« first day (2284 days earlier)      last day (2664 days later) » 

5:11 PM
I've never been happy about the API, but it works
 
Also, got userland GCM in my AES repo :)
(and OCB)
 
Wes
evenings
 
@samayo does it work when you just git clone github.com/ngineered/nginx-php-fpm and link your src into the src folder of that repo? the Dockerfile does ADD src/ /var/www/html/ so it tries to copy the content of a src directory of the provided context. the context is the path you specify at the end of the docker run command on the command line
 
@kelunik I really hate that test… it is very sensitive to load on travis.
 
5:17 PM
@Trowski We could just improve it to count ticks manually.
 
@kelunik The test you mean? That might be better.
 
Yes.
 
If you have a better method, please do.
@kelunik I also find this really annoying github.com/amphp/loop/commit/…
But I suppose many cases using that notation can result in a float, so it's probably better that they all are floats.
 
@Trowski The change or that it's that way a float in general?
 
@kelunik That it's a float in general.
The change is just fine, because that's what I intended.
 
5:22 PM
I wanted to improve the error handler to use a default function ($e) { throw $e; }, but that doesn't work with returning the previous handler.
 
@Trowski @kelunik You can write 10**3 and 10**6 instead
If you don't like writing out the number that is
 
@NikiC For numbers that short it's not a big deal… in general I like being able to glance rather than counting zeros.
 
@NikiC We could, but I think we currently support 5.5 for the loop.
 
@kelunik in v2?
 
5:27 PM
@NikiC For the loop yes, everything else will require 7.0.
 
@kelunik wtf
 
@NikiC That way React people can use the loop with the adapter.
 
@Leigh aww but I can't use that to secure nuclear missiles :(
 
Maybe @Trowski just didn't change this, dunno.
 
It has some preferable features to GCM
 
5:29 PM
I'm staying away from GCM :)
 
@kelunik Isn't the loop literally the only thing a react user would not be interested in?
 
@ScottArciszewski I have a working impl. Optimised 8k lookup table per key
 
@NikiC Dunno whether they will run the our loop + adapter or the React loop + adapter for interop libs.
 
heh, I just feel if people really want GCM they should use PHP 7.1 :)
I don't trust myself to implement GCM safely, is all I'm saying
 
@kelunik It does seem rather pointless for the loop to support <7.
 
Wes
5:31 PM
@GrahamJCampbell none of this would even be an issue if people would stop using types 😎😎😎
 
@Trowski Dunno, we don't gain much from 7 there.
A few return type decl. that's all.
 
@kelunik That's true, we would gain essentially nothing.
 
Right, that's why I think it's fine to support 5.5 there, so React people can use it, if they want to.
 
@ScottArciszewski One of the nice things about OCB is that you can continually add AAD while you're encrypting/decrypting
with GCM you have to do it all at the start
 
@kelunik Yeah, I think we discussed it this before and came to the same conclusion.
 
5:34 PM
@CiaranMcNulty @taylorotwell Covariance is already supported in constructors. I don't think there's a strong case for anywhere else.
 
covariance in constructors?
 
^ lol… there's no LSP restrictions at all
 
@Trowski I don't think I discussed that, but it's fine with me. :D
 
@bwoebi The incompetence in that thread is quite staggering
 
@NikiC yep…
 
5:34 PM
People throwing big words like covariance around without having a single clue what they mean
 
Wes
constructors can do anything they want
 
I'm going to vote "no" on the RFC though.
I'm not opposed to it; I'd just rather have something explicit than implicit.
 
@LeviMorrison That's fair enough
 
@LeviMorrison mixed?
 
or any or something like that, yeah.
Making it explicit does not help one of the use-cases mentioned in the current RFC, though.
 
5:36 PM
It was mentioned in the discussion, but the only reaction I got was: No please don't.
 
(Allowing people to add type info to base classes and interfaces without breaking inheritors)
 
@LeviMorrison that'd be a strong reason for me to vote no however…
 
evenin
 
Not having a top type is just really weird and restrictive.
Wish we'd just fix it and move on.
 
@LeviMorrison What does a top type really gain?
 
Wes
5:38 PM
if top type is anything, why name it?
imho it's not needed
 
You mean a top type for classes, or everything ?
 
Wes
everything, primitives, including null
 
Only real benefit I'd see is that you could distinguish the case of "accepts anything" from "php's type system is too weak to type this yet" in the code
 
I get it for classes, i.e. you want to declare something overarching for something reflection based
 
lazy hack: everything extends from MyProject\BaseClass in some way or another
 
5:40 PM
@NikiC Wouldn't making arrays "implement" Iterable or something like that make more sense?
 
checks the "uses dependency injection" box for typehinting that everywhere
 
@NikiC Yes.
 
@MadaraUchiha not sure how that's related
 
And then when you hint Iterable you can also pass arrays?
 
@MadaraUchiha we already have an iterable hint
 
5:41 PM
Instead of doing it the other way around?
@NikiC Which works with arrays?
 
yes
7.1 addition
 
Neat
Then I don't get the point of this RFC
 
which rfc are we talking about right now?
 
@MadaraUchiha It just expands contravariance support on method arguments
 
5:43 PM
Oh, I totally misread that.
 
The main "use case" is adding argument types to existing classes without breaking BC for inheriting classes
 
Welp, if that's not a sign that I'm too tired to keep focus, I don't know what is.
@NikiC That kinda breaks LSP though, doesn't it?
 
Oh hmm, comments seem to indicate it is, "fix versions" seem to indicate it isn't
 
@MadaraUchiha Nope, it complies with LSP
Because the inheriting class accepts "more"
Which is fine
 
5:44 PM
Hmm, right.
 
Wes
@Leigh in progress. it's something :P
 
@NikiC Well, technically not LSP, because the more doesn't have the same behavior. LSP just covers passing subtypes with the same declaration.
 
It's funny how the first few people to notice/report this, are people from this chat, and we didn't know about each others involvement with it
 
@kelunik Yeah but "the child would accept anything the parent accept"
 
Clearly one of the better communities ;)
 
5:46 PM
So it's fine-ish
 
@MadaraUchiha Yes, but that's just contravariance then, no LSP?
 
Probably.
 
@kelunik LSP on the type level = contravariant arguments, covariant returns
 
And I so want covariant returns :/
 
Of course there's more to it semantically, but that's what you usually refer to when talking about LSP wrt method signatures
 
5:48 PM
@NikiC then fix the latter case instead
 
Wes
@Leigh me too :(
 
@Leigh In 8 maybe.
 
@bwoebi I suspect there are an endless number of such cases :D
 
@LeviMorrison it should be trivially fixable with unions, no?
 
@LeviMorrison Well, all we really need are array types, generics, callable types, union types, intersection types, typedefs, ...
3
Ooops :P
 
5:49 PM
:D
 
@NikiC these are just more restrictive variants of already existing types
the only thing which currently cannot be typed at all are unions.
 
@NikiC I think we can combine array types with generics, by just making array generic.
 
@bwoebi Everything is a more restrictive type than no type...
 
no?
 
Okay, last time I'm taking vote here on short closures.
1. fn(plist) => expr   (fn must be a token)
2. ^(plist) => expr
3. |plist| expr
 
5:51 PM
@kelunik The problem is the implementation of array types, not whether it's array<foo> or foo[]
 
@bwoebi both would probably be quite different in behavior though
 
@LeviMorrison you've given it in the right order already. (regarding my preference)
 
For generics I'd expect something that is validated during construction
While for an array type I'd expect something that's validated during argument passing
 
@NikiC well, it's a by-value vs a by-object thing
 
@bwoebi for arrays?
 
5:52 PM
@bwoebi Have run with nested arrays with the latter.
 
@NikiC … nah… nevermind.
@kelunik I see no issue with foo[][]?
 
@LeviMorrison last one is too rusty, I'd be scared to use it
 
@Leigh Nah, man, it's Ruby's syntax which is still hip and cool right?
 
I don't have the moustache to use it...
 
I never liked Ruby syntax.
 
5:54 PM
@LeviMorrison hip and cool HAHAHAHAHAHA
 
Anonymous
@Gordon sorry I was out. I only tried the commands from the docker site but I gave it a try from the github site and I get Unable to evaluate symlinks in docker file
 
But seriously, please cast your vote.
 
to be fair, I think it was rails that was hip and/or cool, not so much ruby
 
1.
 
5:55 PM
@samayo can you try with docker run -it --rm -v $PWD:/var/www/html:ro richarvey/nginx-php-fpm /bin/bash from the directory that has your webroot on the host. this should give you a bash prompt inside the container. /var/www/html in the container should have your local webroot mounted into it, e.g. whatever is $PWD
 
Anonymous
Samayo@DESKTOP-UH14T27 MINGW64 /c/rex
$ docker build -t nginx-php-fpm:latest .
unable to prepare context: unable to evaluate symlinks in Dockerfile path: GetFileAttributesEx C:\rex\...: The system cannot find the file specified.
 
I do not have to work today so I will write the actual RFC. /cc @JoeWatkins @NikiC @rdlowrey @PhpInternals
 
Anonymous
ok
 
Hello guys
$username = filter_var($username, FILTER_SANITIZE_STRING);
    $password = filter_var($password, FILTER_SANITIZE_STRING);

    $query = $connection->prepare("SELECT * FROM clients WHERE username = '$username' AND password = PASSWORD('$password')");
$query->execute();
Guys this is my query, can anyone please tell me how can I bypass my function?
 
@ZahidSaeed "bypass"?
 
5:57 PM
There are 2 input fields on the form
@MadaraUchiha I mean, can I break the security?
and create a session
I'm testing my code
 
@ZahidSaeed Sure
That's not how you prepare statements.
 
And not how you should store passwords.
 
@NikiC regarding your comment here "For DomNodeList in particular the iterator values are DomNodes" - this isn't always the case as you can get instances of DOMNameSpaceNode (which aren't DOMNodes), example
 
And not how you filter data
 
@MadaraUchiha For now can you please tell me what i should I type in username or password field to see how the security gets break
Any idea?
I'm trying to input:
') OR 1=1 --
in the password field but it's not working
 
6:02 PM
@ZahidSaeed In this case (purely by chance) it's not trivial.
If you were to query by a number (no quotes), you'd be exposed.
Read how to properly use prepared statements.
 
@MadaraUchiha I know this is not how we use it
For just for a short demo
 
If you want a demo
Try this one
"SELECT * FROM clients WHERE id = $id"
That is vulnerable to 1; DROP TABLE clients --
 
But can you please try to bypass my query?
I understand what your saying
@MadaraUchiha Any demo please?
 
Anonymous
@Gordon I fixed on issue which was related to sharing (Docker wanted to share drive C:/) now I created folder webroot in C:/ and run your command inside C:/webroot/ but docker is throwing an error
 
Anonymous
It says or thinks /var/www/html should be inside C:/Program Files/Git
 
Anonymous
6:07 PM
I am using Bash as a terminal (actually conemu) but in C:/webroot
 
hmm, sorry. no idea then. might be windows related.
 
Anonymous
No problems. I can almost smell the problem though, seems like a newbie issue
 
Anonymous
Thanks to you, I am one step closer :)
 
Anyone?
 
@LeviMorrison 2, 1, 3
 
Anonymous
6:14 PM
@LeviMorrison I would like to provide/setup a crappy VM for the OpenGork
 
Anonymous
If that was a serious question
 
Can phpDoc export as PDF? I read the old 1.x branch supported that, and the official latest docs mention PDF, but I can't figure out how to get it to do that as there is no other documentation or examples.
 
Wes
phpdoc? also hi \o
 
@samayo I have some crappy VMs and I don't really want to set them up for it ^_^
 
6:30 PM
@PaulCrovella why is it not a domnode? :(
 
hell if I know
 
@MadaraUchiha hey supp man
 
Can anyone please help me out?
 
@NikiC I don't really understand why TSRMLS_D cannot be removed?
 
Just 5 mins please
 
6:32 PM
@ZahidSaeed issue sir
 
@ujwaldhakal Can you please check my question above?
$username = filter_var($username, FILTER_SANITIZE_STRING);
    $password = filter_var($password, FILTER_SANITIZE_STRING);

    $query = $connection->prepare("SELECT * FROM clients WHERE username = '$username' AND password = PASSWORD('$password')");
I have this piece of code
 
@PaulCrovella and where is it in the dom spec? I can't find it
 
I have 2 input fields, 1 for username & other for password
 
@ZahidSaeed burn it
 
What should I typin in either field in order to bypass it
I just want to see a short demo
I know it's not OK
 
6:33 PM
i think in latest mysql patches its fixed
your mysql version?
 
Mine?
 
I think it's 5.6
or above
 
you can hack your own code just dont polish any variables
let it be
and see
 
What should I exactly type in the fields?
 
Wes
6:35 PM
i think... interface XPathNamespace : Node {
 
@Wes thanks ... why don't we prefix it with xpath ...
 
@ujwaldhakal Any clues?
 
@ZahidSaeed you cant just directly write sql and it will work
you will need to use some lib there are plenty of them
sql Injection
i have used one
HAVIJ
its GUI based
 
hmm
 
Wes
prefix how?
 
6:37 PM
and of course it's not documented either
 
@NikiC I don't think it is in there, though we don't quite adhere to the dom spec anyway
 
now adays pdo and mysqli are changing the world
 
@PaulCrovella we don't? I mean outside the unimplemented stuff
Well, I mean, of course we don't! :P
 
Wes
nobody does, not even dom itself :B
 
@ZahidSaeed want to learn hacking?
 
Anonymous
6:40 PM
@LeviMorrison well I have one from DigitalOcean and I don't want it, maybe for testing it will be fine
 
@ujwaldhakal Not really, I just want to break a security :P
Made by me
Need to login somehow
 
haha :p
host somewhere i will give a try
 
Thanks
It's not secure
@ujwaldhakal I made it a few months ago
It's using the same code for logging in
 
ok man
 
@NikiC arguably dom 1 methods should be totally ignorant of namespaces, so for example getElementsByTagName("ns1:bar") should be required in order to find <ns1:bar/> as the whole thing would be treated as the tag name, but the namespace is effectively dropped so that getElementsByTagName("bar") works instead
 
6:44 PM
@ujwaldhakal Will you do that now?
 
@tpunt lsapi uses the same code for php 5 and php 7, iirc
in any case it's externally maintained, so best not touch it ...
 
yes wait i am searching for my best tool
 
thanks i'm waiting
m trying too
 
havent used for many years feel like m young again yeeah !
 
good
 
6:48 PM
(I could be wrong about that, it's been a while since I've dealt with dom bullshit, but I vaguely remember some variances from the spec similar to that - i.e. wrong but generally useful so fuckit.)
 
Anonymous
@Gordon <3 It worked
 
Anonymous
Your advice helped
 
Anonymous
I will name a Son after you.
 
after you?
strange name if you ask me
 
Anonymous
:)
 
6:51 PM
:P
 
How about PeeHaa? :P
 
Anonymous
E_TOO_MUCH_E_AND_A
 
@NikiC Anatol already removed most of the TSRMLS_* (history)
@NikiC Fair enough, I'll remove it from my PR
 
@ujwaldhakal Any progress?
 
i am not able too see the which type of database it was may be you are only accepting post req so hard for me to enter
 
7:00 PM
@ujwaldhakal It's MySQL
or can i fetch response without adding "Acess-Control" header?
using AJAX?
I'm trying to send a request via localhost but it's not working
 
Nop man
try sql injection
use post mapped values
 
how?
 
@ujwaldhakal Will i be able to login with this?
 
@JoeWatkins Still no luck with your second line?
 
7:08 PM
@tpunt oh
hm, maybe it's fine then
 
no just give a try
there are no sure shot tools
u need to dive into sql injection tools
search for penetrating tools
oh i need to sleep
its morning :D
[00:49:27] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[00:49:27] [CRITICAL] heuristics detected that the target is protected by some kind of WAF/IPS/IDS
 
hmm thanks
 
evenin
 
Anonymous
o/
 
Wes
Do people really pay for Apple's AirPods? $160 seems, well, absurd to pay for wireless earbuds.
 
Anonymous
7:23 PM
Any 11ers work for Zoopla?
 
@tereško \o
 
@Wes probably the same ones who are willing to pay $200/$300 for a picture book: apple.com/shop/product/MLXF2/…
2
 
Wes
AHAHAHAH
 
9 Used from $400.00 .. not that I'd pay that, but I can at least understand paying that much for a "picture book"
 
@kelunik Protect all the scopes! github.com/amphp/parallel/commit/…
 
7:31 PM
@Trowski Doesn't php.net/manual/en/… affect the pipes you use for the exit code? Or do I read that wrongly.
@Trowski :D
 
@kelunik I think it works because the pipe is written to by the terminal, but if you could test that I'd appreciate it.
 
@Trowski Do we have tests that run on Windows for that?
 
@kelunik No, I have no experience with setting up testing on Windows, so if you could handle that I'd appreciate it.
 
@JayIsTooCommon you coming?
2
@jaaaaaaaay
@JAAAAAAAAAAY
 
@Wes I've got them :P
 
Wes
7:44 PM
do you also have the book? :B
@LeviMorrison how hard would be to have actually-private trait fields?
 
lol at starred message
You people are weird
 
@Trowski I just have my VM that runs some PHP 7 version, don't even remember how I installed that one. :D
lxr.php.net/xref/PHP-MASTER/ext/standard/proc_open.c#839 < Any reason why we allow shell_bypass only on Windows and always use sh on Linux?
 
ping @JoeWatkins
 
I guess, because we accept a string and no separate arguments...
 
8:04 PM
@JoeWatkins I got stuff on but if you ping me when you are about I'll try and respond in a timely fashion (re remote)
 
do resources have an object/type yet?
 
@Trowski Do we have any way to get the real PID of processes spawned with proc_open instead of the one of sh?
 
@Sean resources are of type resource, but you can't use it in type declarations
 
@kelunik Not that I'm aware of.
 
8:15 PM
@PaulCrovella Thanks ^^
 
http://i.stack.imgur.com/fFwPM.jpg :P
 
Why does Amp\Websocket receive a promise for onData? What would it need to wait for? (I'm rather confused)
 
@Sean for the actual message
 
I would have assumed onData would have just returned the message
 
onData just means that the beginning of a message has been receive
 
8:34 PM
OH!
Makes sense now, thanks
 
@Sean good luck with a message of 1 GB being slowly buffered and given to you at once
websocket protocol has no inherent size restrictions (I think not before 2^63)
 
Fair dues, I imagine yielding the message doesn't block other things while it receives the payload then
 
right
 
8:47 PM
@Jeeves thanks
 
@Linus You're welcome!
 
prewarning, sorry about the noise that's coming ...
 
HTTP/1.1 200 OK
Server: nginx/1.10.0 (Ubuntu)
Date: Mon, 16 Jan 2017 20:53:48 GMT
Content-Type: text/html
Last-Modified: Wed, 28 Dec 2016 14:14:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"5863c8dd-264"
Content-Encoding: gzip
 
Connection to tcp://86.178.168.218:80 failed: timeout exceeded (30000 ms)
 
8:54 PM
fuck sake
 
:D
 
@JoeWatkins works for me :)
 
I am so tired of this shit .... another two fuckin routers and £100 later ... I mean what the fuck, this shouldn't be difficult
 

« first day (2284 days earlier)      last day (2664 days later) »