword originalHash newHash secretKey > > | > > salt:='salt'. > > originalPassword:='password'. > > userInputPassword:='12345678'. > > originalHash:=PBKDF2 derivedKeySHA1Password: originalPassword salt: salt. > > newHash:=PBKDF2 derivedKeySHA1Password: userInputPassword salt: salt. > > > > secretKey:= SecureRandom new nextBytes: 16. > > > > ((SHA256 new hmac key: secretKey) digestMessage: originalHash) = ((SHA256 > > new hmac key: secretKey) digestMessage: newHash). > > > > > > > > We do the double SHA256 HMAC signing of the hashes because of > > https://www.nccgroup.trust/us/about-us/newsroom-and-events/ > blog/2011/february/double-hmac-verification/ > > > > You can store the #secretKey and each user should get a new #salt every > > time they change their password and you shouldn't reuse the salts for > > other users or password. > > > > For PBKDF2 there is probably a max (or recommended) salt length but I > > don't know it. > > > > I also don't know anything about the SecureRandom class but it says it on > > the tin, so maybe it is. Maybe not though. I don't know how to find > out. > > But I don't know that it matters in this instance as its only used for > the > > SHA256 HMAC internally in the comparison function. > > > > > > Hope this helps. > > > > > > Francis wrote > >> Hi folks > >> > >> I'm playing with the PBKDF2 package of Udo: > >> http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 > >> (thanks Udo), but I can't find how to validate a stored hash. > >> Can you point me in the right direction? > >> > >> Thanks > >> Francis > > > > > > -- > View this message in context: http://forum.world.st/ > Validate-password-with-PBKDF2-tp4952973p4953004.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. > > >

1 0

Logging in with VNC
by sergio ruiz June 30, 2017

June 30, 2017

Hey, all.. I need to be able to log in to my production image with VNC until i am comfortable with the command line interface. I know that every time i have had to do it, it seems like i used a different package. Which package is everyone using these days for remote GUI access? Thanks! ---- peace, sergio photographer, journalist, visionary Public Key:Â http://bit.ly/29z9fG0 #BitMessageÂ BM-NBaswViL21xqgg9STRJjaJaUoyiNe2dV http://www.Village-Buzz.com http://www.ThoseOptimizeGuys.com http://www.coffee-black.com http://www.painlessfrugality.com http://www.twitter.com/sergio_101 http://www.facebook.com/sergio101

2 1