« first day (2243 days earlier)      last day (2720 days later) » 

Anonymous
3:00 PM
rfc :P
 
oh :) Dunno since when I can do that. Lemme check
 
@bwoebi session_decode() ?
 
@Leigh Isn't doing what you want
 
Doesn't say so @JayIsTooCommon
 
Anonymous
@PeeHaa well, congrats. You're welcome
 
3:01 PM
:P
 
@Leigh it populates $_SESSION directly (which may be unwanted as e.g. destroys references for later access)
 
@JayIsTooCommon If I had to guess it's about 3 years
 
@Leigh It'd be nice if session_decode() would just return a simple array, but…
 
Anonymous
@PeeHaa I think you're a bit cooler now.
 
You don't ever need to decode it anyway.

In SessionHandler::write - ignore $session_data, get what you need from $_SESSION, store it in whatever schema, format, location you want.

In SessionHandler::read - get the data, populate $_SESSION with it, and return session_encode() - it populates $_SESSION twice with the same data, but you absolutely can currently store in custom formats in userland today, using SessionHandler
 
3:05 PM
@PeeHaa why is github.com/PeeHaa/AsyncTwitter not working?
 
@iroegbu It's not?
That should totally work
 
Don't mind me... Just can't find any documentation
 
@Leigh hmm… ok
 
@Leigh that's the example I provided on ML too btw
 
Just so much timeouts
 
3:06 PM
Everything implemented is in /examples
 
I stopped reading the ML pretty early on :/
 
plus most people customizing this shit want to store in some particular storage anyway
 
@iroegbu Fix your internet / pay your bills :)
 
Haha!
 
@Ocramius yep … makes no sense to store encrypted sessions locally anyway… if you can read the local session files, you can also read the local keys
 
3:07 PM
Honestly, I've never really used SessionHandler much, when I've wanted something custom, I've written it from scratch.
Then I go around injecting my Session object into stuff, because you know, superglobals
 
For my current projects, I don't use ext/session at all, but for those where I do, I usually just throw in a Zend\Session\SaveHandler\DbTableGateway
 
Regulatory body in my country attempted to force companies to increase internet bill... Shit people
 
had to do it last time because filesystem was unstable on a shared environment (!!!) enforced by the client (!!!)
 
@Leigh but uh… I wish the API wouldn't be that shit that everyone rewrites it and builds weird wrappers around…
 
@Ocramius Typo: ex-client
 
3:10 PM
Nah, they pay well
 
:)
 
What's happening here is what we call shoehorning. Write ext/session2 and leave this one to rot.
 
@Ocramius get some non-bullshitty well paying clients instead :-)
@Leigh YES.
 
@Leigh USERLAND PLEASE!!!1
Unless C can do some magic about I/O, I'm sick of dealing with internals magic pixies
 
But serious @iroegbu if you have an issue I am willing to check it out
 
3:11 PM
@Ocramius Well, C can make a superglobal…
 
@bwoebi oh, you youngsters... keep dreaming :D
@bwoebi LOL
don't want
 
=D
 
@PeeHaa No, I've not seen any issues yet...
 
I don't think there's anything in the current ext/session that can't be written in userland
 
Anonymous
@iroegbu apart from the author..
 
3:12 PM
:D
 
46 secs ago, by bwoebi
@Ocramius Well, C can make a superglobal…
 
@Leigh only the fact that the superglobal exists, but I would argue that that's a negative score
(as in "leaks in every scope")
 
Wes
@bwoebi that's mandatory
... :B
 
@Ocramius direct session access is fine if it's only in a few places… but as the application gets bigger…………
 
@bwoebi Meh, $GLOBALS['_SESSION']
 
3:14 PM
I'd tell you to stop writing to sessions from outside the http layer :P
 
just have to change how you access it :)
 
@Ocramius I say fine and mean "acceptable" … i.e. there's no "good" about it.
@Leigh yay :-P
 
Let's say I have a Daemon, written in PHP, that needs to poll a MySQL database every X minutes. What's the max amount of time I SHOULD keep the connection open before closing it and creating a new one?
 
@Ocramius PSR-Sessions?
 
@bassxzero what about indefinitely?
 
3:16 PM
@Ocramius Not being able to revoke sessions is a big disadvantage. But you can as well store a timestamp and reject all sessions before XY in case you have to revoke all sessions.
 
@kelunik meh, @Ocramius always uses JWT, you don't remember?
 
@LeviMorrison it's a wrapper for PSR-7 middlewares. I use it a lot because it mixes well with expressive (current framework of choice)
@kelunik that's in the documented limitations
Also, I don't need to revoke sessions: I just need to revoke github tokens
(current app)
 
@bwoebi so just limit it to the MySQL_MAX_CONNETION_TIME?
 
@Ocramius I know.
 
Rather than a "session interface" we just need a solid distributed key-value store interface right?
 
3:19 PM
@bassxzero the internal timeout gets reset each time you have activity. If you poll every few mins, no need to ever close that
 
I think we have several, you know memcached, redis, postgresql
 
@Ocramius You need to if you accidentally leak all session cookies.
 
@bwoebi ah thank you
 
@kelunik if I leak session cookies, I change the private signing key
 
@Leigh I think... I think you missed the point :D
 
3:20 PM
@LeviMorrison You need locking as well.
@Ocramius Yes, indeed, that works as well.
 
I thought the revoke thing was for like.. "you're logged in from these locations, remotely log them out"
 
@kelunik True. Distributed locks are a thing though.
 
@LeviMorrison You don't need distributed locks as long as you use sharding for sessions.
 
They definitely are, used to use them myself in crawlers for sites that required authentication. Set a lock in Redis while the session was negotiated so two crawlers don't try and log in at the same time
 
I might start recommending it to people, who want a general purpose framework, if the author drops the claim "mvc framework" from the tagline.
 
3:29 PM
I need to read through it, but looks neat at first glance
 
People still writing their own routers :(
 
I exited out of there as soon as I saw class UserList extends Controller
 
a bit meh about psr-7 support, but maybe I missed it
 
And why do framework authors think that they need to handle my business logic/persistence?
 
@Ocramius I'm not sure whether no PSR-7 isn't actually a plus.
 
3:32 PM
It's a definite minus. I rely on that interop a lot
same goes for the DIC
although easier to wrap/adapt
 
Anonymous
@tereško refreshing
 
@Ocramius yeah, but you are a non-standard case even in this chat room
 
I'm aware
 
@tereško A generic event registering class…
 
Some bits that make me screw up my face in the Encryption areas
 
3:37 PM
Can we please stop using this anti-pattern of defacto global custom event registering objects?
 
Anonymous
@Leigh send us a pic
 
@Patrick where?
 
I think we need a new PSR that simply bootstraps ini_get("mbstring.func_overload") == 0 || die('Fuck off');
 
@Patrick extends Controller?! o_O
@Leigh does that need a formal PSR even?
just add that to the bylaws "possible mbstring.func_overload == 1 configurations SHALL be ignored"
 
3:42 PM
This poor opulence guy has got mb_substr(..., '8bit') all over the place
 
ugh
 
Catering for insanity perpetuates insanity :/
 
@Leigh can probably write a composer pre-install step for it
 
Personally I'll just not cater for it in my projects, and if stuff fails because of it, I don't care
 
@tereško its routing syntax looks like Laravel framework .. also, take a look at this .. seems nice too
 
3:54 PM
 
:D
 
@Shafizadeh lol, no. I have looked enough into Lumen to know that is bad.
@iroegbu I rescind my tentative endorsement
@MadaraUchiha cold you please remove all traces of chat.stackoverflow.com/transcript/message/34442394#34442394 ?
 
I assume nobody ever needed to print something from php?
1 hour ago, by PeeHaa
Unrelated; anybody successfully printed something using php?
halp/urgent/quick/naow
 
@PeeHaa I have
 
How does it work? And how bad is it going to be?
 
3:59 PM
@PeeHaa you need to print it where
 
@PeeHaa old company moved pdfs into a folder where the printer was grabbing it from (I think)
 
on the client side or on the server side?
 
@tereško server
@Patrick And now I have two problems :P
 
it worked... unless you wanted to cancel the printing process :D
 
@PeeHaa just send PDF to CUPS
 
4:00 PM
I don't care about cancelling prints
!!? cups printing
 
Search for "cups printing" (https://www.google.com/search?q=cups+printing&lr=lang_en)
• Cups - CUPS is based on the emerging RFC based standard 'Internet Printing Protocol' (IPP) and on the verg… (https://www.cups.org/)
• 4. Configuring Printers on the CUPS Print Server… - After the CUPS system has been installed and configured, the administrator can begin configuring th… (https://www.freebsd.org/doc/en/articles/cups/printing-cups-configuring-printers.html)
• CUPS - Print Server - Official Ubuntu Documentati… - The primary mechanism for Ubuntu printing and print services is the Common UNIX
 
1 message moved to bin
 
So basically I have to do exec magic
 
yes
 
4:01 PM
oh well
 
it shouldn't be that bad - you will just need to make sure that php is not running using "nobody" account and give access for that user to the CUPS processes
 
Well give it a try tomorrow and see how fast I will start crying
 
Setting up a bunch of different virtual hosts, reckon it's going too far if I assign individual user groups to website directories so I can configure which ssh users have access to which sites?
 
Depends on who those users are
And what kind of server it is
 
colleagues. All developers are to have access to our production servers via SSH. It took me long enough to push that I want it locked down if needed
 
4:08 PM
@tereško what's wrong with that?
 
Unless they are interns I envision it biting you in the arse locking them out
 
Anonymous
^
 
Fair enough :p Maybe I'm just a little bit paranoid
 
If you have reason to be paranoid why the hell do they have access at all
 
@Linus it's a bad idea
 
4:12 PM
It's beer tmie
o/
 
Anonymous
\o
 
I am trying to spend less money .. so no beer for me
 
When I get back expect shouting and stuff like that
 
@tereško ah ok if you say so..
 
4:24 PM
Damn, that opulencephp framework looks neat
> Note: Although similar in concept, Opulence's sessions do not use PHP's built-in $_SESSION functionality because it is awful.
 
He probably should have asked for comments before going 1.0 though. He's doing some pointless shit with his encryption, but would be a BC break to change now
Also, I'm too lazy to make an issue/essay about it
 
Anonymous
refreshing to see something that's not a complete mess though
 
0/10 doesn't use Auryn
 
He's basically doing something like
base64_encode(json_encode([
    'iv' => base64_encode('binary_data'),
    'salt' => base64_encode('binary_data'),
    'value' => 'binary_data'
]));
 
Anonymous
4:32 PM
issue it issue it issue it
 
Nah, it doesn't fundamentally weaken anything, it's just stupid
And he's 1.0 now, don't want to be breaking peoples encrypted data :P
 
@Sean hehe
 
@Leigh lol
@Leigh it sortof makes sense
 
moving that outer b64 around the actual ciphertext value would make sense
 
what would make even more sense is not using json
 
4:44 PM
He's using it for his session serialiser, so I'm letting him off that one
but sure, binary format all the way
 
and why does this need a salt?
 
ah because he's doing (a pointless) key derivation to generate separate encryption and hmac keys
 
using pbkdf2?
 
that's not his actual data structure, there's more to it than that, I cut it down to demonstrate the encoding issue
yea pbkdf2
 
eh, just send a link
or tell me how this is authenticated ^^ at which point is the hmac applied and how is that stored?
 
4:47 PM
Not saying the KDF on the key is pointless, just saying generating separate keys for aes and hmac-sha-512 doesn't give a benefit
ahah, well, I'd like to tell you the json is hashed, but no, it's a custom combination of parameters before encoding
 
good morning/midday all
 
I just noticed he's doing serialise($data) too... and data is typed as string
 
@Leigh So basically, this data is quadruply-encoded? ^^
Or quintuply, if you count the encryption itseld :P
 
quintuply if we call encryption a form of ... beat me,
 
@Leigh well, encryption is indeed a form of encoding…
 
4:55 PM
Sure, cryptographically secure encoding, but I don't use the words interchangeably
Actually, no, only quadruple, because the ciphertext is the only binary field not b64 encoded
 
@Leigh ...
how does this not blow up?
 
json_encode takes care of it by escaping everything I guess :)
 
json_encode only supports UTF-8
...right?
It should be erroring all the time due to invalid encoding
 
iunno, I've never tried this
 
@Leigh Um, you do know that openssl_encrypt returns base64 by default?
 
4:59 PM
wat?
TIL
 
@NikiC Yes.
 
We need to fix our openssl shit
 
you can't say shit
shit is a shitty word to use, so for shit sake don't say shit, you shithead
 
@Leigh btw, this is why I was using mcrypt for a long time
 
5:02 PM
I tried openssl_encrypt and it was giving me "garbage data", because I was, obviously, viewing it as hex
 
I probably knew at one point and forgot, mainly use openssl for pubkey these days
 
@NikiC your hex viewer isn't showing you the ASCII version next to the hex data?
 
@bwoebi bin2hex doesn't ^^
 
Thanks to @nikita_ppv for making the #Opulence session garbage collection faster as well as helping optimize the PSR-4 autoloading.
 
@NikiC oh okay
 
5:06 PM
All Nikita's fault
 
@NikiC though bin2hex is annoying to analyze… not even spaces between every byte…^^
 
needs more params? bin2hex($data, $spaceBetweenBytes, $wrapOctets, $offsetsInGutter)
 
lol
@Leigh join(" ", str_split(bin2hex($data), 2)) works too^^
 
oldskool, not even implode/explode
I guess explode doesn't work on 2 char intervals though
 
@Leigh explode only works if you have some separator…
 
5:09 PM
but join instead of implode :p
 
yea^^
@Leigh it's a few chars less
using implode() in my "real" code though
 
@Leigh wordwrap(bin2hex($data), 16, "\n", true);
 
I'm sure we could come up with a regex to do this for us
 
@Leigh sure
 
Would make a pretty nice codegolf challenge actually, hex pretty printer
 
5:12 PM
@Leigh go ahead (ppcg.SE)
 
something something, now you have 2 problems.
 
I've already done some pretty horrific stuff on codegolf.se
 
@Leigh You'll always find someone with a more terrifying solution…
 
Always a good feeling when something gets fixed
@Leigh that looks like fun
 
5:18 PM
Print a christmas tree using as few characters as possible
 
There's got to be an xmas tree unicode char?
 
haha
 
holy crap, someone did a Whitespace program
It has to have an asterisk at the top and made with rows of 0. Has to be at least ten rows tall.
another person did T-SQL
lol
 
hello @Tiffany
 
hello @rabbitguy
 
5:22 PM
yay! the room is now officially crazy :P
 
should I commit composer.lock as well? cc @PeeHaa / @DaveRandom I ran update aaand there are new stuff. can omit
 
!!cat
!!dog
!!dad
 
I just watched a program about beavers It was the best dam program I've ever seen
 
Pretty sure that crazy phase where people committed composer.lock is over
 
> (Line break after main(...){ only for better readability.)
lol
 
5:23 PM
@Leigh committing it for apps is fine…
 
well, Jeeves has it :)
 
there ought to be a !!cat and !!dog command
 
@bwoebi s/fine/required/
 
as for what they return... I dunno. maybe something like dadjoke, and pick something random from a list.
 
how did the cook get to his job at the chinese restaurant?
he used the side-wok
 
5:26 PM
Can someone point me to some code to how to check if a zval contains an object that is a class of particular type?
 
oh dadjokes
 
yesterday I ate two strings. Today they came out together, I shit you knot!
 
@Ekin For an application yes, for a library no
(IMO)
 
if it's a standalone lib?
I mean, not to be used within a project that already (possiibly) have a lock file
though this is some extra question, mainly I asked that for changelog fix @DaveRandom
 
@Ekin when you do composer install, the composer.lock file of any installed packages are ignored
 
5:33 PM
right yes
 
the dependencies are based on whether a resolvable set of dependencies can be generated from the composer.json files only
 
@Ekin at the risk of seeming to just disagree with Dave constantly - adding it for libraries allows people to test against the exact versions you are testing against.
 
thus (IMO) you want to commit the composer.lock of the top-level project, the thing that stands as an app in it's own right
But not the "sub-projects", because you want to be able to e.g. run tests against the latest versions of your deps
@Danack This is true, but what's more relevant (IMO) is to run tests against the latest compatible (according to composer.json specs) versions, because that's what composer will actually install
IMHO, YMMV, WTF, BBQ
Slippery when wet, fire kills children, other warnings and disclaimers
 
@Danack I think you'll find it's ignored in libraries
 
I assume he meant they could run the lib test suite
 
5:37 PM
Right
 
I'm always interested in anything @Danack has to say about composer though because he definitely knows more about it than I do.
 
Current projet status: imgur.com/gallery/8vbMF
 
Well, imho if you find a specific version breaks your build, fix it or pin it in composer.json
 
picdescbot is not doing very well today.
 
5:50 PM
@Danack Maybe via instanceof_function with the help of Z_OBJCE_P?
 
ta
 
6:01 PM
What do you guys do to manage all the passwords you need to create when setting up a VM? I use SSH auth to get into the VM but for stuff like MySQL root user I need strong passwords
 
Mornings
 
morning PeeHaa
 
I need to make a gist with pseudocode classes for my shadow class hierarchy/primitive classes idea
hmm
 
@ibanore keepass
@Ekin I always commit my lock file. At the very least it provides a baseline and it can always be updated if needed
 
6:19 PM
What's the best implementation to have a php script write a log file? What I currently have in place has me very uneasy.
and goddammit it's past noon again
 
I see, thanks for the insights @_all
 
Hey Germans, question, is Church Tax a mandatory tax?
 
church tax? o_o
 
@Leigh Is that the one where you have to give up your first born son or is that just for Catholics?
 
No it's the one where you have to pay like 8% of your income
 
6:22 PM
A church tax is a tax imposed on members of some religious congregations in Austria, Denmark, Finland, Germany, Iceland, Italy, Sweden, some parts of Switzerland and several other countries. == Austria == Every recognized religious group in Austria can collect church tax at a rate of 1.1%, though currently only the Catholic Church makes use of that opportunity. Church tax is compulsory for Catholics in Austria. This tax was introduced by Adolf Hitler in 1939. After World War II, the tax was retained in order to keep the Church independent of political powers. == Croatia == The Roman Cat...
 
!!? Church Tax
 
Search for "Church Tax" (https://www.google.com/search?q=Church+Tax&lr=lang_en)
• Church tax - Wikipedia - A church tax is a tax imposed on members of some religious congregations in Austria, Denmark, Finla… (https://en.wikipedia.org/wiki/Church_tax)
• Churches and Taxes - ProCon.org - Should churches, temples, mosques, synagogues, etc remain tax-exempt? (http://churchesandtaxes.procon.org/)
• 10 Facts about German Church Tax | myGermanExpert… - The German church tax — which is 8 to 9 percent of the annual income tax — is so steep, however, th… (http://blog.mygermanexpert.com/2013/06/10-Fac
 
:P
 
ty :P
 
I PR'ed changelog fix now, but did I do bad keeping this in plugin file?
 
6:23 PM
seems to say that it's only required by church-going people
 
Was just reading the pr
@Ekin yes you did, but sadly it's the best we can do for now
 
alright
 
We still have no sane way of splitting up stuff into separate files which is terrible :(
 
I also removed that commit from the other PR, which I plan to clear up tonight
 
Cool
 
6:25 PM
Ooo, hacktoberfest tee arrived :o
 
it did? so they started sending out
how nice :-)
 
Is the only way that's going to be falsy when you set it to false yourself?
 
on spot, I was in doubt about that line
 
before, that line was just casting it to string @PeeHaa. It gets sha from api.github.com/repos/ekinhbayar/jeeves/git/refs/heads/fix/…
 
6:28 PM
Do you always get that back. Or can you get back something incomplete?
 
in case you typo and ask for, say changelow, you get no sha in json api.github.com/repos/ekinhbayar/jeeves/git/refs/heads/fix/…
 
tnx
 
In a framework very similar to Laravel is it better to store view links for CSS and JS in a PHP array or in the database? When I say better i mean in terms of performance and code maintenance. Not sure if it matters, but the database and web server are on the same machine and I'm using "localhost" in my connection string. I'm not sure how it's implemented, but I would think there are optimizations for localhost requests.
 
I could do ?? "" too, I guess
 
@PeeHaa Thanks
 
yep, was on it now
 
It is always a commit you get back right?
Or can tags etc also show up instead?
 
nah, just the last commit
from either master or a specific branch
 
kk
 
@Sean nice :)
 
6:37 PM
@Leigh TIL
Also TIL a lot of countries do something like that
 
Yea was just talking to someone about Merkels announcements, and how all of Germany's politics is still rooted in religion
Wasn't sure if everyone had to pay it, but apparently you can opt out by officially renouncing your faith :p
 
Making a religious decision was never so easy :D
 
8-9% of income, think how many bibles you could buy with that instead
 
/me waits
 
6:40 PM
That ^ one actually responds with a 404 like it should
It's probably cleaner to check against the status code
 
I do that too
 
oh I see
Sorry. Carry on
@Leigh bibles and blackjack and hookers
Not sure if troll or just regular wtf
@Ekin did you play dead island on the laptop yet?
 
nope :( did you @JayIsTooCommon?
oh lol
we have a problem :D
you merged it rite
 
uuuhhhhm maybe :P
 
catchable fatal error is back with that change
 
6:53 PM
When I hit enter it is done :P
oh :D
 
somehow the $sha still escape and return a Deferred
 
escape?
!!en escape
 
escape (translated from English)
 
:P
if (!isset($commit['object'])) { -> if (!isset($commit['object']['sha'])) {?
 
sorry nevermind above said, I mean I get Object of class Amp\Deferred could not be converted to string on line 81 again
yeah might do
 
6:56 PM
Can you confirm?
Also sorry for being trigger happy like that :P
 
testing 1sec
heh I missed it as well ^^
yep, works
 
I blame @DaveRandom fwiw
Push to master please <3
!!uptime
 
@PeeHaa I have been running for 1 day, 23 hours, 55 minutes and 47 seconds, since 2016-12-04 19:03:10
 

« first day (2243 days earlier)      last day (2720 days later) »