« first day (1690 days earlier)      last day (3274 days later) » 

6:00 PM
Ok let me rephrase. How do you prevent access to ajax.php?
 
He doesn't want someone pretending they are index.php asking for JSON via ajax
 
H S
I have written rules in .htaccess to prevent some well know user agent to access it. Last time I check using httrack software , I wasnt able to access my website
 
ok great, to prevent access to ajax.php, ajax.php will only serve JSON if you give it a valid token first
or I should say to prevent access to data served from ajax.php
 
And what prevents me (a 3rd party) from getting that token?
 
You need to get the valid token from index.php first.....so screen scrap index.php to get it, and make sure you make the request in (whatever time limit the token is good for)
Yeah, sure you could do that. But screenscraping versus straight up grabbing json are TWO very big different things.
 
6:02 PM
ok I just done that
Now HOW does anything prevent me from doing anything?
 
It's "preventative".
 
No
It's false / fake security
 
It's a barrier to entry, not a guaranteed measure of protection.
 
Correct. You are increasing the barrier of entry
 
H S
@PeeHaa I think if you allowing people to browse your website, people already have access to information . I just want the fake servers to query it
 
6:04 PM
Instead of putting the keys on the outside of your house in the lock you put them on the ground on the ouside of your house
 
H S
maybe make it as difficult as possible for the fake servers
 
@HS Waste of time. Everything you think of is broken faster than you can make it
And let me repeat. A csrf token has nothing to do with this all
 
H S
So I asked, how much is enough? What do people "normally" do in production ready websites?
 
Either it is public or it is behind some form of authentication
 
@PeeHaa you could change the location/perimeter name that it's used on the page as well. So screenscraping would have to keep up
@PeeHaa you are trying to equate public preventative measures with private
apples and oranges
 
6:07 PM
No I am telling you you are spreading misinformation and broken solutions
 
@bwoebi Do you think I should PR this or just merge it? github.com/php/php-src/compare/…
 
No I'm telling you that your communication is nonconstructive. I'm telling him he can do these "preventive" things, it's up to him to weigh it for his context.
 
preventive means something is prevented
 
H S
But why do you think csrf token is useless? Because the user can still screen scrape + get token + use it make request in the limited amount of time and get data ?
@PeeHaa
 
@HS Exactly that
 
6:08 PM
Yeah, it prevents straight up JSON grabbing
 
@HS It's trivial
 
@LeviMorrison I see no real reason why this would need any further discussion…?
 
Any user determined enough to automate the collection of a CSRF token is someone you probably won't be able to prevent from accessing your site in a way you don't want anyway.
 
@LeviMorrison You need to PR this upstream
 
5 mins ago, by PeeHaa
Instead of putting the keys on the outside of your house in the lock you put them on the ground on the ouside of your house
 
H S
6:10 PM
I exactly @Charles
 
I cannot explain it more clearly than that. Do with the information whatever suits you
 
CSRF tokens stop script kiddies and most client-side exploit forms of CSRF. That's it.
They are not a suitable way to attempt to lock down a public API that has to remain public. There's no way to stop the discoverability or accessibility of a public API. It's public. It has to be for the site to work.
 
Any information you want more protection than CSRF token, you should require a login.
 
^^ that.
 
@NikiC A quick search is not showing what the upstream would be for this.
 
6:11 PM
Which is what I said at the start...
 
@LeviMorrison timelib
 
H S
But for a fat client + RestFul server architecture, that the only way - make api public. .. and I guess its commonly used
@PeeHaa
 
Sure, but searching timelib gives php-src and hhvm and python… what's the actual upstream URL?
 
ah, screw that. Don't bother and see if derick bitches about it
 
@PeeHaa you didn't say that. You just said "no". LOL
 
6:12 PM
 
@DavidGraham Look closer...
 
Well at the time I joined the convo
 
@NikiC Yeah, that's one reason I asked about PR. Don't want to upset Derick if I can help it.
 
1 hour ago, by PeeHaa
@HS Authentication
 
@PeeHaa it's all fun, you're a cool guy on here to help folks. It's fun sport. We ended up at the same place
 
6:13 PM
@HS Yes it is public. That is how the web works.
 
Honestly we are including source in PHP but it's apparently another project?
 
AJAX vs "normal" page requests are the exact same thing
 
We should just build it externally or submodule it or something…
 
@PeeHaa he could booby-trap it....
he could have 2 or 3 hidden tokens
 
Same problem
 
6:15 PM
@LeviMorrison Which is why "screw it" :)
 
(I agree with Nikita :-D)
 
If one is "attempted" as used then that's not a human
 
How do I deny from all in a virtualhost in Apache 2.4? I tried Require all denied but it replies: Syntax error on line 3 of /etc/apache2/sites-enabled/000-default.conf: Require not allowed here... I'm going from 2.2 to 2.4...
 
H S
I think @PeeHaa u can make it harder and harder... but ofcourse there always a loophole .. and that is applicable everywhere
 
6:16 PM
So I cloned his timelib repo:
$ make
gcc -O0 -ggdb3 -Wall -DHAVE_STDLIB_H -DHAVE_STRING_H -DHAVE_INTTYPES_H -I.   -c -o parse_date.o parse_date.c
gcc -O0 -ggdb3 -Wall -DHAVE_STDLIB_H -DHAVE_STRING_H -DHAVE_INTTYPES_H -I.   -c -o tm2unixtime.o tm2unixtime.c
gcc -O0 -ggdb3 -Wall -DHAVE_STDLIB_H -DHAVE_STRING_H -DHAVE_INTTYPES_H -I.   -c -o unixtime2tm.o unixtime2tm.c
gcc -O0 -ggdb3 -Wall -DHAVE_STDLIB_H -DHAVE_STRING_H -DHAVE_INTTYPES_H -I.   -c -o dow.o dow.c
gcc -O0 -ggdb3 -Wall -DHAVE_STDLIB_H -DHAVE_STRING_H -DHAVE_INTTYPES_H -I.   -c -o astro.o astro.c
 
Kind of like what I do with forms. I have a input that is the same color as the background. If any input is in there, I reject the submission
 
Doesn't apparently even work standalone anyway.
 
@HS You don't actually make it much harder
Hence the "waste of time" mention
 
H S
Then @PeeHaa what do you suggest ?
U know a way better than csrf?
then pls share
 
Anybody here upgrading from Apache 2.2 to 2.4?
 
6:17 PM
@HS Do nothing. It's public. The only things you can do to actually prevent things gets in the way of the legitimate users
 
H S
But if I do nothing, people will make request easily, and it will increase traffic to my website ...
and make it slower too, and not to mention ppl displaying the data in their own sites
 
actually @PeeHaa he could use JS to do a domain check, perform a "handshake" get the token, then make the ajax request
What do you have to say about that old boy?
 
@HS You say this as if it's a problem.
If you expect people to make automated requests to your site, then maybe you should just make an official public API for it.
As in, dedicated, documented endpoints.
 
H S
No I dont want to make a public api. I want to seperate frontend and backend.
So frontend will ping backend files and get json data
 
Look, let's get real for a moment.
 
H S
6:21 PM
Why i want to do it? because it makes project development easy
 
You aren't doing anything more special than anyone else.
Everyone's doing the same thing you do.
 
H S
Ya
I am not doing anything special. SO I want to just know what security mechanism ppl put
 
We've laid out the options. You can't stop people from doing what they want. Either ask them not to do it and get in their way at the cost of increased complexity, or cater to them and ask them to be nice, which is probalby going to work out better.
In the real world, people do what we've already outlined.
 
@Charles the real protection comes from your database and data entry application architecture. Meaning, they can steal the data, but they don't know how it's maintained in a database or inputted in an backend app. The biz logic and all that.
 
H S
6:23 PM
So in real world, ppl dont use csrf ?
 
@HS They do. But not for that
 
@HS In the real world, people use CSRF tokens to protect from CSRF, not to attempt to protect their API.
 
Does anyone know any good guides for authentication and access lists with web applications? Or are you going to point me to a github package again?
 
@HS he's talking about you get a token after you've entered a username/password, then you CSRF from that point
well, it's stored in your session
 
How do I deny from all in a virtualhost in Apache 2.4? I tried Require all denied but it replies: Syntax error on line 3 of /etc/apache2/sites-enabled/000-default.conf: Require not allowed here... I'm going from 2.2 to 2.4...
 
6:25 PM
@ziGi Every time I try to use ACL I get something fucked up. I have come to the conclusion that ACL is always ugly and terrible to write
 
Wait!!!
 
@PeeHaa same here, that's why I am asking, maybe there is someone who knows how to do it well
 
@Peehaa I have an idea.....
nevermind, if requests are "sniffed" it woudn't work
what about if the ajax JSON is fetched after a "click" or some user interaction?
 
@DavidGraham don't you use SSL? Sorry I don't know what's the problem actually, are you talking about CSRF
 
You have to code the scraper to find which request/token gets the JSON
Once you do that, (takes time), then the scraper can get the JSON easily. However, I want that step required before people steal public information. Also, if the request happens too fast after the first request (that click couldn't have happened that fast from a real user), then you could reject the JSON request as well
Also, your scraper has to be pretty smart. I tend to update changes to "views" regularly
So the point is, the barrier of entry actually is raised
 
H S
6:40 PM
that would be too much @DavidGraham :-) . But ya one more barrier.
 
What I'm saying @HS is that simply having the JSON served after a "click" makes it pretty hard to make a quick scraper
 
@DavidGraham Ther is no such thing as a click. The only thing you are working with are http requests
 
The scraper has to find the place where the request is made
it has to search out the ajax call
because you could have your token there
and it need to get it
 
Open your browser console
Paste the request in here requestable.pieterhordijk.com
3) ?
profit
 
@PeeHaa you clicked on it with your hand right?
 
6:43 PM
@PeeHaa ahahha > I'm a huge fucking header, because fuck content that's why.
Very deep text here because that's what websites are about nowadays...
 
You didn't code something to read through the code and find the token did you?
You clicked on a button
 
How many LOC is PHP-SRC?
 
then sniffed the request
 
@ziGi :D Working on it. Although I have grown fond of it so I might leave it there :)
 
but.....now find the button/token/request on the page programmatically
 
6:44 PM
@DavidGraham ok I will. Setup a page and I will do it
 
not so "open up a browser"ey is it?
 
H S
for stackoverflow I get HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: http://stackoverflow.com/
Date: Tue, 02 Jun 2015 18:43:57 GMT
Content-Length: 148
<head><title>Document Moved</title></head>
<body><h1>Object Moved</h1>This document may be found <a HREF="http://stackoverflow.com/">here</a></body>
@PeeHaa
 
@PeeHaa you are missing some images tho
 
H S
But for some websites I get the whole page
 
@ziGi Everything is missing ;)
@HS Tick the box that says "Automatically follow redirects?"
 
6:45 PM
@PeeHaa it's not asking me for cookie permission, I can call the lawyers tomorrow and sue you for storing 5 cookies :D
 
@ziGi I don't have to ask
Only session cookie is on there
 
ah
 
And with the latest changes I could even use google analytics without asking
 
hah nice
 
Yeah thank the publieke omroep for that
(public broadcaster?)
 
H S
6:46 PM
ha ha ok..@PeeHaa I will take stackoverflow as my reference. If this site can be requested like this... then I will just implement the csrf and go ahead with the project....
We have more imp things to do in our life ... u know what I mean
 
Also, I think @HS is preventing an average non-programmer person from calling the request, copying the JSON and pasting in some website that converts it to whatever they want
 
H S
yup @DavidGraham something like that
 
Or newbie programmer
If they want to pay $$$ for a more senior programmer, than barrier of entry raised
lol
and if they want to work with an unethical programmer (could be risky!), then barrier of entry raised
 
@DavidGraham An average non-programmer person doesn't copy json
 
H S
6:49 PM
haha @DavidGraham
 
I give up
3
 
I win
:-p
 
Out of curiosity @HS what is the link to your site?
 
@PeeHaa seriously, I have no ego here. You make a valid point.
We can't get over excited about these CSRF tokens
but it's so easy to implement, with no cost, that it's a no brainer. Especially with so many sites working with JSON, we really shouldn't just throw it out there. Later when we see a tool in the wild that is being used easily, then we'll update the prevention. But all of this being said, we of course know at the end of the day, public is public.
 
@DavidGraham I always try to protect innocent readers form making wrong choices
 
6:54 PM
@PeeHaa yeah, you were making sure he didn't think his public data was in fact private
 
Nope. I tried to explain to OP CSRF tokens have a totally different goal and for what he is going to use it now it is useless
 
Yeah, ideally you get the token after logging in. But public wise, there's a lot of "drop in some JSON and do whatever" tools out there. More than there are "scrape this and get the token and then get the JSON" tools.
 
H S
Its in the process of development. It will be educational website. Something kind of forum.
I will be doing it with my friends. Will work in my free time after office :-)...
 
@HS Focus on building the site forget about trying to protect your public stuff
 
H S
Ya focusing more on UI - thinking of using material design using polymer .. or materialize css .. and use reactjs or angularjs framework... So i wanted to seperate the backend
 
7:00 PM
@PeeHaa he could put some sort of "signature" in his data. Kind of like how images are protected out on the web.
Not bulletproof, but a programmer is probably not thinking to "clean" the JSON after stealing it
Ie. double-spaces between first and last name, doesn't show in HTML, but page-source it shows
or triple space
 
@Trowski any news about the exception hierarchy changes?
 
random name has lowercase first letter
stuff like that
so at least you can determine if you suspect someone is stealing your data
 
> Anyone, from the most clueless amateur to the best webdeveloper, can create an algorithm that he himself can't break.
 
I think twitter uses their own alternative to json, is that right? Using a non standard parser could be another barrier. A person would have to study your custom parser before being able to use the data. Another barrier of entry. But only @HS can know when it's time to just go private.
 
Anonymous
7:18 PM
@DanLugg Wild guess?? 15 mil.
 
Anonymous
7:50 PM
What is God's name is going on here with scrutinizer-ci ? It says the repo has no issues, and yet gives is 8.52 rating.
 
Anonymous
Do they take bribes or something ..
 
Anonymous
nvm.
 
@samaYo i) I don't think Scrutinizer is a helpful thing to use ii) Click on the "+24 methods" scrutinizer-ci.com/g/samayo/bulletproof/code-structure/master/…
 
Anonymous
yeah, apparently it is asking for more abstraction
 
Anonymous
Probably needs me to break the class into 20 another classes.
 
Anonymous
7:56 PM
@Danack What else do you suggestion, for automated solution.
 
I'd just turn off the code 'quality' analysis and just use it for style (aka bracket placement) checking.
 
Anonymous
Also here I can see it is complaining about 4 if/else conditions, but there is no limit or guidelines as to how many there should be ..
 
Well you could get rid of one of them by just doing $dir = 'images'.
 
Anonymous
Overall, I hate the fact how it mixes useful code check with silly ones. It was able to help me on one thing so far: code duplication. Aside from that, the others "issues" were not that crucial.
 
@samaYo Scrutinizer tells me that \Generator is not a defined class. :)
 
the complexity is high
As well as total lines of method is a bit high
 
@samaYo you do not play with scrutinizer if you do not intend to reach 10.0 score
your goal is not "good enough" anymore, but "close to perfect"
it's a really good tool if you want to improve your coding style
 
9:07 PM
Given the string "foo.bar.qux", is there a name for the process of producing the combinations, "foo", "foo.bar", "foo.bar.qux"?
Given the string represented a path, in order to traverse that path?
 
Anonymous
@LeviMorrison Yeah, it's obvious now. Apparently, it's not simple enough :/
 
Anonymous
I wish we had a good read on how and when it is a good idea to add abstraction to a class / an application. If I have to go with the SOLID *one class per one purpose * ideology, the library would end up being clustered into 20 different classes, and I didn't want that.
 
@samaYo Just add a helper method if it has a clear purpose
If it doesn't it's not the end of the world
@samaYo Maybe check image size section could be a function?
 
Anonymous
@LeviMorrison Yeah, that's the most obvious one, along setLocation ..
 
9:29 PM
^^ Mime checking is also a separate concern
 
Anonymous
Actually, all the setter methods ought to be isolated from the class SOLID..ly speaking.
 
Anonymous
i.e.
 
Anonymous
    $image->setName($name);

    $image->setSize($min, $max);

    $image->setMime(array($jpeg, $gif));

    $image->setLocation($folderName, $optionalPermission);

    $image->setDimension($width, $height);
 
10:00 PM
Since when are debug builds 200% slower? I thought them to be only 100% slower…^^
And btw. PHP really sucks on byte-by-byte ops
My implementation of a static huffman code (code as specified by RFC 7541 Appendix B) is too slow for me… only 2.5 MB/s for decoding…
 
10:16 PM
My implementation gist.github.com/bwoebi/4fb04b69a733f2e5ed10 … Maybe @ircmaxell may want to take a look at it and has better ideas on how to optimize? [At least you seem to like such challenges :-P]
[Took me literally a whole day (about 12 hours working) to get that implementation right^^ … But I'd be happy to see alternative, even faster versions of the two functions…]
 
Geez, tonight is my deadline for my thesis, I still have to generate some data showing optimizations on DB level....
it's gonna be a long night
tomorrow I have to work
 
How do I test for isset(CONST[$key]) again? isset doesn't support constants, right?
 
10:33 PM
@kelunik is there such a thing as accessing constants through a key?
 
It might be compile time, I don't know.
 
Too complicated, a normal class variable will do otherwise.
 
depends what you want to do
why would you keep a key of a constant?
the idea of the constant is not to keep names
 
The thing I wanted to do: Have this simple map from event names to class names:
const EVENT_HANDLER = [
    "push" => "PushHandler",
    "ping" => "PingHandler"
];
 
10:38 PM
@kelunik you shouldn't use constants like that, they are only for scalar values. better do the following:
const EVENT_HANDLER_PUSH = "PushHandler";
const EVENT_HANDLER_PING = "PingHandler";
but it really depends how you want to use it
 
I just want to avoid one big switch for mapping GitHub event hooks actual classes that process those payloads.
 
@kelunik Works in all relevant PHP versions :P
 
@NikiC I do only care about PHP 7 anyway.
 
@kelunik that's what he means with relevant ^^
 
10:41 PM
;-)
 
@bwoebi The code looks very different. You have an extra level of array nesting in one
 
@NikiC no, I don't…
It's exactly the same (except for the very first array fetch, which doesn't matter)
 
Why is it the same?
You're accessing one deeper level on each iteration, not only the first
 
@NikiC I'm doing that in both?
just that I immediately assign the level deeper in the one with list()
 
This is not the right time to think about this
night
 
10:45 PM
(I can assure you, it's the same, I get the same output too^^)
@NikiC hehe, good night
 
@bwoebi I don't doubt the output is the same, just that the implementation is significantly different
But you're right that that's not quite true, as you're basically just swapping the order
 
exactly
question is now just why that's so much slower
 
hey could some one help me on this
2
Q: Building REST APIs code Igniter

user1692342I am trying to develop REST APIs for my website. I am using CodeIgniter's PHP Framework. I have followed the tutorial mentioned on http://code.tutsplus.com/tutorials/working-with-restful-services-in-codeigniter-2--net-8814 to create the restful apis. The tutorial is based upon the code developed ...

 
@user1692342 Throw everything out and start over. Ignore any PHP tutorial or article with a publishing date that isn't within the last 3ish years. Don't use CI for new projects.
 
@Charles unfortunately I have to use CI, as the existing code base is already written
 
10:57 PM
I'm sorry for the pain you're about to go through then.
The remainder of my statement will hold true for anything that isn't CI.
 
:(
could you suggest an alternative way to setup a rest api on code igniter?
 
I avoid CI, so unfortunately I won't be of much help. One thing you should keep in mind is that there is literally nothing fancy or special about building a "REST API." All you're doing is building a web application that spits out something that isn't HTML instead of one that spits out HTML.
 
yes true..but the thing is if there is a library which exists, I can avoid rewriting things for handling sessions etc..
 
11:17 PM
@NikiC Is there any reason why CG(one_char_string) is only set when using opcache? It's actually speeding up my code by about 20%, just by initializing these strings.
 
@Worf No news on the exception hierarchy changes. No discussion on the mailing list either. I'm not sure if that's a good or bad thing...
If the changes are to be included in the alpha1 release, voting on the RFC would have to start now, so I'm guessing that won't happen unless it just gets merged.
 
11:43 PM
Hi all
Someone please help me
0
Q: How to send the push notification only to iPhone device in following scenario?

user2839497I'm using gomoob:php-pushwoosh a PHP Library that easily work with the pushwoosh REST Web Services. I want to send push-notification only to iPhone device. Following is the sample program I've written to send a push notification. Can someone please correct my code in order to send the push noti...

 

« first day (1690 days earlier)      last day (3274 days later) »