June 2018 - Pharo-users - lists.pharo.org

Fwd: ApplicationSecurity Questions

by HernÃ¡n Morales Durand

FYI ---------- Forwarded message ---------- From: HernÃ¡n Morales Durand <hernan.morales(a)gmail.com> Date: 2018-06-13 13:44 GMT-03:00 Subject: Re: ApplicationSecurity Questions To: Sean DeNigris <sean(a)clipperadams.com> Hi Sean, Sorry for the delayed reply, almost no time for anything here 2018-06-08 10:20 GMT-03:00 Sean DeNigris <sean(a)clipperadams.com>: > You can check a project making use of ApplicationSecurity here: > http://www.smalltalkhub.com/#!/~hernan/IGEVET > > Ok, I load it using: Gofer it smalltalkhubUser: 'hernan' project: 'IGEVET'; configurationOf: 'IGEVETWebSite'; loadDevelopment. > Pharo 6.1: > - No #development version for Iliad, had to add to ConfigurationOfIliad > - ConfigurationOfNacl - had to comment out #preload, which failed to > download libsodium (apparently the dropbox link no longer works). I was able > to procure the library elsewhere I checked and ApplicationSecurity baseline was broken, missing some dependencies. Now I've fixed the BaselineOfApplicationSecurity to include the ConfigurationOfNacl (https://github.com/hernanmd/ApplicationSecurity) and PBKDF2 from Configuration, so includes the Fortuna and SecureRandom classes. All Nacl tests passes at least on Windows. If you're loading ConfigurationOfNacl-HernanMoralesDurand.36 then #platformLibraryUrl contains the URLs which points to: https://github.com/hernanmd/NacL/tree/master/res > - ERROR: DNU #selector from RBParser >>#externalFunctionDeclaration when > trying to parse: > > apiDeleteDC: aHDC > <apicall: bool 'DeleteDC' (Win32HDC) module:'gdi32.dll'> > ^self externalCallFailed > IIRC that happens when you load a package with primitive syntax/format for a different version of Pharo. > > Pharo 5: > - ConfigurationOfNacl - had to comment out #preload, which failed to > download libsodium (apparently the dropbox link no longer works). I was able > to procure the library elsewhere > - BioFormatters-HernanMoralesDurand.118 complained about missing PMVector, > clicked proceed and no more problems > I don't have time to try it or support it in Pharo 5 now :( > Since Iâm not familiar with Iliad, I wasnât sure how to run the app. I wrote a Control Panel for Iliad some time ago. It should be accessible from the World Menu. It works pretty much like the Seaside one, plus some minor features, including a Session Browser. > manually executed IGEVETApplication>>#startUp to get the server going, but > wasnât sure what URL to type into the browser. I tried a few things that all > returned 404 like: > - http://localhost:9999/IC > - http://localhost:9999/chromopainter-jobs > - http://localhost:9999/IC/chromopainter-jobs > Add an adaptor using the Control Panel then go to: http://localhost:8888/main > Also from my previous reply (not sure if you saw it): > > Out of curiosity, why Iliad instead of Seaside? Would Iliad be your > default/recommendation for new web apps? > Is it well-supported/maintained? It doesnât seem to have much recent > activity unless Iâm looking at the wrong repo. > > > Thanks! > > - s Thank you for the feedback. Please let me know how it is going, Cheers, HernÃ¡n

June 13, 2018

Re: [Pharo-users] Iceberg - finding deleted classes, reverting versions?

by Sean P. DeNigris

Tim Mackinnon wrote > Hi - I am interested in what the future holds with Iceberg for things like > finding deleted classes or reverting to older versions of things. Great question! It used to be in the Change Sorter that delections were logged and reversible. At some point that stopped working and then I moved to git so I don't know if it was ever fixed. Obviously, that only looks back w/in the current image which doesn't fully solve your issue. The cool thing about git is that we inherit all its functionality - the good and bad. So iot got me wondering whether we could drop down to the command line for the time being. After some googling and experimentation, I came up with the following: git log --full-history -- */{{className}}.class/properties.json NB. I had to add the properties.json because directories don't work, but that may not be needed with Tonel ----- Cheers, Sean -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

June 13, 2018

Iceberg - finding deleted classes, reverting versions?

by Tim Mackinnon

Hi - I am interested in what the future holds with Iceberg for things like finding deleted classes or reverting to older versions of things. As we tend to use lots of classes in Smalltalk (and view them as cheap) - I often create them, then move behaviour around and delete things I donât need anymore. However, if you want to recover one of those classes - with Envy there was a useful concept of âshow me deleted classes in a packageâ and you would get a list that you could then browse and recover from. Even older squeaks had some nice tools to pull this information from the .changes file (and while not quite the same as envy, it did let a solo developer work efficiently). So I was a bit surprised yesterday in Pharo 6.1 - to struggle to find a class I knew that I had deleted. There seemed to be no easy way to do this - and I thought there was somewhere that had that âAvailable/Deleted classesâ menu. Eventually I went to iceberg and browsed older versions of my package and with some riffing - managed to find what a I wanted - but it definitely seemed harder than it should be - for a concept that feels natural to us. Iâve heard it mentioned that we might get âversionsâ behaviour back via git on a method or existing class - but what about Deleted classes - is this something we will be able to do more easily? Tim

June 13, 2018

Why doesn't Iceberg checkin other assets (scripts) but does check them out?

by Tim Mackinnon

Hi - my second attempt at using Pharo with Git has proven very satisfying (I saw the potential in phase 1, but it was often difficult to understand what was happening and the workflow to use). One thing that has come up a few times for me however - and its something that using git nicely highlights, there are many non-smalltalk assets in my project that donât need to live in the image (like Seaside FileLibraries were trying to do) but do need to be versioned and be part of my project. Common examples are server config files, images and even the playground history files that are useful to pull up when on another computer. It seems that while Iceberg does check out a full project, if I change any of the files outside of the src directory (like edit a .txt file using the crude Pharo file editor), those changes donât get committed when I do a checkin? Is this on purpose? It makes the workflow a bit trickier to do an atomic commit of a piece of work - and Iâm not clear whether this is a conscious thing, or an MVP thing (and it will come later). As mentioned above, I was also thinking it would be nice if I could checkin some of the play-xxxx/*.sh files to essentially keep some of that history synced between environments (or team members?). It strikes me that this is the kind of thing that git integration should bring to us? I can overlay my copy of IntelliJ on top of my local iceberg directory and then use it for checkins - but then I still have the atomic problem, as its only when I commit that tonel files are written out onto the file system for me to checkin along with any other assets Iâve changed. Does anyone else have a good workflow for this? What do you guys do? Tim

June 13, 2018

Re: [Pharo-users] Insecure issue tracker registration

by Ben Coman

On 13 June 2018 at 16:25, Manuel Leuenberger <leuenberger(a)inf.unibe.ch> wrote: > Hi, > > I announced my concerns on Discord already, but got no reaction, so I post > it here as well to have it properly archived. > > "A colleague just noticed that the registration for the issue tracker is > HTTP-only. This is not an appropriate choice for sensitive data like a > password. Any possibilities to make this HTTPS-only? > Link: http://tracker.pharo.org/issues-register-service, setting https:// > manually does not work" > > From my perspective this is a serious problem that should be quickly > addressed, it's not just a nice to have feature. Not treating sensitive > data with proper care leaves an image of not caring about user security and > looks unprofessional. I don't think that is what Pharo needs. Thanks for raising this. You're concerns are valid, but in the meantime until someone can change it to https, just use a temporary password and immediately change it the first time you log onto Fogbugz - which is a https service. @all, If its difficult to add https to it, then perhaps at least a not can be added to advise using a temporary password. cheers -ben

June 13, 2018

Insecure issue tracker registration

by Manuel Leuenberger

Hi, I announced my concerns on Discord already, but got no reaction, so I post it here as well to have it properly archived. "A colleague just noticed that the registration for the issue tracker is HTTP-only. This is not an appropriate choice for sensitive data like a password. Any possibilities to make this HTTPS-only? Link: http://tracker.pharo.org/issues-register-service, setting https:// manually does not work" >From my perspective this is a serious problem that should be quickly addressed, it's not just a nice to have feature. Not treating sensitive data with proper care leaves an image of not caring about user security and looks unprofessional. I don't think that is what Pharo needs. Cheers, Manuel

June 13, 2018

Re: [Pharo-users] Is it bad to have an order NeoJsonObject?

by Tim Mackinnon

Once again, thanks for the interesting background to all of this (although I didnât mean to cause so much discussion on the merits of the json spec). Anyway, I did check with the authors of Prismic.io - and they confirmed that their intent is that their document (schema?) does order block elements in the json - and this is something you can rely on. So, its not really in my control to do otherwise. Tim > On 11 Jun 2018, at 09:19, Tim Mackinnon <tim(a)testit.works> wrote: > > Yes i was a bit nervous about the ordering, but had also noticed other examples like this - but it is a good reminder for me to double check with the developers that they consciously have done this and to register an interest that it stays that way (particularly as they strangely donât provide access to a schema for your user type definition - and hence could get the ordering from that). > > On a second note - I did phase out my use of NeoJsonObject after the community warning (and realised how much it had worked into my solution). I think explicitly handling the absent key is better (I do loathe nil checks and am surprised how many languages set this terrible example - of shocked how easily I fell into that trap too). That said - I did miss the #atPath: concept in NeoJson and ended up adding an equivalent (better?) #atPath:ifAbsent: to OrderedDictionary to cope with needing to reach into structures to pull out relevant attributes. > > It did then remind how much I wish we could sort out some form of namespacing, as I donât like to see my model code have to put prAtPath:ifAbsent: (itâs just gross). Maybe I might subclass OrderedDictionary to get the namespacing on a class and my methods can be safely clean). > > Appreciate the commentary on this, itâs been a useful exercise. > > Tim > > Sent from my iPhone > > On 11 Jun 2018, at 08:02, Norbert Hartl <norbert(a)hartl.name <mailto:norbert@hartl.name>> wrote: > >> >> >>> Am 11.06.2018 um 08:55 schrieb Richard O'Keefe <raoknz(a)gmail.com <mailto:raoknz@gmail.com>>: >>> >>> The order of key:value pairs in a JSON "object" >>> is really NOT supposed to matter. For example, >>> if you put {"a":1,"b":2} into a JSON database >>> you should not be surprised to get {"b":2,"a":1} >>> back. Or vice versa, of course. >>> >> But when it does what do you do? It is pretty clear that the order is important for that format. So saying it shouldnât matter does not make it better. If you work with mongo DB you will see the same that for some queries you have to provide proper order of keys. >> >> Norbert >> >>> On 8 June 2018 at 00:16, Tim Mackinnon <tim(a)testit.works <mailto:tim@testit.works>> wrote: >>> Thanks guys - it seems like I was on the right track. >>> >>> Making my own NeoJsonObject did work, but I will go back and see if Iâm really using the js nature of the values and if for this, just an OrderedDictionary might be clearer. >>> >>> As an aside, I was doing some experiments with prismic.io <http://prismic.io/> (a headless cms) and the order of your content when rendering it on a page(generically) is obviously important. >>> >>> Tim >>> >>> Sent from my iPhone >>> >>> > On 7 Jun 2018, at 07:46, Sven Van Caekenberghe <sven(a)stfx.eu <mailto:sven@stfx.eu>> wrote: >>> > >>> > >>> > >>> >> On 7 Jun 2018, at 08:16, Norbert Hartl <norbert(a)hartl.name <mailto:norbert@hartl.name>> wrote: >>> >> >>> >> >>> >> >>> >>> Am 07.06.2018 um 07:29 schrieb Sven Van Caekenberghe <sven(a)stfx.eu <mailto:sven@stfx.eu>>: >>> >>> >>> >>> Tim, >>> >>> >>> >>>> On 7 Jun 2018, at 01:37, Tim Mackinnon <tim(a)testit.works <mailto:tim@testit.works>> wrote: >>> >>>> >>> >>>> Hi - Iâve hit some Json where the outputted values (they are field names) are written out in a specific order - and the author hasnât chosen to use an array to represent those fields in a specific order. >>> >>>> >>> >>>> { âfield1â : { â¦.}, âfield2â: { â¦ } } >>> >>>> >>> >>>> I think this is technically incorrect and should be: >>> >>>> >>> >>>> { [ {âfield1â : { â¦.}, âfield2â: { â¦ } ]} >>> >>>> >>> >>>> Anyway - given what Iâve got, would it be a terrible idea to create my own version NeoJsonObject and just make it a subclass of OrderedDictionary? >>> >>>> >>> >>>> I canât see any issues - but then I might be kidding myselfâ¦ >>> >>>> >>> >>>> Tim >>> >>> >>> >>> Yea, I think you could try making a NeoJSONOrderedObject as a subclass of OrderedDictionary, modelled after NeoJSONObject. Just remember it is implemented using DNU, which will surprise you at one point. >>> >>> >>> >> Wouldnât be setting #mapClass: on the reader to OrderedDictionary not enough? Dictionary is the default anyway. >>> >> >>> >> Norbert >>> > >>> > Yes, of course, Norbert, it keeps the order: >>> > >>> > (NeoJSONReader on: '{"BB":1,"CC":2,"AA":3}' readStream) mapClass: OrderedDictionary; next. >>> > >>> > => an OrderedDictionary('BB'->1 'CC'->2 'AA'->3) >>> > >>> > NeoJSONWriter toString: (OrderedDictionary new at: #BB put: 1; at: #CC put: 2; at: #AA put: 3; yourself). >>> > >>> > => '{""BB"":1,""CC"":2,""AA"":3}' >>> > >>> > It is not functionally 100% the same as a hypothetical NeoJSONOrderedObject, but might do. >>> > >>> > Sven >>> >>> >>> >>

June 12, 2018

Re: [Pharo-users] SQL Server

by linkerstorm

Thanks. Following your suggestion, I found this thread, with the same problem : https://groups.google.com/forum/#!topic/dbxtalk/xoQILQhu_mo <https://groups.google.com/forum/#!topic/dbxtalk/xoQILQhu_mo> I'm not alone anymore -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

June 12, 2018

Re: [Pharo-users] SQL Server

by Linkerstorm

Thanks for the suggestion but already tried with no luck : only the drivers for MySql, PostgresV2 and Sqlite3exist, no OpenDbx driver available, despite the documentation... Le mar. 12 juin 2018 Ã 22:26, orsayman via Pharo-users < pharo-users(a)lists.pharo.org> a Ã©crit : > I'm not an expert but have a look at DBXTalk > <https://guillep.github.io/DBXTalk/garage/drivers.html> . If I understand > correctly, it is able to connect to SQL Server. > > > > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html > >

June 12, 2018

Re: "News" section of the website down

by orsayman

I just wanted to bump this thread because it still doesn't work. -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

June 12, 2018