« first day (1073 days earlier)      last day (3880 days later) » 

12:00 PM
this should help
 
Okay, I will watch it
Thank you
Oh, and one more question
What permissions do I need to have on the folders
should they be different and what about user:group
 
444
:D
 
the whole project should have same user:group pairs
maybe except logs, because you cannot let the simple user to delete logs
 
wow, 444? :D
@Starsong Really?
 
@CvetomirLazarov It's not as simple as one permission level for the whole site.
Ideally every file should have the lowest permission level possible, which is likely (assuming apache/php) 644.
 
12:08 PM
Yes, I know that. That's why I'm asking
 
also there will be different permissions on development and production environments
 
>_> We just added avatars to our scrum board, our project manager made me Twilight Sparkle without even asking. #brony
 
I am interested in both, because this project will start one day
eventually :D
How would you set them?
 
oh ... and for practical part about unit testing you can look at this: youtube.com/watch?v=Jr8jAK86Uf0 (slides are in description)
 
Thanks for the Unit testing videos :)
 
as Starsong already mentioned - the permissions should be at the lowest possible level
 
That's for the production (live). And what about development? It'll be only for me on local server. Should it be 0777?
 
I use 644 on dev, you dont need exec permissions on PHP
Will be 664 for you
 
Remember what I told you about Netbeans?\
 
Netbeans doesn't need exec permissions on PHP scripts either
 
12:19 PM
The text in the IDE is grayed out (cannot be edited) when the permissions are any different than 777
I feel like a dumb cunt
 
if you need 777 , then you have the wrong user
your code should be readable and writable with 0660
actually, it should function with 0640 with some folders (like the /upload and /cache) with 0660
 
As soon as I get home, I will create a new group devel as you suggested. I will put both nginx and xpand there. Then I'm going to change the root directory in the nginx default.conf file from /usr/share/nginx/html to /var/www/example.com/public
 
I use 0640 for most things, 0660 only on directories which don't permit scripts to be run.
.htaccess is 0400, so is config.xml.
 
config.xml?
Where do you use such a file?
 
Contains configuration info (database info, smtp info etc).
 
12:23 PM
the last digit in the permissions would describe the visibility for everyone else .. for example, if you work in a team, you probably will want to use 4 there , instead of 0 because your team might need to view your files
 
@tereško That's assuming your team members aren't in group though, they should be in devel group too.
 
true
it depends on your setup
 
True, if non technical need to view, you may need to use a 4 for 'all users'.
NEVER make your database config file world-readable.
 
:11953373 So this is a start, right?
 
the configuration should not be readable from net which means that your magical config.xml should be outside the document root
 
12:26 PM
@tereško Yes, it should be outside doc root but also in production env probably shouldn't be readable by every user with a shell account.
 
@Starsong I probably wouldn't but why the emphasis on that particular file? To stop people reading how big my index cache is?
 
@Danack I'm talking about the config file with db username & password, not the db itself.
 
oh.
 
@Starsong well , your php script needs to be able to read that file
 
@Danack I have a config.xml file with db details, smtp details, imap details, sms details etc so the site can use all our services & APIs.
@tereško Yes, it's 0400.
 
Anonymous
12:28 PM
@Danack it doesn't work. Never worked, but no problems. I got a way around that.
 
Anything like private keys should also be 0400.
 
agreed
 
Anonymous
lame codding :)
 
@tereško When I'm setting the root directory in my default.conf file of Nginx, I should set it to the /var/www/example.com/public, right?
 
I'm a permissions nazi. I always try to keep permissions as restrictive as possible.
 
12:31 PM
@CvetomirLazarov depends on your exact structure , but yes , that's the general idea
 
@tereško I feel encouraged by the fact that you use a VERY similar dir structure to mine
 
@Leigh ping
 
Yes mine is based off of both yours @tereško and @Starsong
 
I tend to think that if another coder I respect and I came to the same conclusion independently, it's probably a pretty good one.
 
there is nothing worse then having to work on server where logs are NOT part of your "project space"
 
12:33 PM
@tereško Hm.. But if I'm setting the root directory of nginx to public, how my script will work if they're not in the root directory?
 
Actually @tereško, I'm guilty there, mine are under /var/log/www/sitename/
 
@CvetomirLazarov , php can use scripts that it includes even outside the document root
 
I've not seen a place not use /var/log tbh.
 
@Starsong which means that you either have to break the jail for the developers or you cannot give user ability to see logs
 
@tereško Yes, I'd rather have done it how you're doing it. I'm using that for any future projects.
 
12:36 PM
I must confess I do also use a subdir of /var/log but I do symlink it into the project root
 
well, yes, that's also a good way to do it .. but I prefer users to not stray outside their allowed premises
 
I should do that right now. :P
 
brb implementing
 
@DaveRandom Thanks, done.
 
@Starsong @tereško will you be here in.. like.. 3-4 hours?
 
12:39 PM
Probably.
 
probably
 
@CvetomirLazarov @tereško lives here..
 
I'm working until ~7.15pm, European Central.
 
It is an affectation of the guy who used to admin the first web server I ever worked with, who always shouted at me that "logs belong on a logs partition", but I also believe that logs belong with the thing that made them, so the symlink seemed like the best way to have both
 
@reikyoushin :D
 
12:39 PM
btw good morning everyone!
 
@DaveRandom Yeah, our old lead was vehement that logs belong in /var/log.
 
The logs partition is a good idea though, it's a safety net for some application not having a sensible rotation and filling up the main drive and bringing applications down
 
@DaveRandom .. I might need to alter my habits a bit
 
At least if they're in their own space the worst that can happen is you don't get any more logs
 
yes , and you cannot end up with a situation when your users cannot login any more, because logs have eaten up ALL the free space
then again , as a BSD user I just simply have separate partition for /var
 
12:44 PM
I really should give BSD another chance, I didn't like it when I tried it but I didn't really know what I was doing at the time, and I can't even remember why I didn't like it
 
I have /var/log on its own partition
 
@DaveRandom it probably has something to do with following error message:
> apt-get: Command not found.
=P
 
:-P
Possibly so (although I yum)
But not so much these days, I have come to like the Lego computing model
 
And finally I solved it! Yeah! :)
No one here to cheer me up? :/
 
I guess this guy is sleepy
 
Dangit.. I feel proud this fine day. Actually worked through 40 close votes and 20 edit votes.. claps himself on shoulder..
 
@Mr.Alien Insomnia :D
He's sleep-writing comments on stackoverflow
 
hmm ... I need to do some shopping before my estimates of "what is considered food" start to shift
 
@tereško I notice that the quality of the food I buy tends to zero as days to next payday tends to zero, I'm pretty sure there's a linear equation for it.
 
1:11 PM
not applicable
 
Can always afford pony merch, can't say the same for steak. #priorities
 
since I am what you could call "weekday vegetarian" (because preparing meat takes way more effort) then that's not a situation that I am familiar with
 
what is Public RL?
 
@tereško I normally eat fish during the week. It's quicker to cook than red meats.
Steak is fast though, 7-8 mins. (I like it bloody)
 
user895378
@NikiC @DaveRandom @Jack So ... since we're already going down the .ini route with openssl.cafile and friends, would it make sense to also add openssl.verify_peer and have it default to TRUE? If so, setting openssl.verify_peer = 0 in the .ini file would make all preexisting code instantly work without any need to mess with a CA file. Thoughts?
 
1:15 PM
do you include the time it needs for you to buy it and prepare it ?
 
@rdlowrey ...isn't that basically what I said when you were talking about strict_mode? :-P
 
@tereško I buy it from the butcher which is on my way home from work, and preparing is basically a 20 second salt rub. I'm not into marinade.
 
meh
 
@rdlowrey no -1
 
user895378
@DaveRandom I must've missed that. You had a good idea, then :)
 
user895378
1:16 PM
@NikiC You don't think?
 
that makes it too easy to turn it off
instead of modifying every single https:// fetch you modify an ini setting
 
user895378
True ... 90% of devs would just flip that switch and continue being 100% insecure.
 
exactly
 
I would say "add it, if it'll get it past internals". If it's not required to get it past, don't bother.
 
we'll just ship a ca file and everyone will be happy
 
1:17 PM
"everyone will be happy" You're a funny man.
 
user895378
I haven't sensed much opposition to this -- I don't foresee a problem getting secure-by-default past internals (famous last words).
 
user895378
Anyone who says "No" to fixing this massive language-level security hole will out himself/herself as a true luddite.
 
@tereško Between preparation and my girlfriend being a vegetarian, I'm in the same boat.
 
@tereško I may need to pick up weekday vegetarianism. Salad is cheaper than swordfish.
My €75/week food budget really doesn't cut it. :/
 
it's also better for environment ... if you care about that sort of stuff
 
1:20 PM
Swordfish is awesome. So are tuna steaks.
 
@DanLugg I love tuna steak.
 
ok .. off to the market
 
Despite my weekday vegetarianism, I recently picked up a pound of prosciutto, so I've been religiously clogging my arteries.
 
My Achilles heel is olives. :/ I eat stuffed olives as a snack at work.
 
Oh man, stuffed olives, prosciutto, swiss cheese.
 
1:23 PM
Stuffed olives, feta, sundried tomato -- antipasti >_<
 
Not a fan of the feta, but sundried tomatoes are awesome. Recently ate a roasted garlic and sundried tomato pizza :-)
 
I <3 roasted garlic
 
Fuck, now I'm hungry.
 
I do eat a lot better since moving to the continent BUT
Meat is SO much more expensive.
 
@rdlowrey I was thinking that if the x509_fingerprint() goes in, the next step is to have it in the context options as peer_fingerprint => '<hash>' as a predicate.
Make sense?
 
1:28 PM
@CvetomirLazarov haha
 
user895378
@Jack And then store the fingerprint so you can access it in the same way as when you capture the peer cert currently?
 
user895378
maybe, stream_context_get_options($context)['ssl']['peer_fingerprint']?
 
You don't have to do that, you can do this on the x509 resource already.
 
user895378
O RLY?
 
See the small example.
Just add capture_peer_cert context option and you can pull it back later.
 
user895378
1:33 PM
Oh yeah, I get that, but if you're just going to call the openssl_x509_fingerprint what's the point in adding a "peer_fingerprint" context option?
 
Aha! Because ... file_get_contents() :)
 
user895378
I might be stupid but I don't see what effect that has?
 
It makes the checking easier if you want to check cert fingerprint.
Let's say I want to perform file_get_contents() from a server but only if the fingerprint is xyz.
 
user895378
Ohh ... I was totally misreading what you were suggesting :)
 
user895378
I thought you were suggesting this:
 
1:35 PM
Ahh I see.
 
user895378
peer_fingerprint => 'sha1'
 
It would be like CN_match peer_name :)
Ahhh ... no no :)
 
user895378
Oh okay yeah, that would actually be really nice. Makes it easy to work around those shady global CA's who are probably in bed with the NSA anyway.
 
@NikiC @rdlowrey how are you going to handle relative paths correctly? (i.e. what should they be consider relative to?). If PHP ships with a CAfile, it will need to be in a known location relative to something so that PHP can tell OpenSSL where to find it.
 
I could add some convenience by checking expected length; so 32 bytes => check md5, 40 bytes => check sha1.
Those are the two most common fingerprints anyway.
 
user895378
1:37 PM
@DaveRandom Currently you have to specify an absolute path for cafile/capath ... I don't see much benefit to changing that honestly.
 
Alternative, you would pass something like peer_fingerprint => array('sha256' => 'xyz') or something.
 
Oh hell... where was "openssl_x509_fingerprint" last week ...
needed the damn thing for signed xml
 
@rdlowrey OK, well then how is PHP going to ship with a CA file in a portable way? PHP installations do not have a known reliable absolute path.
 
strtoupper(sha1(base64_decode(str_replace('-----END CERTIFICATE-----', '', str_replace('-----BEGIN CERTIFICATE-----', '', $output))))) is somehow less clean :)
 
@DaveRandom Feel free to pull it from the branch and compile it hehe
 
1:39 PM
Also you're not actually required to specify an absolute path as far as I can tell, the lookup operation is subbed out to openssl.
 
user895378
@DamienOvereem You should post to internals with a short note mentioning how useful @Jack's PR for openssl_x509_fingerprint would be.
 
Ah yes, it can be used for that as well :)
In fact, I use that in the test case.
 
user895378
@DaveRandom I might have been making that up, actually. I'd be very surprised if openssl were translating your relative paths based on the scripts CWD, though.
 
it gets the job done.. it just looks insane
@rdlowrey Never bothered with internals tbh.. tell me how and i will :)
 
user895378
@DamienOvereem Funny story, subscribing to the internals list is half-broken as it is. Took me a whole day to get subscribed and I still don't get the digest emails. @NikiC can probably help you do it.
 
1:41 PM
@rdlowrey exactly my point. And you weren't exactly making that up, cURL states that curl.cafile must be an absolute path. I don't think that's because it actually must be, but because a relative path is highly unlikely to point to the right place because of the issue you just mentioned.
 
Hmm, should I extend my existing PR to add the predicate option as well? The latter can only exist with the former.
 
user895378
@DaveRandom Should be really easy to do a realpath transformation on it internally I guess.
 
@DaveRandom Meh, dirname(dirname(dirname(__DIR__))) . '/ca-bundle.crt' =D
 
user895378
As long as your .crt file is in PEM format, sure :)
 
I have bought a VPS recently with Debian 5.0 installed. What are the things basic that i need to install to run PHP and MySql?
 
1:42 PM
@NikiC - requesting tutorial that explains how to subscribe to internals :) Let me know if you can provide assistance.
 
Probably the best bet would be to make it relative to the location of the current PHP.ini file (or binary if no ini file is in use) and realpath it before you sent it to openssl.
 
@DamienOvereem yes, it's very easy
 
user895378
@DaveRandom You're making way too much sense here.
 
user895378
@NikiC Don't believe him @DamienOvereem!
 
1:43 PM
Step 1: if you don't have a gmail address, register a gmail address
 
I'm sorry, it's Monday, it can't last long.
 
Step 2: Sign up with your gmail address
 
yeah @NikiC is playing horrible tricks on you ...
 
any perticular reason for gmail ? :)
(waiting for the pun to slam me in the face...)
 
@DamienOvereem Because you dont want your real mailbox spammed with nerdrage? :P
 
1:44 PM
Thinking about nerdrage makes me prematurely ejaculate
 
user895378
Or Mail Delivery Subsystem returns for bad addresses ...
 
Because of postfix inbox? =D
 
@DamienOvereem To be reasonably sure that your mail isn't just silently rejected for reasons only god (aka ezmlm) knows
 
would google apps do ? ;)
 
ezmlm .. isn't that one of bernstein's works?
And I don't mean the composer lol
 
1:46 PM
bernstein?
@DamienOvereem No idea. maybe ^^
 
Daniel J Bernstein? The guy who wrote qmail?
 
As if by magic, I just received this about 10 secs ago:
Hi! This is the ezmlm program. I'm managing the internals@lists.php.net mailing list.

I'm working for my owner, who can be reached at internals-owner@lists.php.net.
 
Can give it a shot ;p Anyways.. then what ..
 
@Jack ah, no idea what mail stuff he wrote
 
(there must be a page for this somewhere right ?..)
 
1:47 PM
I only know that the string hash function that PHP uses is by him.
 
@DamienOvereem Then you get a huge influx of emails you'll be sorry you read
 
It has the very mnemonic name of DJBX33A ;)
 
@DaveRandom just wanna support my homies man!
 
user895378
@DaveRandom That brings up another point ... if we can settle on a default filename for the CA file (cafile.pem, anyone?) then we could have it fallback to /path/to/ini/directory/cafile.pem if all else fails and have a very specific error message making it even more explicit what needs to happen if people get failures.
 
1:48 PM
Oh okay, he didn't write ezmlm ... :)
 
If my vote can maybe make a tiny atom-level difference on RFC progress.. then I'll take the effort
 
He wrote daemontools though ... the good variant.
 
@rdlowrey I'd go with cacert.pem because that's what cURL calls it, which would make it fairly idiot proof to set up a wget/cron update
 
@DaveRandom I liked cacert,pem more
That sounds like something mac os would do
 
Ugh I really dislike forgetting passwords, especially ones I have to ask my boss to reset.
 
1:50 PM
^^ i actually lol'd
 
or who was it with the really weird directory seperators?
 
user895378
@DaveRandom There you go again with making way too much sense. Monday morning is too early in the week for me to be feeling like the weak link.
 
@NikiC Congrats on the passed rfc btw =D
 
@NikiC Original Mac OS used :
 
One PHP function that you mostly use?
 
1:51 PM
@DaveRandom so I remembered right :)
 
@KamranAhmed var_dump
 
Let it be known while we all sit around at our PCs some guy is being paid to take these :(
 
@Jack Trust @NikiC to put an RFC to vote when I'm not around.
 
@salathe Would you have voted -1000? :)
 
1:53 PM
@KamranAhmed anonymous functions.
 
@salathe I purposefully didn't vote on it owing to not really understanding it, I'm not going to vote on one-sided things that I don't understand
 
Well damn.. actually seems to be working.. Hi! This is the ezmlm program. I'm managing the
internals@lists.php.net mailing list.
 
Serializing anonymous classes ... hmmm~
 
@KamranAhmed I'm a mod. I can see what you wrote even when you delete it ;)
 
"freelance independent business owners."
 
1:54 PM
@DaveRandom um, good for you?
 
@Gordon No offense ;)
 
@KamranAhmed none taken
 
@salathe I know I just realised I'm not entirely sure why I told you that :-P
 
@DaveRandom :-P
 
@Gordon Hmmm! :)
 
user895378
1:55 PM
@Jack Do you mind if when I post a follow-up to my last list email I suggest your PR be accepted and float the idea for a "peer_fingerprint" context option?
 
@rdlowrey By all means!
 
@salathe excuses :P you were around earlier today when vote was still open ;)
 
@rdlowrey ...which takes precedence over the ca store?
 
I'll add another branch on top of the existing one to add the context options =D
 
@NikiC Like I'm going to vote on something having known about it less than a day ;)
 
1:56 PM
@DaveRandom It probably should.
 
Ok let me ask, why do you prefer PHP over other web languages (if you do prefer)?
 
If you know the fingerprint, it should override ca checks imho
 
@Jack Isn't that what I said? :-P
(+1 in that case)
 
@salathe oh, I thought that's the whole point of voting!
 
@DaveRandom Yeah, I like redundancy :)
 
user895378
1:57 PM
So ... if the CA store's verification fails but your fingerprint matches is that okay?
 
Also, there's no way I'm reading a month's worth of internals messages :P
 
@rdlowrey The question is whether CA verification should take place at all.
 
@rdlowrey If you have the fingerprint you skip the CA check entirely
 
user895378
The main reason to use fingerprints is that you don't trust the CA ...
 
@salathe yes, that sounds very reasonable. There has been a lot of drama (again) ^^
 
1:58 PM
Hmm
 
Well.. confirmation sent.. Time to see if the list is broken or nit ..
 
user895378
@DamienOvereem I literally never got a response when I did that :)
 
@rdlowrey So you would suggest that if fingerprint passes it goes down to ca?
 
@rdlowrey Thanks for the reminder about how fucking broken SSL is. I tend to forget
 
Did 3 lists.. php-announce, internals-win and internals.. got 3 confirmation mails.. so that much is working.
 
1:59 PM
Falling back to the CA after failing to match the fingerprint is like the security guy saying "well, you don't look anything like Chris but your name's Chris so you must be the right guy"
 
what is the best OS (Debain, Ubuntu, CentOS) for PHP and MySql ?
 
user895378
@NikiC NSA pwnz U boyyyyyyy.
 
@NokImchen Closed: Primarily oppinion based
 

« first day (1073 days earlier)      last day (3880 days later) »