Re: View scripts of my standalone?

2010-03-23 Thread Björnke von Gierke
I have chronoSync, and it's nice if you like to geek out and prefer to 
customise your backup strategies. For everyone else, I'd suggest superDuper. No 
configuration is often the best configuration.

http://www.shirt-pocket.com/SuperDuper/

for security reasons I suggest to use several different approaches to backups, 
because what if your only backup software is bugged? Therefore I use backup 
(.mac leftover) and time machine from apple, as well as chronoSync and manual 
copies. My backups reside on 3 different drives, as well as a server (or as the 
kids call it these days: the cloud).

Do backups, or you will eventually miss them.

On 19 Mar 2010, at 17:25, Bob Sneidar wrote:

 I have used time machine to recover older versions of rev stacks where I had 
 made a mistake and unknowingly deleted an object with a lot of scripting in 
 it. Very nice feature to have. 
 
 I will caution this however. When doing a FULL restore from a time machine 
 backup, keep in mind it doesn't do everything. I had a local SQL server 
 running and it totally missed that. Apparently there are certain directories 
 it ignores by default. The one that the SQL data files resided in was 
 apparently one of them. 
 
 For full drive backup and restore may I suggest ChronoSync? Best dam backup 
 program period IMHE. And only $40. 
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-19 Thread Peter Brigham MD

On Mar 18, 2010, at 9:31 PM, Kay C Lan wrote:


And then. rrrgghh! A calendar she'd be working with,
the most important of half a dozen calendars, for some reason she
inexplicably deleted, at that was it, it was gone! She looked high and
low, but it was gone. She was almost in tears when she told me what
happened. So I pointed out the clock icon with the anti-clockwise
arrow around and the Enter Time Machine menu item and 5 min later
we had her calendar back.


Time Machine has saved my sorry ass on several occasions. I have  
finally learned the hard way to back up obsessively. I LOVE Time  
Machine! (Or should that be I LERRVE Time Machine?) (Apologies  
to Woody Allen)


-- Peter

Peter M. Brigham
pmb...@gmail.com
http://home.comcast.net/~pmbrig


___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-19 Thread Bob Sneidar
riiight. (wink wink)

Bob


On Mar 18, 2010, at 6:31 PM, Kay C Lan wrote:

 PS My wife really doesn't nag, she's great.

___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-19 Thread Bob Sneidar
I have used time machine to recover older versions of rev stacks where I had 
made a mistake and unknowingly deleted an object with a lot of scripting in it. 
Very nice feature to have. 

I will caution this however. When doing a FULL restore from a time machine 
backup, keep in mind it doesn't do everything. I had a local SQL server running 
and it totally missed that. Apparently there are certain directories it ignores 
by default. The one that the SQL data files resided in was apparently one of 
them. 

For full drive backup and restore may I suggest ChronoSync? Best dam backup 
program period IMHE. And only $40. 

Bob


On Mar 19, 2010, at 5:29 AM, Peter Brigham MD wrote:

 On Mar 18, 2010, at 9:31 PM, Kay C Lan wrote:
 
 And then. rrrgghh! A calendar she'd be working with,
 the most important of half a dozen calendars, for some reason she
 inexplicably deleted, at that was it, it was gone! She looked high and
 low, but it was gone. She was almost in tears when she told me what
 happened. So I pointed out the clock icon with the anti-clockwise
 arrow around and the Enter Time Machine menu item and 5 min later
 we had her calendar back.
 
 Time Machine has saved my sorry ass on several occasions. I have finally 
 learned the hard way to back up obsessively. I LOVE Time Machine! (Or 
 should that be I LERRVE Time Machine?) (Apologies to Woody Allen)
 
 -- Peter
 
 Peter M. Brigham
 pmb...@gmail.com
 http://home.comcast.net/~pmbrig
 
 
 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your subscription 
 preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution

___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-18 Thread Kay C Lan
On Thu, Mar 18, 2010 at 3:07 AM, Kee Nethery k...@kagi.com wrote:

 Imagine me hitting myself on the head with a big dead fish. I use Time 
 Machine on my Mac for backups and it was trivial to go back in time and 
 grab the old source file. I knew there was a reason for doing backups :-)


ROTFL... in pain;-))

Now imagine a nagging wife why are you always buying computer
gadgets, why did you need to buy are 1TB TimeCapsule, why did you buy
another HD, way are there so many HD Icons on my desktop, have you
been on my computer again, why have you been messing with my computer,
why Or when I buy Mac OS X The Missing Manual and suggest she read
up on the new features... No I haven't got time, or to make it even
easier, if I download the propaganda .mov from Apple and say, you
should check out the new features... I'm not in the mood.

And then. rrrgghh! A calendar she'd be working with,
the most important of half a dozen calendars, for some reason she
inexplicably deleted, at that was it, it was gone! She looked high and
low, but it was gone. She was almost in tears when she told me what
happened. So I pointed out the clock icon with the anti-clockwise
arrow around and the Enter Time Machine menu item and 5 min later
we had her calendar back.

How imagine the polar opposite of being hit on the head with a big fish;-)

BTMF (Big TimeMachine Fan)
PS My wife really doesn't nag, she's great.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread stephen barncard
Use the splash screen method and don't password protect the stacks.  the
first stack gets compiled into the app package with the standalone engine.
The other stacks are editable.

The making of splash screen apps has been covered previously.

On 17 March 2010 08:23, Kee Nethery k...@kagi.com wrote:

 I have one stack that I deploy as a standalone. Most stacks I deploy using
 the updater so the actual thing going out to users is the stack with the
 .rev suffix removed. In this case, it's the stack saved as a standalone.

 I'd like to see what I did in a previous version and I've just realized
 that unlike Hypercard where the app and stack get merged together and you
 can still go in and read the scripts ... RunRev seems to not use that
 mechanism. I don't seem to be able to open and view my stack in RunRev or
 even in a text editor now that it's in a standalone. It's not encrypted or
 anything. It's just a small stack converted to standalone.

 Is there a way to view the scripts in the standalone or does runrev
 purposefully make that difficult?

 I can recreate the solution that was in a previous version but I'd rather
 just re-use code that seemed adequate for the task that is no longer in my
 current version.

 Thanks,
 Kee Nethery


 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your
 subscription preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution




-- 
-
Stephen Barncard
currently in Fairhope AL
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 15:23, Kee Nethery wrote:

I have one stack that I deploy as a standalone. Most stacks I deploy using the 
updater so the actual thing going out to users is the stack with the .rev 
suffix removed. In this case, it's the stack saved as a standalone.

I'd like to see what I did in a previous version and I've just realized that 
unlike Hypercard where the app and stack get merged together and you can still 
go in and read the scripts ... RunRev seems to not use that mechanism. I don't 
seem to be able to open and view my stack in RunRev or even in a text editor 
now that it's in a standalone. It's not encrypted or anything. It's just a 
small stack converted to standalone.

Is there a way to view the scripts in the standalone or does runrev 
purposefully make that difficult?


Not that I'm aware of; I've just spent a few minutes mucking around 
inside a Mac OS standalone package,

getting nowhere.

That is why, for my Devawriter application, I have about a gigabyte of 
previous version stacks in zip files

taking up space.

I can recreate the solution that was in a previous version but I'd rather just 
re-use code that seemed adequate for the task that is no longer in my current 
version.

Thanks,
Kee Nethery


What you could do, if you deleted the source stack recently, is do run 
an 'undelete' program to see if the stack

is still lurking, invisibly on your hard disks . . .
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 15:31, stephen barncard wrote:

Use the splash screen method and don't password protect the stacks.  the
first stack gets compiled into the app package with the standalone engine.
The other stacks are editable.

The making of splash screen apps has been covered previously.


Umm . . . jolly helpful advice for the future; the problem, if I read 
things right, is that Kee

neither did that or made a backup of the original stack.

___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread stephen barncard
you can gain access to a mac package by option-clicking on the icon, select
Show Package Contents

On 17 March 2010 08:31, stephen barncard stephenrevoluti...@barncard.comwrote:

 Use the splash screen method and don't password protect the stacks.  the
 first stack gets compiled into the app package with the standalone engine.
 The other stacks are editable.

 The making of splash screen apps has been covered previously.


 On 17 March 2010 08:23, Kee Nethery k...@kagi.com wrote:

 I have one stack that I deploy as a standalone. Most stacks I deploy using
 the updater so the actual thing going out to users is the stack with the
 .rev suffix removed. In this case, it's the stack saved as a standalone.

 I'd like to see what I did in a previous version and I've just realized
 that unlike Hypercard where the app and stack get merged together and you
 can still go in and read the scripts ... RunRev seems to not use that
 mechanism. I don't seem to be able to open and view my stack in RunRev or
 even in a text editor now that it's in a standalone. It's not encrypted or
 anything. It's just a small stack converted to standalone.

 Is there a way to view the scripts in the standalone or does runrev
 purposefully make that difficult?

 I can recreate the solution that was in a previous version but I'd rather
 just re-use code that seemed adequate for the task that is no longer in my
 current version.

 Thanks,
 Kee Nethery


 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your
 subscription preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution




 --
 -
 Stephen Barncard
 currently in Fairhope AL




-- 
-
Stephen Barncard
currently in Fairhope AL
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Andre Garzia
I did not really understand if Kee want to be able to poke inside a
standalone script or if he is not trying to.


Case A: Kee wants to pick his code from a standalone which was not protected
with password:
If the standalone is built with a engine before 4.0 then you can pick the
scripts back using an HEX editor. If it is built with the newer engines,
then I don't know.

Case B: Kee wants to make sure people don't see his source code:
Use modern engine and protect stacks with password.



On Wed, Mar 17, 2010 at 10:33 AM, Richmond Mathewson 
richmondmathew...@gmail.com wrote:

  On 17/03/2010 15:31, stephen barncard wrote:

 Use the splash screen method and don't password protect the stacks.  the
 first stack gets compiled into the app package with the standalone engine.
 The other stacks are editable.

 The making of splash screen apps has been covered previously.


 Umm . . . jolly helpful advice for the future; the problem, if I read
 things right, is that Kee
 neither did that or made a backup of the original stack.


 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your
 subscription preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution




-- 
http://www.andregarzia.com All We Do Is Code.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Lyn Teyla
If I remember correctly, there is a long-standing security
issue where anyone can view the stack scripts of ANY Rev
standalone by doing a memory dump WHILE the app is running.

This works EVEN if all stacks are completely password
protected (and therefore encrypted)!

Apparently this is caused by the RunRev engine decrypting
and reading the scripts into memory and keeping them there
in clear text for as long as the app/stacks are open.

I have no idea how to do a memory dump, but I'm sure many
do, and this security issue has kept us away from deploying
major apps using Rev.

By the way, this could also mean that the same security issue
plagues the browser plugin, if the same method of running
stacks is used.

This can be a major problem especially if the scripts contain
sensitive details such as database logins and so forth.

Can anyone from RunRev confirm if this major security issue
has been resolved?

Also, can anyone who knows how to do a memory dump provide
details on how this is done, so we can verify if this is
still happening for standalones built using the latest version
of Rev, and so that Kee can extract the needed scripts?


Kee Nethery wrote:

 Is there a way to view the scripts in the standalone or does runrev 
 purposefully make that difficult?
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


RE: View scripts of my standalone?

2010-03-17 Thread Richard Gaskin

Kee Nethery wrote:

 I have one stack that I deploy as a standalone. Most stacks I deploy
 using the updater so the actual thing going out to users is the stack
 with the .rev suffix removed. In this case, it's the stack saved as a
 standalone.

 I'd like to see what I did in a previous version and I've just
 realized that unlike Hypercard where the app and stack get merged
 together and you can still go in and read the scripts ... RunRev
 seems to not use that mechanism. I don't seem to be able to open
 and view my stack in RunRev or even in a text editor now that it's
 in a standalone. It's not encrypted or anything. It's just a small
 stack converted to standalone.

Correct, as of v4.0 and later.  In earlier version you could drop the 
executable within the OS X bundle onto TextEdit to read the scripts of a 
non-password-protected standalone, but with v4.0 the way standalones are 
built has changed - this is from the Engine Change Log included with the 
Rev install:


-


New features added in 4.0
~

Standalone Building
~~~

The method by which standalone building is done has changed in this 
release. Standalones are now built in such a way that they behave much 
better as executable files on all three platforms.

...
The new method of standalone building also improves on the previous 
method by implicitly compressing and masking the main stackfile that is 
being built. This reduces standalone size, and also makes it harder for 
individuals to attempt to reverse-engineer a built standalone.


-

So with v4.0 and later, with or without a password you'll need to keep a 
copy of the original source file in order to read scripts.


--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv


___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 16:04, Richard Gaskin wrote:

Kee Nethery wrote:

 I have one stack that I deploy as a standalone. Most stacks I deploy
 using the updater so the actual thing going out to users is the stack
 with the .rev suffix removed. In this case, it's the stack saved as a
 standalone.

 I'd like to see what I did in a previous version and I've just
 realized that unlike Hypercard where the app and stack get merged
 together and you can still go in and read the scripts ... RunRev
 seems to not use that mechanism. I don't seem to be able to open
 and view my stack in RunRev or even in a text editor now that it's
 in a standalone. It's not encrypted or anything. It's just a small
 stack converted to standalone.

Correct, as of v4.0 and later.  In earlier version you could drop the 
executable within the OS X bundle onto TextEdit to read the scripts of 
a non-password-protected standalone, but with v4.0 the way standalones 
are built has changed - this is from the Engine Change Log included 
with the Rev install:


-


New features added in 4.0
~

Standalone Building
~~~

The method by which standalone building is done has changed in this 
release. Standalones are now built in such a way that they behave much 
better as executable files on all three platforms.

...
The new method of standalone building also improves on the previous 
method by implicitly compressing and masking the main stackfile that 
is being built. This reduces standalone size, and also makes it harder 
for individuals to attempt to reverse-engineer a built standalone.


Yup: just tried to open what sits inside the MacOS folder inside one of 
my Devawriter standalones
with HexEdit - no joy: well, from a selfish point of view this makes me 
rather happy - no nosey-parkers

getting very far with bits of my stuff I wish to keep private . . .  :)



-

So with v4.0 and later, with or without a password you'll need to keep 
a copy of the original source file in order to read scripts.


--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv


___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your 
subscription preferences:

http://lists.runrev.com/mailman/listinfo/use-revolution



___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Lyn Teyla
Richmond Mathewson wrote:

 Yup: just tried to open what sits inside the MacOS folder inside one of my 
 Devawriter standalones
 with HexEdit - no joy: well, from a selfish point of view this makes me 
 rather happy - no nosey-parkers
 getting very far with bits of my stuff I wish to keep private . . .  :)

UNLESS they do a memory dump - whatever that is. 
:(___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 16:19, Lyn Teyla wrote:

Richmond Mathewson wrote:


Yup: just tried to open what sits inside the MacOS folder inside one of my 
Devawriter standalones
with HexEdit - no joy: well, from a selfish point of view this makes me rather 
happy - no nosey-parkers
getting very far with bits of my stuff I wish to keep private . . .  :)

UNLESS they do a memory dump - whatever that is. 
:(___


Well, a Google search yields all sorts of stuff on how to analyse 
memory dumps, but nothing on

how to precipitate one.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Andre Garzia
Hey Richmond,

DevaWriter is on Apple Home Page:
http://www.apple.com/downloads/macosx/home_learning/devawriter.html

Cool! :D

On Wed, Mar 17, 2010 at 11:14 AM, Richmond Mathewson 
richmondmathew...@gmail.com wrote:

  On 17/03/2010 16:04, Richard Gaskin wrote:

 Kee Nethery wrote:

  I have one stack that I deploy as a standalone. Most stacks I deploy
  using the updater so the actual thing going out to users is the stack
  with the .rev suffix removed. In this case, it's the stack saved as a
  standalone.
 
  I'd like to see what I did in a previous version and I've just
  realized that unlike Hypercard where the app and stack get merged
  together and you can still go in and read the scripts ... RunRev
  seems to not use that mechanism. I don't seem to be able to open
  and view my stack in RunRev or even in a text editor now that it's
  in a standalone. It's not encrypted or anything. It's just a small
  stack converted to standalone.

 Correct, as of v4.0 and later.  In earlier version you could drop the
 executable within the OS X bundle onto TextEdit to read the scripts of a
 non-password-protected standalone, but with v4.0 the way standalones are
 built has changed - this is from the Engine Change Log included with the Rev
 install:

 -


 New features added in 4.0
 ~

 Standalone Building
 ~~~

 The method by which standalone building is done has changed in this
 release. Standalones are now built in such a way that they behave much
 better as executable files on all three platforms.
 ...
 The new method of standalone building also improves on the previous method
 by implicitly compressing and masking the main stackfile that is being
 built. This reduces standalone size, and also makes it harder for
 individuals to attempt to reverse-engineer a built standalone.


 Yup: just tried to open what sits inside the MacOS folder inside one of my
 Devawriter standalones
 with HexEdit - no joy: well, from a selfish point of view this makes me
 rather happy - no nosey-parkers
 getting very far with bits of my stuff I wish to keep private . . .  :)



 -

 So with v4.0 and later, with or without a password you'll need to keep a
 copy of the original source file in order to read scripts.

 --
  Richard Gaskin
  Fourth World
  Rev training and consulting: http://www.fourthworld.com
  Webzine for Rev developers: http://www.revjournal.com
  revJournal blog: http://revjournal.com/blog.irv


 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your
 subscription preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution


 ___
 use-revolution mailing list
 use-revolution@lists.runrev.com
 Please visit this url to subscribe, unsubscribe and manage your
 subscription preferences:
 http://lists.runrev.com/mailman/listinfo/use-revolution




-- 
http://www.andregarzia.com All We Do Is Code.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richard Gaskin

Lyn Teyla wrote:

If I remember correctly, there is a long-standing security
issue where anyone can view the stack scripts of ANY Rev
standalone by doing a memory dump WHILE the app is running.

This works EVEN if all stacks are completely password
protected (and therefore encrypted)!

Apparently this is caused by the RunRev engine decrypting
and reading the scripts into memory and keeping them there
in clear text for as long as the app/stacks are open.


That appears to remain the case with the latest version in testing.

This line describes the scope of the problem:


I have no idea how to do a memory dump


;)

Those for whom dumping memory is second-nature are probably familiar 
with disassemblers as well.  Like trying to protect images on web pages, 
the only way to deploy an app is to expose its algorithms to anyone with 
sufficiently interest in discovering them.


Sure, RevTalk is easier to read than Assembly, but copyrighted code will 
only be stolen by those with an intent to do harm.  Those seeking to 
profit from such theft are probably well equipped regardless of the 
language you're using.  Nothing shared is ever safe - see Jeff Massung's 
notes on algorithm obfuscation at:

http://mail.runrev.com/pipermail/use-revolution/2010-March/136017.html

That said, I wouldn't mind seeing this changed myself.  While I feel the 
material risk is minimal, risk is still risk.  If you submit a request 
for this please share the RQCC number here.


One solution for this may have other, bigger benefits:  an option for 
true machine-code compilation.  All desktop platforms are now using the 
Intel instruction set, so while this might have been prohibitively 
onerous before it might be doable today.


Such compilation may also open the door to language options which would 
let us communicate with the OS API directly from within RevTalk, as 
Toolbook has provided for years.


I would imagine that an option for machine-code compilation would carry 
some limitations, but for those who could use it it may be well worth 
working with those limitations.


--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 16:27, Andre Garzia wrote:

Hey Richmond,

DevaWriter is on Apple Home Page:
http://www.apple.com/downloads/macosx/home_learning/devawriter.html

Cool! :D


Thanks for pointing that out.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Lyn Teyla
Richard Gaskin wrote:

 That said, I wouldn't mind seeing this changed myself.  While I feel the 
 material risk is minimal, risk is still risk.  If you submit a request for 
 this please share the RQCC number here.

Just submitted a request via the RQCC:

http://quality.runrev.com/qacenter/show_bug.cgi?id=8672___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 16:33, Richard Gaskin wrote:

Lyn Teyla wrote:

If I remember correctly, there is a long-standing security
issue where anyone can view the stack scripts of ANY Rev
standalone by doing a memory dump WHILE the app is running.

This works EVEN if all stacks are completely password
protected (and therefore encrypted)!

Apparently this is caused by the RunRev engine decrypting
and reading the scripts into memory and keeping them there
in clear text for as long as the app/stacks are open.


That appears to remain the case with the latest version in testing.

This line describes the scope of the problem:


I have no idea how to do a memory dump


;)

Those for whom dumping memory is second-nature are probably familiar 
with disassemblers as well.  Like trying to protect images on web 
pages, the only way to deploy an app is to expose its algorithms to 
anyone with sufficiently interest in discovering them.


Sure, RevTalk is easier to read than Assembly, but copyrighted code 
will only be stolen by those with an intent to do harm.  Those seeking 
to profit from such theft are probably well equipped regardless of the 
language you're using.  Nothing shared is ever safe - see Jeff 
Massung's notes on algorithm obfuscation at:

http://mail.runrev.com/pipermail/use-revolution/2010-March/136017.html

That said, I wouldn't mind seeing this changed myself.  While I feel 
the material risk is minimal, risk is still risk.  If you submit a 
request for this please share the RQCC number here.


One solution for this may have other, bigger benefits:  an option for 
true machine-code compilation.  All desktop platforms are now using 
the Intel instruction set, 


Really?

http://www.riscos.com/

http://www.arm.com/

http://www.iyonix.com/

http://www.cjemicros.co.uk/micros/products/a9home.shtml

so while this might have been prohibitively onerous before it might be 
doable today.




Such compilation may also open the door to language options which 
would let us communicate with the OS API directly from within RevTalk, 
as Toolbook has provided for years.


I would imagine that an option for machine-code compilation would 
carry some limitations, but for those who could use it it may be well 
worth working with those limitations.


--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your 
subscription preferences:

http://lists.runrev.com/mailman/listinfo/use-revolution



___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richard Gaskin

Richmond Mathewson wrote:

  On 17/03/2010 16:33, Richard Gaskin wrote:

...

 All desktop platforms are now using the Intel instruction set,


Really?

http://www.riscos.com/
http://www.arm.com/
http://www.iyonix.com/
http://www.cjemicros.co.uk/micros/products/a9home.shtml


There are many others too.

I should have written:

All desktop platforms relevant to Rev deployment are now using the 
Intel instruction set,


--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richard Gaskin

Lyn Teyla wrote:

 Just submitted a request via the RQCC:
 http://quality.runrev.com/qacenter/show_bug.cgi?id=8672

Excellent.  Thanks for submitting that.

--
 Richard Gaskin
 Fourth World
 Rev training and consulting: http://www.fourthworld.com
 Webzine for Rev developers: http://www.revjournal.com
 revJournal blog: http://revjournal.com/blog.irv
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Björnke von Gierke
To do a memory, or core dump on os x you'd need to launch the rev app yourself, 
instead of letting the os handle it (eg. via launchctl, using the limit 
subcommand). Alternatively, you'd need to enable core dumping (disabled by 
default) by some other means.  You then terminate the rev process, most likely 
using kill by supplying a fault, like SIGSEGV. Finally you'd need to find, 
decipher and interpret the dumped data.

So basically it's diving down deep into the unix shell bowels and muck around 
there. I cobbled these ideas together based on the following links, and haven't 
tried anything myself:

http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man5/core.5.html
http://developer.apple.com/Mac/library/documentation/Darwin/Reference/ManPages/man1/launchctl.1.html
http://en.wikipedia.org/wiki/Signal_(computing)

On 17 Mar 2010, at 15:19, Lyn Teyla wrote:

 Richmond Mathewson wrote:
 
 Yup: just tried to open what sits inside the MacOS folder inside one of my 
 Devawriter standalones
 with HexEdit - no joy: well, from a selfish point of view this makes me 
 rather happy - no nosey-parkers
 getting very far with bits of my stuff I wish to keep private . . .  :)
 
 UNLESS they do a memory dump - whatever that is. :(



-- 

official ChatRev page:
http://bjoernke.com?target=chatrev

Chat with other RunRev developers:
go stack URL http://bjoernke.com/chatrev/chatrev1.3b3.rev;

___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone? - Major Security Issue

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 17:05, Richard Gaskin wrote:

Richmond Mathewson wrote:

  On 17/03/2010 16:33, Richard Gaskin wrote:

...

 All desktop platforms are now using the Intel instruction set,


Really?

http://www.riscos.com/
http://www.arm.com/
http://www.iyonix.com/
http://www.cjemicros.co.uk/micros/products/a9home.shtml


There are many others too.

I should have written:

All desktop platforms relevant to Rev deployment are now using the 
Intel instruction set,


Just a gentle tease . . .  :)


--
 Richard Gaskin



___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Mark Wieder
Andre-

Wednesday, March 17, 2010, 7:27:34 AM, you wrote:

 DevaWriter is on Apple Home Page:
 http://www.apple.com/downloads/macosx/home_learning/devawriter.html

 Cool! :D

Very cool! Congrats, Richmond.

-- 
-Mark Wieder
 mwie...@ahsoftware.net

___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Kee Nethery
On Mar 17, 2010, at 6:31 AM, Richmond Mathewson wrote:

 That is why, for my Devawriter application, I have about a gigabyte of 
 previous version stacks in zip files
 taking up space.

Imagine me hitting myself on the head with a big dead fish. I use Time Machine 
on my Mac for backups and it was trivial to go back in time and grab the old 
source file. I knew there was a reason for doing backups :-)

Thanks everyone,
Kee Nethery

PS: Obviously this simple little project needs better (read any at all would be 
good) source control. ___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution


Re: View scripts of my standalone?

2010-03-17 Thread Richmond Mathewson

 On 17/03/2010 21:07, Kee Nethery wrote:

On Mar 17, 2010, at 6:31 AM, Richmond Mathewson wrote:


That is why, for my Devawriter application, I have about a gigabyte of previous 
version stacks in zip files
taking up space.

Imagine me hitting myself on the head with a big dead fish. I use Time Machine on my Mac 
for backups and it was trivial to go back in time and grab the old source 
file. I knew there was a reason for doing backups :-)

Thanks everyone,
Kee Nethery

PS: Obviously this simple little project needs better (read any at all would be 
good) source control. ___


Personally, I have always liked sauce on my fish . . .  :)

I am so happy that everything has been sorted out so simply.
___
use-revolution mailing list
use-revolution@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution