passwordsafe-devel — For developers of Password Safe

RE: [Passwordsafe-devel] Build platform for versions < 2.0

[Rony S. <ro...@gm...>]

Sure - good idea:

"Hear yea, hear yea, Hear yea!

Be it hereby officially decreed that the development platform for all
Windows versions of PasswordSafe henceforth be Microsoft Visual C++ version
6.0, with the HTML Help Workshop. This decree being based on the consensus
of the PasswordSafe development team, this 30th of April, 2003 AD.

In effect until further notice."

[More practically, I'll add a note in plain English in the Notes.txt file.]

	Cheers,

		Rony

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of John
Baldwin
Sent: Tuesday, April 29, 2003 6:28 PM
To: pas...@li...
Subject: [Passwordsafe-devel] Build platform for versions < 2.0



Graham wrote:

> I too am using MSVC++ 6.0. Yes, I do have Visual Studio.Net installed on a
> different drive, but I'm not using it for builds of Password Safe because
> this project uses the older .dsw and .dsp workspace and project files.

A sigh of relief here.  Can we "standardize" on MSVC++ 6.0 for builds of
versions prior to
2.0?  I don't literally mean standardize... people can build with whatever
they want, but it
would be nice to have a target compilation environment where we ensure it
compiles cleanly
(no warnings with the compiler's "maximum whine" bit set).

(I have an ulterior motive here.  :-)  I have to supply my own development
tools; I have Visual
Studio 6.0 Enterprise and I don't have the $$$$ to spring for updating tools
that are working
perfectly fine for me.)

-- john b



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

RE: [Passwordsafe-devel] redesign and XML

[Graham U. <gr...@fl...>]

Andrew,

No I don't put encrypted CItemData directly into the XML doc. I get the
fields of each CItem Data record in textual form and create the XML doc in
human-readable form. The entire XML document is then encrypted during the
file write. Here is an example 3-record XML document:

<PWSafe>
<PWList>
<Item>
<Title>first record</Title>
<Username>david</Username>
<Password>ad;sflja</Password>
<Extra/>
<Notes>first note</Notes>
</Item>
<Item>
<Title>new item</Title>
<Username>user</Username>
<Password>a;dslfj</Password>
<Extra/>
<Notes>a;ldfskja;
hello</Notes>
</Item>
<Item>
<Title>another</Title>
<Username>aaa</Username>
<Password>aaa</Password>
<Extra/>
<Notes>another
note
</Notes>
</Item>
</PWList>
</PWSafe>


> -----Original Message-----
> From: Andrew Mullican [mailto:mul...@in...]
> Sent: Wednesday, April 30, 2003 8:41 AM
> To: Graham Ullrich
> Cc: pas...@li...
> Subject: Re: [Passwordsafe-devel] redesign and XML
>
>
> Graham Ullrich writes:
> >
> >
> >XML En/Decryption Practices
> >My implementation of XML encryption and decryption may not be
> the best. When
> >writing the file I create an entire XML document in plaintext
> and then call
> >_writecbc() on the entire block. The reverse applies to reads.
> This may not
> >be optimal. CMarkup uses CStrings, but we are allowed to change
> the CMarkup
> >source code and could easily change that to CMyString or
> whatever class we
> >desired. After decryption each record is saved as encrypted elements of a
> >CItemData object just like we use now.
>
> Do you mean you create an XML document with all of the accounts
> in it, then
> encrypt the entire thing?  It sounds like you stick encrypted CItemData
> objects into the XML document, then encrypt the entire thing.  Is
> that right?
>
> I'd be curious to see the format of the XML document.
>
> -Andy
>
>
>

RE: [Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS

[Rony S. <ro...@gm...>]

> You might want to mention in README.txt what platforms it runs on
> (Windows 95/98/ME, etc).

Good point.

> Thanks for listing me first when I haven't done anything for this
particular
> release.  :-)

You just did :-)

	Rony

Rony Shapiro writes:
>
>Hi,
>
>In preparation for the upcoming release, I've added the above files. I'd
>appreciate it if everyone would take a couple of minutes to check them
aout,
>at least to make sure I've spelled your names right...
>
>	Thanks,
>
>		Rony
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Passwordsafe-devel mailing list
>Pas...@li...
>https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>

Re: [Passwordsafe-devel] redesign and XML

[<mul...@in...>]

Graham Ullrich writes:
>
>
>XML En/Decryption Practices
>My implementation of XML encryption and decryption may not be the best. When
>writing the file I create an entire XML document in plaintext and then call
>_writecbc() on the entire block. The reverse applies to reads. This may not
>be optimal. CMarkup uses CStrings, but we are allowed to change the CMarkup
>source code and could easily change that to CMyString or whatever class we
>desired. After decryption each record is saved as encrypted elements of a
>CItemData object just like we use now.

Do you mean you create an XML document with all of the accounts in it, then
encrypt the entire thing?  It sounds like you stick encrypted CItemData
objects into the XML document, then encrypt the entire thing.  Is that right?

I'd be curious to see the format of the XML document.

-Andy

RE: [Passwordsafe-devel] redesign and XML

[Graham U. <gr...@fl...>]

Hi everyone, here is a long note regarding our next generation Password Safe
design.

XML
Regarding comments from eq, jens, andy, john b, and others: in my personal
update to Password Safe (several weeks ago) I successfully ported the
current database format to XML using the "demo" CMarkup class from
FirstObject (www.firstobject.com). From their class description: "CMarkup
conforms to EDOM, the key to simple XML processing. EDOM is a concise set of
methods for manipulating XML elements, attributes and data. It saves you
from wading through volumes of DOM and SAX documentation when you don't need
complex features of XML." Here here! I found the class easy to use - moving
the database to XML form took me two days, with another day for file export
and import in XML format and adding the program options to the database.
Once the XML was in place adding these features was a snap. This class only
added 8K to my Password Safe executable size. According to their evaluation
license (http://www.firstobject.com/dn_marktrylic.htm) First Object allows
anyone "a nonexclusive license to use the Software in non-commercial
programs". Highly recommended.

XML En/Decryption Practices
My implementation of XML encryption and decryption may not be the best. When
writing the file I create an entire XML document in plaintext and then call
_writecbc() on the entire block. The reverse applies to reads. This may not
be optimal. CMarkup uses CStrings, but we are allowed to change the CMarkup
source code and could easily change that to CMyString or whatever class we
desired. After decryption each record is saved as encrypted elements of a
CItemData object just like we use now.

Single Executable and Installer
I agree with comments from eq and john baldwin regarding a single executable
file with no installer or DLLs. This is very important to me and a number of
friends. We all use Password Safe on USB keychain (flash memory) drives on
many different computers so "no installation" is a must.

Core
I agree with gregg and rony wholeheartedly with regards to separating the UI
and I/O from all the rest. Core.cpp is a module crying out for an author. As
far as when this gets done, well, I don't need palm integration so I would
prefer to add features to the existing version. Nevertheless I hear a vocal
group of portability supporters and think we should move forward with
separating the major elements: UI, I/O, and main app logic, before adding
new features. Adding features now will just make things harder later.

Random Number Generation Security Issue
A cryptographically adept friend of mine pointed out that Password Safe's
use of rand() is extremely insecure. He proposed that we implement a version
of Yarrow or some other RNG that employs entropy. I proposed that he get in
the developer group and help us out. :-) Regardless of how it gets done, you
should realize that the MSCRTL rand() function is considered very poor by
many experts. Obviously when seeded with the same number PWSafe will
generate the same combination of letters every time. Try it yourself by
placing "srand(10);" after "CMyString temp;" in the OnRandom method of
EditDlg. You'll soon see that the result is "db37hAM1" every single time.
Not much computing time is required to produce all possible password
combinations for a brute force attack.

New Features
Yes, I'll add them to the RFE list, but here is a list of features I already
added to my own version of Password Safe. I'd like to see them implemented
in the communal version, and welcome your comments.

 - "Details" area to the right of the listbox showing full Notes text and
password; hide and show this area with a button; listbox only shows title
and username; password in Details area can be hidden (ala Edit dialog);
Details area can be shown or hidden on startup by a program option.
 - URLs in any Notes field should be highlighted and clickable to open the
URL.
 - Convert database to XML format.
 - Save program options in database. This allows your database-specific
options to stay with the database no matter what computer you open it from.
 - database file import/export; this takes the place of printing for me;
export requires re-entry of database combination
 - default password length and option to use (or not) default password
length
 - password generation rules: minimum number of upper, lower, digit, and
symbols
 - option to save the database immediately after a successful Edit or Add

Skoal!

Graham

RE: [Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS

[Graham U. <gr...@fl...>]

Rony,

I think the release notes should include a comment about the "manually
changed password in edit dialog not getting saved". This bug has existed
since April 2002 (v1.90) whether it was reported or not. Otherwise I think
you did a fine job.

Graham

> -----Original Message-----
> From: pas...@li...
> [mailto:pas...@li...]On Behalf
> Of Rony Shapiro
> Sent: Tuesday, April 29, 2003 9:31 AM
> To: pas...@li...
> Subject: [Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS
>
>
> Hi,
>
> In preparation for the upcoming release, I've added the above files. I'd
> appreciate it if everyone would take a couple of minutes to check
> them aout,
> at least to make sure I've spelled your names right...
>
> 	Thanks,
>
> 		Rony
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Passwordsafe-devel mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>
>
>

[Passwordsafe-devel] sample data

[gregg c. <gr...@ga...>]

i have created some sample data files that could be of use.

the three files contain 100, 500 and 1000 entries.  to get them 
(sampledata.zip) bring up the below link.  i have attached the sample data 
to a bug dealing with large amount of entries (but may help with other 
testing*).

there's also a text file in the zip with some more info.

if the link doesn't work, just bring up Bug 726616 and scroll to the bottom.

<http://sourceforge.net/tracker/index.php?func=detail&aid=726616&group_id=41019&atid=429579>

* i can't load the 500 or 1000 entry files in 1.91 beta, i think it has 
something to do with the column list.  i could bring them both up in 
1.7.  i'll see if i can find a fix.

Re: [Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS

[<mul...@in...>]

You might want to mention in README.txt what platforms it runs on
(Windows 95/98/ME, etc).

Thanks for listing me first when I haven't done anything for this particular
release.  :-)

-Andy

Rony Shapiro writes:
>
>Hi,
>
>In preparation for the upcoming release, I've added the above files. I'd
>appreciate it if everyone would take a couple of minutes to check them aout,
>at least to make sure I've spelled your names right...
>
>	Thanks,
>
>		Rony
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Passwordsafe-devel mailing list
>Pas...@li...
>https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>

Re: [Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS

[gregg c. <gr...@ga...>]

the overall documents look good and i didn't seen any glaring problems.


At 05:31 PM 4/29/2003 +0200, you wrote:
>Hi,
>
>In preparation for the upcoming release, I've added the above files. I'd
>appreciate it if everyone would take a couple of minutes to check them aout,
>at least to make sure I've spelled your names right...
>
>         Thanks,
>
>                 Rony
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Passwordsafe-devel mailing list
>Pas...@li...
>https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

[Passwordsafe-devel] Build platform for versions < 2.0

[John B. <joh...@ps...>]

Graham wrote:

> I too am using MSVC++ 6.0. Yes, I do have Visual Studio.Net installed on a
> different drive, but I'm not using it for builds of Password Safe because
> this project uses the older .dsw and .dsp workspace and project files.

A sigh of relief here.  Can we "standardize" on MSVC++ 6.0 for builds of versions prior to 
2.0?  I don't literally mean standardize... people can build with whatever they want, but it 
would be nice to have a target compilation environment where we ensure it compiles cleanly 
(no warnings with the compiler's "maximum whine" bit set).

(I have an ulterior motive here.  :-)  I have to supply my own development tools; I have Visual 
Studio 6.0 Enterprise and I don't have the $$$$ to spring for updating tools that are working 
perfectly fine for me.)

-- john b

[Passwordsafe-devel] as to XML, etc.

[Jens B. J. <jen...@ta...>]

I would like to register my opinion as well. The top thing I'd like to 
see is having the data synced and available in an app on my Palm pilot. 
Anything that increases the necessary exe/image footprint in my mind 
would be undesirable to that end. XML use would seem to be one of those 
things that I'm concerned would significantly increase the image/exe 
footprint.

Also, not being a cryptographer or anything like that but having read 
many cautionary tales I would certainly suggest that we be *very* 
careful messing with the file format and especially anything to do with 
the way the encryption is done. Perhaps we could get Bruce Schneier to 
give any design that is formulated a once-over. Since he's the original 
author maybe he'd be willing to help out with this little bit.

-- 
Jens B. Jorgensen
jen...@ta...

"With a focused commitment to our clients and our people, we deliver value through customized technology solutions"  

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[Graham U. <gr...@fl...>]

All,

Well this morning I decided to build the new revision after Rony checked in
my changes. Same result as last night, no toolbar buttons. But this time I
decided to try the application resize feature (which is great!). Lo and
behold, after I made the application slightly wider to show the password
column the toolbar buttons appeared. Now I can't get the application to come
up without showing those darn buttons no matter how small I make the window.
I still don't know what is going on, but I'm a lot more confident that my
changes did not break existing code. Maybe someone else has an idea of the
root cause.

Graham

> -----Original Message-----
> From: pas...@li...
> [mailto:pas...@li...]On Behalf Of
> gregg conklin
> Sent: Tuesday, April 29, 2003 8:23 AM
> To: passwordsafe-devel
> Subject: RE: [Passwordsafe-devel] New developer: Graham Ullrich
>
>
> i'm using 6.0 as well.  i have 7.0, but just haven't warmed up to it
> yet.  all my favorite keystrokes have changed... again.
>
>
> At 10:46 AM 4/29/2003 +0200, you wrote:
> >Hm,
> >
> >A thought: I'm using MSVC++ 6.0. What is everyone else using to build the
> >project?
> >
> >         Rony
> >
> >-----Original Message-----
> >From: pas...@li...
> >[mailto:pas...@li...]On Behalf Of
> >Graham Ullrich
> >Sent: Tuesday, April 29, 2003 7:45 AM
> >To: pas...@li...
> >Subject: RE: [Passwordsafe-devel] New developer: Graham Ullrich
> >
> >
> >Thanks for the introduction Rony. I'm happy to be part of the
> team working
> >to improve PasswordSafe. I am quite impressed with the nice
> changes made so
> >far, especially the columnar list format, Find function, and better icons
> >for copying password and username. As Rony mentioned, I have
> converted the
> >database to XML format in my own version of PWSafe  - we can discuss that
> >more later.
> >
> >However, I'm having the strangest trouble with PWSafe builds and hope you
> >all can help. The first time I got the source and built the project the
> >executable worked fine. So I went ahead and merged some of my
> bug fixes and
> >built the project again. This time the toolbar did not show up in the
> >application in either debug or release builds. After lots of
> experimentation
> >I deleted all the local files and directories and retrieved the
> source once
> >again from the CVS repository. The build went fine (it always does) but
> >again the application had no toolbar. Other than that problem is ran just
> >fine! Can anyone tell me what I might be doing incorrectly? I'm
> hesitant to
> >continue with changes until this issue is resolved.
> >
> >I'm sending my updated source files to Rony in hopes he can successfully
> >build the project and then commit the fixes on my behalf.
> >
> >Graham
> >
> >
> > >
> > > Hi,
> > >
> > > I'd like to welcome Graham Ullrich
> > > (https://sourceforge.net/users/grahamu/)
> > > to our team.
> > >
> > > Graham has been working on PasswordSafe independently for a
> while, and has
> > > offered to merge his work into the project.
> > >
> > > For starters, Graham will try to add a couple of bugfixes by
> our May 1st
> > > cutoff. In the longer term, he's implemented some nice advanced
> > > options for
> > > password generation (minimum length, etc.), and, most
> > > interesting, converted
> > > the database to XML!
> > >
> > >       Cheers,
> > >
> > >               Rony
> > >
> > >
> >
> >
> >
> >-------------------------------------------------------
> >This sf.net email is sponsored by:ThinkGeek
> >Welcome to geek heaven.
> >http://thinkgeek.com/sf
> >_______________________________________________
> >Passwordsafe-devel mailing list
> >Pas...@li...
> >https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
> >
> >
> >
> >-------------------------------------------------------
> >This sf.net email is sponsored by:ThinkGeek
> >Welcome to geek heaven.
> >http://thinkgeek.com/sf
> >_______________________________________________
> >Passwordsafe-devel mailing list
> >Pas...@li...
> >https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Passwordsafe-devel mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>
>
>

[Passwordsafe-devel] README.txt and ReleaseNotes.txt added to CVS

[Rony S. <ro...@gm...>]

Hi,

In preparation for the upcoming release, I've added the above files. I'd
appreciate it if everyone would take a couple of minutes to check them aout,
at least to make sure I've spelled your names right...

	Thanks,

		Rony

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[Rony S. <ro...@gm...>]

Odd.

If you want to zip your entire project directory (after cleaning the Debug
And Release subdirs) and mail it to me (directly), I'll try to compile it on
my machine.

	Rony

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of
Graham Ullrich
Sent: Tuesday, April 29, 2003 3:11 PM
To: pas...@li...
Subject: RE: [Passwordsafe-devel] New developer: Graham Ullrich


Rony,

I too am using MSVC++ 6.0. Yes, I do have Visual Studio.Net installed on a
different drive, but I'm not using it for builds of Password Safe because
this project uses the older .dsw and .dsp workspace and project files.

Graham

>
> Hm,
>
> A thought: I'm using MSVC++ 6.0. What is everyone else using to build the
> project?
>
> 	Rony
>
>
> Thanks for the introduction Rony. I'm happy to be part of the team working
> to improve PasswordSafe. I am quite impressed with the nice
> changes made so
> far, especially the columnar list format, Find function, and better icons
> for copying password and username. As Rony mentioned, I have converted the
> database to XML format in my own version of PWSafe  - we can discuss that
> more later.
>
> However, I'm having the strangest trouble with PWSafe builds and hope you
> all can help. The first time I got the source and built the project the
> executable worked fine. So I went ahead and merged some of my bug
> fixes and
> built the project again. This time the toolbar did not show up in the
> application in either debug or release builds. After lots of
> experimentation
> I deleted all the local files and directories and retrieved the
> source once
> again from the CVS repository. The build went fine (it always does) but
> again the application had no toolbar. Other than that problem is ran just
> fine! Can anyone tell me what I might be doing incorrectly? I'm
> hesitant to
> continue with changes until this issue is resolved.
>
> I'm sending my updated source files to Rony in hopes he can successfully
> build the project and then commit the fixes on my behalf.
>
> Graham
>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[gregg c. <gr...@ga...>]

i'm using 6.0 as well.  i have 7.0, but just haven't warmed up to it 
yet.  all my favorite keystrokes have changed... again.


At 10:46 AM 4/29/2003 +0200, you wrote:
>Hm,
>
>A thought: I'm using MSVC++ 6.0. What is everyone else using to build the
>project?
>
>         Rony
>
>-----Original Message-----
>From: pas...@li...
>[mailto:pas...@li...]On Behalf Of
>Graham Ullrich
>Sent: Tuesday, April 29, 2003 7:45 AM
>To: pas...@li...
>Subject: RE: [Passwordsafe-devel] New developer: Graham Ullrich
>
>
>Thanks for the introduction Rony. I'm happy to be part of the team working
>to improve PasswordSafe. I am quite impressed with the nice changes made so
>far, especially the columnar list format, Find function, and better icons
>for copying password and username. As Rony mentioned, I have converted the
>database to XML format in my own version of PWSafe  - we can discuss that
>more later.
>
>However, I'm having the strangest trouble with PWSafe builds and hope you
>all can help. The first time I got the source and built the project the
>executable worked fine. So I went ahead and merged some of my bug fixes and
>built the project again. This time the toolbar did not show up in the
>application in either debug or release builds. After lots of experimentation
>I deleted all the local files and directories and retrieved the source once
>again from the CVS repository. The build went fine (it always does) but
>again the application had no toolbar. Other than that problem is ran just
>fine! Can anyone tell me what I might be doing incorrectly? I'm hesitant to
>continue with changes until this issue is resolved.
>
>I'm sending my updated source files to Rony in hopes he can successfully
>build the project and then commit the fixes on my behalf.
>
>Graham
>
>
> >
> > Hi,
> >
> > I'd like to welcome Graham Ullrich
> > (https://sourceforge.net/users/grahamu/)
> > to our team.
> >
> > Graham has been working on PasswordSafe independently for a while, and has
> > offered to merge his work into the project.
> >
> > For starters, Graham will try to add a couple of bugfixes by our May 1st
> > cutoff. In the longer term, he's implemented some nice advanced
> > options for
> > password generation (minimum length, etc.), and, most
> > interesting, converted
> > the database to XML!
> >
> >       Cheers,
> >
> >               Rony
> >
> >
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Passwordsafe-devel mailing list
>Pas...@li...
>https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Passwordsafe-devel mailing list
>Pas...@li...
>https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[Graham U. <gr...@fl...>]

Rony,

I too am using MSVC++ 6.0. Yes, I do have Visual Studio.Net installed on a
different drive, but I'm not using it for builds of Password Safe because
this project uses the older .dsw and .dsp workspace and project files.

Graham

>
> Hm,
>
> A thought: I'm using MSVC++ 6.0. What is everyone else using to build the
> project?
>
> 	Rony
>
>
> Thanks for the introduction Rony. I'm happy to be part of the team working
> to improve PasswordSafe. I am quite impressed with the nice
> changes made so
> far, especially the columnar list format, Find function, and better icons
> for copying password and username. As Rony mentioned, I have converted the
> database to XML format in my own version of PWSafe  - we can discuss that
> more later.
>
> However, I'm having the strangest trouble with PWSafe builds and hope you
> all can help. The first time I got the source and built the project the
> executable worked fine. So I went ahead and merged some of my bug
> fixes and
> built the project again. This time the toolbar did not show up in the
> application in either debug or release builds. After lots of
> experimentation
> I deleted all the local files and directories and retrieved the
> source once
> again from the CVS repository. The build went fine (it always does) but
> again the application had no toolbar. Other than that problem is ran just
> fine! Can anyone tell me what I might be doing incorrectly? I'm
> hesitant to
> continue with changes until this issue is resolved.
>
> I'm sending my updated source files to Rony in hopes he can successfully
> build the project and then commit the fixes on my behalf.
>
> Graham
>

[Passwordsafe-devel] Graham's changes checked in

[Rony S. <ro...@gm...>]

Hi,

I've merged in the files that Graham sent me, implementing the following:

1. Password changes not saved in Edit dialog.
To reproduce the problem:
a. Enter the Edit dialog, setting options so that the password will be shown
on entry.
b. Manually update the password text (do not use the Random Password
button).
c. Click OK to return to the main dialog.
d. Enter the edit dialog once again for the same record. Note that your
password changes are no longer in place.

2. Hidden password displayed by same number of asterisks as characters in
the password. Fixed in Edit dialog.

3. Improved font for password display in Add and Edit dialogs. Now the font
is mono-spaced Courier.

Note that two new files have been added to the project: PwFont.{h,cpp}, so
you should either update your .dsp  or add the files to your local dsp
yourself.

	Cheers,

		Rony

RE: [Passwordsafe-devel] edit/add bug

[Rony S. <ro...@gm...>]

Hi,

This was a nasty bug caused by confusing semantics: Originally, there was
only a "Title" column, with no concept of "username". The latter was added
to the title field, and separated by a special character. The main advantage
of this was that the file format remained the same. However, Find() searched
for the "raw" title string, which contained both the title and the username.
The bug popped up when Find was called only with the title, and checked only
the title, returning the first match. This was changed inadvertantly when we
moved away from the listbox to the columnar display. Fixed now, in any case.

As to the sort order, I've refined the Compare function so that explicitly
sorting by title or username uses username or title as the secondary sort
key, resp., but I couldn't find how to do this when an entry is added, since
the Compare function isn't called then...

    Rony
  -----Original Message-----
  From: pas...@li...
[mailto:pas...@li...]On Behalf Of Graham
Ullrich
  Sent: Tuesday, April 29, 2003 8:42 AM
  To: pas...@li...
  Subject: [Passwordsafe-devel] edit/add bug


  There seems to be a bug in the current build which I'm too tired to solve
tonight (1:30 am here) but I think it should be resolved before the May 1
"deadline". Reproduction of the bug is simple on my system:

  1. create a new database
  2. add an entry: title = "anything", username = "first", pw = <whatever>
  3. click OK
  4. add another entry: title = "anything", username = "second", pw =
<whatever>
  5. click OK
  6. notice in the listbox that "anything - second" appears before
"anything - first" - I think if the listbox is sorted by title and two
titles are identical then it should be sorted by username
  7. in the listbox select (should already be selected) and edit the entry
"anything - second" and see it contains "first" as a username! Obviously
this is incorrect.

  Good luck.

  Graham

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[Rony S. <ro...@gm...>]

Hm,

A thought: I'm using MSVC++ 6.0. What is everyone else using to build the
project?

	Rony

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of
Graham Ullrich
Sent: Tuesday, April 29, 2003 7:45 AM
To: pas...@li...
Subject: RE: [Passwordsafe-devel] New developer: Graham Ullrich


Thanks for the introduction Rony. I'm happy to be part of the team working
to improve PasswordSafe. I am quite impressed with the nice changes made so
far, especially the columnar list format, Find function, and better icons
for copying password and username. As Rony mentioned, I have converted the
database to XML format in my own version of PWSafe  - we can discuss that
more later.

However, I'm having the strangest trouble with PWSafe builds and hope you
all can help. The first time I got the source and built the project the
executable worked fine. So I went ahead and merged some of my bug fixes and
built the project again. This time the toolbar did not show up in the
application in either debug or release builds. After lots of experimentation
I deleted all the local files and directories and retrieved the source once
again from the CVS repository. The build went fine (it always does) but
again the application had no toolbar. Other than that problem is ran just
fine! Can anyone tell me what I might be doing incorrectly? I'm hesitant to
continue with changes until this issue is resolved.

I'm sending my updated source files to Rony in hopes he can successfully
build the project and then commit the fixes on my behalf.

Graham


>
> Hi,
>
> I'd like to welcome Graham Ullrich
> (https://sourceforge.net/users/grahamu/)
> to our team.
>
> Graham has been working on PasswordSafe independently for a while, and has
> offered to merge his work into the project.
>
> For starters, Graham will try to add a couple of bugfixes by our May 1st
> cutoff. In the longer term, he's implemented some nice advanced
> options for
> password generation (minimum length, etc.), and, most
> interesting, converted
> the database to XML!
>
> 	Cheers,
>
> 		Rony
>
>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

RE: [Passwordsafe-devel] redesign

[Rony S. <ro...@gm...>]

Hi,

Violent agreement here. Once 1.91 is released, I think we need to create a
"core" library sub-project that will handle file reading/writing, record
encryption/decryption, and other platform-independent functions. Would
anyone like to take a stab at defining the interface, i.e., write "core.h"?

As to the cross-platform file format, I've only found one potential problem:
The length of each record is an int written directly via memcpy (see
_writecbc and _readcbc in Util.cpp). This will break on architectures with
endianess != intel's, unless wrapped with the appropriate macros (keeping in
mind backwards compatability - we don't want to break existing databases!) -
any care to write the appropriate wrappers?

XML: as I see it, the main advantages are (1) not reinventing the wheel
w.r.t. parsing records, and (2) an easy way to add new fields that are
requested every now and then: date of creation, date of last use, picture of
pet/spouse/child... The question of portability is indeed important, and, to
my mind, a possible showstopper on adding this feature. Another possible
showstopper would be the addition to the execuatble size. Currently the
release build weighs in at less than 200k - I'd be very upset to see it grow
by much.

PDA's - I've some experience in PocketPC applications, but none with
conduits. I'd guess, however, that the first pre-requisite for syncing
databases is a timestamp for each record. At any rate, I'd like to tackle
the PocketPC port, probably after 1.91 is out.

	Rony

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of John
Baldwin
Sent: Tuesday, April 29, 2003 8:21 AM
To: pas...@li...
Subject: RE: [Passwordsafe-devel] redesign


Edward wrote:

> once this is done, it
> will be easy to split up and build native ui's for multiple platforms,
> especially with the number of people that have signed on to this project!
> for the record, i do not feel that a single cross platform ui in java or
> gtk+ or whatever is appropriate because it will create dependencies that
> password safe users will have fulfill to install password safe.  i may be
> wrong, but the self contained and straight forward install lends to the
> popularity of this application.

I definitely agree that the simple straightforward installation is appealing
and worth keeping as
a goal: "Installers?  We Don't Need No Stinkin' Installers!"  :-)

And I tend to agree on avoiding a single cross-platform "all platforms" UI.
So this suggests an
architecture consisting of the single cross-platform "engine" or "core" and
a very *limited*
number of UI "shells."  There should be as few of these distinct shell
applications as possible.
BTW, the file format should be/remain binary portable: I should be able to
simply copy my file
of encrypted passwords between my PCs running Windows, Linux, and the BSDs,
and my
Macs, aging DEC alphas, Palm Vx, iPaq, PDP-8, and my Cray.  :-)  Without
worrying about
big- or little-endian, etc.

* * *

Which leads me to another issue...  May I play the "devil's advocate" a bit?
(I love questioning
the assumptions!  "Out-of-the box thinking" often results in some cool
innovations.)

Edward wrote:

> i am looking forward to seeing graham's update to an xml file format.

What does XML buy us besides file format portability?  What does it cost us
in return?  I am
not criticizing the idea of using XML... but I *am* trying to "think
critically" about it.  We should
enumerate the answers to both questions.  Right now, I can only see 3
advantages, and I am
sure I'm missing some.  I can see several potential trouble areas, all
associated with parsing,
the availability of parsers, and the difficulty in preventing the XML
structure from providing "out
of channel" information to an attacker.  Please help me flesh this set of
issues out here.

* * *

Finally, somebody mentioned setting design goals for the upcoming "bump up"
of a major
revision number.  I just looked over the feature requests, and there's a
fair amount of interest
in being able to hotsync to a PDA device (pretty evenly split between
platforms, too).  Have
any of our mailing list "lurkers" written PDA apps?  Or hotsync conduits?
What are the
architectural distinctives that make it easy to keep a desktop datafile in
sync with the copy on
the PDA?

* * *

Geez, I've raised more issues than I've solved, haven't I?  :-/

(This is like the Zen master teaching the golfer... "Don't concentrate on
the ball.  BE the ball."
Okay.  As a software designer, I solve problems.  "Don't concentrate on the
problem.  BE the
problem!"  Er....  that wasn't quite what I had in mind.)


regards,
    -- john b




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

[Passwordsafe-devel] edit/add bug

[Graham U. <gr...@fl...>]

There seems to be a bug in the current build which I'm too tired to solve
tonight (1:30 am here) but I think it should be resolved before the May 1
"deadline". Reproduction of the bug is simple on my system:

1. create a new database
2. add an entry: title = "anything", username = "first", pw = <whatever>
3. click OK
4. add another entry: title = "anything", username = "second", pw =
<whatever>
5. click OK
6. notice in the listbox that "anything - second" appears before "anything -
first" - I think if the listbox is sorted by title and two titles are
identical then it should be sorted by username
7. in the listbox select (should already be selected) and edit the entry
"anything - second" and see it contains "first" as a username! Obviously
this is incorrect.

Good luck.

Graham

RE: [Passwordsafe-devel] redesign

[John B. <joh...@ps...>]

Edward wrote:

> once this is done, it
> will be easy to split up and build native ui's for multiple platforms,
> especially with the number of people that have signed on to this project!
> for the record, i do not feel that a single cross platform ui in java or
> gtk+ or whatever is appropriate because it will create dependencies that
> password safe users will have fulfill to install password safe.  i may be
> wrong, but the self contained and straight forward install lends to the
> popularity of this application.

I definitely agree that the simple straightforward installation is appealing and worth keeping as 
a goal: "Installers?  We Don't Need No Stinkin' Installers!"  :-) 

And I tend to agree on avoiding a single cross-platform "all platforms" UI.  So this suggests an 
architecture consisting of the single cross-platform "engine" or "core" and a very *limited* 
number of UI "shells."  There should be as few of these distinct shell applications as possible.  
BTW, the file format should be/remain binary portable: I should be able to simply copy my file 
of encrypted passwords between my PCs running Windows, Linux, and the BSDs, and my 
Macs, aging DEC alphas, Palm Vx, iPaq, PDP-8, and my Cray.  :-)  Without worrying about 
big- or little-endian, etc.  

* * *

Which leads me to another issue...  May I play the "devil's advocate" a bit?  (I love questioning 
the assumptions!  "Out-of-the box thinking" often results in some cool innovations.)  

Edward wrote:

> i am looking forward to seeing graham's update to an xml file format.

What does XML buy us besides file format portability?  What does it cost us in return?  I am 
not criticizing the idea of using XML... but I *am* trying to "think critically" about it.  We should 
enumerate the answers to both questions.  Right now, I can only see 3 advantages, and I am 
sure I'm missing some.  I can see several potential trouble areas, all associated with parsing, 
the availability of parsers, and the difficulty in preventing the XML structure from providing "out 
of channel" information to an attacker.  Please help me flesh this set of issues out here.

* * * 

Finally, somebody mentioned setting design goals for the upcoming "bump up" of a major 
revision number.  I just looked over the feature requests, and there's a fair amount of interest 
in being able to hotsync to a PDA device (pretty evenly split between platforms, too).  Have 
any of our mailing list "lurkers" written PDA apps?  Or hotsync conduits?  What are the 
architectural distinctives that make it easy to keep a desktop datafile in sync with the copy on 
the PDA?

* * *

Geez, I've raised more issues than I've solved, haven't I?  :-/
 
(This is like the Zen master teaching the golfer... "Don't concentrate on the ball.  BE the ball."  
Okay.  As a software designer, I solve problems.  "Don't concentrate on the problem.  BE the 
problem!"  Er....  that wasn't quite what I had in mind.)


regards,
    -- john b

RE: [Passwordsafe-devel] New developer: Graham Ullrich

[Graham U. <gr...@fl...>]

Thanks for the introduction Rony. I'm happy to be part of the team working
to improve PasswordSafe. I am quite impressed with the nice changes made so
far, especially the columnar list format, Find function, and better icons
for copying password and username. As Rony mentioned, I have converted the
database to XML format in my own version of PWSafe  - we can discuss that
more later.

However, I'm having the strangest trouble with PWSafe builds and hope you
all can help. The first time I got the source and built the project the
executable worked fine. So I went ahead and merged some of my bug fixes and
built the project again. This time the toolbar did not show up in the
application in either debug or release builds. After lots of experimentation
I deleted all the local files and directories and retrieved the source once
again from the CVS repository. The build went fine (it always does) but
again the application had no toolbar. Other than that problem is ran just
fine! Can anyone tell me what I might be doing incorrectly? I'm hesitant to
continue with changes until this issue is resolved.

I'm sending my updated source files to Rony in hopes he can successfully
build the project and then commit the fixes on my behalf.

Graham


>
> Hi,
>
> I'd like to welcome Graham Ullrich
> (https://sourceforge.net/users/grahamu/)
> to our team.
>
> Graham has been working on PasswordSafe independently for a while, and has
> offered to merge his work into the project.
>
> For starters, Graham will try to add a couple of bugfixes by our May 1st
> cutoff. In the longer term, he's implemented some nice advanced
> options for
> password generation (minimum length, etc.), and, most
> interesting, converted
> the database to XML!
>
> 	Cheers,
>
> 		Rony
>
>

RE: [Passwordsafe-devel] redesign

[Edward Q. <equ...@be...>]

i agree with you here gregg.  i think the first priority of the next version
should be fixing an updated file format and implementing a portable library
(essentially) for accessing the password databases.  once this is done, it
will be easy to split up and build native ui's for multiple platforms,
especially with the number of people that have signed on to this project!
for the record, i do not feel that a single cross platform ui in java or
gtk+ or whatever is appropriate because it will create dependencies that
password safe users will have fulfill to install password safe.  i may be
wrong, but the self contained and straight forward install lends to the
popularity of this application.

i am looking forward to seeing graham's update to an xml file format.  how
did you address the issue of decrypting the entire file during parsing
graham?  i was going to suggest that sensitive data be encrypted and then
converted to a hex representation, and then the entire file encrypted.
another issue that will need to be addressed with an xml file format is the
availability of parsers on non-windows platforms.  well, not availability
for the platform, but whether or not it is intalled and availble on a
specific machine where password safe is being installed.

anyway, i will be out of touch for the next several weeks but would like to
dive in and get my hands dirty when i get back.  during the day i do a lot
of portable c++ and stl so i could help andrew with porting tasks or
implementation of the file access components.  let me know where i can help
out.

talk with everyone soon,
eq

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of
gregg conklin
Sent: Monday, April 28, 2003 5:24 PM
To: passwordsafe-devel
Subject: [Passwordsafe-devel] redesign


i think it would be great if the passwordsafe engine were fully
encapsulated and the UI didn't have to know anything about reading/writing
files, the format of the file, or maintaining the list of data that was
read from the file.

then each passwordsafe object instance would be one safe file, allowing the
gui to open more than one at a time with minimal effort.

and actually, it's not very simple to just drop in mfc code (features)
right now due to the current design.  but i believe making this basic
design change would help simplify ui changes/fixes/additions.

for portability within the passwordsafe object, we would break out the
low-level file access routines and other such utility functions.

anyway, these are just the thoughts i've had working on it the last few
days.

-gregg


At 03:51 PM 4/28/2003 -0400, you wrote:
>gregg conklin writes:
> >
> >i'd like to see some discussion pertaining to redesigning passwordsafe.
i
> >also think it's something we should really work on in the next release.
it
> >will help move forward on adding features more easily and finally porting
> >to other platforms.
>
>Gregg, what would help you add features more easily?
>
>What I'm working on is to slowly extract pwsafe logic from MFC code.  I
plan
>to refactor very slowly, to minimize the risk I will break anything.  But,
>eventually this will make MFC coding a bit more annoying, I think, since if
>you are adding new program logic, you won't be able to plop in MFC code as
>easily.  So, I think your two goals above may conflict.  I too would like
to
>see discussion on redesigning passwordsafe.  But, I think the discussion
needs
>to be within a framework of our goals.  What other large goals are there
>besides portability?
>
>-Andy



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel

RE: [Passwordsafe-devel] 1.91 beta unstable in Release build

[Edward Q. <equ...@be...>]

sorry about that guys, and thanks again gregg for fixing that.  pretty sure
that was my bug.  the sad part was is that i had generated the proper
message maps with class wizard in a dummy project, just didnt get them all
moved over.
eq

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of Rony
Shapiro
Sent: Monday, April 28, 2003 5:00 AM
To: passwordsafe-devel
Subject: RE: [Passwordsafe-devel] 1.91 beta unstable in Release build


Yep, that fixed it - thanks (again).

Gotta love Microsoft: Things work great as long as you work with their
"wizards", but as soon as you try to write some framework by yourself, they
don't even bother to generate compiler warnings...

Speaking of compiler warnings, I've checked in versions of files that
compile cleanly on warning level 4. Let's try to keep it that way...

	Cheers,

		Rony

-----Original Message-----
From: pas...@li...
[mailto:pas...@li...]On Behalf Of gregg
conklin
Sent: Sunday, April 27, 2003 10:09 PM
To: passwordsafe-devel
Subject: Re: [Passwordsafe-devel] 1.91 beta unstable in Release build


turned out to be the same method signature problem for ON_NOTIFY.

i updated DBoxMain.h/.cpp.  see if you still have a problem.

-gregg

At 07:39 PM 4/27/2003 +0200, you wrote:
>Hi,
>
>It seems that 1.91 beta crashes very easily in the release build (for
>example: minimize, unminimize, double-click on an entry).
>
>A run with a debugger shows that DboxMain's "this" pointer is getting
>trashed after a call from Windows internals (i.e., SendMessage) returns.
>Very doubleplus ungood.
>
>Any ideas?
>
>         Rony
>
>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Passwordsafe-devel mailing list
Pas...@li...
https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel