<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>How would you design such a password safe? Wouldn't this be to be implemented on VM side to make sure no one unauthorized can access it, e. g. via mirror primitive?</p>
<p><br>
</p>
<p>Best,</p>
<p>Christoph</p>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div name="x_divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div>
<div class="x__rp_T4" id="x_Item.MessagePartBody">
<div class="x__rp_U4 x_ms-font-weight-regular x_ms-font-color-neutralDark x_rpHighlightAllClass x_rpHighlightBodyClass" id="x_Item.MessageUniqueBody" style="font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont">
<div dir="ltr">
<div id="x_divtagdefaultwrapper"><font face="Calibri,Helvetica,sans-serif,EmojiFont,Apple Color Emoji,Segoe UI Emoji,NotoColorEmoji,Segoe UI Symbol,Android Emoji,EmojiSymbols">
<div id="x_Signature">
<div style="margin:0px"><font style="font-family:Calibri,Arial,Helvetica,sans-serif,serif,EmojiFont"></font></div>
</div>
</font></div>
</div>
</div>
</div>
</div>
<div><font size="2" color="#808080"></font></div>
</div>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> Squeak-dev <squeak-dev-bounces@lists.squeakfoundation.org> im Auftrag von Tobias Pape <Das.Linux@gmx.de><br>
<b>Gesendet:</b> Samstag, 6. Juni 2020 10:47:28<br>
<b>An:</b> The general-purpose Squeak developers list<br>
<b>Betreff:</b> Re: [squeak-dev] #clearCredentials vs. ModificationForbidden</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">> On 06.06.2020, at 08:01, Marcel Taeumel <marcel.taeumel@hpi.de> wrote:<br>
> <br>
> Collection >> #wipeAllFromMemory would be nice to have. :-D Could be a combination of atAllPut: and #removeAll. And deal with ModificationForbidden.<br>
> <br>
<br>
I think this is hard to do in a general case (think Intervals?) and is a bit mushy between system-level programming and breaking object-oriented encapsulation.
<br>
<br>
A dedicated, wipeable Password-safe storage would be better. Thinking of it, we could go a step further and give it an interface such that the clear text of a password is passed on only in minimal contexts to fool memory snooping.
<br>
<br>
Best regards<br>
-Tobias<br>
<br>
<br>
> Best,<br>
> Marcel<br>
>> Am 05.06.2020 21:11:30 schrieb Jakob Reschke <forums.jakob@resfarm.de>:<br>
>> <br>
>> Hmm so I was obviously wrong. I understand why, if I think what<br>
>> happens to a method's string literal if you becomeForward: it... And<br>
>> actually since Spur this would really write something to the object's<br>
>> memory space, despite my assumption.<br>
>> <br>
>> So why are these immutable? Because you specify a repository with an<br>
>> evaluable constructor snippet, which has the credentials as string<br>
>> literals, correct? Can't we just copy these arguments in the<br>
>> constructors/setters, to make them "owned" and mutable?<br>
>> <br>
>> Am Fr., 5. Juni 2020 um 19:36 Uhr schrieb Thiede, Christoph<br>
>> :<br>
>> ><br>
>> > This does not work for me:<br>
>> ><br>
>> ><br>
>> > x := 'x'.<br>
>> > x beReadOnlyObject.<br>
>> > y := ''.<br>
>> > x becomeForward: y copyHash: false.<br>
>> ><br>
>> > Still raises a ModificationForbidden.<br>
>> ><br>
>> ><br>
>> > Best,<br>
>> ><br>
>> > Christoph<br>
>> ><br>
>> > ________________________________<br>
>> > Von: Squeak-dev im Auftrag von Jakob Reschke <br>
>> > Gesendet: Freitag, 5. Juni 2020 19:31:30<br>
>> > An: The general-purpose Squeak developers list<br>
>> > Betreff: Re: [squeak-dev] #clearCredentials vs. ModificationForbidden<br>
>> ><br>
>> > With copyHash: false, I hope you can. It should not touch the original<br>
>> > object, which is to be discarded anyway.<br>
>> ><br>
>> > Am Fr., 5. Juni 2020 um 19:24 Uhr schrieb Thiede, Christoph<br>
>> > :<br>
>> > ><br>
>> > > > Use becomeForward: and collect garbage?<br>
>> > ><br>
>> > ><br>
>> > > Afaik you cannot forward a read-only object?<br>
>> > ><br>
>> > > ________________________________<br>
>> > > Von: Squeak-dev im Auftrag von Jakob Reschke <br>
>> > > Gesendet: Freitag, 5. Juni 2020 17:53:30<br>
>> > > An: The general-purpose Squeak developers list<br>
>> > > Betreff: Re: [squeak-dev] #clearCredentials vs. ModificationForbidden<br>
>> > ><br>
>> > > Use becomeForward: and collect garbage?<br>
>> > ><br>
>> > > Marcel Taeumel schrieb am Fr., 5. Juni 2020, 16:27:<br>
>> > >><br>
>> > >> Hi all!<br>
>> > >><br>
>> > >> How to update MCHttpRepository >> #clearCredentials?<br>
>> > >><br>
>> > >> clearCredentials<br>
>> > >> user ifNotNil: [user atAllPut: $x].<br>
>> > >> password ifNotNil: [password atAllPut: $x].<br>
>> > >> user := password := String empty<br>
>> > >><br>
>> > >> Make those strings not be read-only?<br>
>> > >><br>
>> > >> Best,<br>
>> > >> Marcel<br>
>> > >><br>
>> > ><br>
>> ><br>
>> ><br>
>> <br>
> <br>
<br>
<br>
<br>
</div>
</span></font>
</body>
</html>