« first day (143 days earlier)      last day (4820 days later) » 

5:00 PM
@edorian It can be true random. But most cases it will be a very secure pseudo-random impelementation
@pestaa Can you show me where it exists in PHP? I haven't been able to find it (at least one that has reasonably standard implementations
Basically, you'd call $randomFactory->getGenerator(Factory::STRENGTH_MEDIUM)->generate(10); to generate 10 bytes of medium strength randomness
(high strength hits /dev/random, so it should be used sparingly
 
Excuse me for asking: What defines a secure random string.
(or to ask differently) what is wrong with:
while(--$length) { $x = mt_rand(0, count($chars)-1); $string .= $chars[$x]; }
 
@ircmaxell They're classic problems, and there are hundreds of third-party solutions, so it must be a special interest to implement them again.
 
@pestaa I know it's a classic problem. But there's no PHP based solutions that I could find. If you find one, I'll abandon this project
@edorian That's not secure by a long shot. If you do that on a server running mod_php that I also have access to, I can guess the exact string with a fairly high probability
 
@ircmaxell The situation is really that bad? I mean, there must be something to send cookies and encrypt stuff. Why do you need level A security?
 
@ircmaxell Thats why i've written something, so i could see the scope of your definition of "secure"
 
5:06 PM
@pestaa There are singular libraries for most tasks (such as PHPASS for password hashing). But there's no solid collection of libraries for the task. Not to mention most of the implementations are either insecure, or aren't standards compliant
 
SHA1 hashes with 32 byte salt would suffice for all the sites except maybe for governments and three-letter agencies.
 
@edorian I'll put it to you this way, the random number generator I wrote takes input from between 4 and 6 pseudo random and true random sources (based upon the requested strength) and then mixes them using one of 3 standard methods (XOR for fast but weak numbers, Hash based for medium strength and speed, and a multi-round DES encryption/decryption scheme for strong numbers)
 
is still on the phone
 
Is standard compliance required for your job or something? Just curious what your motives are.
 
@pestaa That's not true. $hash = sha1($password . $salt) is actually susceptible to a fair number of attack vectors. It's likely good enough, but if you had a library to do it right, why wouldn't you?
@pestaa My motives are to increase the security of websites on the internet. There's a lot of wrong information out there (some perpetrated by so called security experts). And even more misconceptions out there. So I want to provide a better alternative...
 
5:10 PM
What about Whirlpool? It generates 512 bytes and never been hacked up to date. I think the latter is true for SHA1 too.
 
@ircmaxell what attack vectors that does protected against better than the oneliner i've come up with ? (learning)
 
@pestaa It's not about cracking the method. But sha1 and whirlpool's design motives make it exceptionally weak for password based hashing. The key being runtime. They are both computationally cheap. You can brute-force an 8 character password in less than an hour with either method...
@edorian First off, use a full-byte random string (chr(mt_rand(0, 255))) instead of a readable one (and then store it with base64_encoding or something like that).
Secondly, mt_rand is susceptible to seed poisoning attacks...
 
@ircmaxell Ok thats a domain problem. I was thinking about generateing something like a short unguessable uniqueid for a link (~10 chars or 15 but not a base64).
 
@ircmaxell It is only true if the salt is known. And even with that, "less than an hour" sounds like an exaggeration.
 
@ircmaxell i'd use your lib if it gets sektion1 approved :)
 
5:15 PM
nod
 
@pestaa Of course if the salt is known it's easier: openwall.com/john
 
go on if you want
 
user492203
Hi! :)
 
user492203
Is there an arguments object in PHP?
 
No
 
5:16 PM
@Nyuszika7H $args = func_get_args(); : us3.php.net/manual/en/function.func-get-args.php
 
user492203
@ircmaxell oh thanks
 
user492203
So I could do:
 
You could, but it's not recommended that you do that
 
thats not an object though
 
user492203
function test() {
    return implode(', ', func_get_args());
}
 
5:18 PM
why would you?
 
Yes, but readability wise, and from an API standpoint it's not a great idea to do... There are some use-cases for it, but in general it's bad...
 
user492203
@Gordon right, that was a silly example
 
@ircmaxell I possibly am inexperienced in this regard, but if the password is salted before hashed, doesn't the cracked need to know the salt when brute-forcing?
 
@pestaa If they do, the brute-forcing is easier. But it's not strictly necessary.
 
Tek
le gooooooooood morning
 
5:19 PM
Besides, are you using a per-user salt, or a site-wide salt?
 
Tek
=D
Or afternoon, whichever suits you guys
 
@ircmaxell What does it matter? If there are no weaknesses in the hash, the cracker needs a full match. So you must be assuming there are weaknesses.
 
Tek
@pestaa Hey, you're still here. How's it going? :)
 
@pestaa There are weaknesses in sha1
 
@Tek Barely even started my work, thanks for asking. :P
 
Tek
5:21 PM
@pestaa Oh man, that sure did take a while for you to enter the work mode :p
 
Not to mention that hash($str . $salt) isn't as good as an hmac.
In cryptography, HMAC (Hash-based Message Authentication Code) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message. Any cryptographic hash function, such as MD5 or SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly. The cryptographic strength of the HMAC depends upon the cryptographic strength of the underl...
 
@Gordon Quite freaky, huh?
 
awesome
> Mind-controlling fungi that create "zombie" ants in Brazil's rain forests are more diverse than thought, a new study says.
sounds like a cheap tabloid headline
but it's real
 
Yeah, taking over neurons to make it do what it wants...
Wait, wasn't that the exact plot of a Futurama episode? Either fungus or some other parasite...
 
5:29 PM
how to i do "indent" one indention deeper with a word shortcut..
 
tab?
 
i always tought <tab> would just work but apperntly that wasn't it..
 
in what context? A list?
 
yes
 
It works for me...
 
5:30 PM
in a <ul><li> thingy
to be more precise
 
And <shift> + <tab> moves up an indentation level...
 
word 2010?
 
2007
 
Click the Office button - Word Options - Proofing tab - AutoCorrect
Options - AutoFormat as you Type tab. Click to enable the penultimate option
(Set left- and first-indent with tabs and backspaces).
office 2010 changed pretty much everything
and nothing to the better
I'm now doing my presentations with TeX because i get mad trying to use powerpoint
Word 2010 has removed the option to set a language for a document. Every new textbox will get the language of the currently selected keyboard layout
That means if i want to write an english document i NEED to switch to an english keyboard layout for the spellchecker to work.. or change every textbox by hand
</rant>
@Gordon still on the phone?
 
@edorian yes
 
5:38 PM
:-D
value of cookie set by the secure cookie generator: string(136) "name|0|U14HAQwFVVsmJxMyLDfK++OHlNz2t/q5FJ2dIztuVOnKsDK9BRP1lNhcopkakjU3|7732680­faeeeb54043d154aa4975815ce63fbf17ec9d6ac473c9d51f90cc28c6"
all that to represent foo... :-D
 
it that an encrypted cookie with a checksum ?
 
It's a little more complicated than that, but in a sense, yes
The output of the Hash Cookie Protocol: string(75) "name|0|foo|7732680faeeeb54043d154aa4975815ce63fbf17ec9d6ac473c9d51f90cc28c6"
 
hmac hash?
 
both are immune to replay attacks and unforgable (unless the secret key is compromised)
Yeah
 
secret key would be the salt in that case?
 
5:41 PM
it's actually a double-hmac (a hmac fed into the key of another hmac, with different data in each)
The exact algo is: user|expiretime|data|HMAC(user|expiretime|data|ip, HMAC(user|expiretime, serverKey))
where | is concatonation...
 
whats the secound expire
 
it's a typo
 
what good does it do using user and expiretime twice ?
 
Oh, and the ecryption key is the inner hmac (HMAC(user|expiretime, serverKey))
@edorian It feeds it back into the key. So it generates a new key for each user and expire time
 
so that the serverKey isn't as easily compromised?
 
5:45 PM
as far as why the exact algo, it's a published implementation: cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf
 
ok
 
@edorian Right. Otherwise you could do some analysis if the server key was used over and over...
 
And you are planeing on releasing that as oss?
 
Open source you mean?
 
*edit
 
5:51 PM
1
A: Cache Busting images inside CSS

ircmaxellTo achieve cache-busting, the best way is to send the proper headers. Make sure Apache is configured to send a Expires: now header. So in a .htaccss file: Header always set Cache-Control "no-store, no-cache, must-revalidate" Header always set Expires "Thu, 01 Jan 1970 00:00:00 GMT" That will...

^^sigh to commenter...
@edorian Yes. Once I get it to alpha quality, I'm going to make a project on GitHub...
 
finally hung up
did requirements engineering with boss
@edorian available now
 
@ircmaxell funny thing is. We do it the ugly way too. At least we don't hit the filesystem every time
@Gordon :) Good talk?
you didn't seem happy
 
yeah, I know it's used. But downvoted for suggesting the correct, standards-compliant alternative? sigh...
 
not downvoted for makeing him think i'd assume
"whaa thats complicated, i'm scared"
 
Yeah... whatever
 
5:56 PM
Saving performance for later
Isn't doing stuff horribly inefficiently some sort of eco-terrorism?
 
@edorian well, it was good news, wrapped in the usual WTFs :)
missed my doctors appointment though
and all this politics at the company is just so pointless
they rather spend 7 digits figures for platinum support and a product they are not happy with than on a couple capable developers and an inhouse product that does what they want without vendor lockin.
 
well they want enterprise support :D
but 7 digits is kinda lot of money for somethnig that doesn't work
 
it does work
 
misread
the project you are working on or something releated?
 
my project works like they want :)
its the other project. the reason my project exists
 
6:14 PM
nice
@Gordon That's where my company is moving as well. I've been trying to fight it, but it's a losing battle...
 
@ircmaxell I guess that's the usual common sense of a developer vs common sense of a manager
 
yeah
the problem is they had hired a bunch of bad developers (well, junior devs put into senior dev roles). And they got burned big time by it. I wasn't involved in any of the projects, but they all failed miserably (All mine with the exception of one were fine). So now I'm suffering because of miss-management (and that manager is gone now)
 
how do i make the right JOIN in a sql query for selecting two tables, and order by id?
 
@Karem: need more information than that
what's the table schema
and what's your expected output
 
SELECT brID, uID, rating FROM discos_ratings dr, bandr_ratings br WHERE uID =:uID ORDER BY date DESC
 
6:20 PM
don't use inline join syntax
 
the table schema are the same on discos_ratings and bandr_ratings.. I know i could just make a column to make "type" but in this case i want it this way..
are the above query correct?
I want to make a while that outputs the brID and the rating of all the ratings the user has made order by the date descending..
 
SELECT brID, uID, rating
    FROM discos_ratings AS dr
    JOIN bandr_ratings AS br ON dr.br_id = br.id
    WHERE dr.uID = :uID
    ORDER BY dr.date DESC
without knowing the details of the schema, something like ^^
OHHH, wait a tick. you might want a union instead:
 
I want to learn more about this "ON", does it say that it should link together by the id's or?
 
 (SELECT brID, uID, rating, date
    FROM discos_ratings
    WHERE uID = :uID)
UNION  (SELECT brID, uID, rating, date
    FROM bandr_ratings
    WHERE uID = :uID
)
ORDER BY date DESC
 
what are the differences that the one is joining the one and the other is running "two"
 
6:26 PM
One interlace the results, the other appends
 
whats does the word interlace mean?
 
A SQL join clause combines records from two or more tables in a database. It creates a set that can be saved as a table or used as is. A JOIN is a means for combining fields from two tables by using values common to each. ANSI standard SQL specifies four types of JOINs: INNER, OUTER, LEFT, and RIGHT. In special cases, a table (base table, view, or joined table) can JOIN to itself in a self-join. A programmer writes a JOIN predicate to identify the records for joining. If the evaluated predicate is true, the combined record is then produced in the expected format, a record set or a temp...
 
thanks
issue now, my page stops loading total when I have this:
$grabRecensions = $connect->prepare("(SELECT brID, uID, rating, date
    FROM discos_ratings
    WHERE uID = :uID)
UNION  (SELECT brID, uID, rating, date
    FROM bandr_ratings
    WHERE uID = :uID
)
ORDER BY date DESC");
$grabRecensions->bindValue(":uID", $profile_id);
$grabRecensions->execute();
 
is there any problem in the source below?
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<?php
$type = 'N';

$imagesDir = '/prettyphoto/images/thumbnails';

$images = glob($imagesDir . $type . '*[TYPE].{jpg,jpeg,png,gif}', GLOB_BRACE);
?>

<ul>
<?php foreach($images as $image): ?>
<li><a href="<?php echo str_replace('[TYPE]', 'F', $image); ?>"><img src="<?php echo str_replace('[TYPE]', 'T',
it doesn't load the images only shows a <ul> bullet
 
6:44 PM
hey any mysql legends here?
@James @Jake @Karem hi all
@ircmaxell u seems like a mysql legand can u help me out
 
@AlexMathew hi
 
7:18 PM
Hi can anyone tell me the live url for this sandbox paypal url,
 
7:41 PM
I don't know about legend
or not... Granted that was an hour ago
 
@ircmaxell I have the query:
(SELECT dID, uID, rating, date, 'disco' AS type
    FROM discos_ratings
    WHERE uID = :uID)
UNION  (SELECT brID, uID, rating, date, 'br' AS type
    FROM BandR_ratings
    WHERE uID = :uID
)
ORDER BY date DESC

And then i did;
if($r['type'] == 'disco'){
echo $r['dID'];
}else{
echo $r['brID'];
}

It outputs all dID (with type 'disco') right, but it wont output the brID from the other type 'br', why is this? it outputs the other columns, ratings, date, etc. well
 
You need to name the columns the same
 
@ircmaxell thanks!
 
np
-1
A: 2 question about `file_get_html`

maniatortry this: $html = file_get_html('http://www.domain.com') or die('this is not a valid url'); $p = $html->find('p'); if(count($p) <=0){ die('Can not find p tag') } foreach($p as $element) { echo $element; }

sigh...
 
8:19 PM
anyone know a tool that would turn an XML Schema into their corresponding PHP classes?
 
Nope
 
@Gordon what do you use for markdown editing?
 
@edorian in eclipse?
 
@Gordon in general
 
8:27 PM
In general: nothing. Posterous supports it. SO supports it. Eclipse does with Markdown Plugin - winterstein.me.uk/projects/tt-update-site
 
i sort of don't want to install eclipse just for a markdown preview
 
but i don't want to write a blogpost w/o a preview
 
+1
 
8:44 PM
hello @salathe
 
howdy @Gordon :)
 
9:21 PM
doesn't ZF have an autoloader that scans the filesystem?
I thought so but i just can't find it
 
 
2 hours later…
11:27 PM
Hello
 
Tek
11:42 PM
hi
 

« first day (143 days earlier)      last day (4820 days later) »