- Pharo-users - lists.pharo.org

Re: [Pharo-users] [Exercism] Weekly mentoring update (for Pharo)

by Esteban Lorenzano

> On 20 Aug 2019, at 08:52, Norbert Hartl <norbert(a)hartl.name> wrote: > > I find it interesting. Having feedback about things like this is important to know. And knowing that pharo is used is benefifial to the motivation of the community. You can do this more regularly if you ask me. +1 Esteban > > Norbert > > Am 19.08.2019 um 23:00 schrieb Tim Mackinnon <tim(a)testit.works <mailto:tim@testit.works>>: > >> Iâm not sure if this is interesting to the wider community - but Iâm always genuinely impressed that we continue to get a good trickle of solutions submitted to Pharo Exercism - and Iâm genuinely impressed that there is a team of folks who quietly coâhelp in mentoring students and giving feedback to solutions (thanks guys). >> >> Its very impressive. >> >> Tim >> >>> Begin forwarded message: >>> >>> From: The Exercism Team <hello(a)mail.exercism.io <mailto:hello@mail.exercism.io>> >>> Subject: [Exercism] Weekly mentoring update >>> Date: 18 August 2019 at 16:07:40 BST >>> Reply-To: hello(a)exercism.io <mailto:hello@exercism.io> >>> >>> >>> Hi, >>> >>> >>> Here are this week's mentoring statistics. Note that the "Total solutions mentored" value does not include solutions that are approved by our automatic analysers. >>> >>> Site Summary >>> This week 2,540 people submitted 8,983 solutions across all the language tracks. Of these 3,706 solutions were submitted for mentoring. >>> >>> In total, 206 mentors gave feedback on 2,285 solutions. >>> >>> Pharo >>> - New solutions submitted: 43 >>> - Solutions submitted for mentoring: 11 >>> - Total solutions mentored: 22 >>> - Solutions mentored by you: 6 >>> - Current queue length: 6 >>> Thanks for all your hard work this week! >>> >>> The Exercism Team >>> >>> >>

Aug. 20, 2019

Re: [Pharo-users] Why do I not see the transactions when opening a customer

by Richard O'Keefe

I think some people are taking this a bit too seriously. This particular example cannot be taken seriously as an approximation of a real bank, and the "credentials" need not be anything other than a simple clear-text string. There is, for example, *NO* interface of any kind (UI or API) anywhere in the challenge, and *NO* test cases or examples from which test cases could be derived. It is at best an exercise in not mucking up *too* badly. Given that, it's not *that* hard to keep secrets, or it wouldn't be if Pharo didn't have #instVarAt: (:-). So the model code I've attached isn't in Pharo (:-). On Tue, 20 Aug 2019 at 02:19, Roelof Wobben <r.wobben(a)home.nl> wrote: > Thanks all for the answers. > > As I see it , it impossible to store the password in the bankaccount > object and make safe code to use it, > So some one give me a stupid assignment. > > Roelof > > > > Op 19-8-2019 om 11:38 schreef Diego Lont: > > Hi Jupiter. > > This is always a hard problem, as you state: you want a customer to change > their own password, and also want a customer to be allowed to set a > password that he has lost. You could of course make your server code more > resilient, and demand there is security information provided when changing > a password. > > I.E. > newPassword: aString authentication: anAuthenticationInformation > â and here you need to verify the authentication information being: > 1. user / password of the user that has the account > 2. user / password of an administration > 3. reset information sent to the user > â > â¦ details can very, but as said: there will always be a back door. > > So if it is really important, one should implement strong authentication. > Strong authentication is based on the fact, that a user not only knows > something, but also has something. That is why banks always use things such > as a ârabo scannerâ that you need to insert your bank pass (something you > have), type your pin (something you know) and input a picture / code and > the result is a new code that you enter. > > On 19 Aug 2019, at 10:01, Jupiter Jones <jupiter.jones(a)mail.com> wrote: > > Hi Deigo, > > Apologies Roelof for jumping in to your thread. :) > > This solves the issue of storing passwords, however, Richard made the case > for malevolent or broken codeâ¦ > > - you not only provide a getter for the > password, but a setter! This means that > malevolent/broken code can do > aBankAccount password: 'PWNED!'. > and then supply the new password 'PWNED!' > whenever a password is needed. > > The password must be supplied when a > BankAccount is changed and it should not > be settable afterwards (except perhaps with > a master key). > > > To scale there is likely the need to allow customers to change their own > password without call centre or administrator intervention. > > Do you know of any implementations of user/password stores that are > resilient to malevolent or broken code? > > Cheers, > > J > > On 19 Aug 2019, at 5:40 pm, Diego Lont <diego.lont(a)delware.nl> wrote: > > The best way to implement a password security is to never store the > password, but only a hashed password. This way, you never can have a > security leak for your passwords: because you donât have them. And for > hashing you use a standard modern hashing algorithm, so it cannot be easily > rolled back. What I often use is that I make the username readonly, and > make the hash depend on the username (i.e. use the username as seed) > > So you implement > password: aString > self hashedPassword: (self hash: aString) > > verifyPassword: aString > ^(self hash: aString) = self hashedPassword > > Regards, > Diego > > > > >

Aug. 20, 2019

Expression to load a single package from a git repository

by Alejandro Fernandez

Hi all, can anyone point me to a (Metacello?) expression to load a single package from a git repository (I have no project, or baseline, or configuration defined)? The repository is a collection of packages that are supposed to be loaded one by one, on demand (e.g. independent examples or exercises). I am using Pharo 7 (on Pharo 6 I used to do this with IcebergRepositoryCreator and #updatePackage: which does not exist in Pharo 7). Thanks in advance, Yours, Alejandro

Aug. 20, 2019

Re: [Pharo-users] Fwd: [Exercism] Weekly mentoring update (for Pharo)

by Norbert Hartl

I find it interesting. Having feedback about things like this is important to know. And knowing that pharo is used is benefifial to the motivation of the community. You can do this more regularly if you ask me. Norbert > Am 19.08.2019 um 23:00 schrieb Tim Mackinnon <tim(a)testit.works>: > > Iâm not sure if this is interesting to the wider community - but Iâm always genuinely impressed that we continue to get a good trickle of solutions submitted to Pharo Exercism - and Iâm genuinely impressed that there is a team of folks who quietly coâhelp in mentoring students and giving feedback to solutions (thanks guys). > > Its very impressive. > > Tim > >> Begin forwarded message: >> >> From: The Exercism Team <hello(a)mail.exercism.io> >> Subject: [Exercism] Weekly mentoring update >> Date: 18 August 2019 at 16:07:40 BST >> Reply-To: hello(a)exercism.io >> >> >> Hi, >> >> >> Here are this week's mentoring statistics. Note that the "Total solutions mentored" value does not include solutions that are approved by our automatic analysers. >> >> Site Summary >> This week 2,540 people submitted 8,983 solutions across all the language tracks. Of these 3,706 solutions were submitted for mentoring. >> >> In total, 206 mentors gave feedback on 2,285 solutions. >> >> Pharo >> - New solutions submitted: 43 >> - Solutions submitted for mentoring: 11 >> - Total solutions mentored: 22 >> - Solutions mentored by you: 6 >> - Current queue length: 6 >> Thanks for all your hard work this week! >> >> The Exercism Team >> >> >

Aug. 20, 2019

Fwd: [Exercism] Weekly mentoring update (for Pharo)

by Tim Mackinnon

Iâm not sure if this is interesting to the wider community - but Iâm always genuinely impressed that we continue to get a good trickle of solutions submitted to Pharo Exercism - and Iâm genuinely impressed that there is a team of folks who quietly coâhelp in mentoring students and giving feedback to solutions (thanks guys). Its very impressive. Tim > Begin forwarded message: > > From: The Exercism Team <hello(a)mail.exercism.io> > Subject: [Exercism] Weekly mentoring update > Date: 18 August 2019 at 16:07:40 BST > Reply-To: hello(a)exercism.io > > > Hi, > > > Here are this week's mentoring statistics. Note that the "Total solutions mentored" value does not include solutions that are approved by our automatic analysers. > > Site Summary > This week 2,540 people submitted 8,983 solutions across all the language tracks. Of these 3,706 solutions were submitted for mentoring. > > In total, 206 mentors gave feedback on 2,285 solutions. > > Pharo > - New solutions submitted: 43 > - Solutions submitted for mentoring: 11 > - Total solutions mentored: 22 > - Solutions mentored by you: 6 > - Current queue length: 6 > Thanks for all your hard work this week! > > The Exercism Team > >

Aug. 19, 2019

Re: [Pharo-users] Finding replacements for deprecated functions

by Cyril Ferlicot

On Mon 19 Aug 2019 at 20:30, Steve Quezadas <steveeq1(a)gmail.com> wrote: > I am experimenting with smalltalk. Sometimes a function gets > deprecated and is crossed out. Is there a "smalltalk way" of finding > the equivalent replacement function? > Hello, Most of the time the deprecation explains what is the new way directly. If itâs a change in the API with an equivalent method, it will be the one called in the deprecated method that should now be called. For more complex cases, if you donât know the equivalent I guess the easiest way is to ask the community on this ML. -- Cyril Ferlicot https://ferlicot.fr

Aug. 19, 2019

Finding replacements for deprecated functions

by Steve Quezadas

I am experimenting with smalltalk. Sometimes a function gets deprecated and is crossed out. Is there a "smalltalk way" of finding the equivalent replacement function?

Aug. 19, 2019

Re: [Pharo-users] Why do I not see the transactions when opening a customer

by Roelof Wobben

Aug. 19, 2019

Re: [Pharo-users] Why do I not see the transactions when opening a customer

by Richard Sargent

On Mon, Aug 19, 2019 at 9:40 AM Roelof Wobben <r.wobben(a)home.nl> wrote: > Hello Ben, > > I think the purpose of this exercise was to practice expecially things > like encapsulation and thinking in classes. > > So I think it's not a big deal to have a setter and a method to check if > the passwords are matching. > Roelof, There are still ways to avoid that. For example, consider a method such as Customer>>addAccountWithPassword: and Account>>#changePasswordFrom:to:. No need for setters and getters and no exposure to unauthorized password changes. [Of course, this doesn't handle the "I've forgotten my password" scenario, but Account>>#changePasswordTo:usingAuthorizationToken: might.] I think the exercise is more about APIs than it is about every little detail of an exercise reflecting best practices in the corresponding real world scenario. But, understanding that there are those issues is crucial, as we see almost daily with news of security breaches. I don't think anyone would argue that completing this exercise should suddenly make you qualified to develop a banking application. :-) > Roelof > > > > Op 19-8-2019 om 18:35 schreef Ben Coman: > > > > On Mon, 19 Aug 2019 at 22:19, Roelof Wobben <r.wobben(a)home.nl> wrote: > >> Thanks all for the answers. >> >> As I see it , it impossible to store the password in the bankaccount >> object and make safe code to use it, >> So some one give me a stupid assignment. >> > > That would seem to depend on the purpose of the assignment. > a. To produce production ready code that managed someone's real life > money, > b. Provide a vehicle to reason about typical implementation issues, in > which case did you learn anything from the exercise? > > cheers -ben > > >

Aug. 19, 2019

Re: [Pharo-users] Why do I not see the transactions when opening a customer

by Roelof Wobben

Aug. 19, 2019