[Seaside] Seaside Error - No Secure Generator Available

[Philippe Marschall]

Exactly. We use the Pharo/Squeak Security package. On Linux and macOS we
have a secure way to seed (/dev/urandom) but we do not on Windows. The
reasoning was if people load Seaside-Security they expect to have
photographically secure session ids. Rather than silently not doing this we
opted to throw an exception.

Cheers
Philippe

On Thu, Jun 30, 2016 at 7:45 PM, Johan Brichau <johan at inceptive.be> wrote:

> Hi,
>
> This should only happen if you have Seaside-Security loaded.
> Can you confirm that this is the case?
>
> I don’t have a Windows 10 machine, so it might take some to time figure
> this one out.
>
> Johan
>
> On 30 Jun 2016, at 19:34, mldavis at chaparralwest.com wrote:
>
> David,
>
> Many thanks.  I would never have figured this out.
>
> It worked exactly as you said, in all my images.  Some of these are on
> different machines and yet, they all suddenly started with this same error,
> all the same day????  At least two of these have been running for over a
> week without the error (starting, stopping, making changes etc).  I wonder
> what triggered it….
>
> Anyway thank you so much:  It was in Seaside 3.2 loaded into Pharo 5 build
> 50760 running on Zinc server on Windows 10 latest stable.
>
> Regards,
>
> mike
>
> *From:* David Pennington [mailto:lhdavid at me.com <lhdavid at me.com>]
> *Sent:* Thursday, June 30, 2016 9:21 AM
> *To:* mldavis at chaparralwest.com; Seaside - general discussion <
> seaside at lists.squeakfoundation.org>
> *Subject:* Re: [Seaside] Seaside Error - No Secure Generator Available
>
> I had this problem when running seaside in my VAST Smalltalk image. I was
> advised as follows by Instantiations:
>
> I can reproduce this.
> Looks like Seaside wants to generate random numbers to use as keys for
> session caches.  If a secure RNG (via OpenSSL) is not available in Vast
> then it produces this walkback...even for http.
> If it's not found at startup, then it installs a
> 'WANoSecureKeyGeneratorAvailable' which produces an error when asked for a
> key.
>
> To get around this, try changing the key generator method to the following
> below.  This will force it to fallback to using EsRandom as the RNG.
> In the meantime, we will revisit this internally to see if we can
> disconnect the OpenSSL requirement from the session cache keys.
> Thanks for bringing this up....please let me know if the change described
> below solves your issue.
>
> WANoSecureKeyGeneratorAvailable>>keyOfLength: anInteger
>             ^super keyOfLength: anInteger
>
> Long Haired David
> A.K.A. David Pennington
> lhdavid at icloud.com
>
>
>
>
> On 30 Jun 2016, at 15:33, mldavis at chaparralwest.com wrote:
>
> Seaside 3.1 & 3.2 running on Windows 10
>
> Since yesterday, all of my images of Seaside on two different machines are
> getting this error when I connect to them from http://localhost:8080 :
>
> Seaside Walkback
>
>
> ----------------------------------------------------------------------------------
> WAError: no secure key generator availble because seeding failed
> Debug Full Stack
>
> Stack Trace
> thisContext
> WANoSecureKeyGeneratorAvailable class(GRObject class)>>error:
> self
> WANoSecureKeyGeneratorAvailable
> thisContext
> WANoSecureKeyGeneratorAvailable(GRObject)>>error:
> self
> a WANoSecureKeyGeneratorAvailable
> thisContext
> WANoSecureKeyGeneratorAvailable>>keyOfLength:
> self
> a WANoSecureKeyGeneratorAvailable
> thisContext
> WAHashCache>>store:
> self
> a WAHashCache
> thisContext
> [ cache store: anObject ] in WAMutualExclusionCache>>store:
> self
> a WAMutualExclusionCache
>
> -----------------------------------------------------------------------------
>
> The multi image & different machine impact makes me wonder if this was
> caused by a Windows 10 update, which come without warning now?
>
> Can anyone help me?
>
> Thanks, mike
>
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=icon>
> Virus-free. www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link>
> _______________________________________________
> seaside mailing list
> seaside at lists.squeakfoundation.org
> http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside
>
>
>
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=icon>
> Virus-free. www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link>
> _______________________________________________
> seaside mailing list
> seaside at lists.squeakfoundation.org
> http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside
>
>
>
> _______________________________________________
> seaside mailing list
> seaside at lists.squeakfoundation.org
> http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.squeakfoundation.org/pipermail/seaside/attachments/20160701/672d3e7e/attachment-0001.htm