4 ms·
It's great to see Pharo improving, it has tremendous potential. I think the groundbreaking changes in terms of immediate appeal will come in Pharo 6 (new widge
by armitron 10y ago
It's great to see Pharo improving, it has tremendous potential.
I think the groundbreaking changes in terms of immediate
appeal will come in Pharo 6 (new widgets Brick/Bloc, faster graphics with SDL, better font rendering and so on) which will surely attract lots of newcomers to the environment.
To any Pharo devs that may be reading this, there is this snippet in http://www.pharo.org http://www.pharo.org :
$ curl get.pharo.org | bash
In an age where nation states are fighting for control and
MITM attacks are more prevalent than one would think, it does you no favors to promote snippets like the one I pasted. Please consider what the implications are and come up with a better way. I also noticed that you offer no signatures for the Pharo archives or downloads over HTTPS even. You do not need the bad publicity that will come with a security disaster stemming from these issues.
- sigzero 10y agoI hope you are right. I plan on doing the next MOOC that comes out to familiarize myself with Smalltalk and Pharo. Never stop learning.
- soapdog 10y agoThere is a MOOC going on on Pharo programming right now at FUN (France Université Numerique) https://www.fun-mooc.fr/courses/inria/41010/session01/about https://www.fun-mooc.fr/courses/inria/41010/session01/about It is awesome!
- chinathrow 10y agoThey also could secure their downloads with TLS and signing.
- coldtea 10y agoThat would just give a false sense of security. In the end, you DO download a binary. Whether you download it with a script or not doesn't matter. And at least the script, you can examine before running.
- frou_dh 10y agoDamn, I feel like I see the curl-into-shell discussion every day online. Something has to give.
- gcr 10y agoWe would all be satisfied if they took the five minutes to set up a LetsEncrypt certificate. There's no excuse not to. Even better: have the developers agree on a set of GPG signatures to sign their builds with. A bit more complicated...
- yaowenjiaozi 10y ago> five minutes to set up a LetsEncrypt certificate Did you read the LE client source code? Did you verify or set up so that files and directories are with least privilege? All that in five minutes? Or are you suggesting that the Pharo webmaster git clones certbot onto their web server system and just runs the commands according to the LE getting started guide? That's not a qualitative step-up from "curl ... | bash". I use acme-tiny. It's a nice short Python script that mostly shells out to OpenSSL. I went through the source code rather carefully, tested it, and then mucked around with file/directory permissions when using it for real. Took me like 12 minutes at least. I'm kidding about the 12 minutes part, obviously. :-D
- shrugger 10y agoDo you have a source on "In an age where nation states are fighting for control and MITM attacks are more prevalent than one would think" ? I am curious what those numbers actually look like. I've always wondered about what kind of scale they operate on.
- chinathrow 10y agoPRISM is one single huge MITM.
- armitron 10y agoAn example (QUANTUM) that became public with Snowden revelations, that is also very old by now (so who knows what their current capabilities are) gives NSA the ability to on-demand MITM ANYONE they wish with a minimum of effort. This is just a single actor.
- insulanian 10y agoWhat are the best practice alternatives?