July 2018 - Pharo-users - lists.pharo.org

Re: [Pharo-users] Status of Caffeine

by Craig Latta

> The minimal example seems to load fast enough. Do you think there is a > potential to slim it down even further for a production system that > uses the DOM as its UI, ie remove morphic and others and use the image > in headless mode? Certainly. I've done some experiments with "animated wireframes" for the development tools. See [1]. I can compose UIs in HTML, then read them into SqueakJS and give them behavior by giving them DOM event handlers written in Smalltalk. > Thanks for the offer to work together on the Pharo port. It is too > early for me to commit to that, but I definitely like the idea. Right > now I'm just checking out. I'd like to use Pharo's (or Squak's) > interactive development workflow to develop single page web apps and > mobile apps in a reliable manner. Yes, I've found it to be a very productive environment. It's great to be able to debug things in situ, in the DOM environment. > Is there a way to run the IDE in a separate window from the actual > application, so that the UI would behave as in production during > development? I'm especially thinking of responsive web applications > here. Yes; I've also built an interface to the Google remote debugging protocol, so (in Chrome) I can run SqueakJS in one browser window, and control whatever's going on in any other browser window. > (If not then perhaps putting them into divs next to each other might > be a decent workaround) Yeah, this is what I did in the first Caffeine demo[2]. When I want the Smalltalk IDE to disappear I just set the opacity of its div to zero and its pointer-events to none. This approach works across all browsers. thanks, -C [1] https://tinyurl.com/y9ngn363 (github.com) [2] https://caffeine.js.org -- Craig Latta Black Page Digital Amsterdam :: San Francisco craig(a)blackpagedigital.com +31 6 2757 7177 (SMS ok) + 1 415 287 3547 (no SMS)

July 19, 2018

Re: [Pharo-users] separate native window of same Pharo image

by kmo

I believe this is a known Windows issue. I have certainly seen it on my Windows machine at work. Doesn't happen on Linux. -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

July 19, 2018

Re: [Pharo-users] separate native window of same Pharo image

by Peter UhnÃ¡k

Thank you both, this is exactly what I was looking for! But I ran into an issue (maybe this is Windows (10) specific): once I open the window, the original Pharo window is no longer responsive. It is not frozen, I can see a cursor blinking in the playground, but clicking anywhere or pressing any key doesn't do anything. This behavior persists even after I close the new window. Only when I press ctrl (without anything else) the content of the playground gets executed again, but that's it. I will try tomorrow on a different machine. Peter On Thu, Jul 19, 2018 at 6:22 PM, kmo <voxkmp(a)gmail.com> wrote: > Here's a screenshot of two roses windows being run from a pharo image in > another window <http://forum.world.st/file/t368903/roses.png> > > > > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html > >

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Siemen Baader

Hi Craig, Great, thanks! The minimal example seems to load fast enough. Do you think there is a potential to slim it down even further for a production system that uses the DOM as its UI, ie remove morphic and others and use the image in headless mode? Thanks for the offer to work together on the Pharo port. It is too early for me to commit to that, but I definitely like the idea. Right now I'm just checking out. I'd like to use Pharo's (or Squak's) interactive development workflow to develop single page web apps and mobile apps in a reliable manner. Is there a way to run the IDE in a separate window from the actual application, so that the UI would behave as in production during development? I'm especially thinking of responsive web applications here. (If not then perhaps putting them into divs next to each other might be a decent workaround) Cheers, Siemen Sent from my iPhone > On 19 Jul 2018, at 14.25, Craig Latta <craig(a)blackpagedigital.com> wrote: > > > > > Hi Siemen-- > >> What is the status of Caffeine now - is it production-ready with >> Pharo, and how large is a minimal (not development) image with >> everything required to run a production system - i.e. what would be >> the load time of a Caffeine web app? > > I'm using Caffeine in production with Squeak; there are a few bugs > to deal with in Pharo. Would you like to work together on it? > > A minimal system is a few hundred kilobytes, depending on the > application. The VR app I'm doing now is fairly large and loads in 10 > seconds. A small app should take about two seconds. The mini image demo > at [1] is a good approximation. > > Please feel free to join in on Caffeine issues, at [2]. > > > thanks, > > -C > > [1] https://squeak.js.org/demo/simple.html#fullscreen > [2] https://github.com/ccrraaiigg/ccrraaiigg.github.io/issues > > -- > Craig Latta > Black Page Digital > Amsterdam :: San Francisco > craig(a)blackpagedigital.com > +31 6 2757 7177 (SMS ok) > + 1 415 287 3547 (no SMS) > >

July 19, 2018

Re: [Pharo-users] separate native window of same Pharo image

by kmo

Here's a screenshot of two roses windows being run from a pharo image in another window <http://forum.world.st/file/t368903/roses.png> -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

July 19, 2018

Re: [Pharo-users] separate native window of same Pharo image

by kmo

it is perfectly possible with OS-Window to create a morphic world and create your own morphic content for it, then display it in a completely different operating system window. This is how I created a simple application which displays geometric "roses" in a separate window to the pharo window. First create your morph. In my case RosesMorph. This can be a compound morph with as many sub-morphs as you like. In this way you can build a complete application interface. Now create a sub class of OSWindowWorldMorph like this: OSWindowWorldMorph subclass: #RosesWorldMorph instanceVariableNames: '' classVariableNames: '' package: 'KMP-Roses Add the following methods to your OSWindowWorldMorph subclass using this code as a model: RosesWorldMorph>>osWindowCloseButtonPressed self delete RosesWorldMorph>>initialize | rosesMorph rosesFrame | super initialize. self layoutPolicy: ProportionalLayout new. self extent: 600 @ 600. self osWindow title: 'Roses'. rosesMorph := RosesMorph new. rosesMorph color: (Color r: 0.13 g: 0.13 b: 0.13 alpha: 1.0). rosesFrame := LayoutFrame fractions: (0 @ 0 corner: 1 @ 1) offsets: (0 @ 0 corner: 0 @ 0). self addMorph: rosesMorph fullFrame: rosesFrame. rosesMorph sticky: true As you can see once you have an OSWindowWorldMorph you can add whatever morphs you like to it. Now you can launch your RosesWorld app in a separate window like this: RosesWorldMorph new open. Hope this helps -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

July 19, 2018

Re: [Pharo-users] separate native window of same Pharo image

by alvaro piorno

Hi, I played a bit with that. I did something like this: window := OSWindow createWithAttributes: (OSWindowAttributes new resizable: false; yourself). window title: title. And then: surface := AthensCairoSDLSurface fromSDLSurface: self window handle handle getWindowSurface Then you can render everything in the surface from Pharo. Is this what you want?. 2018-07-19 8:31 GMT-03:00 Peter UhnÃ¡k <i.uhnak(a)gmail.com>: > Hi, > > did anyone play around with launching a separate native window for Pharo? > > E.g. I have normal window in which Pharo is, and then I open a separate > native window that shows just e.g. Transcript. > > I know that there are some projects like OSWindow-SDL and OSWindows-UI > (using WinAPI), but both of them are aimed at opening windows with > non-pharo content, which is not what I want. > > Any pointers? > > Thanks, > Peter >

July 19, 2018

Dynabook concept under Dr. Geo perspective

by Hilaire

Hi, The Dynabook concept and Dr. Geo share some values. Here is how http://blog.drgeo.eu/post/2018/The-Dynabook-Concept Hilaire -- Dr. Geo http://drgeo.eu

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Craig Latta

Hi Erik-- > I read in some of the more recent issues that on some mobile devices > (based on iOS) the page reloads after switching apps and/or locking > the device. This will loose any data currently in the Caffeine app. > Craig is working on a solution based on WebWorkers. This probably > means: not production ready for mobiles yet. It turns out splitting the app over multiple processes is only necessary on iOS 12, which has more severe memory limits. iOS 12 doesn't support OffscreenCanvases in web workers yet, or 2d contexts for OCs, so for now I'm just back in iOS 11, where everything works in one big process (Squeak + A-Frame). thanks, -C -- Craig Latta Black Page Digital Amsterdam :: San Francisco craig(a)blackpagedigital.com +31 6 2757 7177 (SMS ok) + 1 415 287 3547 (no SMS)

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Craig Latta

Hi Siemen-- > What is the status of Caffeine now - is it production-ready with > Pharo, and how large is a minimal (not development) image with > everything required to run a production system - i.e. what would be > the load time of a Caffeine web app? I'm using Caffeine in production with Squeak; there are a few bugs to deal with in Pharo. Would you like to work together on it? A minimal system is a few hundred kilobytes, depending on the application. The VR app I'm doing now is fairly large and loads in 10 seconds. A small app should take about two seconds. The mini image demo at [1] is a good approximation. Please feel free to join in on Caffeine issues, at [2]. thanks, -C [1] https://squeak.js.org/demo/simple.html#fullscreen [2] https://github.com/ccrraaiigg/ccrraaiigg.github.io/issues -- Craig Latta Black Page Digital Amsterdam :: San Francisco craig(a)blackpagedigital.com +31 6 2757 7177 (SMS ok) + 1 415 287 3547 (no SMS)

July 19, 2018

separate native window of same Pharo image

by Peter UhnÃ¡k

Hi, did anyone play around with launching a separate native window for Pharo? E.g. I have normal window in which Pharo is, and then I open a separate native window that shows just e.g. Transcript. I know that there are some projects like OSWindow-SDL and OSWindows-UI (using WinAPI), but both of them are aimed at opening windows with non-pharo content, which is not what I want. Any pointers? Thanks, Peter

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Siemen Baader

Thanks! My idea was to use it in a similar manner to e.g. Angular, with a full app being loaded into the browser which communicates with a backend API. But this requires the load time to be acceptable.. another direction would be to embed it in a phone gap app and use it to build DOM-based mobile apps. There a larger footprint would be ok. -- Siemen Sent from my iPhone > On 19 Jul 2018, at 11.26, Erik Stel <erik.stel(a)gmail.com> wrote: > > You can find the source at the GitHub-link below. Craig seems active on this > project seeing the number of recent commits. Focus is on creating a live > VR-environment. Cool stuff I think . It will run Pharo, but if that means > 'production ready'... Small image sizes for production systems/applications > is probably a separate topic. Caffeine is a Smalltalk VM written in JS (with > some extra's), so image size depends on how small you can make your image. I > read in some of the more recent issues that on some mobile devices (based on > iOS) the page reloads after switching apps and/or locking the device. This > will loose any data currently in the Caffeine app. Craig is working on a > solution based on WebWorkers. This probably means: not production ready for > mobiles yet . > > Link: https://github.com/ccrraaiigg/ccrraaiigg.github.io > <https://github.com/ccrraaiigg/ccrraaiigg.github.io> > > HTH > > > > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html >

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Erik Stel

You can find the source at the GitHub-link below. Craig seems active on this project seeing the number of recent commits. Focus is on creating a live VR-environment. Cool stuff I think . It will run Pharo, but if that means 'production ready'... Small image sizes for production systems/applications is probably a separate topic. Caffeine is a Smalltalk VM written in JS (with some extra's), so image size depends on how small you can make your image. I read in some of the more recent issues that on some mobile devices (based on iOS) the page reloads after switching apps and/or locking the device. This will loose any data currently in the Caffeine app. Craig is working on a solution based on WebWorkers. This probably means: not production ready for mobiles yet . Link: https://github.com/ccrraaiigg/ccrraaiigg.github.io <https://github.com/ccrraaiigg/ccrraaiigg.github.io> HTH -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

July 19, 2018

Re: [Pharo-users] Status of Caffeine

by Ben Coman

On 19 July 2018 at 14:59, Siemen Baader <siemenbaader(a)gmail.com> wrote: > What is the status of Caffeine now - is it production-ready with Pharo, and how large is a minimal (not development) image with everything required to run a production system - i.e. what would be the load time of a Caffeine web app? > > Thanks, > Siemen > > Sent from my iPhone hey cool. I had thought Caffine was only for Squeak, but then was surprised to find... https://thiscontext.com/2017/06/29/pharo-comes-to-caffeine-and-squeakjs/ cheers -ben

July 19, 2018

Status of Caffeine

by Siemen Baader

What is the status of Caffeine now - is it production-ready with Pharo, and how large is a minimal (not development) image with everything required to run a production system - i.e. what would be the load time of a Caffeine web app? Thanks, Siemen Sent from my iPhone

July 19, 2018

Re: [Pharo-users] StCAD is open source

by askoh

Hi: I have been careful to separate the GUI, Geometry, Multibody Dynamics and Math. Only the GUI would need customization for Pharo. The others use pretty generic Smalltalk. I suspect the GUI bits from Jun4Pharo, Woden and Croquet should be sufficient for StCAD port. StCAD uses a bit of Jun and a bit of GF/ST and a bit of Business Graphics Kit. I am willing to help anyone starting the port. It can be the basis of a CAD system. All the best, Aik-Siong Koh -- Sent from: http://forum.world.st/Pharo-Smalltalk-Users-f1310670.html

July 19, 2018

Re: [Pharo-dev] [ANN] Pharo Git Thermite Release

by Alexandre Bergel

It would be fantastic that people try it out. It is easy to use, and is really a big improvement over the tool set we use. And getting feedback is important. Cheers, Alexandre -- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;. > On Jul 17, 2018, at 11:08 AM, Ronie Salgado <roniesalg(a)gmail.com> wrote: > > Hello, > > I am finally releasing an initial public version of Pharo Git Thermite, a tool that I am developing as part of my master thesis for visualizing Monticello and Git commits, for Pharo and Python: > > GitHub Page with sources/documentation/issue tracker: https://github.com/ronsaldo/pharo-git-thermite <https://github.com/ronsaldo/pharo-git-thermite> > > Short video examples: > - Monticello Visualization; https://youtu.be/02CUHBmm-K8 <https://youtu.be/02CUHBmm-K8> > - GitHub pull request: https://youtu.be/f196btLfYxM <https://youtu.be/f196btLfYxM> > - Local git commit: https://youtu.be/LCHTiJ4nx3g <https://youtu.be/LCHTiJ4nx3g> > > Feedback form: https://docs.google.com/forms/d/e/1FAIpQLSeir6VlE3bR78oRsNAp9eHLkUn2Q016wEl… <https://docs.google.com/forms/d/e/1FAIpQLSeir6VlE3bR78oRsNAp9eHLkUn2Q016wEl…> > > Best regards, > Ronie > > <thermite-visualization.png> >

July 17, 2018

Re: [Pharo-users] pharo bash script with startup

by Jerry Kott

I am happy to see some real security conversation here. Ultimately, security is about risk management, so both of you are somewhat correct. However, on the whole I tend to agree with HernÃ¡n. OTOH, it is theoretically possible to break any known cipher or hash algorithm, given sufficient resources, time and motivation. One needs to understand the measure of risk and understand their own risk tolerance to decide whether or not something is a viable threat. Good security means good behavior as well as technical solutions. Questioning 'wget â¦. | bashâ absolutely counts as good behavior in my book. Jerry Kott This message has been digitally signed. PGP Fingerprint: A9181736DD2F1B6CC7CF9E51AC8514F48C0979A5 > On 17-07-2018, at 8:31 AM, HernÃ¡n Morales Durand <hernan.morales(a)gmail.com> wrote: > > 2018-07-17 4:07 GMT-03:00 Norbert Hartl <norbert(a)hartl.name>: >> >> >>> Am 17.07.2018 um 05:14 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: >>> >>> 2018-06-27 23:21 GMT-03:00 Otto Behrens <otto(a)finworks.biz>: >>>> Thanks for the effort guys. >>>> >>>> I tried to download the image, sources and vm separately (basically >>>> extracted what https://get.pharo.org/64/61+vm does), but ran into fresh >>>> trouble. >>>> >>>> Firstly, is "wget -O - https://get.pharo.org/64/61+vm | bash" not risky in >>>> terms of security? It should be quite possible to inject a lovely trojan >>>> horse with this, or not? >>> >>> Yes, this is possible: >>> >>> https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ >>> >> I like this kind of articles because it proofs every time how less people know about security. If it comes to security eyerone goes hysterical. >> The basic assumption in it is that you need back pressure in order to detect it. But as the get.pharo.org script is not big enough.... the whole thing is not possible. Finished. Next. >> > > Well, you have a case: "People telling people to execute arbitrary > code over the network" : https://curlpipesh.tumblr.com/ ;) > > When it comes to security, it is better to keep humble. Even the guys > behind cryptographic functions got caught, so it is better to follow > the best practices around, at least in a really complex domain as > security. > You don't need a big script to get fooled, have a look at > http://people.zoy.org/~sam/filsdepute.txt and copy-paste its contents > in a text editor. > >> But what is really funny is that there is something not mentioned. Because for this to work you need to have control over the server meaning get.pharo.org. If this is the case I can also make the client download a different image with malicious code or a vm or .. >> Or even better. Every piece of software you download has the same problem. Just because it comes with an installer doesnât mean it is safe. >> >> Security problem scenarios are often theoretical problems. The need to be checked against real conditions in order to identify a threat or not. >> > > We don't agree this time Norbert. Even without a real scenario the > theoretical problem is enough. Two examples are: 1) In security if a > vector is prone to attacks, with a success probability, then could be > considered obsolete or weak, and weakness increases over time (SHA-1, > SHA-2). As computer speeds gets faster, they just calculate an > algorithm resistance and estimate its life-expectancy. 2) People use > package managers precisely because is a delivery mechanism which > transfer the burden of trust from the Pharo maintainers to the package > manager (which verify signatures). That without counting the pleasure > of deniability if an installation got compromised :) > > Cheers > > HernÃ¡n > >> Norbert >> >>> >>>> >>>> Secondly, the pharo bash script that it generates is different to the one in >>>> the zip. The directory structure (where the image & vm goes) is also >>>> different. Why is that? >>>> >>>> I started the image (http://files.pharo.org/get-files/61/pharo64.zip) with >>>> the vm (http://files.pharo.org/get-files/61/pharo-linux-stable.zip) and got >>>> the following, which I tried to do, but that did not take the message away: >>>> >>>> pthread_setschedparam failed: Operation not permitted >>>> This VM uses a separate heartbeat thread to update its internal clock >>>> and handle events. For best operation, this thread should run at a >>>> higher priority, however the VM was unable to change the priority. The >>>> effect is that heavily loaded systems may experience some latency >>>> issues. If this occurs, please create the appropriate configuration >>>> file in /etc/security/limits.d/ as shown below: >>>> >>>> cat <<END | sudo tee /etc/security/limits.d/pharo.conf >>>> * hard rtprio 2 >>>> * soft rtprio 2 >>>> END >>>> >>>> and report to the pharo mailing list whether this improves behaviour. >>>> >>>> You will need to log out and log back in for the limits to take effect. >>>> >>>> (I did do this). >>>> >>>> I reverted to the deb package for now, because this have take some time and >>>> I can't focus on it now. >>>> >>>> I'll give it another shot soon, I hope >>>> >>>> >>>> >>>>> On Wed, Jun 27, 2018 at 8:58 PM, Tim Mackinnon <tim(a)testit.works> wrote: >>>>> >>>>> When we get confirmation of success - we need to make sure this gets >>>>> applied to both zeroconf and official downloads. >>>>> >>>>> Anything we can do to simplify and make it robust is gratefully >>>>> appreciated as there is nothing worse than falling at the lunch hurdle. >>>>> >>>>> Itâs cool to see so many clever minds on this. >>>>> >>>>> Tim >>>>> >>>>> Sent from my iPhone >>>>> >>>>>> On 27 Jun 2018, at 19:52, HernÃ¡n Morales Durand >>>>>> <hernan.morales(a)gmail.com> wrote: >>>>>> >>>>>> 2018-06-27 10:50 GMT-03:00 K K Subbu <kksubbu.ml(a)gmail.com>: >>>>>>>> On Wednesday 27 June 2018 06:39 PM, K K Subbu wrote: >>>>>>>> >>>>>>>> >>>>>>>> The double quotes are required here to skip splitting arguments with >>>>>>>> embedded spaces into different words. >>>>>>>> >>>>>>>> I suspect the error is earlier in the image=$@ assignment. This >>>>>>>> requires >>>>>>>> double quotes. Double quotes are also required while calling zenity to >>>>>>>> avoid >>>>>>>> word splitting. >>>>>>> >>>>>>> >>>>>>> My earlier fix is also in error, Sorry! >>>>>>> >>>>>>> Essentially, we are mixing up single value variable (image) with >>>>>>> argument >>>>>>> array ($@). I found a cleaner fix : >>>>>>> >>>>>>> ```` >>>>>>> if [ $# -eq 0 ]; then >>>>>>> image_count=`ls "$RESOURCES"/*.image 2>/dev/null |wc -l` >>>>>>> if [ "$image_count" -eq 1 ]; then >>>>>>> set -- "$RESOURCES"/*.image >>>>>>> elif which zenity &>/dev/null; then >>>>>>> set -- "$(zenity --title 'Select an image' >>>>>>> --file-selection >>>>>>> --filename "$RESOURCES/" --file-filter '*.image' --file- >>>>>>> filter '*')" >>>>>>> else >>>>>>> set -- "$RESOURCES/Pharo6.1-64.image" >>>>>>> fi >>>>>>> fi >>>>>>> >>>>>> >>>>>> Use $() instead of backticks for command substitution: >>>>>> http://mywiki.wooledge.org/BashFAQ/082 >>>>>> >>>>>> Cheers, >>>>>> >>>>>> HernÃ¡n >>>>>> >>>>>>> # execute >>>>>>> exec "$LINUX/pharo" \ >>>>>>> --plugins "$LINUX" \ >>>>>>> --encoding utf8 \ >>>>>>> -vm-display-X11 \ >>>>>>> "$@" >>>>>>> ```` >>>>>>> >>>>>>> HTH .. Subbu >>>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> >> > >

July 17, 2018

Re: [Pharo-users] pharo bash script with startup

by Norbert Hartl

> Am 17.07.2018 um 17:31 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: > > 2018-07-17 4:07 GMT-03:00 Norbert Hartl <norbert(a)hartl.name <mailto:norbert@hartl.name>>: >> >> >>> Am 17.07.2018 um 05:14 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: >>> >>> 2018-06-27 23:21 GMT-03:00 Otto Behrens <otto(a)finworks.biz>: >>>> Thanks for the effort guys. >>>> >>>> I tried to download the image, sources and vm separately (basically >>>> extracted what https://get.pharo.org/64/61+vm does), but ran into fresh >>>> trouble. >>>> >>>> Firstly, is "wget -O - https://get.pharo.org/64/61+vm | bash" not risky in >>>> terms of security? It should be quite possible to inject a lovely trojan >>>> horse with this, or not? >>> >>> Yes, this is possible: >>> >>> https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ >>> >> I like this kind of articles because it proofs every time how less people know about security. If it comes to security eyerone goes hysterical. >> The basic assumption in it is that you need back pressure in order to detect it. But as the get.pharo.org script is not big enough.... the whole thing is not possible. Finished. Next. >> > > Well, you have a case: "People telling people to execute arbitrary > code over the network" : https://curlpipesh.tumblr.com/ <https://curlpipesh.tumblr.com/> ;) > > When it comes to security, it is better to keep humble. Even the guys > behind cryptographic functions got caught, so it is better to follow > the best practices around, at least in a really complex domain as > security. > You don't need a big script to get fooled, have a look at > http://people.zoy.org/~sam/filsdepute.txt <http://people.zoy.org/~sam/filsdepute.txt> and copy-paste its contents > in a text editor. > >> But what is really funny is that there is something not mentioned. Because for this to work you need to have control over the server meaning get.pharo.org <http://get.pharo.org/>. If this is the case I can also make the client download a different image with malicious code or a vm or .. >> Or even better. Every piece of software you download has the same problem. Just because it comes with an installer doesnât mean it is safe. >> >> Security problem scenarios are often theoretical problems. The need to be checked against real conditions in order to identify a threat or not. >> > > We don't agree this time Norbert. Even without a real scenario the > theoretical problem is enough. Two examples are: 1) In security if a > vector is prone to attacks, with a success probability, then could be > considered obsolete or weak, and weakness increases over time (SHA-1, > SHA-2). As computer speeds gets faster, they just calculate an > algorithm resistance and estimate its life-expectancy. 2) People use > package managers precisely because is a delivery mechanism which > transfer the burden of trust from the Pharo maintainers to the package > manager (which verify signatures). That without counting the pleasure > of deniability if an installation got compromised :) > Iâm not sure why we disagree here. I said that all of those scenarios need to be checked against real conditions. An algorithm that can brute forced due to the increase in computing power is a real condition. What I was saying is that not every theoretical problem is one you need to take care about. Why I am saying this? In my career I met far too many âexpertsâ dealing every theoretical problem as a real one without understanding the impact. Those people often sit at important positions in corporate infrastructure restricting the usage of the internet and software to a bare minimum. And they cannot see that they produce an economical damage to the company while keeping everyone from working. In order to justify that the damage it should at least be a real threat, donât you think? The cost of the measure you take to protect needs to correlate in a sensible manner to the value you want to protect. Norbert > Cheers > > HernÃ¡n > >> Norbert >> >>> >>>> >>>> Secondly, the pharo bash script that it generates is different to the one in >>>> the zip. The directory structure (where the image & vm goes) is also >>>> different. Why is that? >>>> >>>> I started the image (http://files.pharo.org/get-files/61/pharo64.zip) with >>>> the vm (http://files.pharo.org/get-files/61/pharo-linux-stable.zip) and got >>>> the following, which I tried to do, but that did not take the message away: >>>> >>>> pthread_setschedparam failed: Operation not permitted >>>> This VM uses a separate heartbeat thread to update its internal clock >>>> and handle events. For best operation, this thread should run at a >>>> higher priority, however the VM was unable to change the priority. The >>>> effect is that heavily loaded systems may experience some latency >>>> issues. If this occurs, please create the appropriate configuration >>>> file in /etc/security/limits.d/ as shown below: >>>> >>>> cat <<END | sudo tee /etc/security/limits.d/pharo.conf >>>> * hard rtprio 2 >>>> * soft rtprio 2 >>>> END >>>> >>>> and report to the pharo mailing list whether this improves behaviour. >>>> >>>> You will need to log out and log back in for the limits to take effect. >>>> >>>> (I did do this). >>>> >>>> I reverted to the deb package for now, because this have take some time and >>>> I can't focus on it now. >>>> >>>> I'll give it another shot soon, I hope >>>> >>>> >>>> >>>>> On Wed, Jun 27, 2018 at 8:58 PM, Tim Mackinnon <tim(a)testit.works> wrote: >>>>> >>>>> When we get confirmation of success - we need to make sure this gets >>>>> applied to both zeroconf and official downloads. >>>>> >>>>> Anything we can do to simplify and make it robust is gratefully >>>>> appreciated as there is nothing worse than falling at the lunch hurdle. >>>>> >>>>> Itâs cool to see so many clever minds on this. >>>>> >>>>> Tim >>>>> >>>>> Sent from my iPhone >>>>> >>>>>> On 27 Jun 2018, at 19:52, HernÃ¡n Morales Durand >>>>>> <hernan.morales(a)gmail.com> wrote: >>>>>> >>>>>> 2018-06-27 10:50 GMT-03:00 K K Subbu <kksubbu.ml(a)gmail.com>: >>>>>>>> On Wednesday 27 June 2018 06:39 PM, K K Subbu wrote: >>>>>>>> >>>>>>>> >>>>>>>> The double quotes are required here to skip splitting arguments with >>>>>>>> embedded spaces into different words. >>>>>>>> >>>>>>>> I suspect the error is earlier in the image=$@ assignment. This >>>>>>>> requires >>>>>>>> double quotes. Double quotes are also required while calling zenity to >>>>>>>> avoid >>>>>>>> word splitting. >>>>>>> >>>>>>> >>>>>>> My earlier fix is also in error, Sorry! >>>>>>> >>>>>>> Essentially, we are mixing up single value variable (image) with >>>>>>> argument >>>>>>> array ($@). I found a cleaner fix : >>>>>>> >>>>>>> ```` >>>>>>> if [ $# -eq 0 ]; then >>>>>>> image_count=`ls "$RESOURCES"/*.image 2>/dev/null |wc -l` >>>>>>> if [ "$image_count" -eq 1 ]; then >>>>>>> set -- "$RESOURCES"/*.image >>>>>>> elif which zenity &>/dev/null; then >>>>>>> set -- "$(zenity --title 'Select an image' >>>>>>> --file-selection >>>>>>> --filename "$RESOURCES/" --file-filter '*.image' --file- >>>>>>> filter '*')" >>>>>>> else >>>>>>> set -- "$RESOURCES/Pharo6.1-64.image" >>>>>>> fi >>>>>>> fi >>>>>>> >>>>>> >>>>>> Use $() instead of backticks for command substitution: >>>>>> http://mywiki.wooledge.org/BashFAQ/082 >>>>>> >>>>>> Cheers, >>>>>> >>>>>> HernÃ¡n >>>>>> >>>>>>> # execute >>>>>>> exec "$LINUX/pharo" \ >>>>>>> --plugins "$LINUX" \ >>>>>>> --encoding utf8 \ >>>>>>> -vm-display-X11 \ >>>>>>> "$@" >>>>>>> ```` >>>>>>> >>>>>>> HTH .. Subbu

July 17, 2018

Re: [Pharo-users] pharo bash script with startup

by HernÃ¡n Morales Durand

2018-07-17 4:07 GMT-03:00 Norbert Hartl <norbert(a)hartl.name>: > > >> Am 17.07.2018 um 05:14 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: >> >> 2018-06-27 23:21 GMT-03:00 Otto Behrens <otto(a)finworks.biz>: >>> Thanks for the effort guys. >>> >>> I tried to download the image, sources and vm separately (basically >>> extracted what https://get.pharo.org/64/61+vm does), but ran into fresh >>> trouble. >>> >>> Firstly, is "wget -O - https://get.pharo.org/64/61+vm | bash" not risky in >>> terms of security? It should be quite possible to inject a lovely trojan >>> horse with this, or not? >> >> Yes, this is possible: >> >> https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ >> > I like this kind of articles because it proofs every time how less people know about security. If it comes to security eyerone goes hysterical. > The basic assumption in it is that you need back pressure in order to detect it. But as the get.pharo.org script is not big enough.... the whole thing is not possible. Finished. Next. > Well, you have a case: "People telling people to execute arbitrary code over the network" : https://curlpipesh.tumblr.com/ ;) When it comes to security, it is better to keep humble. Even the guys behind cryptographic functions got caught, so it is better to follow the best practices around, at least in a really complex domain as security. You don't need a big script to get fooled, have a look at http://people.zoy.org/~sam/filsdepute.txt and copy-paste its contents in a text editor. > But what is really funny is that there is something not mentioned. Because for this to work you need to have control over the server meaning get.pharo.org. If this is the case I can also make the client download a different image with malicious code or a vm or .. > Or even better. Every piece of software you download has the same problem. Just because it comes with an installer doesnât mean it is safe. > > Security problem scenarios are often theoretical problems. The need to be checked against real conditions in order to identify a threat or not. > We don't agree this time Norbert. Even without a real scenario the theoretical problem is enough. Two examples are: 1) In security if a vector is prone to attacks, with a success probability, then could be considered obsolete or weak, and weakness increases over time (SHA-1, SHA-2). As computer speeds gets faster, they just calculate an algorithm resistance and estimate its life-expectancy. 2) People use package managers precisely because is a delivery mechanism which transfer the burden of trust from the Pharo maintainers to the package manager (which verify signatures). That without counting the pleasure of deniability if an installation got compromised :) Cheers HernÃ¡n > Norbert > >> >>> >>> Secondly, the pharo bash script that it generates is different to the one in >>> the zip. The directory structure (where the image & vm goes) is also >>> different. Why is that? >>> >>> I started the image (http://files.pharo.org/get-files/61/pharo64.zip) with >>> the vm (http://files.pharo.org/get-files/61/pharo-linux-stable.zip) and got >>> the following, which I tried to do, but that did not take the message away: >>> >>> pthread_setschedparam failed: Operation not permitted >>> This VM uses a separate heartbeat thread to update its internal clock >>> and handle events. For best operation, this thread should run at a >>> higher priority, however the VM was unable to change the priority. The >>> effect is that heavily loaded systems may experience some latency >>> issues. If this occurs, please create the appropriate configuration >>> file in /etc/security/limits.d/ as shown below: >>> >>> cat <<END | sudo tee /etc/security/limits.d/pharo.conf >>> * hard rtprio 2 >>> * soft rtprio 2 >>> END >>> >>> and report to the pharo mailing list whether this improves behaviour. >>> >>> You will need to log out and log back in for the limits to take effect. >>> >>> (I did do this). >>> >>> I reverted to the deb package for now, because this have take some time and >>> I can't focus on it now. >>> >>> I'll give it another shot soon, I hope >>> >>> >>> >>>> On Wed, Jun 27, 2018 at 8:58 PM, Tim Mackinnon <tim(a)testit.works> wrote: >>>> >>>> When we get confirmation of success - we need to make sure this gets >>>> applied to both zeroconf and official downloads. >>>> >>>> Anything we can do to simplify and make it robust is gratefully >>>> appreciated as there is nothing worse than falling at the lunch hurdle. >>>> >>>> Itâs cool to see so many clever minds on this. >>>> >>>> Tim >>>> >>>> Sent from my iPhone >>>> >>>>> On 27 Jun 2018, at 19:52, HernÃ¡n Morales Durand >>>>> <hernan.morales(a)gmail.com> wrote: >>>>> >>>>> 2018-06-27 10:50 GMT-03:00 K K Subbu <kksubbu.ml(a)gmail.com>: >>>>>>> On Wednesday 27 June 2018 06:39 PM, K K Subbu wrote: >>>>>>> >>>>>>> >>>>>>> The double quotes are required here to skip splitting arguments with >>>>>>> embedded spaces into different words. >>>>>>> >>>>>>> I suspect the error is earlier in the image=$@ assignment. This >>>>>>> requires >>>>>>> double quotes. Double quotes are also required while calling zenity to >>>>>>> avoid >>>>>>> word splitting. >>>>>> >>>>>> >>>>>> My earlier fix is also in error, Sorry! >>>>>> >>>>>> Essentially, we are mixing up single value variable (image) with >>>>>> argument >>>>>> array ($@). I found a cleaner fix : >>>>>> >>>>>> ```` >>>>>> if [ $# -eq 0 ]; then >>>>>> image_count=`ls "$RESOURCES"/*.image 2>/dev/null |wc -l` >>>>>> if [ "$image_count" -eq 1 ]; then >>>>>> set -- "$RESOURCES"/*.image >>>>>> elif which zenity &>/dev/null; then >>>>>> set -- "$(zenity --title 'Select an image' >>>>>> --file-selection >>>>>> --filename "$RESOURCES/" --file-filter '*.image' --file- >>>>>> filter '*')" >>>>>> else >>>>>> set -- "$RESOURCES/Pharo6.1-64.image" >>>>>> fi >>>>>> fi >>>>>> >>>>> >>>>> Use $() instead of backticks for command substitution: >>>>> http://mywiki.wooledge.org/BashFAQ/082 >>>>> >>>>> Cheers, >>>>> >>>>> HernÃ¡n >>>>> >>>>>> # execute >>>>>> exec "$LINUX/pharo" \ >>>>>> --plugins "$LINUX" \ >>>>>> --encoding utf8 \ >>>>>> -vm-display-X11 \ >>>>>> "$@" >>>>>> ```` >>>>>> >>>>>> HTH .. Subbu >>>>>> >>>>> >>>> >>>> >>> >> > >

July 17, 2018

[ANN] Pharo Git Thermite Release

by Ronie Salgado

Hello, I am finally releasing an initial public version of Pharo Git Thermite, a tool that I am developing as part of my master thesis for visualizing Monticello and Git commits, for Pharo and Python: GitHub Page with sources/documentation/issue tracker: https://github.com/ronsaldo/pharo-git-thermite Short video examples: - Monticello Visualization; https://youtu.be/02CUHBmm-K8 - GitHub pull request: https://youtu.be/f196btLfYxM - Local git commit: https://youtu.be/LCHTiJ4nx3g Feedback form: https://docs.google.com/forms/d/e/1FAIpQLSeir6VlE3bR78oRsNAp9eHLkUn2Q016wEl… Best regards, Ronie

July 17, 2018

Re: [Pharo-users] Iceberg issue on Ubuntu 16.04.3 Pharo 6.1

by Juraj Kubelka

Hi Guillermo, Thank you for the explanation. I have noticed that if I use https://get.pharo.org/64/vm61 <https://get.pharo.org/64/vm61> instead of 64/vmI61 (__I__ letter) it works. The same happens for Pharo 7.0. Cheers, Juraj > On Jul 17, 2018, at 04:33, Guillermo Polito <guillermopolito(a)gmail.com> wrote: > > Hi Juraj, > > The version of Iceberg in Pharo 6.1 is just a preview and we have decided so far that we will not update it so far to avoid disrupting people using Pharo6.1 for business. > Also, iceberg development has moved forward a lot on Pharo7, I don't think that a "simple fix" could be just backported. > > Maybe you can try instead to upgrade your pharo6.1 image with latest iceberg? Try using the script in iceberg's readme. > > On Tue, Jul 17, 2018 at 2:58 AM Juraj Kubelka via Pharo-users <pharo-users(a)lists.pharo.org <mailto:pharo-users@lists.pharo.org>> wrote: > Hi, > > I am trying to build a project in ubuntu 16.04.3. To this: > - I downloaded Pharo 6.1 (60541) 64bit > - I open the Pharo image and execute: > > Metacello new > baseline: 'GToolkit'; > repository: ' <>github://feenkcom/gtoolkit/src <github://feenkcom/gtoolkit/src>'; > load. > > I have the following issue: LGit_GIT_ERROR: SSL error: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init > The full stack is below. > I can clone the repository from a terminal using: git clone git(a)github.com <mailto:git@github.com>:feenkcom/gtoolkit.git > I believe that my settings are correct (same that I use on macOS): > > > > > Is Iceberg suppose to work on Ubuntu 16.04.3 64bit? > I have noticed that it works in Pharo 7 64bit (excluding the fact gtoolkit does not work in Pharo 7 yet). > I found this bug report that might be related: https://github.com/libgit2/libgit2/issues/4644 <https://github.com/libgit2/libgit2/issues/4644> > > Thanks! > Juraj > > > Full stack: > > LGitReturnCodeEnum>>handleLGitReturnCode > LGitRepository(LGitExternalObject)>>withReturnHandlerDo: > LGitRepository>>clone:options:to: > LGitRepository>>clone:options: > [ repo clone: url options: cloneOptions ] in [ | repo cloneOptions | > repo := LGitRepository on: self location. > cloneOptions := LGitCloneOptions > withCredentialsProvider: IceCredentialsProvider default. > cloneOptions checkoutOptions > checkoutStrategy: LGitCheckoutStrategyEnum git_checkout_none. > [ repo clone: url options: cloneOptions ] > on: LGit_GIT_ERROR > do: [ :e | e acceptError: IceLibgitErrorVisitor new ]. > repo > checkout: > (aBranchName > ifNil: > [ self branch ifNotNil: [ :b | b name ] ifNil: [ 'master' ] ]). > (LGitRemote of: repo named: 'origin') > lookup; > setUrl: url ] in IceLibgitLocalRepository>>cloneRepositoryFrom:branch: in Block: [ repo clone: url options: cloneOptions ] > BlockClosure>>on:do: > [ | repo cloneOptions | > repo := LGitRepository on: self location. > cloneOptions := LGitCloneOptions > withCredentialsProvider: IceCredentialsProvider default. > cloneOptions checkoutOptions > checkoutStrategy: LGitCheckoutStrategyEnum git_checkout_none. > [ repo clone: url options: cloneOptions ] > on: LGit_GIT_ERROR > do: [ :e | e acceptError: IceLibgitErrorVisitor new ]. > repo > checkout: > (aBranchName > ifNil: > [ self branch ifNotNil: [ :b | b name ] ifNil: [ 'master' ] ]). > (LGitRemote of: repo named: 'origin') > lookup; > setUrl: url ] in IceLibgitLocalRepository>>cloneRepositoryFrom:branch: in Block: [ | repo cloneOptions |... > [ self checkInitialized. > aBlock value ] in LGitGlobal class>>runSequence: in Block: [ self checkInitialized.... > [ activeProcess psValueAt: index put: anObject. > aBlock value ] in LGitActionSequence(DynamicVariable)>>value:during: in Block: [ activeProcess psValueAt: index put: anObject.... > BlockClosure>>ensure: > LGitActionSequence(DynamicVariable)>>value:during: > LGitActionSequence class(DynamicVariable class)>>value:during: > LGitGlobal class>>runSequence: > IceLibgitLocalRepository>>cloneRepositoryFrom:branch: > IceRepositoryCreator>>createRepository > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] in [ | urlToUse | > urlToUse := remote url. > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] > on: IceAuthenticationError > do: [ :e | > self > crLog: > ('I got an error while cloning: {1}. I will try to clone the HTTPS variant.' > format: {e messageText}). > urlToUse := remote httpsUrl. > e retry ] ] in MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository in Block: [ (IceRepositoryCreator new... > BlockClosure>>on:do: > [ | urlToUse | > urlToUse := remote url. > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] > on: IceAuthenticationError > do: [ :e | > self > crLog: > ('I got an error while cloning: {1}. I will try to clone the HTTPS variant.' > format: {e messageText}). > urlToUse := remote httpsUrl. > e retry ] ] in MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository in Block: [ | urlToUse |... > OrderedCollection(Collection)>>detect:ifFound:ifNone: > OrderedCollection(Collection)>>detect:ifNone: > MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository > IceGithubRepositoryType>>mcRepository > Iceberg class>>mcRepositoryFor: > IceMetacelloPharoPlatform>>createRepository: > MetacelloMCBaselineProject(MetacelloMCProject)>>createRepository: > MetacelloRepositorySpec>>createRepository > [ aSpec createRepository ] in [ :aSpec | > | description repo | > description := aSpec description. > (repo := repositories > detect: [ :rep | rep description = description ] > ifNone: [ aSpec createRepository ]) ~~ nil > ifTrue: [ repos add: repo ] ] in MetacelloFetchingMCSpecLoader(MetacelloCommonMCSpecLoader)>>repositoriesFrom:ignoreOverrides: in Block: [ aSpec createRepository ] > Array(Collection)>>detect:ifFound:ifNone: > Array(Collection)>>detect:ifNone: > [ :aSpec | > | description repo | > description := aSpec description. > (repo := repositories > detect: [ :rep | rep description = description ] > ifNone: [ aSpec createRepository ]) ~~ nil > ifTrue: [ repos add: repo ] ] in MetacelloFetchingMCSpecLoader(MetacelloCommonMCSpecLoader)>>repositoriesFrom:ignoreOverrides: in Block: [ :aSpec | ... > > > > -- > > Guille Polito > Research Engineer > > Centre de Recherche en Informatique, Signal et Automatique de Lille > CRIStAL - UMR 9189 > French National Center for Scientific Research - http://www.cnrs.fr <http://www.cnrs.fr/> > > Web: http://guillep.github.io <http://guillep.github.io/> > Phone: +33 06 52 70 66 13 > <Screen Shot 2018-07-16 at 20.24.31.png><Screen Shot 2018-07-16 at 20.24.31.png>

July 17, 2018

Re: [Pharo-users] Iceberg issue on Ubuntu 16.04.3 Pharo 6.1

by Guillermo Polito

Hi Juraj, The version of Iceberg in Pharo 6.1 is just a preview and we have decided so far that we will not update it so far to avoid disrupting people using Pharo6.1 for business. Also, iceberg development has moved forward a lot on Pharo7, I don't think that a "simple fix" could be just backported. Maybe you can try instead to upgrade your pharo6.1 image with latest iceberg? Try using the script in iceberg's readme. On Tue, Jul 17, 2018 at 2:58 AM Juraj Kubelka via Pharo-users < pharo-users(a)lists.pharo.org> wrote: > Hi, > > I am trying to build a project in ubuntu 16.04.3. To this: > - I downloaded Pharo 6.1 (60541) 64bit > - I open the Pharo image and execute: > > Metacello new > baseline: 'GToolkit'; > repository: 'github://feenkcom/gtoolkit/src'; > load. > > I have the following issue: LGit_GIT_ERROR: SSL error: error:140E0197:SSL > routines:SSL_shutdown:shutdown while in init > The full stack is below. > I can clone the repository from a terminal using: git clone git(a)github.com > :feenkcom/gtoolkit.git > I believe that my settings are correct (same that I use on macOS): > > > > Is Iceberg suppose to work on Ubuntu 16.04.3 64bit? > I have noticed that it works in Pharo 7 64bit (excluding the fact gtoolkit > does not work in Pharo 7 yet). > I found this bug report that might be related: > https://github.com/libgit2/libgit2/issues/4644 > > Thanks! > Juraj > > > Full stack: > > LGitReturnCodeEnum>>handleLGitReturnCode > LGitRepository(LGitExternalObject)>>withReturnHandlerDo: > LGitRepository>>clone:options:to: > LGitRepository>>clone:options: > [ repo clone: url options: cloneOptions ] in [ | repo cloneOptions | > repo := LGitRepository on: self location. > cloneOptions := LGitCloneOptions > withCredentialsProvider: IceCredentialsProvider default. > cloneOptions checkoutOptions > checkoutStrategy: LGitCheckoutStrategyEnum git_checkout_none. > [ repo clone: url options: cloneOptions ] > on: LGit_GIT_ERROR > do: [ :e | e acceptError: IceLibgitErrorVisitor new ]. > repo > checkout: > (aBranchName > ifNil: > [ self branch ifNotNil: [ :b | b name ] ifNil: [ 'master' ] ]). > (LGitRemote of: repo named: 'origin') > lookup; > setUrl: url ] in IceLibgitLocalRepository>>cloneRepositoryFrom:branch: in > Block: [ repo clone: url options: cloneOptions ] > BlockClosure>>on:do: > [ | repo cloneOptions | > repo := LGitRepository on: self location. > cloneOptions := LGitCloneOptions > withCredentialsProvider: IceCredentialsProvider default. > cloneOptions checkoutOptions > checkoutStrategy: LGitCheckoutStrategyEnum git_checkout_none. > [ repo clone: url options: cloneOptions ] > on: LGit_GIT_ERROR > do: [ :e | e acceptError: IceLibgitErrorVisitor new ]. > repo > checkout: > (aBranchName > ifNil: > [ self branch ifNotNil: [ :b | b name ] ifNil: [ 'master' ] ]). > (LGitRemote of: repo named: 'origin') > lookup; > setUrl: url ] in IceLibgitLocalRepository>>cloneRepositoryFrom:branch: in > Block: [ | repo cloneOptions |... > [ self checkInitialized. > aBlock value ] in LGitGlobal class>>runSequence: in Block: [ self > checkInitialized.... > [ activeProcess psValueAt: index put: anObject. > aBlock value ] in LGitActionSequence(DynamicVariable)>>value:during: in > Block: [ activeProcess psValueAt: index put: anObject.... > BlockClosure>>ensure: > LGitActionSequence(DynamicVariable)>>value:during: > LGitActionSequence class(DynamicVariable class)>>value:during: > LGitGlobal class>>runSequence: > IceLibgitLocalRepository>>cloneRepositoryFrom:branch: > IceRepositoryCreator>>createRepository > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] in [ | urlToUse | > urlToUse := remote url. > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] > on: IceAuthenticationError > do: [ :e | > self > crLog: > ('I got an error while cloning: {1}. I will try to clone the HTTPS > variant.' > format: {e messageText}). > urlToUse := remote httpsUrl. > e retry ] ] in > MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository > in Block: [ (IceRepositoryCreator new... > BlockClosure>>on:do: > [ | urlToUse | > urlToUse := remote url. > [ (IceRepositoryCreator new > url: urlToUse; > subdirectory: repoPath; > branchName: self projectVersion; > createRepository) register ] > on: IceAuthenticationError > do: [ :e | > self > crLog: > ('I got an error while cloning: {1}. I will try to clone the HTTPS > variant.' > format: {e messageText}). > urlToUse := remote httpsUrl. > e retry ] ] in > MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository > in Block: [ | urlToUse |... > OrderedCollection(Collection)>>detect:ifFound:ifNone: > OrderedCollection(Collection)>>detect:ifNone: > > MCGitHubRepository(MCGitBasedNetworkRepository)>>getOrCreateIcebergRepository > IceGithubRepositoryType>>mcRepository > Iceberg class>>mcRepositoryFor: > IceMetacelloPharoPlatform>>createRepository: > MetacelloMCBaselineProject(MetacelloMCProject)>>createRepository: > MetacelloRepositorySpec>>createRepository > [ aSpec createRepository ] in [ :aSpec | > | description repo | > description := aSpec description. > (repo := repositories > detect: [ :rep | rep description = description ] > ifNone: [ aSpec createRepository ]) ~~ nil > ifTrue: [ repos add: repo ] ] in > MetacelloFetchingMCSpecLoader(MetacelloCommonMCSpecLoader)>>repositoriesFrom:ignoreOverrides: > in Block: [ aSpec createRepository ] > Array(Collection)>>detect:ifFound:ifNone: > Array(Collection)>>detect:ifNone: > [ :aSpec | > | description repo | > description := aSpec description. > (repo := repositories > detect: [ :rep | rep description = description ] > ifNone: [ aSpec createRepository ]) ~~ nil > ifTrue: [ repos add: repo ] ] in > MetacelloFetchingMCSpecLoader(MetacelloCommonMCSpecLoader)>>repositoriesFrom:ignoreOverrides: > in Block: [ :aSpec | ... > > -- Guille Polito Research Engineer Centre de Recherche en Informatique, Signal et Automatique de Lille CRIStAL - UMR 9189 French National Center for Scientific Research - *http://www.cnrs.fr <http://www.cnrs.fr>* *Web:* *http://guillep.github.io* <http://guillep.github.io> *Phone: *+33 06 52 70 66 13

July 17, 2018

Re: [Pharo-users] pharo bash script with startup

by Esteban Lorenzano

> On 17 Jul 2018, at 09:07, Norbert Hartl <norbert(a)hartl.name> wrote: > > > >> Am 17.07.2018 um 05:14 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: >> >> 2018-06-27 23:21 GMT-03:00 Otto Behrens <otto(a)finworks.biz>: >>> Thanks for the effort guys. >>> >>> I tried to download the image, sources and vm separately (basically >>> extracted what https://get.pharo.org/64/61+vm does), but ran into fresh >>> trouble. >>> >>> Firstly, is "wget -O - https://get.pharo.org/64/61+vm | bash" not risky in >>> terms of security? It should be quite possible to inject a lovely trojan >>> horse with this, or not? >> >> Yes, this is possible: >> >> https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ >> > I like this kind of articles because it proofs every time how less people know about security. If it comes to security eyerone goes hysterical. > The basic assumption in it is that you need back pressure in order to detect it. But as the get.pharo.org <http://get.pharo.org/> script is not big enough.... the whole thing is not possible. Finished. Next. > > But what is really funny is that there is something not mentioned. Because for this to work you need to have control over the server meaning get.pharo.org <http://get.pharo.org/>. If this is the case I can also make the client download a different image with malicious code or a vm or .. > Or even better. Every piece of software you download has the same problem. Just because it comes with an installer doesnât mean it is safe. > > Security problem scenarios are often theoretical problems. The need to be checked against real conditions in order to identify a threat or not. +1 Esteban > > Norbert > >> >>> >>> Secondly, the pharo bash script that it generates is different to the one in >>> the zip. The directory structure (where the image & vm goes) is also >>> different. Why is that? >>> >>> I started the image (http://files.pharo.org/get-files/61/pharo64.zip) with >>> the vm (http://files.pharo.org/get-files/61/pharo-linux-stable.zip) and got >>> the following, which I tried to do, but that did not take the message away: >>> >>> pthread_setschedparam failed: Operation not permitted >>> This VM uses a separate heartbeat thread to update its internal clock >>> and handle events. For best operation, this thread should run at a >>> higher priority, however the VM was unable to change the priority. The >>> effect is that heavily loaded systems may experience some latency >>> issues. If this occurs, please create the appropriate configuration >>> file in /etc/security/limits.d/ as shown below: >>> >>> cat <<END | sudo tee /etc/security/limits.d/pharo.conf >>> * hard rtprio 2 >>> * soft rtprio 2 >>> END >>> >>> and report to the pharo mailing list whether this improves behaviour. >>> >>> You will need to log out and log back in for the limits to take effect. >>> >>> (I did do this). >>> >>> I reverted to the deb package for now, because this have take some time and >>> I can't focus on it now. >>> >>> I'll give it another shot soon, I hope >>> >>> >>> >>>> On Wed, Jun 27, 2018 at 8:58 PM, Tim Mackinnon <tim(a)testit.works> wrote: >>>> >>>> When we get confirmation of success - we need to make sure this gets >>>> applied to both zeroconf and official downloads. >>>> >>>> Anything we can do to simplify and make it robust is gratefully >>>> appreciated as there is nothing worse than falling at the lunch hurdle. >>>> >>>> Itâs cool to see so many clever minds on this. >>>> >>>> Tim >>>> >>>> Sent from my iPhone >>>> >>>>> On 27 Jun 2018, at 19:52, HernÃ¡n Morales Durand >>>>> <hernan.morales(a)gmail.com> wrote: >>>>> >>>>> 2018-06-27 10:50 GMT-03:00 K K Subbu <kksubbu.ml(a)gmail.com>: >>>>>>> On Wednesday 27 June 2018 06:39 PM, K K Subbu wrote: >>>>>>> >>>>>>> >>>>>>> The double quotes are required here to skip splitting arguments with >>>>>>> embedded spaces into different words. >>>>>>> >>>>>>> I suspect the error is earlier in the image=$@ assignment. This >>>>>>> requires >>>>>>> double quotes. Double quotes are also required while calling zenity to >>>>>>> avoid >>>>>>> word splitting. >>>>>> >>>>>> >>>>>> My earlier fix is also in error, Sorry! >>>>>> >>>>>> Essentially, we are mixing up single value variable (image) with >>>>>> argument >>>>>> array ($@). I found a cleaner fix : >>>>>> >>>>>> ```` >>>>>> if [ $# -eq 0 ]; then >>>>>> image_count=`ls "$RESOURCES"/*.image 2>/dev/null |wc -l` >>>>>> if [ "$image_count" -eq 1 ]; then >>>>>> set -- "$RESOURCES"/*.image >>>>>> elif which zenity &>/dev/null; then >>>>>> set -- "$(zenity --title 'Select an image' >>>>>> --file-selection >>>>>> --filename "$RESOURCES/" --file-filter '*.image' --file- >>>>>> filter '*')" >>>>>> else >>>>>> set -- "$RESOURCES/Pharo6.1-64.image" >>>>>> fi >>>>>> fi >>>>>> >>>>> >>>>> Use $() instead of backticks for command substitution: >>>>> http://mywiki.wooledge.org/BashFAQ/082 >>>>> >>>>> Cheers, >>>>> >>>>> HernÃ¡n >>>>> >>>>>> # execute >>>>>> exec "$LINUX/pharo" \ >>>>>> --plugins "$LINUX" \ >>>>>> --encoding utf8 \ >>>>>> -vm-display-X11 \ >>>>>> "$@" >>>>>> ```` >>>>>> >>>>>> HTH .. Subbu

July 17, 2018

Re: [Pharo-users] pharo bash script with startup

by Norbert Hartl

> Am 17.07.2018 um 05:14 schrieb HernÃ¡n Morales Durand <hernan.morales(a)gmail.com>: > > 2018-06-27 23:21 GMT-03:00 Otto Behrens <otto(a)finworks.biz>: >> Thanks for the effort guys. >> >> I tried to download the image, sources and vm separately (basically >> extracted what https://get.pharo.org/64/61+vm does), but ran into fresh >> trouble. >> >> Firstly, is "wget -O - https://get.pharo.org/64/61+vm | bash" not risky in >> terms of security? It should be quite possible to inject a lovely trojan >> horse with this, or not? > > Yes, this is possible: > > https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ > I like this kind of articles because it proofs every time how less people know about security. If it comes to security eyerone goes hysterical. The basic assumption in it is that you need back pressure in order to detect it. But as the get.pharo.org script is not big enough.... the whole thing is not possible. Finished. Next. But what is really funny is that there is something not mentioned. Because for this to work you need to have control over the server meaning get.pharo.org. If this is the case I can also make the client download a different image with malicious code or a vm or .. Or even better. Every piece of software you download has the same problem. Just because it comes with an installer doesnât mean it is safe. Security problem scenarios are often theoretical problems. The need to be checked against real conditions in order to identify a threat or not. Norbert > >> >> Secondly, the pharo bash script that it generates is different to the one in >> the zip. The directory structure (where the image & vm goes) is also >> different. Why is that? >> >> I started the image (http://files.pharo.org/get-files/61/pharo64.zip) with >> the vm (http://files.pharo.org/get-files/61/pharo-linux-stable.zip) and got >> the following, which I tried to do, but that did not take the message away: >> >> pthread_setschedparam failed: Operation not permitted >> This VM uses a separate heartbeat thread to update its internal clock >> and handle events. For best operation, this thread should run at a >> higher priority, however the VM was unable to change the priority. The >> effect is that heavily loaded systems may experience some latency >> issues. If this occurs, please create the appropriate configuration >> file in /etc/security/limits.d/ as shown below: >> >> cat <<END | sudo tee /etc/security/limits.d/pharo.conf >> * hard rtprio 2 >> * soft rtprio 2 >> END >> >> and report to the pharo mailing list whether this improves behaviour. >> >> You will need to log out and log back in for the limits to take effect. >> >> (I did do this). >> >> I reverted to the deb package for now, because this have take some time and >> I can't focus on it now. >> >> I'll give it another shot soon, I hope >> >> >> >>> On Wed, Jun 27, 2018 at 8:58 PM, Tim Mackinnon <tim(a)testit.works> wrote: >>> >>> When we get confirmation of success - we need to make sure this gets >>> applied to both zeroconf and official downloads. >>> >>> Anything we can do to simplify and make it robust is gratefully >>> appreciated as there is nothing worse than falling at the lunch hurdle. >>> >>> Itâs cool to see so many clever minds on this. >>> >>> Tim >>> >>> Sent from my iPhone >>> >>>> On 27 Jun 2018, at 19:52, HernÃ¡n Morales Durand >>>> <hernan.morales(a)gmail.com> wrote: >>>> >>>> 2018-06-27 10:50 GMT-03:00 K K Subbu <kksubbu.ml(a)gmail.com>: >>>>>> On Wednesday 27 June 2018 06:39 PM, K K Subbu wrote: >>>>>> >>>>>> >>>>>> The double quotes are required here to skip splitting arguments with >>>>>> embedded spaces into different words. >>>>>> >>>>>> I suspect the error is earlier in the image=$@ assignment. This >>>>>> requires >>>>>> double quotes. Double quotes are also required while calling zenity to >>>>>> avoid >>>>>> word splitting. >>>>> >>>>> >>>>> My earlier fix is also in error, Sorry! >>>>> >>>>> Essentially, we are mixing up single value variable (image) with >>>>> argument >>>>> array ($@). I found a cleaner fix : >>>>> >>>>> ```` >>>>> if [ $# -eq 0 ]; then >>>>> image_count=`ls "$RESOURCES"/*.image 2>/dev/null |wc -l` >>>>> if [ "$image_count" -eq 1 ]; then >>>>> set -- "$RESOURCES"/*.image >>>>> elif which zenity &>/dev/null; then >>>>> set -- "$(zenity --title 'Select an image' >>>>> --file-selection >>>>> --filename "$RESOURCES/" --file-filter '*.image' --file- >>>>> filter '*')" >>>>> else >>>>> set -- "$RESOURCES/Pharo6.1-64.image" >>>>> fi >>>>> fi >>>>> >>>> >>>> Use $() instead of backticks for command substitution: >>>> http://mywiki.wooledge.org/BashFAQ/082 >>>> >>>> Cheers, >>>> >>>> HernÃ¡n >>>> >>>>> # execute >>>>> exec "$LINUX/pharo" \ >>>>> --plugins "$LINUX" \ >>>>> --encoding utf8 \ >>>>> -vm-display-X11 \ >>>>> "$@" >>>>> ```` >>>>> >>>>> HTH .. Subbu >>>>> >>>> >>> >>> >> >

July 17, 2018