« first day (1724 days earlier)      last day (3230 days later) » 

12:00 AM
?
 
You can create this magic method?
 
I could, I just don't see any additional value here
 
You can not see a use for this method?
 
class foo {
    public static $number = 2;
    public static $doubleNumber;

    public static function init(){
        self::$doubleNumber = self::$number * 2;
    }
}
foo::init();
that's how you do it today
what does that magic method allow what I can't today?
 
it is called when the file is loaded.
require, require_once, include or include_once
 
12:03 AM
Yeah… which is same than loading time of the class
 
I will do a better example.
//Debug.php
class Debug {
    public static $startTime;

    public function __onLoad(){
        self::$startTime = microtime(true);
    }
}

//Functions.php
function loadClass($realPath){
	require $realPath;
}

//Other.php
loadClass('Debug.php');
loadClass('foo.php');
loadClass('bar.php');

echo Debug::$startTime; // Outputs int(1) 4
 
@RowAraujo sure, and how does a direct call to an init function not do that?
foo::init() is also called when file is loaded
 
the method runs too?
humm.. i will test
You must call the method.
This __onLoad is called automatically after loading the file.
__onLoad need not be called. anyway... u understand.
 
12:20 AM
So, you want "static constructors" as they're referred to in C# land
101
Q: What is the use of static constructors?

Dr. Rajesh RolenPlease explain to me the use of static constructor. Why and when would we create a static constructor and is it possible to overload one?

 
??
here is php
 
lol, yes. And they exist in C# by that name already.
 
really?
@RowAraujo we tend to allow off topic messages in this room, so long as they aren't disruptive.
 
@Danack lol
 
@Danack That message wasn't disruptive? ;-P
 
12:34 AM
That's actually a point - the flag text is different from the text people see on the flagged messages screen.
spam/offensive vs spam/inappropriate/offensive
 
12:46 AM
ok. ok lol I just thought you too took seriously that here.
 
12:57 AM
@bw
@bwoebi u are there?
 
@RowAraujo yes
 
You program in C / C ++
?
 
C, yes.
 
You have committed something in the source code of php?
 
@RowAraujo I'm currently one of the five most active core contributors I'd say.
(number four or five^^)
 
1:01 AM
humm.. You can help me create this magic method? It should be easy.
because it is simple
 
It is simple too. I just honestly don't think that it's worth adding an extra magic method when we just can call a method right after class declaration.
 
yeah
I'm talking about __toReturn
class foo {
	public $bar;

	public function __Construct($bar)
	{
		$this->bar = $bar;
	}

	public function __toReturn(): int {
		return $this->bar;
	}
}

$foo = new foo('123 bar');
echo $foo;
 
@RowAraujo that one will be more work because it needs extra handling code at every place which checks for type. And I'm personally not a fan of that and think __toString was a mistake.
 
__toString is too limited.
 
I mean… an object is an object and nothing else. It's not a string and shouldn't be handled like a string. never.
 
1:10 AM
"The __toString() method is extremely useful for converting class attribute names and values into common string representations of data (of which there are many choices). I mention this as previous references to __toString() refer only to debugging uses."
I have previously used the __toString() method in the following ways:

- representing a data-holding object as:
- XML
- raw POST data
- a GET query string
- header name:value pairs
 
@RowAraujo in that case a non-magic method would have done too.
 
I think the question is only in save writing code.
 
hmm?
 
With the magic method you write less code.
understand?
 
you don't really write less code. You just write a function call less
Which makes it usually harder to figure out that the object wasn't a real string but indeed an object and may confuse.
 
1:16 AM
hmm...
You are right ..
You can send some RFC links that u created?
 
https://wiki.php.net/rfc/generator-delegation
https://wiki.php.net/rfc/fast_zpp
https://wiki.php.net/rfc/date.timezone_warning_removal
https://wiki.php.net/rfc/const_scalar_exprs
https://wiki.php.net/rfc/phpdbg
(These are the ones which passed^^)
 
=D
congratulations
 
not so much… but there's a lot to do which doesn't require RFCs… fixing bugs… internal changes etc.
 
yeah
I am testing the PHP 7 Alpha 2
I think there is a bug.
with the globals variables
 
yep?
 
1:25 AM
I gave some reload (F5) on my browser and globals variables sometimes do not carry.
do not load*
 
that's not a reproduce script…^^
 
for example
 
1:38 AM
for($i = 0; $i < 1000; $i++){
	if( !isSet($GLOBALS) ){
		exit('...');
	}
}
It can be a problem in my apache.
i'm on windows 7
If I refresh the page several times only with this code. My Apache goes to 100% and the consumption of ram increases greatly.
@bwoebi u is there?
 
no idea…
 
tested there?
u have php 7 alpha 2?
 
@RowAraujo yes, but I have no such issue.
 
humm
wait... i will upload a video
 
2:16 AM
@bwoebi it is normal?
 
normally memory should be cleaned up after a request oO
Looks like something is malloc()'ed but never freed
 
humm
it can be in my apache
I needed to upgrade it to install PHP 7
I tested here. Not only that variable. Is any variable.
 
2:39 AM
yeah, related to exit() probably?
Anyway, good night.
@NikiC Turned out it was indeed possible to kill brk_cont_array ^^
 
sorry. is a problem here in my apache.
bye
 
^^
 
protected <name>( ... parse error ... but why?! oh, forgot "function" =/
this is happening way too often
 
2:54 AM
@Ja͢ck I would be fine with making function optional, but really it doesn't make much difference.
 
that's not an entirely objective assertion ;-)
To be honest, I'm not even sure why I leave it off so often
 
Haha, no it isn't... Let me rephrase: I'd like to get rid of it, but I'm sick of bike shedding arguments and I don't care enough to try and get rid of it :)
 
That's fair enough heh
I know it's been proposed before, but the impetus wasn't strong enough apparently.
 
@Ja͢ck So I plan on adding AccessError and UndefinedSymbolError. Do you think I can just commit that, or should I do a PR?
Oh, and using TypeError for more scenarios.
 
That sounds like something RFC-worthy imo
When would those errors be used?
Actually, it would be nice if calling non-existent methods wouldn't raise a fatal :)
 
3:02 AM
AccessError is for attempting to access private or protected methods, or trying to statically call instance methods.
UndefinedSymbolError = Undefined functions, methods, constants, classes, etc.
TypeError = Doing an operation with the wrong type of value, for instance $scalar->method() would throw a TypeError.
 
They're called errors, but they would work like exceptions, correct?
 
@Ja͢ck Yeah, all I'm doing is subclassing some things that already throw Error.
 
I would definitely welcome those :)
 
I feel like I should be doing a RFC or at least a PR, but I really want to avoid the bike shedding argument and just commit it, lol
 
I understand that sentiment hehe
Even for simple stuff like my ** operator, I've had to put my foot down on certain aspects, otherwise the voting choices would have been manifold.
 
3:09 AM
We recently added ArithmeticError and DivisionByZeroError with no RFC, so...
 
I'd suggest hashing out the hierarchy in this room first.
 
Yep, I've been discussing it in this room quite a bit. I'm not sure if I should go beyond UndefinedSymbolError and add UndefinedFunctionError, UndefinedClassError, etc. or just keep it simple.
 
Afterwards you might want to privately ask the RM and/or dmitry whether they feel an rfc is necessary.
 
The RM?
 
Sure, they're responsible for delivering the build at the end of the day.
 
3:15 AM
Oh, you mean Kalle.
 
Or Anatol
 
Yeah, alright, I'll have to find them on IRC.
 
That's probably the fastest, they're quite busy so responding to emails may be more delayed :)
 
4:15 AM
69
Q: Generating a random password in php

nunosI am trying to generate a random password in php. However I am getting all 'a's and the return type is of type array and I would like it to be a string. Any ideas on how to correct the code? Thanks. function randomPassword() { $alphabet = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXY...

can this be reopened so I can post a non-insecure answer?
 
4:59 AM
why does a password need to use a CSPRNG @ScottArciszewski ?
 
If you're generating a random password to hand off to a user, you want it to not be trivially guessable
a rand() or mt_rand() powered random password generator will, at best, give you up to 4 billion possible values
 
> Note however that the password only contains numbers 0-9 and small cap letters a-f!
quite
 
(32 bits of entropy)
which a GPU password cracking cluster can power through in no time at all
in a naive brute force
see the answer I linked in my comment to the question
none of the existing answers to this question give a secure password generator
 
you haven't explained why the password, which is probably going to be changed by the user to "password" at some point, needs to be CS ?
 
okay fuck it, I give up
 
5:06 AM
dude, don't give up, I'm interested, I think you're probably right, but it's not explained very well ...
 
I just explained
the consequences of non-CS
the passwords are insecure as shit
in security, you have two modes (barring formal proofs):
definitely insecure, and probably not insecure
CSPRNGs are the latter
if you let users choose their own passwords, they can of course nullify this feature
 
what if, I'm sensible, and these passwords are never stored, only CS hashes of these passwords, what vector is there for attack then ?
 
you can still, knowing how they were generated, guess what they were
 
how ?
 
start a seed at 0
srand($increment_me);
generate a password with the algorithm
repeat until you hit PHP_INT_MAX
or 2^32
whichever is smaller
 
5:09 AM
give this kind of explanation in your answer, and it can't be argued with, show why it is insecure without using language that only security experts might understand ...
 
I'm actually writing a blog post on this matter
instead of wasting my time with the editorial process here
much less frustrating that way
 
you'll reach many more people here most likely ... but I look forward to reading it ...
 
I'll probably copypasta it into SO answers
because I modified my blog software to use markdown
anyway brb
 
peope who work with security all the time, too quickly, forget when they didn't work with security all the time ... people that don't work with security are so bombarded with words like entropy and CSPRNG, nobody really takes the time to actually communicate why a certain thing is bad in language everyone can understand ...
/me is out to walk dogs, lata
 
5:55 AM
stackoverflow.com/questions/6101956/… <- +1 to the mods, I had no idea they could do this :D
 
6:36 AM
quick question .. I am trying to pass a variable as parameter from my page to a function in a another php script. How can I check if my request is going through and value of variable in php?
 
lol @ count($alphabet)
 
that's arguably the best part of that code
 
heh, it's sad that the answer they're pointing them to is arguably as bad.
 
answers are much simpler now with random_int() =D
as in, a decent answer
 
Yea, rand is such a bad idea for that use case. Especially on a heavily trafficed server.
and then why even bother creating an alphabet really?
 
6:46 AM
True, why not just generatePassword($length) { return "Password123"; }
 
Hey, that's random.
At absolute zero, that's as random as you can get :)
 
Randomly determined by throwing an arrow at the password board.
 
Kinda like http request listener
 
This shit frightens the crap out of me yahoo-security.tumblr.com/post/122883273670/…
I swear this is going to be heartbleed all over agian
 
7:27 AM
@Danack pong
 
monday morning
 
@ScottArciszewski I disagree with that
Nowhere in the question does it say cryptographically secure
(and it shouldn't be edited to contain that imho)
 
7:43 AM
ping @NikiC mo 'elp please sir ...
 
Anonymous
'good' morning o/
 
anyone who is happy on a monday morning is suspicious ...
 
Anonymous
and untrustworthy
 
gooooooooood morning roomies
 
@Jimbo welll, I think the point is that even a generated password needs to be a CS string from CS random numbers ...
I think ...
I dunno if it really applies in the real world, where everyone uses "apples" or "password" for their password ...
 
7:52 AM
I'm currently drafting a blog post (still)
@Jimbo the question was about passwords
passwords have an implicit security requirement (they should not be trivially guessed)
if you want to generate a random string that cannot be trivially be guessed by a powerful computer, you need a CSPRNG full stop
ask @ircmaxell if you distrust my advice ;)
yes, users can shoot themselves in their foots
but if you're generating one for them, there's an implicit trust there too
 
yes, but applications have an implicit requirement to be usable, if you are going to give your users the ability to set specific passwords then there's not much can be done to make them secure, which I think is why people focus on the secure storage and use, rather than generation
 
and that oversight will lead to much pwnage when people just use the password that was generated for them, insecurely
 
if everyone adopted a policy where only generated secure passwords can be used, the internet would be almost unusable ...
 
@JoeWatkins I use onepassword :)
+ 2FA
 
point of order: if you do something for a user, you have an obligation to give them something reasonably secure
if they downgrade the security through their own choices, that's their responsibility
the simplest answer by your reasoning is "don't generate passwords for users"
 
7:56 AM
yeah, that's probably right ...
 
which might be more practical for the real world
but if your application does, you shouldn't make it easy for the attackers
if it's just, I dunno, "I need a random string that's just unique but has no security requirement" go ahead and use mt_rand() but check for birthday collisions
after 65k you can expect at least one
 
or 4
 
I've seen so much bad code in production lately, and a lot of it traces back to SO answers
I'm bound by contract not to reveal who or what :P
 
bad code
shocking
 
I've rarely seen good code in production
 
8:00 AM
did you read the story of the Senior Programmer, who was an Indian ?? when SO was blocked by country or corporate (can't remember exact detail) firewall, he was "unable to do his job" ...
 
you haven't seen my work then :P
lmao
 
it sounds like the start of a bad racist joke, but this genuinely happened ...
 
okay, I'm not going to comment on the racist bit of that, but I will say
 
@JoeWatkins country
 
I clean up after cheap offshore developers
I've seen how bad it can be
I also have friends all over the world who are competent developers
 
8:02 AM
competence by association?
 
srsly, not racist, it really happened ...
wait wait
 
@JoeWatkins Why can't it have really happened and be racist?
Do the two have to be mutually exclusive?
 
I'm not sure
 
I think it's only racist if you made it up ...
 
So the guy never learned about XOR
Shocker
 
8:04 AM
most of the people I call friends were competent before I knew them
 
Half the people who call themselves programmers today don't know what XOR is and probably have never had to write a swap function before in their lives.
 
we should work XOR into more programmer humor punchlines
 
I mean, what's a temporary variable now-a-days anyway?
:)
 
that would solve one of those problems :P
 
Good thing he didn't have to do prime factorization on all positive integer space. That migth have taken him the rest of his career.
 
8:06 AM
lol
also, writing about CSPRNGs with minimal security jargon is proving to be a fun challenge
 
Or sort a btree, or write a deterministic acyclic finite state automation, or any of the other pesky things we never really need to know these days.
Because stdlib all teh things :D
 
Morning
 
Yes, yes it is.
 
oh, I did a work sample test not too long ago for a payment processing company
 
@ScottArciszewski it's not about reducing jargon to zero, it's about explaining jargon you do use before expecting the reader to understand an explanation containing jargon ...
 
8:09 AM
they needed a PHP dev
 
moin fab
 
Hey @JoeWatkins. Almost conference time.
 
their work sample tests were questions from an ACM programming team competition I swear
 
What time you heading up?
 
8:10 AM
including jargon might be good ... so long as ell explained without the use of further unexplained jargon
 
@JoeWatkins that's why it's minimal
I'm introducing the jargon but then dispensing with it
 
@ScottArciszewski ACM?
 
@Fabor in about 12 days :s ?
 
there are "weak" and "strong" PRNGs, and that's enough of a distinction
or whatever the prevailing programming team organization is
I might have the acronym wrong
 
@ScottArciszewski cool, I was just explaining my earlier 6am thoughts on jargon and reading about sec things
 
8:12 AM
@JoeWatkins I try to explain things clearly (and often in bold terms): paragonie.com/blog/2015/05/…
 
@JoeWatkins heh, I mean do you have to get there extra early or anything? :P
 
^- about SQLi
 
just used a goto, i feel dirty
 
Hi, do you know any good places to make a login system ?
I'm new to this and not really sure where to start
 
@Fabor oh, I don't think so, I'll check in the comin days ...
 
8:13 AM
@BradleyCouisns have you seen github.com/psecio/gatekeeper ?
 
@ScottArciszewski you do know that validating emails with FILTER_VALIDATE_EMAIL is a bad idea, right?
cc @ircmaxell
 
@ScottArciszewski Thanks, Looks like just what i need
 
a bad idea in what sense? it doesn't guarantee that there's a valid inbox there?
 
@ScottArciszewski Would i be able to integrate this directly into my site or would i need to remake it ?
 
you should be able to integrate it directly
 
8:15 AM
nice !
 
@JoeWatkins If possible can I grab a lift please? Assuming you've got availability and timings work out.
 
yeah, sure
 
Mornin'
 
I always cringe when I see nonsense like this in people's code const STATUS_ACTIVE = 'active'
learn2useconstants
 
@ScottArciszewski I don't distrust your advice. It's not about that. I just disagree with the blanket 'delete all' on that question's answers
 
8:25 AM
@Sherif const WARNING = 'learn2useconstants'; echo WARNING;
 
I was asking for it to be reopened so I could write a new answer that offered a secure answer
it was closed as a duplicate
 
@Sherif what's wrong?
 
I have no idea
github.com/paragonie/csprng-js/pull/1 this was their contribution lol
 
8:42 AM
Cheers Joe
 
@ScottArciszewski the list of his starred repos is... impressive
 
hi guys
what is the difference between foreign key and key-to-key match between 2 columns
??
 
@ScottArciszewski Why don't you return CSPRNG instead of defining a var in the scope of the caller?
And yes I suck at that js sthing
 
personally, something else bothers me
> throw new Exception
> Exception
 
@PeeHaa I am not a Javascript dev
I literally wrote this as a PoC and someone suggested nodeifying it
and they were satisfied with what you see
 
8:46 AM
this path wasn't tested, was it?
 
there's probably a "best practices" for that but I'm mostly a PHP guy
 
@ScottArciszewski there's no Exception in js, there's Error
so you probably want throw new Error('...')
 
ok
yeah, you're probably right :)
 
@ScottArciszewski where is this defined? github.com/paragonie/csprng-js/blob/…
 
wow, github's editor keeps freezing firefox
check master now :P
 
8:49 AM
Anyone willing to read talk abstracts and give feedback?
I've submitted to the website that says I'd get some feedback and I got fuck all!
 
ah, recursive
@ScottArciszewski yeah your code is... weird
@ScottArciszewski this is never called for example: github.com/paragonie/csprng-js/blob/…
 
morning
 
since you're basically using "static methods"
 
I know jack shit about Node.js tbh
 
it's not about nodejs, it's about js
 
8:51 AM
I literally wrote that to make someone stop asking me to make it
 
as a function, fine
but as a whole, your library has a bunch of useless code
 
I'll just rm it
 
can I open a PR? :)
 
sure
I don't think anyone uses this, though
 
@ScottArciszewski which API do you want: instantiable objects, or static methods?
 
8:52 AM
tried to set up npm on a VM to test it and ran into distro issues
 
@ScottArciszewski fine, I won't then :P
 
static methods
you don't need multiple CSPRNG objects
just one
shall I rm -rf then?
 
keep only this:
if (typeof crypto !== 'object') {
    throw new TypeError("crypto is not available!");
}
although it means it's completely useless on node...
but your code already is useless on node ^^
(I mean, it doesn't work.)
 
there, I made the problem better
(deleted)
 
8:55 AM
eventually, when I'm not dirt poor
I'll probably have a JS guy on my team
and I'll ask them to write one
(I literally just hack things together using jquery and a PHP REST API :P)
appreciate the review though :D
 
@ScottArciszewski the main problem was that you were using crypto, an object available on browsers only
In node you have to require the module
 
I intended the original secure_rand() to be used in browsers
I wrote that for EFF's openwireless as part of a diceware passphrase generator :P
 
Which is usually as simple as var crypto = require('crypto'); (or whatever the name is)
 
I have Node.js on my "to learn" list under perl
 
But it's probably not the same API...
 

« first day (1724 days earlier)      last day (3230 days later) »