« first day (2236 days earlier)      last day (2728 days later) » 

Wes
12:00 AM
i suck at testing. i can't be concise. in my mind testing means all combinations :B so i end up with shit like this github.com/Netmosfera/Symbola/blob/master/test/GetTest/…
:B:B:B
 
@Wes what... is.. this?
 
Wes
tests method visibility @FélixGagnon-Grenier
i should improve the readme... github.com/Netmosfera/Symbola
 
@Wes why are you testing that?
 
Wes
@bwoebi because i couldn't find a way to reuse php's own visibility/inheritance checks
 
@Wes no, why are you testing that at all?
 
Wes
12:04 AM
because i'm generating stuff on the fly. check the code :B
i don't remember anything about that, except that i tried everything to tune is_callable to work like i wanted, but it was impossible, so i had to reimplement all the things
what i tried was function($x){ return is_callable($x); }->bindTo(..., 'ActualScopeIWantedToCheck')->__invoke() but i don't remember why it didn't work
 
 
1 hour later…
1:33 AM
wake up everyone
I am here
 
 
2 hours later…
3:59 AM
morning morning
 
4:30 AM
morning
 
o/
 
4:43 AM
morning \o
 
5:04 AM
Hi , I want to upload image from pc in ckeditor .
How can I do it ?
 
anyone here good with symfony?
 
5:32 AM
moin
 
morning Joe
 
6:17 AM
\o
 
6:40 AM
@DaveRandom I had serious problems spotting that 38 on my 4k screen. I had to stand up and look at a sharp angle from the top to see it. Could see immediately on the thinkpad's built-in screen though.
 
6:52 AM
o/
 
7:04 AM
can anyone help with algorithm problem?
 
Morning
 
yo Pointer o/
 
Yoyo Anmol \o
 
I went for a trip and I keep taking pictures . After every picture I will mark if the picture is good or bad . After going to home I want to see all the pictures in the following way -



1. Get the picture taken after picture x .

2. Get the next good picture take after time "t" .

If you need to make an app how would you do this so that if is efficient in terms of space and time
can anyone tell approach to solve this
 
7:22 AM
1. picture[x+1]
2. while (picture[++i].quality != "good");
picture[i]
 
@littlepootis
you are not considering time "t"
so array won't help i think
 
while (picture[++1].time < t);
while (picture[++i].quality != "good");
picture[i]
assuming they're sorted by time.
 
 
7:55 AM
Am I doing something wrong or is the -z option of the CLI SAPI broken? gist.github.com/sebastianbergmann/…
 
8:11 AM
@SebastianBergmann have you tried with an absolute path?
The -z flag will pass the file argument to zend_load_extension(const char *path)
 
o/ @Gordon
 
@Duikboot yes? you pinged?
 
morngins o/
 
I hate the winter
 
8:21 AM
@SebastianBergmann -v is evaluated before -z so it won't show the loaded extension
 
@Wes I think somebody PRed it into intervalparser
 
@Gordon How confusing is that? Thanks!
 
@SebastianBergmann very confusing indeed. you are welcome.
 
gut moaning!
 
Only two days left to nominate passbolt (and your other favorite projects) to @mozilla MOSS! #fundopensource https://www.mozilla.org/en-US/moss/secure-open-source/
@DaveRandom I will nominate PHP today.
 
8:24 AM
@Gordon Still does not work, though. Created a script with phpinfo() in it and "php -z opcache.so phpinfo.php" does not show OpCache in phpinfo() output.
 
<headache = true>
 
@SebastianBergmann when you say opcache.so you meant ./opcache.x.y.z.so?
 
@SebastianBergmann Isn't that because opcache is disabled by default?
/ can you try passing the ini settings to enable it on cli
 
yeah, you might need to add -d opcache.whateverisit = 1
 
enable_cli iirc
!!docs opcache.enable_cli
 
8:32 AM
[ opcache_compile_file() ] Compiles and caches a PHP script without executing it
 
How can I print in *for* loop which iteration is currently running?
 
Anonymous
This guy and his tweets twitter.com/ericbristow
 
Anonymous
what a prick
 
Anonymous
Mornin o/
 
8:33 AM
tnx
Also guesswork++
Morning jay
 
@PeeHaa No, that is not it. The extension always shows up in phpinfo() even if it is disabled.
 
That's true, but that should mean you get startup errors otherwise
If it cannot load the extension that is
 
gooh@gooh-ThinkPad-X250:~$ php -r "phpinfo();" | grep opcache
/etc/php/7.0/cli/conf.d/10-opcache.ini,
opcache.blacklist_filename => no value => no value
opcache.consistency_checks => 0 => 0
opcache.dups_fix => Off => Off
opcache.enable => On => On
opcache.enable_cli => Off => Off
@PeeHaa should show even when disabled for cli
I don't have a php without opcache at hand, so i cannot test the -z flag
 
Use -n to ignore your ini?
 
good idea
 
8:39 AM
No INI to ignore
 
And that is without coffee
 
Anyways, time for real work. Thanks.
 
php -n -z /usr/lib/php/20151012/opcache.so -r "phpinfo();" | grep opcache no output :(
 
@Gordon And what happens if you pass the ini settings for shits and giggles?
brb grabbing coffee
 
php -n -z /usr/lib/php/20151012/opcache.so -d opcache.enable_cli=1 -r "phpinfo();" | grep opcache- still nothing
 
8:43 AM
Maybe it's just not possible because opcache does crazy things
Not sure if by design or broken
 
php -n -d zend_extension=/usr/lib/php/20151012/opcache.so -d opcache.enable_cli=1  -r "phpinfo();" | grep opcache
works /cc @PeeHaa @SebastianBergmann
 
Got it execute php file in terminal and echo counter it will print current loop
 
@Gordon wat
I always thought that was exactly what -z did :P
 
php -n -d zend_extension=/usr/lib/php/20151012/opcache.so -d opcache.enable_cli=1  -v
works, too
 
\o/
@Gordon is great and does all the things
 
8:47 AM
PHP. It's dynomite
it makes no sense that it works with -v
where the hell does it apply the -d flag? I cannot find it in cli.c
 
Anonymous
!!wotd
 
quinquennium: a period of five years.
 
@Jeeves I'll use this as an interview question: "where do you see yourself in a quinquennium?" If the applicant doesn't know what a quinquennium is, he is not hired.
 
:P
!!dad
 
Dad, did you get a haircut? No I got them all cut
 
8:58 AM
summary of SQL-related news for autumn of 2016: use-the-index-luke.com/blog/2016-11/big-news-in-databases
 
o/ mornin tereško
 
yo
 
9:21 AM
How to get the number of rows in a table:
eg. <?php try{ $stmt=$dbh->prepare("SELECT * FROM users"); $stmt->execute(); $users= $stmt->rowcount(); echo $users." users found"; } catch(PDOexception $ex){ echo "Error :" .$ex->getMessage(); } ?>Masivuye Cokile 1 min ago
 
o/ all
 
@MasivuyeCokile you probably should stop spreading the stupid. — tereško 25 secs ago
 
@pmmaga o/
@tereško That got deleted fast :P
 
@PeeHaa SO is a "safe space" now
I wouldn't be all that surprised, if soon someone floats an idea to remove ability to close questions, because it is "marginalizing reputationally disadvantaged"
 
9:39 AM
Close it while will still can :)
 
@MadaraUchiha why was my NAA flags on stackoverflow.com/questions/3522454/java-tree-data-structure/… and stackoverflow.com/questions/3522454/java-tree-data-structure/… disputed? The answers have no relevant content when you strip away the links.
 
@Gordon Disputed by Community
a.k.a. from Review.
 
ah. so obviously mistakes. thanks for clarifying.
it sucks that I cannot delete at my own discretion anymore although I was trusted to be able to delete at my own discretion
 
@tereško Nice! Wouldn't I need a special kind of optical drive to be able to use the slot at the top? Never seen anything like that before
 
@PeeHaa this ruined my morning
 
9:53 AM
yw :)
 
@kelunik nominated keepass
@Gordon awwwwww
 
@Gordon yes it's a test of the viewing angle of your LCD more than anything else
 
@DaveRandom at first I thought it was a joke and there is nothing to see
 
@kelunik well that is serendipitous :-)
We need to be able to present them with bug reports I think
 
@DaveRandom Why?
 
> Please give pointers to advisories or other documentation for any recent security bugs that have been found in the project.
(just looking at the submission form)
I mean I'm looking at the selection criteria, I think PHP is an obvious candidate, maybe they will not need that
but still "zomg so many bugs" isn't really a description of the problem
 
It's not like they are hard to find/share cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 :P
 
Yeh but there are a number of specific and as yet unreported (because we are still determining the scope in some cases) issues in ext/openssl in particular
@kelunik in fact I'm going to create some bugs
 
Is that actually in ext/openssl or libopenssl?
 
10:19 AM
No it's us
 
poop
 
yup
 
@tereško So I've been looking at some posts, this guy got a 1080 Hybrid and two coolers in there (I'm guessing one for CPU and one for GPU). Good temps too :-) Looks messy as fuck though! If I buy this, would you mind advising me on mobo + psu choices?
 
@DaveRandom Tomorrow is the current deadline, next one will be in three months.
Please give pointers to advisories or other documentation for any recent security bugs that have been found in the project. > We can just link to the release notes of the most recent versions.
@DaveRandom We need to fix MD5 certificates ASAP for all supported versions.
 
  --enable-the-force      enable if you are Luke Skywalker and the force is
                          with you [default=no]
 
10:23 AM
@kelunik I will create some bugs for the four distinct issues I currently know about - default stream ctx, support for insecure cert algorithms (i.e. RFC), incorrect chain depth checking, inconsistent frees at return
 
genuinely I've just found that as a configure option in something ...
 
user895378
wow
 
@rdlowrey morning
 
Anonymous
@Gordon again, I wouldn't get any work done :P
 
user895378
@kelunik hiya
 
10:24 AM
in fact can you create a bug corresponding to the RFC @kelunik
I'm still not clear on the correct terminology there
 
user895378
hola @DaveRandom too
 
yo o/
 
@rdlowrey Yes, you fixed some things for TLS in PHP for 5.6, but it's still horrible insecure. And WordPress does updates via HTTPS without digital signatures...
 
user895378
sorry for not responding on ext/openssl questions
 
no worries, I know you're busy much like myself :-)
Holidays coming up plus your country is on fire
 
user895378
10:25 AM
it's true. United States of Trump
 
user895378
I have to sincerely apologize for all the Brexit jokes I made.
 
@rdlowrey You may or may not be aware of this, in the UK "trump" is a children's slang for fart. I have been somewhat amused every single time I see his name.
 
:D
 
user895378
I was not aware. This is glorious news.
 
@DaveRandom We need a "cloud" browser plugin for trump ;)
 
10:28 AM
to... Hitler?
 
Also later today I'm going to make a Twitter account that quote-tweets everything he says with a caption of "MEANWHILE, AT THE LEGION OF DOOM". I think it will make it mildly less depressing to keep track of the crazy.
 
user895378
@kelunik Well (1) Fuck wordpress ... (2) What issues?
 
@rdlowrey We still accept certificates using MD5 as the digest algorithm.
 
@rdlowrey We still accept MD5 and SHA1 certs
also we don't check the chain depth correctly
 
user895378
Just because some things are insecure doesn't mean they should go away ... e.g. how do I do penetration testing for things like that if I'm not allowed to accept them
 
user895378
10:29 AM
They shouldn't be defaults but they should probably still be supported
 
user895378
I should be able to use a general purpose scripting language to write malicious tools to do things like that
 
@rdlowrey yes, it's the defaults we are concerned with (and the lack of an option to not accept them)
 
user895378
oh i see
 
no-one is suggesting we don't let you write insecure code on purpose
you just shouldn't be able to do it accidentally, or at least it should be as difficult as reasonably possible
 
user895378
10:30 AM
:thumbs-up:
 
@rdlowrey Hey handsome
 
user895378
o/
 
Anonymous
@PeeHaa hey
 
lol
 
fawn
 
10:32 AM
@JayIsTooCommon is always so jelly
 
user895378
IIRC you can get metadata on the cert signing algo once the connection is established and cease operations in userland. But you can't have php do it for you and fail the connection
 
@rdlowrey my current understanding is that we would need to walk the chain in verify_callback and check the algo of each cert (excl root) based on a stream ctx option
 
@rdlowrey you got the issue ;-)
 
user895378
@DaveRandom that sounds right. In most legitimate cases you'd only have to go a couple of levels as the verify_depth option is going to prevent you from needing to go very far
 
user895378
@kelunik the biggest obstacle to TLS server performance is the inability to share the SSL_CTX (in C land) across different SSL structs as things are currently setup
 
user895378
10:40 AM
we need a new resource to house the SSL_CTX so we can then specify that in a context option for new client connections
 
@rdlowrey Sure, but I don't care about that as long as we anyway don't have OCSP stapling and those security issues.
 
user895378
As for OCSP stapling, there are probably two options ...
 
@rdlowrey See e-mail to Jakub, I think you were in the CC.
 
user895378
1. just accept a file path and a refresh "timeout" ... every n seconds reload the stapled info from the specified path
 
@rdlowrey on the subject of verify_depth... this does not seem right
this is the main thing I wanted your input on in case there was something I don't know
 
user895378
10:42 AM
I don't think anything special is even needed for ocsp stapling ... we could probably just expect a resource in the stream context
 
user895378
and leave it to userland to update that periodically
 
but afaict that will only give you a relevant value if there was actually an error already by that point, i.e. it's checking against the depth of the error, not the general chain depth
 
user895378
php shouldn't go fetch the stapled info automatically ... userland should be in charge of going to retrieve the cert and updating the server's context periodically
 
@rdlowrey Sure, I thought about that. But we accept them by default and have no built-in way to disable that.
 
user895378
@kelunik agree
 
Anonymous
10:44 AM
@PeeHaa Not jealous, just disappointed
 
@rdlowrey there's an inconsistency here as well - the win32 cert store routine does do OCSP stapling because it's built in to the API
 
@DaveRandom @DaveRandom For clients, but not for servers?
 
@JayIsTooCommon C'mon look at the guy
You can't blame me for that
 
@kelunik E_DUNNO
 
user895378
I'm pretty sure it doesn't do it for servers ...
 
10:45 AM
all of this just emphasises the fact that we really need to get some experts involved
 
Anonymous
:P
 
@DaveRandom We only use that API for verification, we don't do that for servers.
 
Well I'm not sure how it works in the context of client certs
moment will see if I can figure that out
 
@rdlowrey Why not automatically?
 
user895378
@kelunik how are you going to do that without blocking?
 
user895378
10:46 AM
it involves an http call
 
^ that
 
user895378
best just to let userland periodically do the fetch and update the server's stream context
 
@rdlowrey Threading. :P
 
hello
everyone
all good?
 
@rdlowrey Probably, yes.
@SagarNaliyapara No, too many TLS stacks are broken.
 
10:49 AM
@rdlowrey how does userland know what to fetch and how often to fetch?
 
@rdlowrey Well, fuck wordpress, but I still care if that allows anyone to compromise 26% of the web.
 
@kelunik Transport Layer Security?
 
@bwoebi It examines the certificate it uses.
@SagarNaliyapara Correct.
 
it's can't be possible, while you are on earth @kelunik
 
@rdlowrey it could in theory be incorporated into enable_crypto() in a non-blocking way
 
user895378
10:51 AM
@bwoebi The URL is specified on the server's certificate
 
@rdlowrey so, complete manual handling… mhm
 
user895378
I honestly think it's easiest to just accept a resource in the stream context for what you want to staple then periodically go and fetch it in userland and assign the resource to the stream context
 
@rdlowrey At the moment I disagree with "easier" because it would require a manual impl at every step. Maybe if we have some useland API where you can pass in an x509 resource (or something).
 
gist: 1084e4be51bcb020f2ee98843b2de83c, 2016-11-29 10:56:23Z
From: ...
To: "sebastian@phpunit.de" <sebastian@phpunit.de>
Subject: sebastianbergmann inside of composer is too long for windows to
 recognise
Date: Tue, 29 Nov 2016 10:45:30 +0000

Dear Mr. Bergmann,

I am one of the many users of the awesome composer feature that is used for=
 development of software. A thing however that I am not first to run into, =
is that your own current package / dependancy is too long for Windows to wo=
rk with. Thus, when updating the composer through composer update, I get th=
e following result:

C:\Users\Gebruiker\Desktop\2e jaar\Database\DataSlechteDatabase\DB-Applicat=
ie>composer update

Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Installing phpunit/php-code-coverage (4.0.3)
    Downloading: 100%

  [ErrorException]
  ZipArchive::extractTo(C:\Users\Gebruiker\Desktop\2e jaar\Database\DataSle=
chteDatabase\DB-Applicatie/vendor/composer/794fbaff/sebastianbergmann-php-c=
ode-coverage-903fd63\tests\_files\Report\HTML\CoverageForClassWithAnonymous=
Functio
  n/source_with_class_and_anonymous_function.php.html): failed to open stre=
am: Invalid argument

update [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--=
lock] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progr=
ess] [--no-suggest] [--with-dependencies] [-v|vv|vvv|--verbose] [-o|--optim=
ize-autoloader] [-a|--classmap-authoritative] [--ignore-platform-reqs] [--p=
refer-stable] [--prefer-lowest] [-i|--interactive] [--root-reqs] [--] [<pac=
kages>]...

C:\Users\Gebruiker\Desktop\2e jaar\Database\DataSlechteDatabase\DB-Applicat=
ie>

I hope that thus this makes sense to you, that this is halting alot of peop=
le. On the internet for example, numerous github forums can be found relate=
d to your package. It is okay, but, it is too long, resulting in a composer=
 update failure.

Sincerely yours,
...
 
10:56 AM
The inherent problem with manual is that most people won't know there's a thing to do/won't bother
 
Does anyone have an idea what that would be about?
 
@DaveRandom we have no way internally to handle non-blocking http reqs though?
 
Sorry, did not want to spam the chat. Just pasted a link to a Gist :-/
 
@SebastianBergmann it's fine ^^
 
user895378
@DaveRandom yeah that's what I'm suggesting ... just saying userland should be in charge of creating that resource and passing it to the stream context once per day (or so) in a server setting
 
10:57 AM
@SebastianBergmann yeh it happens, no worries
@SebastianBergmann Windows has a maximum path length that's not particularly long (96 chars maybe?)#]
 
user895378
@DaveRandom I think that's actually okay ... if you look at one of the examples from openssl here you'll see it's done the same way in the verify callback: code.metager.de/source/xref/OpenSSL/apps/s_cb.c#152
 
i.e. everything including the C:\ and all slashes and file name
 
I guess "Use a real operating system" is not the proper answer here.
 
They reporter's issue is that his base path is far too deeply nested to begin with, but I think it's not necessarily an invalid concern
 
@SebastianBergmann actually, I fear, it is…
 
10:59 AM
However I also think there might be something you can do about it in ZipArchive
although not in userland
 

« first day (2236 days earlier)      last day (2728 days later) »