A captcha is mechanism to prevent scripts and bots to spread spam, create fake votes or accounts. For this a captcha presents some kind of distorted text, which should be easy to read and reenter for any human, but should be hard to be deciphered by common OCR-Software. An implementation of such a method is reCAPTCHA from the Carnegie Mellon University. It uses images of text out of scanned books, which an OCR program failed to read. So in addition to stop spam, every solved reCAPTCHA challenge helps also to proof read the text out of scanned books. This captcha also can offer a sound stream of spoken digits for visually impaired users. You can read about the details here at the homepage of the reCAPTCHA project.

If you want to use reCAPTCHA in your project you could try a Seaside 2.9 component I did. You can find the package BowWave-Recaptcha in a SqueakSource repository called (surprise) BowWave. After you loaded the latest version in a Seaside 2.9 image (I didn’t check with Pharo though. Or VisualWorks. Or GemStone. Or GNU Smalltalk), you can use it as a Seaside component inside a form. But at first you will only see the following instead of the reCAPTCHA Box:

Missing configuration for recaptcha component

You have to add a reCAPTCHA configuration to your root component.

Add a reCAPTCHA configuration to the root component

Now you will see two more configuration options under the group Recaptcha.

required reCAPTCHA configuration

To get your own private and public key, you have to get an account at reCAPTCHA. There you have to add a domain you want the reCAPTCHA to be used for.

Keys from reCAPTCHA website

Now the reCAPTCHA Box should appear in your form as a component. Now you should ask if the captcha was answered correctly in some callback on submission of your form.

So let’s assume you created a callback with a submit button in your renderContentOn: method. (There is only one child, the captcha component in that instance variable)-

renderContentOn: html
  html form: [
    "... some other form elements ..."
    html render: captcha.
    html submitButton
      callback: [ self submitComment ];
      value: 'Submit Comment']

submitComment
  (self checkInput and: [captcha verify])
    ifTrue: ["Everything is fine"]

Voilà! That’s it.

On my Seaside demoserver is a rudimentary comment/reply component, which uses reCAPTCHA.

This is the first shot at it, so handle it with care and … ah … well … leave a comment.

Update: I moved some stuff around so that you now need to load the BowWave-Captcha-Core and the BowWave-Captcha-Recaptcha packages

The second alpha release of Seaside 2.9 was announced today. This release mainly contains fixes for critical issues reported to the Seaside bug tracker and features a brand new Seaside builder. This is a convenient way to create taylored load scripts for various flavours of Seaside 2.9.

Choices presented by the Seaside Builder

There have been also some fixes to JQuery “The Write Less, Do More, JavaScript Library”, which became a new part of Seaside 2.9.

JQuery for Seaside

So head over to my Seasidemo or use the Seaside Builder to have a look at the new stuff.

Update: I forgot to mention the new Seaside Control Panel. It nicely lets you start and stop different Seaside Servers running in one Smalltalk image.

Seaside Control Panel

One of the best things in Smalltalk or Squeak is the fact that there are almost no artificial barriers and you are free to explore. In a local environment, like on your laptop, there is not much to worry about. But if you use Squeak as a server and expose it to the world, like when you run a Seaside server, then you would like to have at least one high barrier that protects yourself from misuse.

What follows is my experience in setting up a restricted environment (chroot) on a linux box to run a Squeak server.The basic idea is that one sets up a directory with subdirectories and to enforce an environment, where only this directory tree is accessible and nothing else. This has the advantage that even if something goes wrong, it should be almost impossible to break out of this jail. So for example even if someone manages to open a filebrowser in Squeak via Seaside, all he could see would be this directory tree and nothing else.

The hard part is to setup such an environment, because everything you need during runtime has to be in that directory tree. I found that the article “chroot login HOWTO” by White and Rhodes describes very good how to setup a chroot login. This is a user, that after login has only access to a restriced directory tree. Following this HOWTO I found, that the only real problem was to build a working su program. On my minimal Ubuntu system I had to build a new su from sources and to run the installed su through strace to find every needed library.

Now we assume that you managed to setup an account sesidemo and that you can log into it. But you can’t do very much.  The restricted directory could be looking like this:

$ ls /home/seasidemo
bin  dev  etc  home  lib  tmp  usr

You need another trusted user account to install the squeak runtime into this restricted directory tree.

On my linux box the Squeak virtual machine is called squeakvm. Create a usr/bin directory and copy the VM to that place.

$ which squeakvm
/usr/bin/squeakvm
$ cp /usr/bin/squeakvm /home/seasidemo/usr/bin

You also need the shared libraries that squeak uses. As described in the HOWTO you can use ldd to find out, which libraries this are.

$ ldd usr/bin/squeakvm
        linux-gate.so.1 =>  (0xffffe000)
        libutil.so.1 => /lib/tls/i686/cmov/libutil.so.1 (0xb7f70000)
        libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7f6c000)
        libm.so.6 => /lib/tls/i686/cmov/libm.so.6 (0xb7f46000)
        libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7f2e000)
        libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7de4000)
        /lib/ld-linux.so.2 (0xb7f7b000)

Now you have to locate these libraries (but linux-gate.so.1) in /lib and copy them over to the restricted lib.

$ cp /lib/libutil.so.1 /home/seasidemo/lib
$ cp /lib/libdl.so.2 /home/seasidemo/lib
$ cp /lib/libm.so.6 /home/seasidemo/lib
$ cp /lib/libnsl.so.1 /home/seasidemo/lib
$ cp /lib/libc.so.6 /home/seasidemo/lib
$ cp /lib/ld-linux.so.2 /home/seasidemo/lib

Part of the Squeak VM is made out of VM Plugins. You need to copy them too.

$ squeakvm -version
3.9-12 #1 Sa 5. Jan 00:24:24 CET 2008 gcc-Version 20070929
Squeak3.9alpha of 4 July 2005 [latest update: #7021]
Linux avion.lazarevic.de 2.6.22-14-generic #1 SMP Tue Dec 18 08:02:57 UTC 2007 i686 GNU/Linux
default plugin location: /usr/lib/squeak/3.9-12/*.so
$ mkdir -p /home/seasidemo/usr/lib/squeak
$ cp -r /usr/lib/squeak/3.9-12 /home/seasidemo/usr/lib/squeak

These VM Plugins also use shared libraries. As you have guessed: You need them too. I decided to copy every needed shared library for every VM Plugin to fullfill the dependencies, even if the Plugins are not very useful on a server (eg. audio plugins).

I used a small script to find all the libraries needed on my system:

$ for i in /home/seasidemo/usr/lib/squeak/3.9-12/*.so; do ldd $i; done | sed "s/^\t*\([^ \t]*\).*/\1/" | sort -u
/lib/ld-linux.so.2
libGL.so.1
libICE.so.6
libSM.so.6
libX11.so.6
libXau.so.6
libXdamage.so.1
libXdmcp.so.6
libXext.so.6
libXfixes.so.3
libXpm.so.4
libXrender.so.1
libXt.so.6
libXxf86vm.so.1
libasound.so.2
libaudio.so.2
libc.so.6
libdbus-1.so.3
libdl.so.2
libdrm.so.2
libm.so.6
libnsl.so.1
libpthread.so.0
libutil.so.1
libuuid.so.1

Find all those libraries in /lib and /usr/lib and copy them to /home/seasidemo/lib.

At this point you could copy over a prepared headless image to eg. /home/seasidemo/home/server, login into the restricted account and start the squeak with that image.

$ mkdir /home/seasidemo/home/server
$ cp headless.image /home/seasidemo/home/server
$ cp headless.changes /home/seasidemo/home/server
$ cp SqueakV39.sources /home/seasidemo/home/server

Note that by doing that, the image and changes file belongs to the trusted user. Assuming default umask settings and that you don’t change filepermissions, squeak can’t save any changes to that files while running as the user seasidemo. That is a good thing, because it prevents that changes to the squeak system are beeing saved. This could be a problem, if you use the squeak image as an instrument for data persistence.

$ su - seasidemo
Password:
-bash-3.2$ cd server/
-bash-3.2$ /usr/bin/squeakvm -headless headless.image

Now this has the disadvantage, that the server stops if you log out. You might want to find nohup on your system and install that too, so that the server keeps running.

-bash-3.2$ nohup /usr/bin/squeakvm -headless headless.image &

If you need more control over your server you could additionally install Xtightvnc into your restricted environment and use a vnc client to get access to the Squeak desktop of that server.

What I described above just describes how to make squeak run in a more secure environment. It does not prevent the Squeak server from being modified and misused. There are additional measures inside Squeak that make even this more difficult, but this also depends on the kind of server you planning to run.

At http://seasidemo.blobworks.com:9090 you will find a Seaside demo server, that was setup this way.

In VisualWorks is a Cairo addition to the SUnitToo(ls) package(s). This shows a very slick progress bar while the unit tests are being processed. Here you can see a few Unit Tests on a very early seesmic API implementation.

Lately there has been a thread on seesmic about numbers in and around seesmic. There is also seesmic café episode 85 which presents additional numbers. I had some fun using the seesmic API and providing even more numbers.

Looking at about 40.000 of the latest videos posted on seesmic (during about a month):

English is the seesmic language

All in all ten different languages have been used. Not specified are all those videos from YouTube or qik. English dominates with 78%. This won’t come as a real surprise. Also not French being on the second place with 16%, because of the origin of the seesmic founders. Spanish is on the third place with under 1.5%. So far I think the order matches the overall distribution of spoken languages. Now let’s have a closer look at the remaining languages below 1%.

72 out of 40000 (0.18%) had been recorded in german followed by 43 italian, 31 japanese, 15 dutch, 13 chinese, 4 russian and 3 korean.

Thursday is the seesmic day

People don’t seem to like mondays.

Freida is the top seesmic user

The 40000 videos were posted by 1280 different users. Freida was the single user that posted the most videos, namely 1562. That are about 3-4 videos per hour constantly over a period of a month (assuming 8 hours of sleep per day).

Now how hard was it to get those numbers. It was very straight forward to have some implementation in Smalltalk to use the seesmic API. As an example the following snippet fetches information about the latest 50 videos on seesmic:

| session videos languages |
session := SMICSession username: 'user' password: 'pwd'.
videos := session videolistMax: 50.


Doing the statistics is also very easy in Smalltalk:

"include above code here"
languages := Bag new.
videos do: [:video | languages add: video language].
Transcript show: languages sortedCounts.


Now instead of just showing the numbers of language distribution on the Transcript it is also easy to generate a URL that uses the Google graph API and produces above nice graphs.

In episode 149 Randal L. Schwartz talks with Leo about Squeak. He shows Squeak, OLPC and EToys. Although it is a fun story where the name Squeak comes from, I guess it is as true as the other rumors about the name.

I was testing the freshly released seesmic API and gathering a lot of videos and thumbnails. As a “byproduct” I used metapixel to create a mosaic of the german speaking seemic users. This is a zoomable seesmic picture of size 6400×2688 (~6MB) !!!

Debian users can take part in a so called popularity contest, reporting back which packages are installed on their systems. Squeak is not yet part of Debian, but there are Debian packages for squeak and so they show up in the statistics. Here is a diagram of the current distribution of Squeak image packages.

Ubuntu has Squeak packages based on 3.8:

I finally managed to upload a reduced version of the last video from the Squeak BOF at OOPSLA by Göran Krampe. Here Dan Ingalls and Krzysztof Palacz talk about the Lively Kernel.