« first day (1367 days earlier)      last day (3581 days later) » 

user895378
3:00 PM
I haven't looked at it in three or four weeks, though.
 
user895378
I've been meaning to add ext/sockets support for alert ... it's pretty straightforward.
 
@ircmaxell Doesn't seem too bad.
 
@rdlowrey tcp/udp server is not really specific.. It's just new to php world, I guess.
 
Although I'd simply invalidate the user's password and let him choose one next time he goes in via a link in email.
 
user895378
@Leri If you actually want an example I can spin something up for you in a minute or two.
 
3:01 PM
@rdlowrey Basically I want SOCK_RAW and mcast/bcast support, and I want to be able to mux it in a loop with stdio, which you can't do without importing a socket as a stream as far as I can see.
 
user895378
@DaveRandom I think the better solution would be for us to implement options to allow those in native streams.
 
Or that, I'd also be fine with that
 
user895378
Instead of importing the already-setup socket from an extension.
 
@SecondRikudo depends on what he uses uniqid() for ... if it's to generate a one-use token it's not that bad.
If he used it to create the password, then ... eeew
Wait, hang on ...
 
@Jack Why? Even if it is to create the password, what's wrong with it?
Wait
 
3:02 PM
@rdlowrey That'd be nice. and thanks.
 
Well, uniqid() still depends on LCG iirc
 
@SecondRikudo then why not just set the stored hash value to null ?
 
lol only now I realized that it would mean sending the user his password by mail
 
because it is not "resetting password" it is remoing it and replacing with something that will make no sense to the users
 
@tereško That's what I usually do.
 
3:03 PM
@SecondRikudo Actually, no matter how you put it ... you're sending the user some kind of password either way.
 
@Jack I guess that's true.
 
The only difference is that you send them a "one time" password.
 
user895378
Specifically, streams have easy access to SSL/TLS right now where ext/sockets resources do not. So I'd prefer to bring the necessary socket options directly to native instead of importing things between the two.
 
@Jack Yeah well, it doesn't matter
You have a reset_on_next_login field in your database, and if it's set the user must reset his password on the next login
 
It does matter in terms of the window of opportunity.
 
3:06 PM
How you access the account, via token in GET or via posted randomly generated password really doesn't matter.
Yes, the token you get in the URL should be valid for a specific period of time
(Why is that, though? It appears rather pointless)
And you can implement the same with a temporary password that you generate for that account
 
That's true. I guess people just like the single click emails :)
 
The whole timed thing appears rather pointless to me though
If I'm an attacker and I've access to your mail, I will click the link now, I won't wait.
I'd much rather to have a "I did not ask for a password reset" link that would invalidate it immediately
Hmmm
 
If an attacker has access to your email, obviously nothing will stop them.
 
@Jack yes it is
 
No, I guess the timed thing is more for "if you ignore this email, I don't want this dangerous thing valid forever"
 
3:10 PM
@ircmaxell yeah, i already came to that realisation :)
 
@ircmaxell Why? Not strong enough?
 
predictable is the thing i believe
 
Reddit makes me want to cry and punch people.
 
@SecondRikudo uniqid is fully predictable
 
@DanLugg why.. what hapnd ??
 
3:12 PM
What happened? Besides "reddit happened" you mean?
 
^^ This.
 
What's the algo that generates the uniqid?
 
@SecondRikudo see first user note
 
@rdlowrey stream_socket_set_option() or ctx? I might take a look at this after I've finished the current ctx work
 
3:14 PM
@frankdejonge @nacin Actually what would be cryptographically secure it random bits that are them MD5'ed.
 
algo is linear congruential generator @SecondRikudo
 
@NikiC Yup, I saw
 
Frank knows what he's talking about, the other two is very much blind leading blind... sigh...
 
Also stream_socket_last_error()
 
user895378
@DaveRandom well the problem (at least for server-side multicast and indeed most of the desirable server socket options) is that you have to set the socket options before the socket is bound or starts listening.
 
3:15 PM
@ircmaxell someone should explain to him that hashing decreases the entropy
 
@rdlowrey ctx then :-(
 
user895378
well ...
 
@tereško I've blocked him for nearly a year now. And have been really happy about it. This is the first I've seen any of his tweets or posts in nearly that long :-)
 
Or flags args for stream_socket_(server|client) I suppose
 
user895378
@DaveRandom It's either that or tack on more bitwise $flags
 
user895378
3:16 PM
Yeah that.
 
That could get messy though
 
user895378
Context is probably the right way to go.
 
user895378
Given the current mess of an API, that is.
 
I think I'd actually prefer context over that, it could be made more descriptive
 
3:18 PM
god damn it I think someone rewrote history in php-src/PHP-5.6
 
user895378
Right now you have to set the listen flag at the time you call stream_socket_server. At one point like a year ago I proposed making the flag optional so you could set options on the server socket then later call a new function, stream_socket_listen($sockResource);
 
@ircmaxell what scenario does time limited one-time passwords cover, if any?
 
I wish people wouldn't do that, it screws with my workflow
 
@Jack I recommend avoiding it...
 
workflows are bound to be screwed by somebody ;-)
 
3:19 PM
inb4 xkcd
 
user895378
I think a new "listen" function might be better because then you could set options on the server without having to start listening at the same time.
 
user895378
You can still do things with the context that way. The separate listen function does allow one very useful thing, though ...
 
user895378
Namely that you can bind sockets in one process then fork or thread and start them listening in a separate thread/process
 
@ircmaxell You mean avoid the time limitation?
 
@rdlowrey I see the argument against it in that stream sockets are supposed to be a higher level abstraction and if you want to do that you should use ext/sockets, but leaky abstraction is leaky otherwise we wouldn't be having this conversation?
@rdlowrey Why does doing it in that order gain you anything?
 
user895378
3:21 PM
Which would mean you could have multiple procs/threads listening on the same ip:port interface in OSs that don't have access to the SO_REUSEPORT option
 
user895378
^ that.
 
user895378
That behavior I need specifically for aerys.
 
user895378
I can fake it (which I'm doing now) but it's a PITA.
 
@rdlowrey I what I mean is, if you can bind the sockets in one env, why can't you bind and listen in one env before handing them off?
 
user895378
@DaveRandom You can, it just makes things more difficult especially if you're trying to support hot upgrade functionality. It's not that big of a deal -- like I said I've been able to work around it.
 
user895378
3:23 PM
Actually, I got my wires crossed.
 
@Jack Wait, when you say time-limited one-time passwords... what do you mean?
 
user895378
You don't need the separate bind/listen functionality for that.
 
OTP as in 2-factor-auth?
 
any of you familiar with the DoctrineOrmTypeGuesser in Sf2's formBuilder?
 
@ircmaxell hmm, no i mean tokens for a reset-password flow.
 
user895378
3:24 PM
@DaveRandom Right, but ext/sockets has no TLS support. That's the big issue. And it shouldn't be that complicated to use contexts to support all the options we need.
 
I don't like it
why not use an explicit reset token flow?
 
user895378
@Leri I didn't forget about you. I'm putting together a server example in-between other things :)
 
@ircmaxell How is it different from a one time limited password?
It's the exact same as a one time limited reset token
 
@Ocramius stop whining about yaml on twitter :P
 
@ircmaxell sorry, not sure i know what that means.
 
3:27 PM
^^ I'd like to know what that means too.
 
@Jimbo I did a long time ago
 
haha
 
I don't need to re-iterate, I just link the same tweet over and over
 
@rdlowrey Agreed. I'm just trying to fathom why you need a separate listen except for setting opts after bind, it's possible if could be done in some hidden magical way that, crucially, doesn't require adding a new function (I'm thinking STREAM_SERVER_DEFERRED_LISTEN). Depends what the actual problem is as to whether that would make sense though
 
have a separate db table, when user clicks "forgot password", you generate a random token, store a hash of it int he table, and send it to user via email. They click the link, you check the table to see if it's there, and delete it, then allow them to enter a new password"
 
3:28 PM
@ircmaxell Ah, okay. That's simple enough.
 
@ircmaxell if it's there and if not too much time has passed
 
@ircmaxell way too complicated. just store all the pws in plaintext and send them their old pw to whatever email they requested it to. scnr
 
@SecondRikudo Yea, time limit; 24 hours, 1 week, whatever.
 
@Gordon for president
4
 
user895378
@DaveRandom I don't think you need separate function. I was thinking of something else.
 
3:29 PM
YAML is better than XML.
 
@ircmaxell okay, right, that's what i have too ... when i created it, though, i instinctively thought that adding a time limit would be better, but after thinking it through i couldn't really think of a scenario that would break it :)
 
@Jimbo hahahahahahahaha NO.
 
@Jimbo LIES HORRIBLE LIES.
 
:D
 
@Gordon actually, yeah, I'm coming to that conclusion
screw crypto, just make it easy for the user to do what they want :-)
@Jack you can add a time limit if you want.
 
3:30 PM
he has been using YAML and Twig... smh
 
add a field to the table with "created timestamp", then when validating validate if the timestamp is within 24 hours or whatever...
 
user986408
quick question: when using eventsource for notifications with php i'm basically running a loop to persist the connection. does this mean i have to like query the database every 10 seconds to look out for news?
 
@ircmaxell okay, one thing it might be good for is cleaning up unused tokens :)
 
@Ocramius do you know anything about the DoctrineOrmTypeGuesser in Sf2?
 
@rdlowrey Cool. The suckiest part of this as I see it now is yet more constants duplicated from ext/sockets in streams, but I don't see any way around that
 
3:32 PM
@Gordon wth is that?
 
user895378
@DaveRandom I had this same problem with the process signal constants (like SIGINT for php-uv extension and pcntl and other places). It's annoying that each extension has to have its own set of low-level constants that should be part of the language already.
 
user986408
or do i need some kind of storage layer like memcached or redis for better performance and queue those?
 
@matthiasnoback @frankdejonge @nacin If I never let anyone log in and never published the app, it’d be 100% secure.
I think he's getting the point now.
 
@Ocramius a source of pain :)
 
actually .. that brings up an interesting point ... should you hash the raw output of /dev/(u)random ?
 
3:34 PM
@rdlowrey What did you do? Did you find a sane way to check if they are defined? Or do you have to just conditionally define them in both places?
 
@Jack emm ... no it would still be insecure. The difference would be in the p[art that nobody can exploit the vulnerabilities in it
 
/me just verified identity with stripe/gofundme, and is awaiting 9k ... omfg ...
 
Actually does REGISTER_*_CONSTANT complain if you register the same thing again?
 
yes
 
@Jack is it "the tree falls in the forest and nobody hears it .. " argument ?
 
3:35 PM
@JoeWatkins that must feel pretty exciting :)
 
@JoeWatkins logical but annoying
 
@tereško yup, and it's a pretty big forest.
 
user895378
@DaveRandom Well for php-uv there was already a Uv class that aggregated things like that. So it was just a matter of adding class constants like Uv::SIGINT, etc.
 
@DaveRandom write your own inline function to check EG(zend_constants)
make it based on the routine for fetching constants because of CS ...
 
@Gordon is it some kind of Doctrine\DBAL\Types inception with the container?
because if it is, types were never meant to do that
 
3:36 PM
So. Project Manager didn't aprove something I'm doing; Team Leader tells me to do it anyway. Something must've got lost in translation xD
I wonder If I'm working in India. Looking at the surroundings: Nope. Looking at the project: Yep, very much so.
 
PM vs Team Lead: Fight!
 
@rdlowrey Sounds like that class might be better named Ugh
 
user895378
@DaveRandom well libuv already aggregates lots of functionality from lots of extensions into one place. So it's really the only sane way to do it.
 
@DaveRandom I was gonna make another joke with that but I can't think of something that makes the sound of asynchronous .. =(
 
user895378
These problems stem from php having a very incomplete featureset for programming as part of its standard library.
 
user895378
3:39 PM
Things like concurrency and sockets and process control should be included in a real language.
 
@Jack a lot of things would be better in that case :-X
 
@Ocramius Sf's FormBuilder uses that to determine whether a form element can be resolved to an Entity/Choice element
 
@rdlowrey That just makes PHP sound bad; it's a language with opportunities!
 
user895378
@Jack lol, I like this.
 
@Jack This is brilliant.
 
user895378
3:40 PM
A language with opportunities!
 
@JoeWatkins Yeh I'm sure I could do something like that very easily, the issue is more that I'd then have to go touch some code I'm not actually doing anything with to get it to use that method. The issue here being stuff like SIGINT, SO_REUSEADDR - low-level constants that apply to more than one extension but are defined in a specific one, so if you are missing that specific one you don't have them. And they have to be defined with the check everywhere, since load order is not guaranteed.
 
if a tree falls in the forest, and there's nobody around to hear it, does that make you any less of an idiot?
8
 
user895378
@DaveRandom yeah it's a real PITA
 
@ircmaxell Depends on whether you can make your way out of the forest.
 
i c
class constants then ...
@ircmaxell is the answer "it depends how the tree feels" ?
 
3:43 PM
:-)
@JoeWatkins what's your take on the scalar hints proposal?
 
@JoeWatkins Yup. Except in this specific case, streams. So no classes to add them to. Which means STREAM_SOCKET_ prefix. Which means people cleaning sick out of their keyboards.
@rdlowrey rapidly coming to the conclusion this aint gonna happen in a sane way without the much-theorised OO streams API.
 
@DaveRandom yeah, yuk ... that's really horrible ... if for future version of php then you could change the api for registration, retaining bc ... probably effect a few places, but better than all that typing ...
 
user895378
STREAM_SOCKET_* blows hard, but that's how everything is done right now in PHP with procedural C-style resources and contexts :)
 
user895378
So yeah, more reason why streams need fixing.
 
user895378
Objects are the only sensible thing to do IMO.
 
3:47 PM
In the interim something can probably be done without constants in the ctx
 
@ircmaxell looks like the correct patch for php ...
 
What about some of the discussion points? ex: what should satisfy a bool hint?
 
user895378
I mean, we already deal with a million STREAM_CRYPTO_METHOD_* constants. That's just the side effect of the current streams implementation.
 
user895378
You have to create a million constants to do anything.
 
user895378
We're at least two releases away from OO streams. Constants and ctx opts seem like the only way we're going to get this functionality in the interim.
 
3:49 PM
> 5) Add type hints using existing syntax, which are casts; Change casts
(both existing and these new ones) to emit a new E_CAST in case of data
loss or 'bogus' conversions.
 
so explicit cast may also raise a notice? hmm, that seems fair.
 
/me strongly doesn't like that
 
I only read some of the discussion, the reason it's the correct patch imo is that it treats data the same as zpp, anything that would be accepted by zpp as a bool should therefore be allowed to pass or zpp should be changed ... but the two things should be compatible if we want everything to make sense ... if it doesn't make sense to have return types do something then zpp shouldn't either, we are talking about 6 I think, so time to make it consistent I guess ...
 
@rdlowrey I hate the "no new features in x.y.z+1" rule
 
yeah, i would see myself writing code to prevent the notice if all i want is to just clean up the sh*t with an (int) cast... not so nice.
 
3:52 PM
are you in touch with andrea @ircmaxell ?
 
@JoeWatkins yup
 
cool ... I'll read the whole discussion tonight when kids are in bed
 
user895378
@DaveRandom I mean, I understand it -- BC and stability are very important for the continued enterprise success of the language. But it sucks when the old features suck and need improvement.
 
getting positively received at the beginning of the thread, still same ?
 
it's not overall negative, just differing'
 
3:54 PM
as opposed to reddit =(
 
@rdlowrey Indeed. It's a PoV thing I suppose - I view this as basically a bugfix, most people never use it and will see it as a new and somewhat useless feature.
 
there's time to work on the patch, it is the correct patch, undeniably so ... the focus on zpp compatibility should be taken to it's conclusion, we'll have something really sensible (relative to php anyway) that we wont hate in a few years ...
 
user895378
@DaveRandom Which is why I don't have a problem with STREAM_SERVER_* vomit constants because they have essentially no effect on people who don't need them and they bridge the gap between now and a better API.
 
user895378
Any thought to how to implement mcast?
 
user895378
I was thinking probably something like resource stream_server_multicast_group(...) then you could add client sockets to individual group resources as they connect.
 
user895378
3:57 PM
I dunno, haven't given it a ton of thought.
 
user895378
Issues like this highlight (to my mind, at least) the ridiculousness of firing up the whole PHP environment fresh on every web request :)
 
this is about the time I will start to tell people how much I hate my job
 
user895378
If you don't have to reload the whole freaking system for every request then adding more (necessary) standard lib constants isn't a big deal.
 
@tereško I thought you liked your current one?
 
@JoeWatkins some disagree ;-) reddit.com/r/PHP/comments/2akddw/…
 

« first day (1367 days earlier)      last day (3581 days later) »