« first day (1733 days earlier)      last day (3219 days later) » 

12:00 AM
@ircmaxell so now that you're in a director role, will you still have time for these toys? ;)
 
@Ja͢ck at night ;)
 
hehe
 
also, if someone wants to PR in a white-list instead of Tuli's default blacklist, go for it :-D
 
Dear PHP developers: Send me any StackOverflow questions whose answers you're thinking about implementing. I'll tell you if it's secure.
my open invitation to the community is more specific than yours @ircmaxell :P
 
:-P
 
12:02 AM
Sending questions: 1 / 453132543
 
lmao
you implement a lot of stuff from SO, eh?
 
conscientious copy-paste, really.
 
@ScottArciszewski Well, given the open invitation, could you have a look at one of my answers? :)
 
12:53 AM
@Ja͢ck
already have :)
 
i see :)
 
you've fixed everything that I saw as a concern already
well, actually
openssl_random_pseudo_bytes() might not be the besT
but it's probably ok
 
Now we have random_bytes() of course.
@ScottArciszewski hmm, but we can pass a by-ref to openssl_random_pseudo_bytes() that should determine whether the resulting output is cryptographically strong.
I suppose I could make that more obvious by adding an assert($strong); :)
office time, cya!
 
1:11 AM
what are Notic messages in php ?
and what is difference between them and Warning messages ?
and also what is difference between them and Erroe messages ?
 
@Sajad the difference is artificial and conventional
They are just some messages to you from the engine with different severity
 
which one has more severity ?
 
"more severity"?
 
I mean is more destructive
more bad !
 
:-S
Generally your code should not emit any of them
(including and especially notices)
 
1:19 AM
@Sajad in increasing order: notice, warning, error
 
ah I see
 
notice means "hm, something looks wrong in your code. It should fail, but may work."
warning means "hm, dude, you're doing something dangerous. Pretty sure your code ain't working"
error means "not gonna run that code"
 
s/It should work, but may fail/It should fail, but may work/
 
@FlorianMargaine great explanation !
@zerkms what is s/It ?
 
@Sajad it's a replacement operator from sed, kind of developers slang
It means "replace the first thing with the second one"
I hope I confused you
 
1:23 AM
@zerkms ow ! got it ..!
 
s/confused you/explained it correctly/
 
@zerkms that's professional a bit ;-)
when I echo $var and If $var be empty, it give me a notice. how can I solve it ?
 
1:46 AM
@Ja͢ck I'm not sure if that's the case... github.com/paragonie/random_compat/issues/…
 
@Sajad no it does not give you notice when a variable value is empty
 
@Sajad By initializing $var before you try using it?
5
Q: How important is to initialize a variable

VivekHow important is it to initialize variables? Does proper initializing avoid memory leaks or have performance advantages?

> Uninitialized variables make a program non-deterministic. Each time the program runs, it may behave differently.... The program may run a million times before the defect presents, then may do it every time, or run another million.
Focus on the non-deterministic part of that and you quickly realize the importance of initializing your variables early.
 
2:13 AM
@Sherif yes
@zerkms you right.
 
That was a rhetorical question. Clearly I wasn't seeking your advice on a question I'm answering for you.
 
2:40 AM
@ScottArciszewski So, then, at this point the best is file_get_contents('/dev/urandom', false, null, 0, $n)? :)
 
0
A: PHP anonymous functions chaining

SherifJust to clarify a few things first, chaining is something traditionally attributed to the Object Oriented Paradigm (as in method chaining), whereby one method returns an instance in order to chain multiple method calls together on the return value of each successive method. In a functional parad...

Can you tell the last two answers are basically people copying the first answer in desperation for Karma?
Where's the authenticity anymore :/
awwe crap... I started writing PHP 7 code and didn't realize it until after I was done.
bleah
 
2:56 AM
Adding it to use () is wrong imo ... so your answer is better
 
damn it!
 
Um, not sure. I'd say openssl_random_pseudo_bytes() is okay and something like random_bytes() should be preferred...
mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM) is actually decent
 
does mcrypt do anything special with what's read from /dev/urandom?
 
it uses CryptGenRandom on Windows
 
Since we're on the topic, is there a reason to hash() the results from /dev/urandom ?
 
3:00 AM
no
 
Windows shmindows
 
unless, e.g.
you're storing a token in a cookie and storing a hash of the cookie in a DB
 
What's this Windows thing you speak of?
 
Why would you hash a token? That sounds like over engineering to me.
Keep in mind I have no clue what you guys are talking about so....
 
3:02 AM
well, for like "remember me" tokens
 
@ScottArciszewski Yea, that didn't really clarify the reason why you'd hash it
 
let's say, you have a read-only SQL user (which I do!) and somehow someone leaks the contents of the token table
if they have the tokens, they can just authenticate as the user
 
ohnoes, not the contents of the token table.
 
that lets you impersonate any user
including ones with admin rights
 
What you're saying is you don't have multiple layers of security built around your authentication mechanism?
 
3:04 AM
that's not what I'm saying at all o_o
 
Well then the damage there should be quite minimal.
 
one of the layers of security is only storing a hash of the token so that, should it ever be leaked
e.g. SQLi
(which should never happen because I'm a meticulous coder, but I'm not arrogant enough to neglect layered defenses)
then you now have to figure out the 256-bit urandom input that made that SHA256 hash
this is a specific scenario
 
Right, but the ease at which one could conduct a MITM attack to steal the cookie from the client directly is far more probable than the ease at which they could infiltrate your database.
 
right, so once the random data "leaves" the system it's advisable to hash it.
 
"the ease at which one could conduct a MITM attack to steal the cookie from the client directly is far more probable" -> implying I don't use HTTPS with HSTS
 
3:07 AM
And again... if you do build multiple layers of security around authentication (like forcing them to re-authenticate when chaing something like their password)... the damage should be quite minimal.
You could also invalidate the token upon login, making it even more difficult to replay the token.
 
I don't have a "remember me" checkbox nor a "I forgot my password" backdoor on my projects actualy
 
HTTPS will guard against attacks made over the network .. I think Sherif is talking about something that's installed locally on the victim's machine?
 
this is my advice for how to implement it sanely
 
@ScottArciszewski Do you know how trivial it is for me to strip the SSL layer in a MITM?
 
there is no defense, from a website's perspective, against malware
 
3:08 AM
@ScottArciszewski so what if you forgot your password? ;-)
 
@Sherif HPKP + TLSv1.2 + HSTS + the HTTPS Everywhere addon installed client-side
how do you defeat all those? :)
 
That's not impossible to defeat.
 
no, but can you do it trivially?
 
You think HSTS helps you when your client believes I'm the router?
 
yes
especially if the public key is pinned on the client
if there's a bug in firefox or chrome that leads to it being circumvented, fine
 
3:11 AM
Let me just say this... there are working exploits out there in some deep dark corners of the Internets :)
 
PoC||GTFO :P
I don't buy FUD
 
I won't mention which corners, but if you hold your weight in infosec you likely alreayd know of them.
 
I haven't had much contact with blackhats lately
but the biggest problem is that openssl is crap and needs to be improved
followed by NSS
 
Right, I'm just pointing out the pros and cons of your approach. Think about what you actually gain there.
In my opinion, not much.
 
You mean .. not enough?
 
3:13 AM
Sure, it doesn't hurt, but meh... I'd be more worried about which hash is used and what collision implications that creates at a certain scale.
Think of what happens to /dev/urand on a busy server
 
SHA256 is fine
if you're using a newer version of Linux, you don't need to worry about urandom
 
How new? :)
 
@ScottArciszewski I'm just saying... some things only work in theory. In my experience practice proves you wrong in ways you could never have imagined had you not seen them for yourself.
 
I'll check, but this was an issue raised by Stefan Esser in a Twitter argument
I think 3.x is immune
 
Again, not saying it's bad necessarily, so think twice before you start playing the FUD card ;) Just putting the question out there "Is it really as helpful as you think?" for those thinkers out there.
 
3:17 AM
if you're using random_bytes() on PHP 7 on a Linux 3.19 or newer machine, you have getrandom(2)
in the end, TLS should be strictly enforced but weakly trusted :P
 
Stefan Esser is a little nutty, but he's usually right
Hardly practical, but right.
 
if you can give the user a GPG-signed client that wraps all communications in libsodium before sending it over TLS, then you'll probably give GCHQ some heartburn
 
Who knows... maybe with HTTP 2.0 we might actually be able to start getting rid of this "remember me" token nonsense.
Fuck client cookies. Let's move to HTMl5 storage and never turn back.
 
anwyay, back to your question :P
in most cases, hash(entropy) is a waste of CPU cycles
 
anyone have experience with GitLab?
 
3:23 AM
not recent, and only as an end user
 
@DemCodeLines My experience is it sucks balls
 
Really? Why?
 
Have you seen the interface? It's fucking hideous.
Try figuring out how to search for a repository or a branch.
Tell me how fun that crap is.
It's non-comprehensive
 
Well is there an alternative then?
 
Uhhh yea it's called github
 
3:25 AM
I basically need a GitHub for within the company.
 
That's called Github enterprise
 
Nah, we don't want to put the code on their server.
 
Yes, they have an enterprise version.
 
you can just use git over ssh :P
if you do use gitlab, please send patches upstream to improve their UX :P
 
3:26 AM
Github appliance! :)
 
$2500 for just 10 users? wth
 
Trust me, it's worth it.
 
That's the price for success.
 
If you don't want to pay for the enterprise version hosted github really isn't that bad anymore.
They've gotten much better about security.
 
Considering we're a startup who are already tight on finances, I don't think the guys would want dedicate that amount for a version control.
 
3:28 AM
Then get hosted github.
What kind of audit compliance do you need to adhere to?
hosted github > local gitlab really
You'd probably more easily get hacked on a local gitlab than you could on hosted github these days, sans social engineering
 
We're not a startup but we're definitely tight on finances .. which is why we defer security to "institutions" like Github ;-)
 
Well, we're a team of like 5, have a decently documented codebase and I proposed the idea of a decent version control. I don't want to go and say, "Hey, I found it. You just have to put out $2500"
 
I, for one, am pretty certain Github knows more about security than we do hah
 
Especially when there is a free software (GitLab) right there.
 
use gitlab if it's right for you
if you're worried, keep it locked behind a VPN and monitor all traffic to/from it
snort is pretty ok
 
3:33 AM
I mean, we only really need a version control to keep track of changes and an issue tracker. We're not interested in open-sourcing the code at the moment (so no regular GitHub). Enterprise is kinda expensive at the moment. So GitLab, at least right now, is the only decent option.
 
Who says you have to open source anything? Hosted github has a paid subscription that allows you to keep private repositories.
It's like $7/mo
If you can't afford $7/mo to get a decent version control interface for your devs you probably won't keep them around for very long.
Trust me, I've dealt with gitlab in a startup before.. .Everyone hated it.
 
> for your devs
I'm one of the devs.
 
All more the reason to get take the superior solution over the inferior one when they are both readily available at a reasonable cost.
You'll thank me later.
 
Again, the code is going on their an outside party's server.
 
When you're tight on resources you can't afford to maintain all the tools that go into your development process in-house. It only makes more sense to take the external solution over the in-house one when the cost is relatively cheaper.
 
3:38 AM
at $7/mo you have a business relationship
 
@DemCodeLines So? It's still likely going to be far more secure on github than on a local gitlab.
 
if they get hacked (and you don't) and it hurts your startup, that could be grounds for a lawsuit
IANAL tho
 
You know github does offer 2FA these days.
 
Well, I'll propose the idea and see what happens.
 
Get everyone on 2FA and you've already got an order of magnitude better security around your code.
 
3:40 AM
yeah
but if github gets hacked and the attackers are aiming to steal private repo codes
e.g. at the filesystem level
that won't help
 
Just don't keep secrets in your code.
 
but at the same time, any damage the startup incurs would, if I'm correct (not a lawyer!), could be used for a claim for damages in a legal action against Github
 
Thing is, the company can go into a legal battle, but at the end of the day, such an event could potentially take out the company.
 
@ScottArciszewski I'm pretty sure Github has very good attorneys that have drafted up meticulous disclaimers in their TOS.
 
well, it's your threat model, not mine or @Sherif's
 
3:42 AM
It'd be quite hard to get punitive damages in open court from Github.
You'd have to prove they were directly involved in incompetent behavior that led up to your damages. That's not trivial, because for example I've seen social engineering attacks where Github was not the one at fault.
Some idiot at the copmany clicked on a link in an email and gave out their password.
 
lmao
yeah well I'm talking "github gets owned, secret sauce to startup business model is stolen, they are victims of corporate espionage from some APT"
 
You laugh, but I've seen this happen in a company that is now a billion dollar tech giant.
 
if the idiot user is the one who gets owned, it doesn't matter if it's self-hosted or not
 
The truth is social engineering is a much more plausible vector for hackers these days.
 
I know
I can't find a single provider that will implement proper safeguards against it
 
3:46 AM
You could be the smartest mofo on earth and still get pwned because some jr dev doesn't understand what a phishing scam is.
Or just isn't bright enough to ask first...
heh
 
safeguard: "this client has opted out of customer service. unless you receive a signed and dated message from [full PGP fingerprint], do not service this account in any way"
 
Yea, that doesn't stop the guy on the other end of the social engineered attack from trying to find that one dumbass in the company that doesn't know that and believes this person is from company X trying to service the account.
 
Hey guys, I want to use seige to test my website. Do you think I should launch an EC2 instance just for the siege or use my laptop?
 
it should, ideally, lock the technician out
 
And believe me... there is always that dumbass in every company.
 
3:48 AM
and require the message be input
valid PGP message? go
add a challenge-response verification on top of it
with a nonce
 
@ScottArciszewski Again, that isn't the problem. The problem is uninformed guy on the other end of that attack that doesn't know any of this and is just being naive.
You should see how trusting some people can be when you say all the right buzzwords. I once proved that by calling up the receptionist and asking her to give me the make and model of the office wireless router then tried the default root password, reset it, and locked everyone's MAC address out.
 
and it if doesn't go through without a PGP signed input from the "customer"
the clueless tech can't cause harm
 
The solution to social engineering isn't more technology. It's more information.
You have to educate people.
 
maybe I should start my own hosting company
sure, but you just said
"there's always that dumbass in every company"
by saying that, you've conceded defeat against education
 
Right, you mitigate that by educating the dumbass.
 
3:53 AM
then there isn't "always" anything
 
good morning
 
it's predicated on a lack of education
 
No, that's a rather pessimistic view on the subject. I'm merely pointing out that people are generally uneducated when it comes to technology.
That's not to say that they can never learn.
 
okay, don't use absolute terms like "always"
:P
 
Why not? It's a fact. The average intelligence of a person dictates that most people won't be smart enough to know any better. That doesn't mean you can't try to educate them and make it harder for the attacker to prey on their naiveness.
 
3:56 AM
I agree that education is fundamental to any plan to improve security
see also: why I even bother with SO
 
Well, if you look at it from Steve Job's perspective ... you don't try to teach everyone how to use a keyboard... you wait until the generation of people that will just never come to accept writing with a keyboard to die and the next generation will already have embedded this practice as a regular part of their lives.
They're both forms of educating... One is just a lot more realistic than the other.
Some people will never have the desire to learn how to embrace certain technology, as a regular part of their routine lives.
 
and they're in their right to make that choice
but
they also should not be responsible for anything to do with technology
 
One would think, but it's so hard to divvy up technical responsibility these days ... you know with the Internet making us all so connected and all :p
Finding the weakest link in that chain is all too easy.
 
they can participate as customers :P
consumers
 
It's a double edged sword indeed.
 
4:02 AM
etc
 
You can be a consumer and still carry responsibility up the technical chain.
That doesn't necessarily exclude you from responsibility. It's just that you are now likely to be less aware of what that responsibility means... For e.g., browser plugins that act as worms for botnets.
 
heh
 
and those are the people we should do as much as we can to design usable systems that are secure by default for :P
 
Taylor Swift is talking about security now?
 
4:05 AM
lulz
 
Wait is this real or is this intended for comical effect?
 
neither
bedtime
I'll be back on pretty much every day
 
ugh, didn't realise that when you build a phar with an iterator, you need to make sure to only traverse the leaves =/
phar doesn't quite understand that if you add a directory, it shouldn't behave like a file.
 
Probably because Phar was half backed
No one's really worked on it much in the last few years.
 
Phar is great!
And I do mean that ... there's just some pitfalls you have to know about ;-)
 
4:21 AM
lol I launched a seige command and I can't figure out how to make it stop :-)
 
^C
 
nope its giving terminal output
logging into the ssh, and killall -9 seemed to help
 
Can anyone find a reason why Bcrypt hashes should be stored in a BINARY(60) column?
 
Just out of curiosity what benefits are derived from phar other then ease of source deployment?
 
For me, that's really the only reason I use it .. easy to throw around ;-)
 
4:31 AM
that's fair. .... also stackoverflow.com/questions/5881169/… suggests BINARY(60) for hash storage
 
I think this only matters if you do comparison in MySQL, which you shouldn't do.
At least not for Blowfish, because the hash will be different each time.
 
4:51 AM
morning
 
morning
 
@NikiC ping, bit mo help please :)
morning all
 
hello
moderator de reputed my id
damn
but why dnt knw
 
reputed your id for what?
 
Moderator Private Message
from

Brad Larson♦

sent 8 hours ago
to

ujwal dhakal
Hello,

I'm writing in reference to your Stack Overflow account:

http://stackoverflow.com/users/4661744/ujwal-dhakal

There are clear signs of falsified accounts being used to artificially inflate your reputation.

It is not fair to other users of Stack Overflow to allow users to gain reputation through sockpuppets.

The offending accounts have been removed and the votes invalidated. Please refrain from this behavior in the future.
 
5:03 AM
Cool :)
 
:p
damn
 
5:14 AM
So the guy was nice enough to send you a private message... You had to go castigate yourself publicly?
 
why m i getting like this
so i asked
 
What that message wasn't clear enough for you?
He's saying you setup fake accounts on SO to up your rep.
That's not allowed.
The point of SO isn't to have the highest reputation because you've up voted your answers using a bunch of fake accounts. Any idiot can do that. This is a place where gathering Q&A is a useful resource to a programmer. The quality of that Q&A should be deemed by the community that uses it, not one person.
By cheating you are hurting the very community whose karma you seek.
 
i dint setup any fake accounts though
 
He's saying you did. Go take it up with Brad.
Why are you here talking about it?
Unless it was true and you already know you have no leg to stand on so you instead choose to come to a public channel and bitch about it?
 
trust me bro
i event dnt knw
from someday i am getting votes dont knw who it was
 
5:27 AM
Why should I trust you? I know nothing about you.
Another way of looking at this is: if you really didn't do anything wrong why are you here trying to convince me, the person who is powerless in rectifying this situation, rather than convince Brad, the person who has that power?
 
i am here to solve
what can be done
 
You're really not the brightest bulb in the box are you?
 
i cant directly contact
so i am here for the suggestion dough
 
My only suggestion to you is grow up.
 
already grown up
 
5:43 AM
is it just me or does laravel code look like wordpress code with better use of whitespace.
 
not wordpress
its vast different
but one thing
i find myself using event and action like same
 
6:18 AM
@NikiC i want to prepare a PR but i want your feedback first :P i want to change this and related tests
https://github.com/php/php-src/search?utf8=%E2%9C%93&q=function+name+must+be+a+string
to "xxxxx must be a callable" or something. any thoughts?
 
6:48 AM
doesn't it make sense that a function name must be a string? ;-)
 
Today was a good day broke 2,000 reputation :)
 
congrats :)
 
@RonaldUlyssesSwanson well. Method names must be a string. They're not callables. The only issue is that the text sometimes is "function name ..." in case of a method name.
 
MOrionignignrfighrinrgrngiing
 
@Ja͢ck woo yeah, I have one question that is at 34k views; but it only has 5 upvotes lol
 
6:56 AM
what's the question?
 
@bwoebi in PHP 5.4 you can have callables as arguments, within functions. Callable Typehint
 
@Killrawr I'm talking about the part after the paamaayim nekudotayim.
 
@Killrawr it has 9 votes, though?
 

« first day (1733 days earlier)      last day (3219 days later) »