« first day (2200 days earlier)      last day (2745 days later) » 

7:03 PM
so crazy, i used $_POST["oName"] which sent via jquey ajax and get undefined variable eerror
 
@DaveRandom then your cost is far too high. I'd set a reasonable cost at a level of 10-20 ms at most
 
can anyone tell me of an updated resource on login sessions? because this one is completely outdated. stackoverflow.com/questions/21627600/php-user-login-session
 
@DaveRandom If a password can be cracked by brute-force in less than a billion tries, the password is anyway too weak
 
@KerrialBeckettNewham please stop using `mysql_* functions for SQL, please stop using md5 for password
 
@tereško please read what I wrote.
 
7:05 PM
@bwoebi The problem is it is based on your hardware
 
.... aaaand you wont get anything more, get bent
 
@PeeHaa sure. But if your hardware is that crappy, you won't anyway be able to handle much requests
 
It's not about crappy hardware
It's about other having better hardware
 
@tereško thank you for your suggestion, but that doesn't answer my question. I'll wait for someone else to reply.
 
@PeeHaa if there are others with that a great hardware in comparison to yours, then I'm sorry, but then your hardware is crap.
 
7:10 PM
WTF are you on?
It's not hard to get better hardware than some crappy vps
 
@PeeHaa better hardware, yes. that much better hardware, no.
 
Hell your target 20ms means downgrading the cost from the default on most systems
 
With that much better I mean like hundred times faster or such
 
can any body help me with this case
Notice: Undefined index: oName in
line 2
 
I'm not saying that everybody for all cases should set it to 16 though
 
7:12 PM
whole php code is
<?php
$name = $_POST["oName"];
echo $name;
?>
 
@PeeHaa Possibly. The cost is a conservative default, not the needed cost
 
The thing is hardware gets faster
 
Do i do anything wrong?
 
@PeeHaa sure.
@PeeHaa Okay, 10-20 ms is not enough, 30-40ms is rather normal
(At least on my normal desktop)
 
7:16 PM
Yes that would be more sane yeah imo
 
@PeeHaa It's basically cost 9 vs 10 ^^
 
yes and basically twice the effort ;-)
 
@PeeHaa but tbh, it doesn't make that much of a difference, 9 vs 10
 
It does
 
@Sandro check out the documentation on echoing variables. php.net/manual/en/function.echo.php
 
7:18 PM
@PeeHaa it's 1.4 * 10^17 vs 0.7 * 10^17 (for a normal 10 letter lowercase password)
 
@KerrialBeckettNewham what do u mean
 
> float(0.031455993652344)
float(0.061379909515381)
 
!!!
 
That's certainly much difference
 
that a simple echo!! @KerrialBeckettNewham
 
7:18 PM
@PeeHaa not really
 
@Sandro in the browser's network tab, check what data your POST request actually sends
 
@Sandro yes, it has information about echoing variables there too.
 
It's twice as slow?
 
@PeeHaa and then?
 
Well twice the effort to get the crappy passwords of your users
 
7:20 PM
I am trying to setup a new repository in bitbucket. When I type in git push -u origin -all it says "cong: repository does not exist. fatal: Could not read from remote repository." However my git remote -v shows the repository correct
 
@PeeHaa that's true, but it doesn't matter. You do common attacks like dictionary attacks and such. Instead of taking 1 day for that, you need 2 … wow.
 
@Sandro p.s try: echo "$name";
 
@bwoebi It matters if you have to do a lot of them
 
@Sandro just ignore him
 
@PeeHaa I meant 1 day for the whole usertable
 
7:23 PM
1 day for an entire usertable? I call lies
 
@PeeHaa you won't decrypt them all. You just try to get as much as possible
 
Point in case the dropbox leak
@bwoebi Which is not many when done properly
 
@tereško how can i find out that my form data sent to server i don't see anything in header tab
 
@PeeHaa Enough peoples passwords are crap
 
@bwoebi Surew
I don't argue that
 
7:24 PM
@Sandro which browser?
 
firefox
 
@Sandro click on the request and then check "params" tab
 
ok there is no parameter !!! overthere
 
then you are not sending anything
 
exactly
 
7:26 PM
@Sandro what's in your XHR code in JS?
 
It's all about being annoying enough for attackers to the point you can justify it in your application
 
the code you posted had shit commented out
 
@PeeHaa and that's where it's pointless. You can just ever try to make brute-force unreasonable. And a cost factor of 9 is enough for that.
 
Somethign somethign blanket statements are stupid something
Or rather something somethign 64k
 
@PeeHaa tell me… how many Gigahashes/second does an ambitious cracker do?
 
7:28 PM
@tereško it hightlight $.ajax({
 
Look it up
 
@PeeHaa I basically do not care too much about lowercase passwords with less than 8 chars.
 
that made no sense
 
Also look up what he can do next year
@bwoebi I very much do
 
7:29 PM
People are stupid
 
i pasted here
 
@PeeHaa people that stupid usually can be attacked with a dictionary attack too.
 
@Sandro it has all the code for data commented out
 
@tereško should i have to send data
or it automaticely send
 
@bwoebi Probably yes. Doesn't prevent me from trying to protect the others either way
 
7:30 PM
why would it be automatically sent?
 
The amount of people using an all lowercase password < 8 chars without being attackable by a dictionary attack (and perhaps a few variations or number appending or such) is quite low.
 
just like regular post
 
@PeeHaa I'm all for protecting people, but that's where the tradeoff security vs. perf lies.
@PeeHaa Or why don't you just set a cost => 20 ?
 
As said:
5 mins ago, by PeeHaa
It's all about being annoying enough for attackers to the point you can justify it in your application
20 would be pretty silly on most (all?) hardware
 
@PeeHaa Most passwords can be cracked easily, even with bcrypt and salts.
 
7:32 PM
@PeeHaa right. And that point you can justify it is…
 
I cannot justify that
 
@bwoebi Which is also a tradeoff between security and security.
But you can work around that usually using rate-limits.
 
@kelunik yet they had proper issues with the dropbox db
 
ultimately, yes
@kelunik rate-limits just help against normal DoS
(unless you want to block people generically from login…)
 
@bwoebi Depends how distributed it is.
@bwoebi Maybe, if that can keep the rest of the page working instead of a total outage.
 
7:37 PM
@kelunik sure.
 
Requiring a captcha (which uses less resources than the hash) might also work there.
 
I still use captcha for this stuff although I really hate to do it :(
 
Why hate it?
 
It's mostly just for waves of chinese "users"
@kelunik It's an ugly workaround to something for which there is no real solution
Basically what I have is: captcha on user level and global
And captcha's are hard (even the recaptcha's)
 
@PeeHaa Not the nocaptchas. :-)
 
7:43 PM
Is that a real thing? Do I look like an ass when actually googling them?
!!? nocaptcha
 
Search for "nocaptcha" (https://www.google.com/search?q=nocaptcha&lr=lang_en)
• The Official CAPTCHA Site - A CAPTCHA is a program that protects websites against bots by generating and grading tests that hum… (http://www.captcha.net/)
• CAPTCHA - Wikipedia - A CAPTCHA is a type of challenge-response test used in computing to determine whether or not the us… (https://en.wikipedia.org/wiki/CAPTCHA)
• reCAPTCHA: Easy on Humans, Hard on Bots - Google - A captcha system that uses successful decodings to helps digitise books for online use. Background,… (https://www.google.com/recaptcha)
 
internet says yes :)
 
You really didn't see them yet?
 
Oh those. Yeah. It's a bit hit n miss
If it works it's great, but if it doesn't it's meh
Depending on google's moot I have to do the picture thing
Still beats their old captcha's I guess
These ones are still funny as hell
 
:P
 
8:00 PM
@PeeHaa Can't read, request new. :P
 
Those were from a time that google suddenly started responding with most of the captchas like that
refresh -> refresh -> refresh -> refresh -> refresh -> refresh -> \o/
                                                           ^ human
 
ThW
8:18 PM
took me only a few hours :-)
 
Nice! :) You can also use php_printf("Hello %s!\n", arg); to make it simpler
 
ThW
nope
php_printf("Hello %s!\n", Z_STRVAL_P(arg));
:-)
zval pointers \o/
@pmmaga The repository is basically my learning notes. I would be happy to see better versions.
 
ThW
@JoeWatkins 'file is corrupt' (firefox)
 
refresh
I got same for some reason, worked on refresh
 
ThW
no change
 
maybe download it ... possibly github are sometimes stopping the content working
 
ThW
chrome downloads it and it plays in vlc
 
8:49 PM
yeah, there's nothing wrong with the video, not sure what's going on there with github ... if it did work, then everyone would use github for their video hosting ... maybe it shouldn't work ...
 
ThW
is this opengl from php?
 
@PeeHaa meh, I prefer the text recognition to the picture
 
@ThW it's not opengl, it's cairo, or direct2d, or whatever is supported by libui on your os
 
ThW
cool
 
8:52 PM
@ThW this is opengl: github.com/Ponup/phpopengl
 
ThW
@JoeWatkins so next step is programming vr apps in php? :-)
 
looks like libui intends to have an opengl canvas
 
ThW
I should try to combine the gpio with libui, like showing sensor data in a gui an the raspberry
 
you could do that
which is really amazing ...
 
ThW
not yet - I still have problems with the i2c
and the raspberry has no analog input
 
9:04 PM
are you doing an extension for gpio ?
and have I seen it ?
 
ah I remembered someone was doing one
 
ThW
wiringpi bindings
 
I haven't seen this one
 
good nite all
 
9:05 PM
nn
 
ThW
n8
I need to understand streamwrappers for spi - so that is the next step
spi as an protocol fells like it should be an streamwrapper
 
stream wrappers are very horrible
you would probably be better to just write a nice interface ... and avoid resources and built in streams ... and avoid all the problems they come with ...
 
ThW
true, but spi has really just a read/write function.
 
simple interfaces are good :)
 
ThW
indeed
ordered a chess board, now I need TWO friends for a game: ebay.de/itm/like/…
 
9:25 PM
I'm annoyed we didn't get typed properties, they were a good idea…
 
ThW
@Andrea I still dream of declared properties (delphi style)
to be able to define properties in an api ...
 
have you just come to upset me, or is there something else @Andrea ?
:)
I'm also annoyed about that ... I won't ever be trying again ...
I think an implementation could be found actually, but it's just so much effort to argue the toss about every little thing ... every. little. thing ... it's fine, when the people arguing actually have a clue ... but they mostly don't on internals, but you have to entertain them anyway ...
 
@JoeWatkins As to my perception, if we could support references with relatively little perf impact, the RFC would pass
 
people who have a clue come to you and are productive, even if they don't like the idea ... dmitry and so on ... but all the noise is too much to cope with ... I'm going to stay in my RM corner and keep quiet ...
 
@JoeWatkins mostly the former
@bwoebi references? good joke
 
9:32 PM
@Andrea :)
 
@Andrea sadly not joking
 
no bob did have some ideas there ... none of them are simple, but it's not going to be simple ... I think it was worth trying to avoid any of those solutions, but probably worth trying now it failed ...
one or both of you should run with it ... I still want it ...
 
ThW
thinking about the php core is scary, just thinking about how few people maintain it and how many depend on it
 
Is there anything kicking around in Jeeves which lets us nicely format times, or is it okay if I fetch something from composer for it?
 
under no circumstances should you peek behind the curtain ...
 
9:35 PM
I don't even maintain it, I'm a liability
I probably introduce more bugs than I fix
 
I've wiped out more branches than I've released ...
 
the one I'm most ashamed of is var_export()
 
ThW
SCARY
 
related: I just figured out the other day that I've been using git wrong ...
 
that was a really obvious thing I would've spotted and it broke real apps
 
9:36 PM
@Andrea Progress only happens by introducing bugs, usually.
 
@bwoebi progress is deleting code
 
@Andrea Ideally, yes :-P
… without removing crucial functionality ;-)
 
there's probably more people around than it seems @ThW
it's unreasonable to assume that if all of us died in a PHP 7 party bus crash, that there would be nobody able to maintain php ...
there must be people standing in the wings that just don't need to come forward right now ...
 
@JoeWatkins yes… only people unable to maintain PHP 7…
 
ThW
not really, some people might to be able to take over, but they are not active - a lot is experience
 
9:39 PM
regarding OPcache, let us pray to the great elePHPants above us that buses in moscow don't hit pedestrians often
 
ThW
so it would take time
 
@Andrea the only hard bugs are the ones due to shm race conditions
 
ThW
the main part (like me) never programmed c
 
@bwoebi ah, concurrency :)
hmm
regarding actually useful PHP additions, I wanna rewrite that UString extension at some point
 
well yeah it would, but that's a hypothetical, there's no party ... the point was that there is probably people standing by that would fill our shoes ... in might not take something as extreme as us all perishing to get them to actually contribute either ...
@Andrea do it
 
9:42 PM
some part of me is rather NIH and wants to see if it can work without ICU, but that's probably a bad idea
 
well I don't know if it is a bad idea
there are good reasons to want to avoid icu in the beginning, and in the future ...
 
I should probably rewrite it using ICU and just copy the entire Swift string API
@JoeWatkins using ICU is kinda inevitable if we want to support Unicode properly, alas
 
maybe, I guess I came to that conclusion too ..
if targeting core, then bundling another huge library, or relying on one, is not ideal ... and it makes certain people squeak when it's suggested
 
I wonder if it's worth implementing as much as possible without ICU and requiring ICU only for “advanced” features, but then you'd get a pretty spartan API out of the box
 
how spartan ?
because it would only need to cover what ext/standard does for strings to be useful for most people
 
9:47 PM
doing that properly with Unicode is rather difficult
well, it depends what we want to do for the user
if we just ignore normalisation, then it's easy :p
 
I don't doubt it would be difficult, but it's not much of a moving target, once the initial effort is expended it won't take much to maintain it to a decent standard, arguably less than tracking changes and bugs in a project as large as icu ...
it sounds like I'm arguing for it ... getting the job done is most important whatever ...
 
the problem is stuff like
comparison? requires ICU. indexing? requires ICU. substring lookup? requires ICU. conversion between upper and lower case? probably requires ICU or mbstring.
ah, no, it requires ICU
$ php -r 'var_dump(mb_strtoupper("ß", "UTF-8"));'
string(2) "ß"
good job mbstring, well done, 10/10
 
ok then, just use ICU :D
 
anyone got any good references or chat groups to build out full fledge chat app?
 
10:01 PM
@Andrea I'm not sure whether to capitalize ß at all (by a SS), ever…
 
@bwoebi Switzerland is its own place :p
but the worrying thing here is it suggests mbstring doesn't obey the Unicode standard
 
ThW
Here is no uppercase ß
 
oh there is now\
ß→ẞ
 
@Andrea wtf
And what's the optical difference here? 10% more space between the strokes on both sides?
 
10:09 PM
@bwoebi I think it's more noticeably different in different fonts
 
@Andrea I see not much more difference in other fonts
(at least for these which support that capital ß glyph)
 
Anonymous
10:34 PM
Noight o/
 
Does anyone have any recommendations for tools for seeing what is consuming memory in long running apps?
 
11:13 PM
@Danack Thanks for the gist!
and controller
 
np.
 
@Danack what os?
I really like monit mmonit.com
It can even handle restarting processes
 
osx....but I meant inside a php application that is running up against the PHP memory limit.
 
oh. hmm
 
uh.. I'm trying to write a test
but I keep getting constants are already defined error
I see that I should be leveraging setUp() and tearDown() but I couldn't make it work yet
goes to prepare gist
 
11:22 PM
Is the code online?
 
@Danack uh … looking at which big allocations we have and figure out where these are stored… at the C level… :-D apart from that, I must say that I'm quite sorry…
 
@bwoebi The memory management and ability to trace it is something that could do with some love at some point.
 
@Danack yeah, phpdbg has the foundations already (binary tree impl for storing allocations & wraps emalloc()/efree()) … just needs the tooling for users.
 
here is the class and lexicon.php where I have the constants - and this is my last try on the test - and the data_provider file is here
I don't really trust myself at all on anything I do regarding this test
 
A 1.5 mb PHP file.... wew lad
 
11:31 PM
eih yes... I know
 
@Ekin you don't show where lexicon.php is being loaded.....presumably it's being loaded more than once, by accident.
 
hmm, the only way I use the lexicon.php is:
class BrillTagger
{
private $dictionary = LEXICON;
....
}
oh wait!
 
@Ekin ....k - but where is lexicon.php loaded? it's not in the file you linked.
 
I forgot to remove an include() that I used for a very quick test :(
duh.......
 
\o/
 
11:35 PM
although now the test fails but at least it runs okay
partial success \o/
thank you @Danack I wouldn't realize this if you didn't ask me that :-)
...it could've taken hours before I see I forgot the include
 
hmm
 
:D
 
did someone make a properties trait yet
 
Wes
\o
 
11:38 PM
ooh someone did
 
o/
\o/ now the test passes too, great
 
trait Properties {
    function __get(string $name) {
        if (\method_exists($this, "get$name")) {
            return $this->{"get$name"}();
        }
    }
    function __set(string $name, $value): void {
        if (\method_exists($this, "set$name")) {
            $this->{"set$name"}();
        }
    }
    function __isset(string $name): bool {
        return \property_exists($this, $name) || \method_exists($this, "get$name");
    }
    function __unset(string $name): void {
        throw new \RuntimeException("nope");
maybe we should implement that in core
 
Wes
evenings
omg your avatars are beautiful :B
 
11:54 PM
:D indeed they are, well done Wes
hmm... BrillTagger vs brill-tagger - the results are very close (4-3)
the 2nd one feels like a good option to keep it same for both github & packagist, as on the latter I need to use it lowercase anyways
 
Can I do something like $this->method() inside a method's chain, like ClassName::open( $character )->insert( $hex, $this::method() )->save(); and ClassName::method() ?
 
Wes
i need to convince teresko and danack wear theirs :B
 

« first day (2200 days earlier)      last day (2745 days later) »