<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hi Vanessa,</p>
<p><br>
</p>
<p>thanks for the pointer to capability-based security, this makes sense! However in the OSVM source, I could not find any implementation of <span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;">dropRequestFileHandle()
that would not call <span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;">dropRequestFileName() and sqFileOpen(), so I believe capability-based security is not actually used at the moment. Still, this hook could be relevant
when a new platform (for instance, Android?) would be supported by OSVM. So for now, I conclude that one should indeed use both primitives as implemented in the latest Trunk, in order not to comprise this possibility for future implementations.</span></span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;"><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;"><br>
</span></span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;"><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;">Best,</span></span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;"><span style="font-family: Calibri, Helvetica, sans-serif, serif, EmojiFont; font-size: 16px;">Christoph</span></span></p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div><font size="2" color="#808080"></font></div>
</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Squeak-dev <squeak-dev-bounces@lists.squeakfoundation.org> im Auftrag von Vanessa Freudenberg <vanessa@codefrau.net><br>
<b>Gesendet:</b> Mittwoch, 19. August 2020 23:42:52<br>
<b>An:</b> The general-purpose Squeak developers list<br>
<b>Betreff:</b> Re: [squeak-dev] What is primitiveDropRequestFileHandle and do we really need it?</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>A file handle can be a capability (*). A file name is a string. The Squeak process may lack the permissions to open a named file, but could still read from an open handle (which maybe was created by the OS using a direct user gesture). That way, a sandboxed
app can only access files that were explicitly granted permission by the user, rather than all files on the disk.</div>
<div><br>
</div>
<div>Secondly, it allows the use of temporary files - the file can be opened (which creates the handle) and deleted (which deletes its directory entry). The contents can still be read from the handle afterwards (at least on unix)</div>
<div><br>
</div>
<div>Vanessa</div>
<div><br>
</div>
<div>(*) <a href="https://en.wikipedia.org/wiki/Capability-based_security">https://en.wikipedia.org/wiki/Capability-based_security</a></div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Aug 19, 2020 at 11:26 AM Thiede, Christoph <<a href="mailto:Christoph.Thiede@student.hpi.uni-potsdam.de">Christoph.Thiede@student.hpi.uni-potsdam.de</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_-8095036337511838975divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p>Hi all,</p>
<p><br>
</p>
<p>as some of you already might have noticed [1, 2], I am currently working at a more powerful Drag and Drop (DnD) handling at the VM level of Squeak, heavily inspired by Marcel's ideas. While studying the existing source code, I was wondering what is the actual
purpose of <span>primitiveDropRequestFileHandle compared to <span>primitiveDropRequestFileName</span> which both are called by StandardFileStream >> #<span>requestDropStream:.</span></span></p>
<p><span><span>I had a very short look at all the different DropPlugin implementations and in a nutshell, <span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">dropRequestFileHandle
appears to call <span>dropRequestFileName and then <span>sqFileOpen() that path using the FilePlugin. Compared to this, the regular <span>primitiveFileOpen from the FilePlugin which is called by StandardFileStream >> #<span>open:forWrite: leads to <span>fileOpenNamesizewritesecure()
which first performs some ominous security checks (basically whether the file path is valid and the file is writable if needed) and then, again, calls sqFileOpen().</span></span></span></span></span></span></span></span></p>
<p><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span><br>
</span></span></span></span></span></span></span></span></p>
<p><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span>So at the end of the day, both primitives
appear to call the same logic. So please allow me my naive question: Does anyone remember or imagine any good reason why we have an additional primitive for this purpose? My overall guess (from what I have learned so far about the VM side) would have been
that you should be as frugal as possible when it comes to introducing a primitive, because developing, debugging, and exploring VM code is so much less simple and intuitive than Smalltalk code. For this reason, I would not expect to find any redundant "convenience
primitives" in the OSVM interface.</span></span></span></span></span></span></span></span></p>
<p><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span><br>
</span></span></span></span></span></span></span></span></p>
<p><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span>I have two hypothetical explanations
so far which however both I do not find satisfying:</span></span></span></span></span></span></span></span></p>
<p><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span><br>
</span></span></span></span></span></span></span></span></p>
<p></p>
<ul style="margin-bottom:0px;margin-top:0px">
<li><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span><b>Optimization:</b> Could there
have been some ancient times where it might have been wise to save a redundant call to the SecurityPlugin after you have got a trusted file path from the host system?</span></span></span></span></span></span></span></span></li><li><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><span><span><span><span><span><b>Buggy SecurityPlugin:</b> Could
there be any situation in which the SecurityPlugin would refuse a special file path returned by the DropPlugin though it can be opened by sqFileOpen()? But I cannot experience such a situation.</span></span></span></span></span></span></span></span></li></ul>
<p></p>
<div id="gmail-m_-8095036337511838975Signature">
<div id="gmail-m_-8095036337511838975divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div name="divtagdefaultwrapper">
<div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody">
<div id="gmail-m_-8095036337511838975Item.MessageUniqueBody" style="font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont">
<div dir="ltr">
<div id="gmail-m_-8095036337511838975divtagdefaultwrapper"><font face="Calibri,Helvetica,sans-serif,EmojiFont,Apple Color Emoji,Segoe UI Emoji,NotoColorEmoji,Segoe UI Symbol,Android Emoji,EmojiSymbols">
<div id="gmail-m_-8095036337511838975Signature">
<div style="margin:0px"><font style="font-family:Calibri,Arial,Helvetica,sans-serif,serif,EmojiFont">
<div><font size="3" color="black"><span style="font-size:12pt"><a href="http://www.hpi.de/" rel="noopener noreferrer" id="gmail-m_-8095036337511838975LPNoLP" target="_blank"><font size="2"><span id="gmail-m_-8095036337511838975LPlnk909538"><font color="#757B80"></font></span></font></a></span></font></div>
</font></div>
</div>
</font></div>
</div>
</div>
</div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><br>
</div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><b>Tl;dr:</b> What is the reason for the existence of <span>primitiveDropRequestFileHandle and should it still be used? Why not simply nuke it and always use <span>primitiveDropRequestFileName + <span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">primitiveFileOpen?
Looking forward to your suggestions!</span></span></span></div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px"><br>
</span></span></span></div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">Best,</span></span></span></div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><span><span><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">Christoph</span></span></span></div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody"><br>
</div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody">[1] <a href="https://github.com/OpenSmalltalk/opensmalltalk-vm/pull/508" id="gmail-m_-8095036337511838975LPlnk455342" target="_blank">https://github.com/OpenSmalltalk/opensmalltalk-vm/pull/508</a></div>
<div id="gmail-m_-8095036337511838975Item.MessagePartBody">[2] <a href="https://github.com/OpenSmalltalk/opensmalltalk-vm/pull/514" id="gmail-m_-8095036337511838975LPlnk698556" target="_blank">https://github.com/OpenSmalltalk/opensmalltalk-vm/pull/514</a></div>
</div>
<div><font size="2" color="#808080"></font></div>
</div>
</div>
</div>
</div>
</div>
<br>
</blockquote>
</div>
</div>
</div>
</body>
</html>