« first day (815 days earlier)      last day (4133 days later) » 

5:03 PM
@NikiC there's an option in 5.4 to not unicode escape
ok, I remember seeing something in that direction, but I didn't remember the details
thanks :)
 
that vintage.js really did a number on chrome, had to chrome://gpucrash to kill it
1
A: Random Password Generator using JS

LeighI think this is what you want. function randomPassword { // Chosen by fair dice roll // guaranteed to be random. return 'abcABC123!@#$'; }

had to be done
 
@Neal muhahahah
I voted for you
 
racist
 
I have been searching online for 2 hours and have not found a script that fits my needs. - usually you write a script that fits your needs, if your entire project is copypasta then a) it won't work very well and b) you will never learn anything. — DaveRandom 6 secs ago
 
5:15 PM
lol
:D
 
@hakre Thanks
 
@Leigh :-P I was setting up the hover over. took me too long.
Not sure why we were both voted down.
 
@Neal probably by the SO-police!
 
@Dezigo how's it going?
 
@Leigh DUN DUN DUUUUNNNN
 
5:18 PM
@Oyeme i'm just copied full css template :), now i'm trying to implement it in symfony
:D
 
php -r "var_dump('rep' > 'common sense');"
bool(true)
 
 
lol
 
@Leigh because it's a string.
 
@Oyeme I wasn't asking - It was a reply to PeeHaa's rep == common sense (and commenting about the '==' not '===')
 
5:21 PM
whats the topic of discussion
 
oh.. ok.
 
topic: how to live without a brain more than 2 days
 
we have some experts
 
Do like in Futurama place my head in a jar...
 
I think you'll find those heads still contain brains
 
5:24 PM
have you seen the one with pamala andersan init then i think im right...
 
oh..where is my head is
@Dezigo good topic
@Dezigo im out
 
ok
 
5:42 PM
@NullPointer that is awesome
 
Anonymous
5:59 PM
what is this talk about head and brains..
 
6:20 PM
1 message moved to recycle bin
 
awesome skill youtube.com/…
 
Anonymous
^^Awesome vid
 
at stas
 
6:36 PM
is there any php function with both crypt&decrypt,and I could set the salt my self
 
6:54 PM
@ircmaxell what did he do again?
@Olli There are functions like these in PHP, but I have a certain doubt that you would be able to use them correctly.
 
ok.
i will use md5
 
Hi all
 
@Olli md5 is not crypting. it's checksum.
 
ok ,but i will use it anyways
 
or it has pretty good compression as you can fit DVD image in 32 characters :)
 
7:00 PM
ok..
 
I can't believe my eyes xD
 
eih
 
?
 
not that one.but i will save the password to cookie .
actually i cannot use md5
since it cannot be decrypted
i need to save user pssword to cookie
and then fetch it from there,to send to remote server
 
7:09 PM
24 secs ago, by Olli
not that one.but i will save the password to cookie .
^ Don't do it
 
i don't want to save to db
i don't have any info in db
i just connect to remote server using password&user provided by the user
it's a client to remote server
 
does this remote server generate session?
 
no
 
Storing a plain text password in a cookie it's moronic.
It doesn't matter if you plan or not to persist it. Period.
 
Alexander,but the cookie is just in user's device
nowhere else
so i think it doesnt matter
 
7:13 PM
You want to implement 'remember me', I guess?
 
is connection secured with https?
 
user652649
hello folks
 
raspi,yes
i'm using fiel_get_contents
@Robik yes
 
@Olli I'm off this conversation then :)
 
ok, but if you think it - the pass is only in user's device - no-one can grab it there, ok?
only if someone steals it
but thats users fault
not fault of the developer :)
 
7:16 PM
someone could intercept the cookies?
 
user652649
@Sharlike yes...
 
so you have client <-> your server <-> remote server right?
 
yes
 
user652649
a hashed password in the cookie, or a hashed session string, has the same problem btw...
 
yes
 
user652649
7:19 PM
everyone could intercept cookies can easly replicate a logged account, independently by how the login system works
 
but i think it's safe enough,i will warn the user that he/she should not anyone allow to steal their device
 
user652649
the real problem of a non-hashed password
 
user652649
is that the user probably uses the same password on a lot of sites
 
yep
but i'm sorry i need to go nw
 
user652649
ok bye Olli
 
user652649
7:22 PM
stackoverflow.com/questions/14222339 can someone help me with paypal?
 
@wes no
 
user652649
@Neal very thank you for your candor
 
@wes no problem ^_^
 
user652649
xD
 
7:38 PM
@Neal, how do you manage to get downvoted so badly?
-16
Q: Rep Slimfast and Tag knowhow

amanaP lanaC A nalP A naM AMost people on these sites seem to think that rep is everything in this world. It is not. Wasn't the original reason for these sites to help people who did not want to pay for the other site? There must be a way for users (not using bounties) to shed some unwanted reputation onto people they ...

 
@Alexander haha meta hates me. I thought that was a very legit post...
 
@NikiC I summon you!
 
Here I am :)
 
user652649
@Neal I voted up! xD
 
Still he's not gonna help you
 
7:44 PM
14 mins ago, by wes
@Neal very thank you for your candor
^_^
 
user652649
@Alexander xD
 
@webarto I choose* you!
 
@NikiC I'm sorry, I thought I found bug in iconv_mime_decode_headers but setting it to ICONV_MIME_DECODE_STRICT fixed it :P I'm sorry again
 
@Alexander Ahhhh that's what you think :-P
But no, no I am not going to help you @wes I know nothing about the PayPal API
 
He says
 
user652649
7:45 PM
lolol
 
user652649
Paypal API is the antichrist. trust me
 
user652649
PayPal API is the mother of all antichrists.
 
@NikiC I'm using ZF1, mail parser fails in certain conditions, precisely iconv_mime_decode_headers does, if header is ending with = followed by \n (LF), it just merges with the following header... when set to ICONV_MIME_DECODE_STRICT it works OK, but ICONV_MIME_DECODE_CONTINUE_ON_ERROR fails... where do you think it would be appropriate to discuss this? Similar: stackoverflow.com/questions/14000889/…
 
user652649
my idea of redundancy has changed radically today: 3 different APIs that in practice do the same thing, dozens of variables which of them dozens are deprecated, dozens work in dozens of different cases which of them supersede the dozens of original ones
 
user652649
thats PayPal API
 
7:58 PM
sounds fun
 
user652649
I can see my roommate having a dump. because i've made a **** hole in the wall with my ****** head
 
You need to call it a day
And, if you can't then you are more doomed than you think
 
at least take a break :)
 
user652649
:(
 
Can anyone please tell me why I have 2 readme.md files in this repo?
And hi :D
 
user652649
8:08 PM
@MadaraUchiha because one is .md one is .MD .... case matters
 
user652649
lol
 
@wes In my local working tree, I only have one README.md file
I have no README.MD file
 
initial commit .. true initial commit .. bugfix for the initial true commit
 
ls -a doesn't revealing it either
Bah, screw it
I'm just gonna delete it and start git all over
waaaay to many complications.
 
@tereško That's epic... fail
 
8:14 PM
@MadaraUchiha Nothing to see here yet. Move along.
 
@Neal I've deleted it and restarted it
 
@MadaraUchiha ahhh ok then
 
user1125394
@MadaraUchiha git pull
 
@cab It said no difference
But it's no longer relevant, I've removed the repo and started over
 
user1125394
8:20 PM
with github, the most used command is git add -u & git commit --amend & git push -f
 
user652649
is github available for private projects?
 
@webarto Dunno, maybe the bug tracker?
 
Hi all
 
user1125394
git commit -a -n --amend & git push -f <- this one rather
 
@cab what does that do?
@wes yes if you pay for it
 
user652649
8:35 PM
@Neal I see, nice
 
user1125394
@Neal edit your last commit
 
@wes good things come to those who google.
@cab how so? (we just started using git in my office, so I want to learn as much as I can)
 
user652649
@Neal i googled in fact xD
 
suuuuure
 
user652649
@Neal google for me the paypal question. LOL
 
user1125394
8:39 PM
@Neal first part edit locally your lasr commit, second push it with force, don't do it in a team it will affect badly others versions
 
@wes ur question will be the #1 result.
@cab I confuzzled... Can you break it down to baby steps for me?
 
user652649
@Neal still without answers by the way! i'm looking for the #2
 
@cab lol i did that already
 
user1125394
8:46 PM
git commi­t --hel­p
 
@cab o pffft. :-P
Ur helpful-er :-D
haha I love the downvotes here:
0
A: In all SE sites, Is all about pages height and widht are equal?

amanaP lanaC A nalP A naM AI am not sure what widht is, but every Stack Exchange site has it's own unique CSS that controls how it looks (unless it is a beta site, then it has the beta CSS). So each site might not have the same width and height for every element on the page, so everything won't necessarily look the same f...

 
^ don't ask, just DV + Close + Del if you ask me ;)
 
There is a new uprise of vulnerabilities in Rails
A few days ago an SQL Injection vulnerability across all versions
Now a Remote Code Execution / SQL Injection / DoS vulnerability across all versions :)
 
nice
/me just built a broken-web-app
 
9:01 PM
And this time it's not something hard to exploit or only working in narrow cases. We are talking exploitable by just installing rails, without external deps.
Heck, it's even exploitable when there are no controllers registered in Rails ^^
 
finally freedom!
Evening room
 
Hello
 
Hello
 
user652649
my idea of redundancy has changed radically today: 3 different APIs that in practice do the same thing, dozens of variables which of them dozens are deprecated, dozens work in dozens of different cases which of them supersede the dozens of original ones... (ADDED:) documented in dozens of different books in dozens of different sites, which all of them belong to paypal
 
hi there :)
 
user652649
9:06 PM
hello
 
@wes /me thinks about PayPal API documentation and shivers
 
user652649
:(
 
@NikiC huh? interesting, can you share a link? :)
 
9:10 PM
thx :)
 
Oh, sorry, that is the other vulnerability announced today
The first I posted isn't very critical
 
user652649
you know guys that when you pay with paypal, you are reading that you will pay, for example 1$... and after that the seller can change the amount to a limit of 10000$ without any notify?
 
@wes For some reason I doubt that :)
 
user652649
you have to login to your paypal account to see effectively how was the amount, but nobody does that
 
user652649
@PeeHaa I'm 100% sure.
 
9:13 PM
@NikiC how does it work actually? passing xml will do what?
 
@KamilTomšík You can trigger the YAML loader by passing XML
 
cool my script works
 
user652649
when you confirm a transaction the seller can change the amount and then confirm the transaction
 
@Neal parrot.js javascript?
 
@NikiC okay, I'm not enough educated to see the point, nevermind :)
 
user652649
9:16 PM
with paypal you get the access to the user's account, not to a specific amount that user confirmed
 
user652649
@PeeHaa want proof?
 
If it sails, it ain't rails.
 
@wes You mean after the fact the user (buyer) has confirmed the amount on the paypal site?
 
@KamilTomšík Me neither. I don't know the specifics of this exploit. I just know that once you got a YAML::load with attacker-controlled content things go bad ;)
 
I.e. after the transaction is completed as far as the buyer is concerned
 
user652649
9:17 PM
@PeeHaa yes, after the confirm on the paypal site, the seller can still change the amount
 
proof or didn't happen
 
user652649
ok
 
Or maybe just didn't happen / I don't understand what you are trying to say
:)
 
user652649
stackoverflow.com/questions/7984864/… read comments here for example
 
@wes Yeah I somewhat know what it is, but where do you think to see you can change the billed amount after confirmation by buyer?
 
9:20 PM
@NikiC oh I see, seems like YAML parser does more than just parsing data
 
user652649
in practice express checkout is meant only for paypal account reuse
 
user652649
because on the confirm you can change the amount, the confirm is made on your site after the express checkout
 
user652649
@Neal very funny
 
lol
Now stop it again pls :)
 
cut it now
 
9:22 PM
sorry I left the bot running.
one sec
twas a test
 
5 messages moved to bin
 
You know there is a sandbox right?
 
don't test in active rooms
 
@wes IIRC the actual confirmation is on the paypal site
 
user652649
@PeeHaa i just tested both in sandbox and live, seller can change amount
 
9:23 PM
sorry bout that
 
user652649
@PeeHaa i don't have a one-sentence-proof of what i'm saying, if you don't trust me, test by your own or ask someone who knows paypal
 
Why is that even allowed @wes?
 
@wes I somewhat know the paypal API (although it has been some time ago), but I'm 99% sure you cannot do what you say you can (or I am misunderstanding you). Either way, I really don't want to dive into it ;)
 
@KamilTomšík Basically YAML allows you to create arbitrary objects
So getting something in the YAML loader in Rails is basically equivalent in an attacker provinding the input to unserialize() in PHP
 
user652649
9:28 PM
@Sharlike because they want to allow the seller to charge more money, for example shippings and handling costs...
 
user652649
@PeeHaa want a challenge? xD
 
And once you can create arbitrary objects you can exploit various code paths in Rails for remote code execution
 
@wes $10000 does seem like a lot
 
@wes Not really tbh
 
user652649
@PeeHaa again, i'm 100% sure of what i'm saying. you confirm 10$ on paypal's site, seller can still change the amount, and you will not be notified of that, unless you login to your paypal's account
 
9:30 PM
k
 
user652649
would be nice to ask that to some paypal guru... i'm 100% sure, yes, but it is the opinion of a fool
 
If you find you paypal guru can you please ask him/her why the paypal docs are so terrible?
 
@LeviMorrison What exactly did you want me to see?
 
user652649
I will, worst API and documentation ever seen in my entire life
 
user652649
a total chaos
 
9:35 PM
Agreed. Not 100% sure about the worst, but if it is not it is a very very close call for sure
 
user652649
Since it is a bank it is the worst for sure for me
 
user652649
lol
 
:D
 
user652649
in practice, when you set up an express checkout you can preview the amount on the paypal's site... but this is worthless, it is just a summary.. you can write whatever you decide, doesn't matter for the actual transaction
 
user652649
then the user completes the procedure on paypal's site, and returns back to your own site
 
user652649
9:40 PM
here you can change everything about the payment (in the DoExpressCheckoutPayment call)
 
user652649
including the amount
 
user652649
no one logins to paypal to see the effectively transferred money
 
user652649
and like you are now, when i understood how paypals payments actually work, i was astonished
 
user652649
@PeeHaa
 
I guess paypal leaves it up to the user to make sure the amount is correct and dispute if necessary
 
9:45 PM
USA folks, how much would it cost to send this part (3inch radius) to Europe?
 
user652649
@Sharlike only if user notices that, otherwise user will be charged of the amount that seller decided
 
Yeah
 
user652649
i mean... logging to your paypal account... not waiting the credit card bill... because in this case bye bye money
 
user652649
for instant payments (which belong to some kind debit-cards) you can't do anything, i guess
 
user652649
@webarto not so much, problem may be douane/customs/border police... on one occasion i had to pay 200€ only because they examined the package (was a gift)
 
9:59 PM
@GoogleGuy Just that they liked your voting mechanism.
 

« first day (815 days earlier)      last day (4133 days later) »