« first day (1465 days earlier)      last day (3483 days later) » 

2:00 PM
@ircmaxell gotta love your bookmarks ;)
 
nah, I open my "Conference Talks" playlist on my youtube channel :-)
 
@ircmaxell I meant the PHP Chat Stackoverflow bookmark :P
 
:-)
 
thank you all for the help though cya later
 
2:04 PM
OH @ircmaxell: "Recki-ct: it's not going to run WordPress at all." SOLD. #PHPRoundTable
 
Composer can't seem to find "1.0.0-rc2" or artax :(
 
user895378
@Fabien you may need to update your composer file to use amphp/artax
 
user895378
@Fabien or delete the vendor/ directory in your current project to clear out the composer cache
 
"amphp/artax": "1.0.0-rc2",
 
user895378
@Fabien oh, I guess I don't have the packagist hooks setup on the amphp repos. Hold on ...
 
2:13 PM
furry
 
That's really in the spec
 
@ircmaxell why should that print anything but "3 3"?
 
user895378
@Fabien Should be fixed now.
 
Works thanks.
 
@bwoebi I consider 2 1 to be correct, because $a = $b is a by-value copy of the array, hence the references inside of it should break (in an ideal world at least)
 
2:19 PM
@ircmaxell disagree
(for the record)
 
well, if an array is a by-value data structure, why are its members by reference?
 
Because that array member is a reference. The fact that it is a reference to something external is part of the information that is copied.
 
@ircmaxell ostensibly yes, but that's not how PHP works.
PHP does not break references when copying arrays
 
@NikiC I know it's not how PHP works, I'm saying it's how it should work
 
@ircmaxell oh, they should break? why?
 
2:21 PM
@ircmaxell yeah, but that has nothing lost in the spec ^^
 
@NikiC then why does it say 2 1 is valid? Shouldn't is specify that the proper behavior is 3 3?
 
@ircmaxell yes, it should
 
ok, at least we're on the same page
I've got documents that prove @philsturgeon @taylorotwell and @pmjones are actually "parody" accounts created by @brandonsavage . #Wikileaks
 
^ lmao
 
user895378
Am I the only person who finds all the silly php accounts not funny? Because I don't find them funny.
 
2:26 PM
most of the time, I think they are bad
every once in a while, they make a good joke tho
 
user895378
Usually this happens: one of them follows me, so I follow back. Then after a while I'm like "this is stupid, I'm unfollowing." Then I see one of their things retweeted and I feel bad for unfollowing and start the process over again.
 
user895378
Actually, that describes pretty much all of my follow/unfollow activity on twitter. Not just the php parody accounts.
 
@DaveRandom Any idea if you can perform some sort of equivalent of a HEAD request to a DLL in C# to retrieve some info about it before going ahead and actually assembling it dynamically?
 
@rdlowrey why do you follow accounts which follow you?
 
user895378
Habit.
 
2:29 PM
I have like a 10% follow rate
 
@Jimbo What information do you want?
@rdlowrey For the most part, I don't follow any them
 
@DaveRandom A string provided by the DLL itself (a method call). But I didn't want to have to pull the whole thing into memory to get it if I could avoid it. Also thinking about it, if it's a method call, there's nothing I can do really
 
Well it doesn't load the whole thing into memory, it only loads the entry point addresses
 
Orly? So I'm okay to loop around 50 DLL's calling this method until I get the one I want?
 
If every program loaded every DLL it used into memory then Windows would need 10s of GBs or mem just for the kernel
Don't get me wrong, dl'ing stuff is still expensive, but it doesn't read the whole assembly into memory
 
2:35 PM
Ah that's okay then
Ofc, thanks. Still 26 beers though.
 
:-P
 
@DaveRandom well, doesn't it memory map the file? So it's assigned memory addresses, but not "really" loaded into ram
 
^ that
 
This is good, so as long as I discard the dll after looping through it, I should be good?
 
I believe that there are some circumstances under which it will page whole routines ahead of time, but that's where my understanding becomes basically non-existent
 
2:37 PM
As it'll free the memory address allocation
 
@Jimbo As long as you don't need it again in the lifetime of the program
 
@webarto why Y U NO SPEAK HERE? tday2014.phpsrbija.rs
 
Otherwise, the gains in mem from dumping the symbol table will (likely) be far outweighed by the other overheads of dl
tbh though I would put this into the category of micro-optimisation, it's one of those things I wouldn't think about unless I have a memory consumption or speed problem
 
@Ocramius at I read it as phpSiberia
felt proud
 
@Ocramius Haha, just saw that link on Twitter. To be honest, many people that actually know something around here are not related to the organisation/movement. Are you coming? I'm located about 2km from the venue.
 
2:40 PM
@DaveRandom Fair enough, I was interested in it more than worried about too much speed loss
 
@webarto calendar says no:
 
I generally have a fuck you attitude to any sponsoring company here because they're all outsourcing companies.
@Ocramius Fawesome.
 
@Ocramius I would go to that
 
@nikita2206 "Coding against the wind for over 10 years"
 
@ircmaxell I would go too if I wasn't in another flight :D
 
2:44 PM
Maybe it's just me, but is @ircmaxell saying PHP-FIG is full of self-important bloviators? His next blog post should be "The sky is blue".
 
well… that's somehow funny…
 
Kohana coding style/guide is goddamn awful.
 
@webarto >Kohana is goddamn awful.
FTFY?
 
s/coding style\/guide//
 
this to be precise :)
@nikita2206 I was optimistic 2 years ago.
 
2:48 PM
@ircmaxell I think the cool thing about PHP-FIG is that there are some people who genuinely care and want to put effort into some standards - that on it's own has got to be a really good thing for PHP
 
Interview task.
 
@webarto Bosnia? Bloody hell, are you coding with shells sailing past the window?
Panic Driven Development
 
@Jimbo I completely agree. Harnessing passion is a really hard thing to do, especially without letting it blind you
 
@ircmaxell got a link for this usb key you threw in the audience?
 
PTSD DD @Jimbo :D
 
Good god..what a hassle to figure out someone else's code..
Can't even imagine how you guys feel when helping others lol
 
On the best thing that ever happened: Thanks http://blog.krakjoe.ninja/2014/10/thanks.html #php
2
 
posted on October 20, 2014 by Joe Watkins

Fig 1. An actual miracle All the time I am awake, I think about writing code, if I'm not thinking about it, I'm either driving, or doing it. I don't need very much at all to be happy, to be productive. I am productive, I purposely involve myself in things where I know I can be useful. I do that at work, I do that for PHP. I do that so that every morning, I have some code to think about. Not

 
2:53 PM
:-)
 
Aw that's awesome man, what a lovely place
 
@ircmaxell Have it for 2 years and still haven't figured out how to configure it :)
 
lol
 
I will build a house like @JoeWatkins' one day.
 
2:57 PM
does it work on linux?
the yubikey?
 
@FlorianMargaine it's a USB keyboard, so yes
 
also... I guess I need a duplicate one, don't I?
 
@ircmaxell Ha ha ha ha!
 
@ircmaxell I don't get how it works then
 
@FlorianMargaine you press it, and it generates a one time password
 
2:58 PM
yeah
how do you reuse it?
 
you don't
every press generates a new one
 
Also known as OTP.
 
but they are predictable if you know the secret key (which their servers do)
 
how do you log in on google for example then?
did I misunderstand its puporse?
 
3:00 PM
is it just a password generator?
 
read the docs, it's there pretty explicitly
 
They've told me to protect it in coffee shops.
 
yeah so google has to support it, for example
 
It's like you typed in the password but you didn't. Comprende?
 
3:02 PM
@webarto is that your yubikey for some kind of bc wallet? :P
 
just watched the video... I don't see why the usb key needs to be encrypted or something
it just generates a key, or gets it from yubico server and enters it
isn't that it?
 
@Ocramius No, just some irrelevant thing known as Data Center :D
 
I still don't get it?
 
@FlorianMargaine it keeps the key hidden in hardware
 
which key?
 
3:03 PM
@webarto pffft, nobody cares then
 
isn't it a OTP?
 
A one-time password (OTP) is a password that is valid for only one login session or transaction. OTPs avoid a number of shortcomings that are associated with traditional (static) passwords. The most important shortcoming that is addressed by OTPs is that, in contrast to static passwords, they are not vulnerable to replay attacks. This means that a potential intruder who manages to record an OTP that was already used to log into a service or to conduct a transaction will not be able to abuse it, since it will be no longer valid. On the downside, OTPs are difficult for human beings to memoriz...
 
I suck at explaining, sorry.
It's like the token thingy when you log in to bank account.
 
how is the OTP communicated with yubico server?
and does google supports it?
 
You just need to press the thingy physically.
You sound like a broken record.
I made funny.
 
3:05 PM
so, you have a secret key
 
@Ocramius That's what I said too, I don't work there anymore.
 
You hash that key with a counter. Every time you hash it, you increment the counter, and get a new value out
that value is a one time password
you send that to the server, which also has a key, and the same counter.
if they match, then it's valid. If not, it's not
 
oh, got it
you better enter the OTP when you generate it then... or don't press the button accidentally
 
well, there are tricks for that
if the OTP isn't valid, the server will try future counter values
 
3:08 PM
up to 10 or 100 or something like that, and if it finds a match, it'll update the counter to match
but it will never go backwards
 
pushing the button only works if the key is plugged in, right?
I mean, it doesn't increment the counter if it's not plugged in, right?
and I don't get how this works without working with google
 
@FlorianMargaine correct
 
and it won't work with my bank I assume?
 
HOTP is a standard protocol, so the only variable is the private key
 
how does google know it has to use yubico as provider?
 
3:10 PM
it doesn't
 
It just recommends Yubico.
 
you install the google private key (that it gives you) on the token
and boom, it's transparent
 
oh
so I can use the yubikey for only one provider?
 
the key has 2 slots
 
ok... I understand better
thanks
so the provider gives me a private key, I store it on the yubikey. When I want to connect for my double-auth, the provider will ask me an OTP (for example, google stores the key + counter and calculates). Then, I have to connect my yubikey, generate an OTP thanks to the key + counter... and google compares, eventually testing some counters++. Is that it?
no... there's something wrong
I don't know what though
 
3:17 PM
if you press for 3 seconds or less, you get slot 1's key and counter. If you press for 5 or more seconds, you get slot 2's key and counter.
 
wait, you mean that's it?
 
so slot one can be google, and slot 2 something else...
yes, it presents itself as a USB keyboard
 
I just meant wrt the protocol. Is it correctly understood? So it never actually goes through yubiko's servers, right?
 
not if it's using Google's keys
 
the video showed some "yubikey input"... so I'm concerned
why would I use yubiko's servers, except to log in on them?
 
3:19 PM
use them as an oauth (or openid) provider
 
oh
they're not supported anywhere I guess though...
 
huh?
 
ah, you meant google. I thought you meant using yubiko as oauth provider
 
what?
 
what are you talking about?
 
3:22 PM
you can use it with yubikey's servers, at which point you're using them as an oauth or openid provider. So you can do federated authentication using them as the source of truth. Or, you can install a secret key from another provider (like google), and use that other provider as the authentication service. It's flexible
 
For oauth, doesn't your app need to be registered at the provider to be able to use it?
I mean if I make a website, I need to register it at yubikey if I want my users to login with yubikey
 
OpenID (OID) is an open standard and decentralized protocol by the non-profit OpenID Foundation that allows users to be authenticated by certain co-operating sites (known as Relying Parties or RP) using a third party service. This eliminates the need for webmasters to provide their own ad hoc systems and allowing users to consolidate their digital identities. In other words, users can log into multiple unrelated websites without having to register with their information over and over again; Several large organizations either issue or accept OpenIDs on their websites according to the OpenID Foundation...
 
I said oauth, not openid
 
@ircmaxell I've read you got these at Google now
 
3:47 PM
@Gordon I don't know what to say to that
 
@ircmaxell choose from [yes|no] and add how you like them ;)
 
I think I'd rather say nothing
 
that's okay, too
though not as satisfying as I had hoped
 
@Gordon where did you read that?
 
@FlorianMargaine right on yubico's front page?
and on their reference customers page: yubico.com/about/reference-customers
the part I am interested in is "works very seamlessly for people in their day-to-day workflow here at Google". precisely, how much effort it is for non-tech people to use them?
 
3:52 PM
@webarto
@webarto i just followed @nikic twitter and ended up here :) @JoeWatkins Yo! :) ping me on talk when you get time ;)
 
on what ?
hi :)
 
@Vladd welcome
 
@ircmaxell thanks :)
@JoeWatkins gtalk :D
 
@Gordon it integrates quite well with websites
after all, it's just a keyboard: you plug it in and that's it
 
@Vladd do i have you on there ? not seeing you in list ?
 
3:55 PM
@JoeWatkins huh.. then i might have another Joe on my talk, one living in thailand :)
 
And Joe, there's no link to your Twitter on your blog
 
yeah that's not me :)
@iroegbu good observation, will fix it ...
 
@JoeWatkins joe on my list was with FBM, so i thought its you by @webarto comment :)
sorry :)
 
np np
 
anyway guys, greetings to all of you here ;)
 
3:57 PM
:)
 
one does not just disable eval ... I think that's worth a mention, it's also worth a mention that things like twig use it ...
 
eval() all the things!
 
@JoeWatkins yes, but that also defeats the point :-)
 
but even then, there are workarounds, so nobody cares :P
 
4:04 PM
well it's not even as if disabling eval can be seen as some sort of quick fix, it's as much effort and disruption to install something that disables it and do without the components that require it as it is do "The proper solution" ...
 
posted on October 20, 2014 by kbironneau

/* by d_ave */

 
ping @rdlowrey gTalked you an error.
 
@JoeWatkins IIRC, CLI interactive mode uses eval.
 
user895378
@Fabien Fixed, tagged and pushed. Thanks.
 
@ircmaxell typo "leatting" and "Perhaps it wasn't the teacher nor the student" looks/sounds funny
 
4:11 PM
/me crashes
 
fixed
 
Is this normal behavior? 3v4l.org/roMrL -- the fact that the finally thrown exception is injected with the try thrown exception as it's $previous?
It seems like a bit of unexpected magic to me.
 
posted on October 20, 2014 by Anthony Ferrara

Recently, there has been a spout of attention about how to deal with eval(base64_decode("blah")); style attacks. A number of posts about "The Dreaded eval(base64_decode()) - And how to protect your site and visitors" have appeared lately. They have been suggesting how to mitigate the attacks. This is downright bad. Read more »

 
@DanLugg even magicker 3v4l.org/I6Qcf#v550
 
@Danack Awesome, good find
Yea, that seems a bit fucky.
 
4:18 PM
@DanLugg that's a bit odd
 
^^ I thought so too, and as @Danack points out it gets odd-er.
 
@Ocramius btw, have I ever told you that you are an evil person?
 
Why do I need to be told that?
 
I'm just asking :-P
 
I think you already told me that btw
 
4:20 PM
Oh, ok, just wanted to be sure :-P
 
next step in my plan is building Scala macros that mess up hardcoded magic numbers
could do it for PHP as well... hmmm
 
/me backs away slowly
 
Lord. RT @mattburgess1: chair of Lords committee on drones was "horrified" when she recently discovered Google Maps http://t.co/81d098Lrkm
 
Morning.
 
@Danack I wish I could say I was surprised
 
4:29 PM
 
@Ocramius a quick shortcut: use CPP preprocessor on php source files, it's fun
 
please no
 
@FlorianMargaine but theres no genirics
 
@DanLugg Are you going to do the bug report?
 
@Danack Probably, I'm just cruising lxr for info.
 
4:48 PM
@Vladd Welcome :) :slatkoirakija:
 
@DanLugg Uh, what's the bug?
 
@NikiC That the exception is being magically set as the previous?
 
That's how exception chaining works.
If an exception is thrown while another is still active, it set as the previous. Right?
 
4:51 PM
@nikita2206 well, you can use cpp macros...
 
Or am I missing something here?
 
@NikiC Um, I thought that was an explicit decision of the dev; made by passing an instance of exception to a newly instantiated one.
This is implicit.
I mean, if it is a feature, I haven't seen appropriate documentation of it.
@Danack Whoops, thanks for the add. Definitely important.
 
@DanLugg An undocumented PHP behavior? You don't say!
4
 
@NikiC I can understand for extensions or other weird dark corners, but exceptions should be thoroughly documented, no?
 
@Vladd @JoeWatkins is working with Pilipović, so he is with FBM :) Just maybe there's more of Joe because Joe is well... Joe... but this Joe is not your ordinary Joe.
He's John Joseph.
And kicks-ass.
 
4:55 PM
@DanLugg finally is a dark corner. A very dark and spooky corner
 
@DanLugg It looks like any construction of an Exception in the finally block: 3v4l.org/dskBd#v550
 
s/any/first
yep - same as: 3v4l.org/QJGBS#v550
I've updated the ticket.
 
just saying you don't even need to throw it
 
Does anyone know of a post POODLE Centos 6 vagrant box? Because currently I can't install any packages from Epel without disabling SSL.
 
5:32 PM
what's the php ?: operator? the new one?
 
13:26 <cjones> dmitry, Are we going to see some PHP 7 benchmarks announced at ZendCon?
13:31 <dmitry> cjones: yes
13:32 <cjones> dmitry, it's been a while since the last results :)
@FlorianMargaine short-hand ternary
 
thanks, that's hard to google
 
@ircmaxell 1:50 is pure gold
 
5:51 PM
 
6:06 PM
@DaveRandom you mean my sentence doesn't make sense, or the fact that we had a boolean settings which controls if we always do something or only sometimes?
 
6:20 PM
Hello Room. I have a question, does anyone know if there is an advantage to using storing images as BLOBs in a table vs the Filesystem? Is there a noticeable difference in performance for either approach?
 
@TheSnooker Only thing I can think of is replication, but there are better solutions for thta
 
I know it can be accomplished programmatically (via switch, etc.) but some parameter-pattern-matching would be nice:
class FooContainer {
    public multi function add {
        (Foo $foo): void {
            $this->fooArray[] = $foo;
        }
        (array $fooArray): void {
            foreach ($fooArray as $foo) {
                $this->add($foo);
            }
        }
    }
}

$fooContainer = new FooContainer();
$fooContainer->add(new Foo());
$fooContainer->add([new Foo(), new Foo(), new Foo()]);
 
47
Q: Files - in the database or not?

Jack DouglasWhat is the best place for storing binary files that are related to data in your database? Should you: Store in the database with a blob Store on the filesystem with a link in the database Store in the filesystem but rename to a hash of the contents and store the hash on the database Something ...

 
@PeeHaa I have a filesystem of images for a corporate website that is topping out around 2.8 terrabytes. It's becoming an issue just listing the directory. Need a way to maintain these images and so we are contemplating turning them all into blobs in a table. My concern is that while the table will only have about 100,000 rows.. it will still be huge. Would that effect the query time? The size of the DB?.. or is it just the number of rows?
@FlorianMargaine thanks for the link
 
@TheSnooker You mean you have a signle directory?
 
6:26 PM
@PeeHaa yes, currently that is how it is structured. 1 directory with about 77,000 images in it.
 
O_o
There's your problem :P
 
@PeeHaa It's produced from an internal process that just spits out images into a folder. It's been spitting them out since 2008
 
@TheSnooker I believe @SecondRikudo used a clever system for this: get an md5 hash of your image, and store the file in <first letter of hash>/<second letter of hash>/<rest of hash>.jpg
this way you get many directories
not that many directories though
 
@TheSnooker use the directory as a dropbox and move it to directories?
 
and it avoids having way too many files in the same directory
 
6:29 PM
@TheSnooker Yeah, do what @FlorianMargaine mentioned.
 
I don't have control over the filesystem on this machine. I can just read from it..
which is why I was debating making a script to pull it all out into a DB table.
 
Ali
Hey guys
 
@TheSnooker If you have 77k files in one directory, indexing will be a bitch.
 
@TheSnooker I think that is also going to be slow as hell
 
Ali
I have a forum script which I wrote which also allows for BBCs
I just need with something that might seem a bit weird
So [b]Some text[/b] would be converted to <strong>Some text</strong>
I also have one for URLs
 
6:31 PM
@PeeHaa not really
 
Ali
I use htmlentities before replacing the BBC so that I'm safe from any XSS
but I found a possible PoC
 
if you have an index on the field with the image name (not the data, duh), it shouldn't be slow
 
Ali
which is supplying for example
[url]javascript:alert(1);[/url]
and that would change to
 
@FlorianMargaine Wouldn't actually retrieving (ie browsing) them slow as fuck?
 
Ali
<a href="javascript:alert(1);">Whatever</a>
 
6:32 PM
47
Q: Files - in the database or not?

Jack DouglasWhat is the best place for storing binary files that are related to data in your database? Should you: Store in the database with a blob Store on the filesystem with a link in the database Store in the filesystem but rename to a hash of the contents and store the hash on the database Something ...

 
Ali
Whenever someone clicks it, it obviously shows a javascript alert
What would be the better way to protect against such a thing
 
@FlorianMargaine And nobody got time fo dat. gist or stfu :P
 
Ali
I thought of just not replacing anything that has "javascript" in it
but what that really be efficient?
 
@PeeHaa it's not slower than an fs access
 
Ali
If anyone has some thoughts, I'd appreciate it
 
6:33 PM
@FlorianMargaine tnx :D
 
You want a cheap way of storing things in a directory, hashing is that.
 
@JoeWatkins your blog down? (DNS?)
 
@FlorianMargaine that answer doesn't think broadly enough about the problem, in my opinion. For example, it lists only one disadvantage in using the DB as a filesystem. There are many more. Consider what happens when you have more data to store than a single node can handle. Or what happens when you're reading from that data at a throuput that the dbms simply can not withstand without falling over. Or the fact that it's a single point of failure.

Also, the file system option allows you to do things like distributed storage. Take S3, for example.
To give you an idea, a ~16TB MySQL database takes about 12-16 hours to backup and restore properly. A ~3PB S3 storage cluster takes less than half that time, because the backups can be done in parallel.
 
6:50 PM
@TheodoreBrown I still think we're solving the wrong problem.
If instead we have functions that determine if the parameter can be safely cast to a certain type then we have a solution that returns bool. That's simple. Additionally, you push the issue of what to do on 'error' to the programmer.
The programmer can throw an exception, or ignore it, or whatever they want.
We don't need to chose how we handle errors: let the programmer make that decision.
/cc @AndreaFaulds @NikiC
 
@LeviMorrison leaves you in a spot where doing the right thing requires extra work
 
@NikiC I am absolutely fine with that.
It means we don't force programmers to use a certain error system.
And in this case it's a bloody cast.
 
@ircmaxell hmm ... yeah seems down ...
 
after all, a major motivation for this is that we can introduce strict typehints while countering the "people will just use an explicit cast" argument. if the function doesn't cast you can't just easily call to_int when passing to a strictly hinted function
 
Let's not pretend that this 'extra work' is much more.
Ultimately, deciding if something can be cast safely and then casting it is better than casting and determining if there was an error.
The latter is probably better only in the case of atomics, as the former case wouldn't work.
 
6:59 PM
dunno what happened there ...
 

« first day (1465 days earlier)      last day (3483 days later) »