« first day (1745 days earlier)      last day (3209 days later) » 

4:04 PM
@rdlowrey Yes, GC is definitely a reason to use a static closure. I've noticed that closures seem to cause trouble with the GC.
 
user895378
Though I suppose since I'm using a stdclass to share state between the primary object and the closure I could just rebind the closure to the shared object instance instead and avoid the static to achieve the same effect.
 
@rdlowrey So rebind it to the stdClass? That sounds like a good idea.
 
user895378
@Trowski yup exactly
 
btw @ircmaxell do you know anyone who's absolutely bananas about Unix-based-OS file systems?
 
4:14 PM
no
 
k :(
github.com/paragonie/random_compat/compare/is_device <- trying to see if there's a better way to approach this
 
@ScottArciszewski Since that page gave me a 500 I'm going to go with "use a different hosted VCS service"
 
rofl wut
 
Ahh working now
@ScottArciszewski Specifically what are you not happy with? All looks reasonable to me
 
I also broke the unmerged version by symlinking /dev/arandom -> /dev/zero :)
oh
um
I'm not unhappy with it, I'd just like to know if there are any corner cases it doesn't cover adequately
and if so, whether or not they're worth considering
also cc @SammyK I dunno if any of these checks are a worthwhile consideration for PHP 7 ;)
 
4:28 PM
@ScottArciszewski Well, the TOCTOU check should probably be done at every call if you're going to do it at all. The chances of a change between random_bytes() calls are higher than the chance of a change between fopen() and pretty much the next instruction...
Also I do have some stylistic issues with the way some of your logic is structured, but that's not what you're asking
 
@ScottArciszewski are you planning on porting this logic to C?
 
no, but only because I'm probably the worst C coder in the world
 
@ScottArciszewski How I would write it (fewer nested ifs, TOCTOU check every call, attempt to open urandom if arandom fopen() call fails, more helpful exception messages)
It's basically the same code just slightly restructured
Oh yeh, and by using !$fp instead of $fp === null it means that failure on one call does not affect subsequent calls, in your current code, if $fp ever gets a value of false then it will never work again, whereas that ^ will attempt to open the data source again on the next call in that case
I would expect that is desirable, unless there's some good reason not to do that
 
I submitted a boyscouting commit to clean some of the ifs up before I saw your message ;P
 
I wonder if we should read-buffer
not 8k, but 128 bytes or something like that. Otherwise repeated calls to random_int() can get expensive
or 32 bytes
just something
 
@ScottArciszewski Ah yeh, I forgot to static the rdev value from fopen() time. I'm still not a fan of wrapping the main body in if (!empty()), guard pattern wins every time for me
 
that's not a bad suggestion
32 bytes would probably be ok
 
5:02 PM
@ircmaxell where you able to exploit the loophole and get your flight changed?
 
@Orangepill not yet
 
Good luck... customer service in the airline industry as a whole is going to shit
 
@ScottArciszewski I suggest min($bytes, 8192)
 
@ircmaxell why would they get expensive?
 
@NikiC having to read from a device on every single call
 
5:05 PM
@DaveRandom are you suggesting to reset the read buffer on every call?
 
@ircmaxell Sounds like something that could backfire badly
 
@NikiC someone leaking the buffer? (like via an exploit)?
 
@ircmaxell yes ... having the buffer containing the next N random numbers in the PHP address space sounds problematic
 
yeah, that's fair
 
Just tested, random_int is about 20 times slower than mt_rand
 
5:09 PM
though it's not a forward break (knowing those next N doesn't tell you about following M)
 
@ircmaxell yes
 
so it's not like an arc4random leak, or a mt_rand state leak
 
or an mt_rand anything leak ^^
 
well, just issuing 4 mt_rand() numbers won't leak the state (though it can reduce the search space significantly)
 
Does "expedite technological progress" sound weird?
 
5:14 PM
@NikiC Sounds like it comes from the marketing department
 
@ScottArciszewski Yeh I just realised that, wasn't thinking straight, meant min($n * $bytes, 8192) where $n is the number of calls between reads. What the value of $n should be is beyond the scope of what my brain is capable of processing atm. I would assume that in most applications where multiple sets of random bytes are requested, it will be the same number every time.
 
Whether that is weird or not is up to your perspective ;)
 
The value of $n should be determined by (∩ ͡° ͜ʖ ͡°)⊃━☆゚. * ・ 。
 
$n = 4; // chosen by a fair dice roll
 
Hi, We have created the application using cakephp 3.0 that an application runs in an Iframe.

Now the problem is not able to get the session value in the safari browser.
 
5:15 PM
@ScottArciszewski problem solved!
 
HI,
We have created the application using cakephp 3.0 that an application runs in an Iframe.

Now the problem is not able to get the session value in the safari browser.

We have tried this solution added header ('P3P: CP="CAO PSA OUR"') --->It works fine in IE browser

Anyone please, help to get the session value in safari browser
 
@KarthikKeyan Set the p3p header
 
Annoyingly it should probably be user-configurable somehow, but that's kind of at odds with the "compat" part of what you're doing...
 
@PeeHaa i used but i works only in IE web browser
 
Handle state yourself
It's annoying as fuck, but blame apple for that
 
5:17 PM
Blame Apple For All The Things
 
@KarthikKeyan Yeah only read your last message at first
 
@ peeHaa i can't get u
 
I don't see any indication that they buffer the reads in the PHP 7 version :P
 
There is some hack IIRC in which you can open a new tab and kill it to make it work on safari, but I am not sure whether that still works and is super crappy anyway
@KarthikKeyan Pass an id back and forward to and from the client and match that id with state on the server manually
State being whatever you want in your session
You can tell php to not use cookies for session
It's really terrible, but so is @DaveRandom's mom so there is that
 
5:21 PM
You can't keep using that as an excuse for doing whatever you want all the time
 
:P
 
@ peeHaa could you please explain bit more, I am new to php
 
Do you know how sessions work?
 
Magic? It's magic isn't it
 
Yeah i know :)
 
5:26 PM
@DaveRandom It kinda is. The bad magic though
@KarthikKeyan So you understand how a client is identified when using sessions?
What you could do is the following (not sure whether it still works):
- Create a landingspage (the first page being loaded in the iframe)
- Add a form to this page
- Submit the form with javascript
- redirect to your actual first page
- cookies may or may not be set now
But for the love of god please test it first :)
 
Sweet Jesus that's horrible
 
@ peeHaa tks very much
 
@DaveRandom Yes yes it is
It's super secure...
If the above is "fixed" in newer safari versions you will have to prevent PHP to pass the sessionid in the cookie and let it pass it through the url instead
Also horrible btw
Also one last option is to let the user manually initiate something in your page. E.g. let them first click a link in the iframe to get to the second page
TL;DR safari is horrible and you are fucked one way or another
 
Well, there is one constant fuckedness throughout every option, which is that you either own a Mac or have installed Safari on Windows.
In the latter case you deserve everything you get, frankly
 
Safari on windows hasn't been supported since god knows when :)
@DaveRandom Totally :P
 
5:35 PM
@PeeHaa Since its inception, afaict
 
\o/ within the edit window
@DaveRandom Yeah also true
 
I just replied with what, I hope, is my last email to Internals on this issue
 
Although it's official now :D
 
Jesus that's still going on
 
5:38 PM
yeah, news.php.net/php.internals/87319 <- this was the latest rebuttal to throw new Error();
 
Also I already cannot stand the confusion Error is / will become
TOLD YOU SO!
 
@PeeHaa it just needs to be documented better :|
I didn't see anything about it chronologically until halfway through reading the thread
 
Well either way I am agree with you
 
secure.php.net/manual/en/language.exceptions.php <- this offers no indication about Throwable or Error, for instance
 
Nope. Isn't everything added / pushed committed once 7 is actually out?
 
5:42 PM
the random_bytes docs are already live
 
Yeah that's true
 
Err, isn't PHPDBG not supposed to overwrite $_SERVER after bootstrapping?
 
Double negatives are either very good, or very bad....
 
Double negation... does not compute
yay two whole edits
And ninja'd. Even better!
 
the answer is "No"
to which part remains the mystery
 
user895378
5:51 PM
The answer isn't not no?
 
posted on July 27, 2015 by rdlowrey

### Initial stable release \o/

 
\o/
 
Wait WAT!?
 
"The answer isn't not no, no?"
FTFY
 
user895378
if (!$inception) {
   go_cross_eyed();
}
 
user895378
5:52 PM
@PeeHaa three years later ...
 
Patch v1.0.1 arriving in 3...2...1...
 
@Feeds Yaaay!
 
@rdlowrey Gratz man!
Not sure if actually finishing stuff or just releasing :P
 
user895378
Now would be a good time for me to apologize to @bwoebi and @kelunik for the constantly moving dependency targets over the course of months/years.
 
Why? Now you can break stuff going forward to 2.0!
 
user895378
5:56 PM
Yup, time to take breakage to a whole new level.
 
:D
 
speaking of 2.0 I need to bug defuse
 
@rdlowrey Now for the constant feeling of regret, knowing you can't change anything without moving to 2.0.
 
user895378
^ exactly this
 
user895378
I have so much commitment phobia. Locking myself into anything is painful.
 
user895378
5:59 PM
Options are good. I like having options.
 
I'm looking at releasing v1 for PHP 5.5+ and v2 for PHP 7 simultaneously. I'm not sure if I could handle the anxiety though, lol
 
user895378
lol I understand 100%
 
BTW there is a typo in your docs:
after stop() -> after run()
Or the other way around :)
 
user895378
@PeeHaa I assume you mean in the gist guide? That's definitely half-baked right now. Good thing I moved it out of the source code for exactly that reason :)
 
Oh wait? I can edit it myself on that stackedit thing?
 
6:05 PM
@ScottArciszewski I replied
 
user895378
@PeeHaa You can, but it won't modify the actual link. The stackedit thing you're looking at just links to an underlying gist at the URL in the address bar
 
Oh well. Fix the first example please :)
 
user895378
@PeeHaa it's actually not a typo I'm dumb
 
user895378
Both are correct -- but there's a stop() call in that example that gets scheduled
 
huh?
 
user895378
6:08 PM
Yeah I see what you're saying now
 
k :)
 
@ircmaxell You didn't really address the main issue: returning false instead of throwing.
 
@Trowski because that seemed pretty settled at the time. If it's not, I can reply again
 
@Trowski That is not an option at this point
 
@Trowski not sure if you're trolling ;)
 
6:11 PM
At this point I don't care what it throws, just that it throws. Exception does seem more appropriate, but I was just trying to get the consistency people on board with throwing Error.
 
yeah, I don't have a preference for either but
intdiv()'s division by zero error is "the user passed 0 to the denominator"
 
@ScottArciszewski Div by 0 should be an Exception
 
@NikiC Are you sure? Because from the list it seems there's a lot of resistance to changing the behavior from returning false.
 
@Trowski There isn't.
I tallied.
 
6:15 PM
@Trowski I don't see Anatol being in favor of returning false
 
if anything, I'd vote for random_bytes() throwing an Exception simply because it requires no additional code changes from PR 1397 :P
 
He's asking for clarification on how exceptions are supposed to be adopted
@Trowski Is news.php.net super slow or is it just me?
 
It's super slow.
 
@NikiC it's always been slow
 
6:16 PM
Ah, it's me that's slow
At least right now everything is slow here
 
@NikiC I see it as denying throwing from random_*() for PHP 7 because there's no way a roadmap like that will be agreed upon in time.
 
that's why I said, if RC1 lands without an agreement, we should just throw an Exception and revisit it for 7.1
 
One of the risks you run if you take photos of your food... http://t.co/Us3zEWTaJh
 
lol
I have a friend that hates pelicans for a similar reason
 
6:33 PM
I think I know those two Dr.Who stories there
 
@ peeHaa Hi, I have checked but is not work in safari browser
 
What is not work in safari?
None of my three solutions?
 
@PeeHaa I have tried form submit using javascript and redirect to first page
 
Oh yeah. I was kinda expecting they would have fixed it by now :(
 
6:47 PM
@PeeHaa Could you please tell what another two solution
 
Start here
1 hour ago, by PeeHaa
If the above is "fixed" in newer safari versions you will have to prevent PHP to pass the sessionid in the cookie and let it pass it through the url instead
 
@ peehaa okay, But using safari got another new id , How to overwrite and replace old session id
@peehaa simple explain my project , I kept all form values in session , there is no login for iframe
 
@PeeHaa Microsoft not work in Safari. Plaese help!
Sorry, couldn't resist
 
@rdlowrey Apology rejected. There's nothing to apologize. It was necessary and so nothing to apologize as said ;-D
 
@KarthikKeyan Well as said. You told me you understood how sessions work, so you understand it's a matter of passing an identifier somehow to and from the client and match it on the serverside
 
6:54 PM
Are global variables that evil? $db = \Magento\TestFramework\Helper\Bootstrap::getInstance()->getBootstrap()->getAppli‌​cation()->getDbInstance();
 
@SebastianBergmann I'm wondering what's the time post-processing the coverage data…
 
@hakre Wow that is a special kind of special
 
Looks like code that get's paid on the number of bytes written.
 
Yay, Google got a clue: venturebeat.com/2015/07/27/…
I will soon be able to comment on my own videos again.
 
lol. Your existing upload account didn't get converted?
 
6:58 PM
Nope. I have a grand-fathered free google business account.
So I could still upload videos - just not reply to people's questions.
Or follow any link to Google+ content when I'm logged in - have to switch to incognito mode to follow some links.
 
hehehehe
arrrrggggh chrome is eating images on pages. brb. updating...
 
Synonym for "wildcard"?
 
@ircmaxell I'm not sure. It's rather a code error that it wasn't checked against 0, … but there's where the disagreement may begin, yeah ;-)
 
@DanLugg joker :)
 
@bwoebi Exceptions may be caused by code errors. But Errors are always a code problem
 
7:10 PM
@PeeHaa How self-referential of you ;-)
 
:P
 
@bwoebi I only compared the time to run the tests.
 
@DanLugg Is that thing also called the joker btw in card games in English?
 
Awesomsauce
 
7:11 PM
@ircmaxell so, calling a function on a non-object (e.g. null) should be an exception, because they just may be caused by a code error
 
@bwoebi by that definition, yes
 
58th Squadron? Wild cards? Hammerhead, hammerhead, flying all the way ...
 
@SebastianBergmann I'm just seriously wondering whether processing of the returned arrays is that slow of the actual generation…
@ircmaxell which is why it is IMO absurd // afk, dinner.
 
@bwoebi Ah. BTW, I think it might make sense to have a call some time to discuss code coverage etc.
 
7:31 PM
@PeeHaa Well, with such a big love for many new classes and objects, what can you expect to find under the hood? This is Magento 2, only took a peek into the databse adapter, surprise, surprise: magento.stackexchange.com/a/75819/4115
 
@henke they are still using ZF1 components?
 
How do you handle "validating" a char type? Range limited integers? Trimmed strings?
 
@DanLugg filterus
 
@hakre Uggggghhhh
 
@bwoebi How is that not always a code error?
 
7:35 PM
@ircmaxell Filters?
Is there a filter for char?
 
Ah, gotcha.
 
7:50 PM
@NikiC How is it not always a code error to not check against 0?
(Just like checking against null.)
 
@bwoebi Are you saying that if you get a fatal error that's not necessarily a code error?
And you might actually be intentionally triggering a fatal error?
 
not sure what we're talking about fatal errors here. The discussion was Error vs. Exception?
 
no, the discussion was E_WARNING vs E_ERROR vs Error vs Exception :P
but most people are in the latter two
recently it was suggested to just use E_ERROR and add exceptions in 7.1
but I believe that's a poor decision
 
Agree
 
That is kinda the worst of both worlds :P
 
7:55 PM
@ScottArciszewski @Trowski How about making failures of random_bytes a fatal error instead of an exception if we can't decide until the first RC? That way there aren't any BC issues when revisiting it for 7.1
 
then nobody will use it
developers will go "eww, it can fatal error unpredictably? DO NOT WANT"
and that will create even more uphill battles for me
 
@DanLugg metacharacter, jolly character, wild character
 
Well, it should actually only error if the system setup is fundamentally broken, right?
 
define fundamentally broken
"another process has exhausted all available file descriptors" is not really "we're fundamentally broken"
but it is a condition that cannot be recovered from
 
@kelunik yes, however many frameworks still support them
@ScottArciszewski yeah, it is...
 
7:57 PM
@kelunik IMHO, it should throw an Error if it fails, since it's either due to $min > $max or due to improper system setup, the latter of which can't be handled at runtime, and $min > $max is like passing 0 as the denominator to intdiv().
 
@kelunik which means that if the frameworks support them, they can't use random_*
 
I'd call it a runtime condition rather than an immutable property of the operating environment
do any OS's properly mitigate file descriptor exhaustion attacks
?
 
@Trowski Do we have a clear definition of Error and Exception now? IMO errors should lead to an immediate code fix, whereas exceptions might be temporarily, e.g. because of broken I/O.
 
(in b4 openbsd, which apparently mitigates everything I can think of every time I ask a question like that)
 
@ScottArciszewski Yeah, I didn't consider open FDs, only permanent failures like jails now allowing access to /dev/urandom etc.
 
8:07 PM
@kelunik No, which is part of the problem. Based on what you said, actually I can see where Exception might be more appropriate if, for instance, reading from /dev/urandom fails.
 
would a jail be an Exception (oh hey this didn't work!) or an Error (oh hey you didn't set up your environment right)?
or are my definitions silly?
 
I hate naming things.
If I have two "matching" strategies; one returns the first match from the candidates, the other returns a list of any matches from the candidates, what would those strategies be called?
 
@bwoebi Weren't we talking about calling methods on null?
 
So, contrived regexy example; given foo.* and foobar, quxbar, foozip, quxzip, the first strategy would return foobar and the second foobar, foozip
 
@DanLugg / and /g
 
8:14 PM
@NikiC So, SlashMatcher and SlashGMatcher it is ;-)
 
@DanLugg I was actually thinking $matcher->{'/g'}($regex) there :P
 
@NikiC Ah. Much better :-P
 
So how about FirstMatcher and GlobalMatcher/AllMatcher?
 
Though, I'm looking to leverage polymorphism.
@NikiC My only problem with All* is that I've already used it in the context of Any/All for boolean predicates; the first if any, the latter only if all.
First is good.
 
SingleMatcher / ListMatcher?
 
8:16 PM
Can't you just call it FirstMatcher and GlobalMatcher?
 
Global would work too... it just sounds weird.
 
That's because we have educated you well :P
 
FirstMatcher/EveryMatcher
@PeeHaa lol
 
MultipleMatcher
 
^^^^^ I think we have a winrar
 
8:17 PM
But serious what nikic said which my first thought too so global in this made sense to me
 
MultiMatcher
 
Yea, I noticed.
 
Also that was not really English
 
MultiMatcher is even better, as it satisfies my psychotic need to have derived type names match in character length
MultiMatcher
FirstMatcher
 
WinnrMatcher
 
8:19 PM
Thank you room 11, you folks are great enablers of my anal-retentive psychotic tendencies.
 
is "matcher" even a real word?
 
It is now. Don't spoil my day.
 
.. would I be so cruel?!
 
With certainty. But to jump the gun, I'll ruin yours: it's actually CompositeMatcherBase because Matcher alone isn't enterprisey enough.
:-P
 
Yeh, Matcher on its own is Voyager at best.
Ugh, two Star Trek references in one day, I may have a problem
 
8:26 PM
the works is actually "spotter", "locator" or "finder"
 
What about Context? :-D
 
You mean Doer?
 
we can go with ..ContextDoer, just to be inclusive
@DanLugg why not use "Sonar" ?
 
abstract class ContextFactoryDecoratorBase implements ContextFactoryDecoratorInterface { }
 
duh
 
8:29 PM
When I say "JA" you say "VA"!! JAbstractFactoryDecoratorEnterpriseFacadeV2_1!!
 
abstract class A0001 implements I0001 {}
2
 
@DanLugg Right, I can't take any more of this, I'm setting off now to hunt you down and kill you.
 
(Which tells you this is serious enterprise software, because I plan on having 10000 classes)
 
@NikiC Oh. I thought you'd plan to have 65535 classes. It has to be hex to be really enterprisey.
 
I actually used the term "enterprisey" to describe something today.
 
8:32 PM
@bwoebi Right ... Actually it's base-36 so I can have 1679616 classes. A mid-size Java project, basically.
 
@NikiC [thought about saying that, but I don't know 36^4 in my head.]
 
dammit this recent trend of moving towards common components is making it hard to find 0day :(
that's a good thing, for everyone else
 
@NikiC Sounds like you are talking about a problem which requires 2 lines of python code to solve
 
@staabm hm?
 
8:42 PM
nevermind, AnchorCMS broke the combo
 
-13
Q: what boy do I pick

Shelbi BraunOk so like idk what to do because I really like this guy but it'd be long distance. I really don't like the guy im dating because I know nothing about him and whenever I bring up talking about it he changes the conversation. Like I know everything about the guy that'd be long distance. They both ...

SO is a dating site
 
@RonaldUlyssesSwanson you mean it doesn't stand for Significant Other?
 
@RonaldUlyssesSwanson With a bit of work you could probably totally make that a programming question
 
You just got to reframe it in terms of "decision theory under imperfect information"
 
8:45 PM
What have you tried so far? Please show us your code and we can help you solve the problem. — Elliot Bonneville 1 min ago
 
user895378
fantastic.
 
@rdlowrey hm?
 
user895378
That deleted "what boy do I pick" question.
 
user895378
aww boo chat won't onebox links to comments on a deleted post
 
9:01 PM
Why choose between when you can choose both.
 
libtool: link: `Zend/zend_execute.lo' is not a valid libtool object
make[1]: *** [sapi/cli/php] Error 1
make: *** [install-pear] Error 2
^ Getting this while building 7.0.0alpha1, does anyone know more about it? (How to fix it)
 
@kelunik What version of libtool do you have?
 
@Trowski Default version on 12.04 / 15.04, worked fine yesterday, doesn't work today..
 
Hmm... yes, that should be fine.
 
@Fabor, you probably will enjoy reading the comments here (gaming related)
 
9:15 PM
@kelunik make clean?
 
man, every time I deal with Phi nodes, my head hurts
 
@ircmaxell Every time I try to understand Phi resolution at all, my head hurts…
 
:-)
It's not that bad
 
ok, now I am curious
what's Phi?
is there a wikipedia article on it for laymen?
 
9:27 PM
@RonaldUlyssesSwanson The real question on that one is she a depth first or breadth first kinda girl
4
 
that looks complicated .. gonna add it to the read later pile
 
@Orangepill mrbeanknowswhatyoumean.gif
 
@NikiC Doesn't change anything.
 
@kelunik make distclean && ./vcsclean
 
careful, vcsclean deletes the config.nice
 
9:43 PM
It's always a fresh copy from downloads.php.net/~ab, --without-pear did the trick..
 
-1/12
 
I see you are a subscriber to Numberphiles (I hope the spelling is right)
 
I hate that assert() failures are recoverable warnings in PHP
 
@ircmaxell I know, if it were up to me I'd change the default for assert.exception to 1.
 
@ircmaxell Use PHP 7 with assertion exceptions :)
 

« first day (1745 days earlier)      last day (3209 days later) »