« first day (1472 days earlier)      last day (3490 days later) » 

9:01 PM
another blog post is scheduled for Wednesday
 
user895378
@Danack I've pushed changes that I believe resolve the behavior you were seeing. Tagged rc4 as well.
 
@rdlowrey Cool. So I'll need to implement the "Jeebus, slow down a bit mate?!" functionality to avoid having issues?
 
user895378
@Danack No you won't. It will just work.
 
TM.
 
@rdlowrey Is this using a bounded queue?
 
user895378
9:09 PM
@LeviMorrison Officially it's using an array and queuing requests beyond a configurable number of outstanding requests.
 
user895378
It won't process more than 512 requests concurrently and starts queuing them beyond that.
 
user895378
Then each time a response comes back the next queued request is fired off.
 
user895378
@Danack Testing directly with the Bastion code seemed to go smoothly with the recent changes.
 
Quick semantics check: in PHP variables don't have types, they have values. And values have types.
 
@LeviMorrison I think that's the right frame-of-reference
 
9:13 PM
Hmm.
As an optimization, there are value types which are embedded in the value struct, and reference types which get stored on the heap and linked via pointer.
So, values have a type, and there are value types and reference types.
Multiple meaning for "Value" depending on context.
 
9:30 PM
@rdlowrey I'm still seeing a large number of connections being made at once, despite all of the requests going to the same host. I can about 80 requests being made when the program starts up.
Also, I have infected you with embedding debug into programs .... "--retry--"
 
I'm wondering, is it actually better to have .html pages with forms which redirect to .php classes that handle the input then redirect the user furtherly to 'success' pages and so on ? Asking since I'm doing what I said above and it feels like a lot of work which makes me wonder if I'm doing things right or I should just have everything inside one file.
 
@ShowTime If you're asking whether the PRG pattern is a good thing that you should use then: yes, it is.
 
@ShowTime It's not perfect and I'm not sure that I actually recommend using it, but you really ought to be aware of twig.sensiolabs.org ... as you may just not realise how to separate code that does stuff from code that displays stuff...
 
/me does not like templating engines build on top of PHP
 
@DaveRandom I didn't actually know it's called the PRG pattern, anyway, thanks for the answer, I'll keep using it then. :)
@Danack I'm mainly having PHP separated in files, the page itself only contains a session_start() and perhaps some other minor stuffs, the rest is HTML.
 
I need to write a blog post on I like to use dependency injection in my templates which makes having them written in straight PHP be really annoying, and so having a custom DSL for it makes doing DI in a template not be a pain in the arse
 
Just closed 94 tabs
 
On purpose?
 
@Danack DI in a template?
 
@ShowTime Pro tip: most people are fully aware of that stuff, no need to star it :)
 
9:46 PM
DI in a template?
 
@Danack Yeh, pruning
Yeh that, DI in a template doesn't seem to make a whole bunch of sense... why are you instantiating stuff in a HTML template?
 
{inject name='advert' value='Sidebar\Advert'}

$injector->alias('Sidebar\Advert', 'Sidebar\XmasAdvert')
 
@PeeHaa tip, "most people here .."
 
I mean, maybe if you were using DOM, but if you were using DOM you wouldn't be using twig so...
 
lol
 
9:47 PM
@tereško that... :)
 
you could argue that this is not you average sample of PHP developers
 
@DaveRandom Because otherwise you're just creating it in a class, and then passing it to another class, which means that designers need to touch two things just to accomplish one thing...
 
You've been busy lately @tereško?
 
@Danack Creating what though?
 
@PeeHaa was sick, played a lot of xcom
 
9:49 PM
How are you guys usually sanitizing PHP data ? Using PHP functions or creating your own, and if so, could you give an example ?
 
ah I see
 
@Sho
Depends on your needs ... filter_var, custom functions or even none
 
Everything for which there exist multiple possible versions, but you can't know which are going to be used until you hit the view.
 
My fault, I refer to data that I'm going to insert into a MySQL database.
 
So, we're probably hiring an intern to maintain and work on/develop a small and simple php code base, consisting mostly of wordpress. Whoever will be doing it needs to be qualified to do it but will likely not work on our bigger projects. I wanted to ask the regs here about interviewing them, because while I have a few good question ideas for senior developers - I have no idea what to ask someone who is to work on a simpler code base as an intern.
The only other intern we have is actually pretty competent, and I'd hire them as a developer.
 
9:50 PM
@ShowTime are you using pdo?
 
No, I'm using mysqli_*
 
cc @ircmaxell @tereško @PeeHaa @bwoebi
 
@Danack I can't think of what those things might be, but I'll take your word for it
 
Oh, also @Gordon , I'd value all your opinions, if you feel like sharing them.
 
@ShowTime with prepared statements?
 
9:51 PM
@ShowTime depends on what type of output are you sanitizing .. there is no real benefit from sanitizing the input (aside from cleaning the extra whitespace) , because first order sql injection are preventable with prepares statements
 
As I said, I ought to write a blog post or two on it.
 
I'm also interested in what people like @rdlowrey have to say but they're doing less mainstream php development so there's that.
 
Maybe so, include some concrete examples if you do
 
ThW
grmpf hhvm build failed again
 
No, I'm not really using prepared statements.
 
9:52 PM
you REALLY should
 
^ this
 
Reading more about it right now.
 
validate your input and use prepared statements
 
@BenjaminGruenbaum so basically you're thinking about what questions you should ask the interviewee?
 
I'm always validating and sanitizing input before placing anything in MySQL
 
9:53 PM
@HamZa yes, I'm asking what every php developer must know, even if they're an interern maintaining a mostly wordpress codebase.
 
@Patrick input's validation is kinda what "business objects" do .. it's what we call domain logic
 
@ThW Another fortnight down the drain
 
@BenjaminGruenbaum are you looking for someone who actually has some development experience ? As in: at least knows basics of PHP ?
 
ThW
@DaveRandom A strange one this time, hhvm can not find the trait, runs fine on php
 
@BenjaminGruenbaum it's a bit tricky. I'm still a student and I've seen a lot of crazy (bad) stuff/code. I guess it depends on the area but I think most students don't have any "real" experience from your average school unless he/she really is committed to it in his/her free time.
 
9:55 PM
@tereško yes, what they have to in order to maintain a very standard web codebase. For instance - I don't care if they understand all the semantics involved with how references work in PHP although I consider that php fundamentals developers should know.
 
@BenjaminGruenbaum The only semantics about references newbies need to know in PHP is that they are poison and if they touch references, they will die. A brutal and painful death. At my hands. A mercy kill, you see.
 
@BenjaminGruenbaum ask the candidate how he/she would about debugging code (maybe prepare some common error/warning messages). Ask how the candidate goes about learning things, which sites frequents. Ask whats the most annoying part of PHP that he/she has had to deal with.
 
@HamZa that person will likely not get to do architecture unless they prove themselves very worthy of that.
 
@tereško "How do you learn / what do you read / where do you go to keep up with new stuff" is one of my favorite interview questions.
 
@BenjaminGruenbaum Pardon my french but what the fuck: "we're probably hiring an intern...Whoever will be doing it needs to be qualified to do" You're hiring someone who has to already be qualified to do what they're going to be working on, but you don't want to pay them a real salary, or involve them on stuff that isn't shit?
That would be illegal in the UK...
 
9:57 PM
@tereško that's not a bad idea, maybe ask them about a php code that fetches data from the DB and what's wrong with it, and then ask them to write a script doing it well.
 
Just saying. Once I saw someone using password_hash() for generating some token but they used md5() for passwords. lolwut
 
I don't really see what is the benefit of prepared statements as most of these stuffs can be accomplished without them too. Could someone correct me ?
 
@Danack we're going to pay him a real salary, not as much as a developer but still.
 
@BenjaminGruenbaum data sanitisation principles (obviously), HTML/CSS (obviously), ability to hack out some mostly warning/notice free code - "how do you check if a variable exists", "what happens if you declare a function twice", etc. But I think the most important thing to test (not sure how to best do this) is "can you read and understand documentation". WP and PHP are both extremely well documented, so it doesn't matter if you are a total beginner as long as you can read docs.
 
@ShowTime prevent SQL injections from the first order
 
9:58 PM
@BenjaminGruenbaum don't ask someone to write new code in the interview ... that will kill the process. You will be better off by having small code snippets with a single error in them (syntax or logical) and ask to fix it
 
250
A: Are PDO prepared statements sufficient to prevent SQL injection?

Joel CoehoornPrepared statements / parameterized queries are sufficient to prevent 1st order injection on that statement. If you use un-checked dynamic sql anywhere else in your application you are still vulnerable to 2nd order injection. 2nd order injection means data has been cycled through the database o...

 
@Danack when you get accepted as an intern, you have to prove your worth before you work on interesting things or push code to production. That's a given. If you don't have any experience or any deep understanding of design I would not trust you to do a good job at those. I'd expect you to start at getting things done, which I believe is deeply undervalued at schools.
@Danack because I'd take a developer who can get the ugliest PHP 5.2 WordPress filled with jQuery plugins and weird stuff site off the ground any day over someone who can tell me why 3-SAT is NPC but can't deploy anything.
 
@BenjaminGruenbaum The thing on top of my list would be to let them show they understand different security principles
 
@PeeHaa also a good idea.
 
10:01 PM
@PeeHaa the CIA?
 
@Danack I'd go even further - I think that how you handle debugging tasks and "shit", as well as solving bugs no one else wants to touch teaches a lot about you as a developer.
 
@BenjaminGruenbaum .. oh , and you can ask about what are the benefits or issues if you have files which mix HTML , JS and PHP.
(that would cover the basics of "good development practices" for someone of an intern's level of skill)
 
@tereško @DaveRandom @PeeHaa I think I might get the pattern here. You all recommend asking about basic security and code management, and to stick to showing them chunks of code but only asking them to write small chunks if at all.
 
dont ask him/her to write code
unless it's like 5 symbols
 
10:04 PM
No. You can have them read code though.
That's my $0.02
 
Not even a tiny classic CRUD task?
 
Definitely not.
 
@BenjaminGruenbaum We'd just call those people a junior developer in the UK. Calling that it an internship would create interesting suggestions/liabilities for having a full training schedule for the 'intern'.
 
That's probably the first time I've heard someone advise against writing code in interviews, may I ask why?
 
@BenjaminGruenbaum even seasoned PHP developers suck at SQL
 
10:05 PM
@BenjaminGruenbaum Well... from my end there are really two interviews, at least.
 
I´m fairly certain that even dbas suck at sql ±P
 
The first is a screening interview. You try to get a general feel of their knowledge. Writing code here is really bad; reading is okay.
 
@BenjaminGruenbaum our current recruiting process is to send people our programming test. when they dont totally mess up that, we call them for a short pre-interview where we ask them to explain their solution and any quirky things we found. if they pass that, we invite them to the office. they get interviewed about an hour. questions then usually are about their previous jobs, what they expect from us, where they wanna go, how they keep up to date. if we think they fit, they get the job.
 
@BenjaminGruenbaum the code that you should be looking for should be "this line needs a semicolon", "it should be === and not = int that if", "this loop will never end" ... and so on
@Gordon he's looking for an intern
 
@Danack well, someone from the chat is working for us as an intern. He's getting plenty of training (learned at least 2 new programming languages since he started, worked on at least 5 technologies, pushed new projects, now working as a member in a team and pushes code to production). I admit he's left a good impression, there was a lot of intent in making him do certain things at a certain order but now he's just good enough to get assigned the same tasks as seniors.
 
10:07 PM
@tereško same process for us. maybe with a bit lower standards.
 
In the second interview we are basically choosing between acceptable candidates. These are all people we think we could hire. Writing code here is okay.
 
@Gordon that sounds very similar to what we do with developers, but I don't want to ask students to go through all that for an internship.
@LeviMorrison why though, why is writing code bad?
 
@LeviMorrison wow .. so you tend to end up with more then one "acceptable candidate" ?
 
@tereško what if it's working against a REST API?
 
@tereško After the first round of interviews, yes.
Hopefully.
 
10:09 PM
@LeviMorrison that sounds unrealistic and has not been our experience at all. Then again you might be better at finding candidates than us.
 
@BenjaminGruenbaum because the guy/gal who comes to the interview will be scared out of his/her bloody mind ... how good are you at coding, when someone stands behind your back?
 
Basically, what tereško said.
 
@tereško we never stand behind your back. When we ask candidates to code they do it in front of an editor of their choice, with internet, and in work conditions similar to what they'd have if they got the job.
 
@BenjaminGruenbaum It's still a lot of pressure.
 
Of course it is, an interview is a pressuring experience.
For example, Joel Spolsky advocates candidates writing code during their interview:
 
10:12 PM
 
Hey, I just met you and this is crazy
But here's my problem, solve and you're hired maybe.
 
> Would you hire a magician without asking them to show you some magic tricks? Of course not.

> Would you hire a caterer for your wedding without tasting their food? I doubt it. (Unless it's Aunt Marge, and she would hate you forever if you didn't let her make her "famous" chopped liver cake).

> Yet, every day, programmers are hired on the basis of an impressive resumé or because the interviewer enjoyed chatting with them. Or they are asked trivia questions ("what's the difference between CreateDialog() and DialogBox()?") which could be answered by looking at the documentation. You don't
 
@BenjaminGruenbaum candidate should write the code before the interview and then you could discuss said code in the interview
 
@BenjaminGruenbaum Are you doing two rounds of interviews, at least?
And how long would an interview be for a Junior/Intern?
 
@LeviMorrison I'm not sure yet, this is what I came here to get advice for. We have a very clear process for senior developers but we haven't hired very many juniors or interns yet, the ones we have we're very happy with but that does not mean we have the process right.
@tereško painfully accurate :D
 
10:14 PM
We hire 2 or 3 jr. devs every year, sometimes more.
 
We use three 'pruning' processes.
 
"intern" is kinda the person with no real practical experience
"junior" is someone with *some* practical experience (~2 sites)
 
1) The resume check.
2) After first round of interviews
3) After second round of interviews
 
@BenjaminGruenbaum yeah, but they only need 30 minutes for the test. 30 minutes for the interview and then another hour. that's not that much. we had lots of students fail the test already. we expect our students to know php on a beginners productive level. our offer is not to teach them php but to gather experience on a real project.
 
10:16 PM
What we look for in the first round of interviews is general programming knowledge, and our confidence that they'll be able to learn new things.
 
@LeviMorrison that's quite all right for juniors .. especially if you throw in a small practical exercise between the interviews
 
We use the second round of interviews to choose a candidate for hire. What we do here is a lot more focused on the particular candidates we have, but basically we are determining which one we think would be the best overall, which includes how much they can do under pressure.
 
Ok, so prepared statements increase security and make code cleaner. But what if I have something like:
if($stmt = $mysqli->prepare("INSERT INTO friends VALUES (?, ?, ?)"); {
$stmt->bind_param("ssi", $firstname, $lastname, $age);
$firstname = "Good"; $lastname = "Guy"; $age = 3;
$stmt->execute();
$stmt->close(); }
$mysqli->close();

The question is, won't it still be necessary to sanitize data if the parameters were gathered from $_POST data f.e ?
 
@ircmaxell I agree and disagree with that blog post, by the way. I love education but if education is harder than "Just use XYZ library!" sometimes using XYZ library is tthe correct business course of action.
 
I would recommend going with PDO ... nicer API in general
 
10:18 PM
@Gordon yes, completely agreed.
 
@ShowTime no, there should be no need to sanitize them .. did you even watch the video I linked ?
 
@BenjaminGruenbaum def disagree there ;-)
 
I don't know what kind of organization you work for, Benjamin, but when we hire a Jr. developer we understand we'll be training them. We focus a lot more on how well we think they'll learn than how well they can currently write.
The last time we hired a Jr. PHP developer the guy had never written PHP before. Not once. He has been an excellent employee.
 
@BenjaminGruenbaum using 3rd party libraries is just fine, but you should actually looks at it's codebase to see if it fits your standards. And I have been trying to hammer this home for my coworkers ...
 
@LeviMorrison I take it from the fact that you bring that up that this has worked out alright?
 
10:21 PM
I have no issues with "use xyz library". I have problem with "just". You don't have to teach now, but if you stop at "use it", we lose
 
@DaveRandom Not just alright. He's worked out very well.
 
@ircmaxell education is superior to so many alternatives, especially in security. Especially when you contrast it with censorship, or with prevention, or with policing or with all these things. However, there are plenty of places where we make uneducated decisions happily because we use our time differently.
 
@tereško I actually watched it, just making sure since up until now, I sanitized every single $_POST data I'd get, no matter what.
 
@DaveRandom we did something very similar at NBC...
 
One of the points I was getting to though, was that if we made him write PHP during the interview he'd have failed.
Especially the first interview.
By the second interview he was already learning PHP and depending on the task would have done okay.
 
10:23 PM
@ircmaxell as much as I love education, I think that we can't just catalogue people not understanding things as ignorance and hope to teach them. The best problem is one that does not occur to begin with - if security was easier on the server side there would be less things to get wrong, as someone who worked on making it so I don't think you'd disagree.
 
@ShowTime That is always the wrong approach, only sanitise what you need at the point where you need it, "sanitise everything always" is less secure and often results in double-encoding of things and bugs that are hard to track down
 
@ircmaxell The post implies, at least the way I read it, that the problem with users writing unsafe code is their education (wisely not blaming it entirely on them). Sometimes it also stems from the fact doing things in a given platform is too complicated. Isn't it fine to "just use password_hash"?
 
@DaveRandom, I said I'm sanitising $_POST data in general, not -everything-.
 
@ircmaxell Presumably someone who had some reasonable experience with something else, though?
@ShowTime By "everything" I mean "all the $_POST data"
Also, define "sanitise"
 
@BenjaminGruenbaum that wasn't what I was trying to say. And it had less to do with "unsafe" code, than just giving an answer without solving their problem
 
10:26 PM
@DaveRandom In our case, yes. Python, JavaScript, C, C++, and Rust.
 
@DaveRandom sometimes yes, sometimes no. We've hired people who just showed an incredible thirst for knowledge
 
thirst*
 
I know, I read that as "thrust"
 
@DaveRandom Replacing potentially dangerous characters with their ASCII code equivalents.
 
We care more about their ability to learn than what they can do right now, especially with Juniors.
 
10:27 PM
@ircmaxell how is "just use password_hash" different from "just use jQuery" for DOM manipulation in older browsers or "just use WordPress" for a blog?
 
@ircmaxell I will let you know, when I meet such a person =/
 
@BenjaminGruenbaum it's not different
@tereško :-P
 
@LeviMorrison I think that it's a bit different with interns. An intern is typically done after 6 or 12 months.
 
@ShowTime Wait, what? What are you sanitising for?
 
@ircmaxell So you'd expect all web developers to understand basic cryptography?
 
10:27 PM
@tereško I work with a large number of them. So come here and I'll introduce you to some
 
@HamZa And how long do you keep Juniors?
 
@DaveRandom mainly for inserting data in MySQL (but so far I haven't used prepared statements)
 
@LeviMorrison If you offer trainings, I would expect a couple of years (2-3+)? Just guessing, I worked only as an intern...
 
@BenjaminGruenbaum no, I expect all web developers to have a cursory understanding of it. Cursory. Enough to say why password_hash is better than md5. Why they shouldn't just use mcrypt() to encrypt data. etc.
 
Which is why I said I'm sanitising everything from $_POST data
 
10:28 PM
@HamZa Usually no more than 2 years.
 
@LeviMorrison this. Blank canvases are way easier to work with than "experienced" people who are set in their bad habits
 
I see...
 
Or in other words... don't hire any of us :-P
 
But yes, interns would be a bit different than juniors.
Since their work-time is compressed.
 
nn
 
10:30 PM
@ircmaxell why is it better? What understanding would satisfy you, is "Because smart people said so?" enough? What about "It's harder to hack"? Or would you expect to be familiar with what password_hash actually does?
 
@ShowTime General rule: don't change the data, ever. Only make it safe for the thing you are going to do with it, when you are doing it. If you escape all the data for SQL and then later suddenly decide you also want to write it to a file, the data that gets written to the file is no longer the original data
 
@BenjaminGruenbaum because smart people said so is basically how Hitler rose to power. So no
 
Oooh, he invoked Godwins law, this is getting serious
3
 
There's a line. I don't expect every developer to be an expert in everything, I expect them to have a basic level of understanding of it though.
 
lol
 
10:32 PM
@LeviMorrison they can write C for all I care if they're a competent developer. The problem is people coming to interview for internship positions are rarely competent developers otherwise they'd come interview for senior positions. Knowing the language for someone studying CS without any practical experience might be a biggie, especially if its among their first 1-3 languages. But ymmv and you might be right.
 
@BenjaminGruenbaum We need to be breeding the future smart people. Not letting them rely on experts. They need to stand on the shoulders of giants, not lean on them.
3
 
I think a lot of people think of juniors as seniors with less experience.
 
@ircmaxell I think that's why we're all here - on StackOverflow :)
@ircmaxell basic, or cursory? Because I'd probably not hire a developer who doesn't understand basic crypto but I would not design an API for the general developer public that relies on the fact its user understands crypto.
 
@DaveRandom, then my question is: if prepared statements make it no longer necesarry to sanitise $_POST data, where's sanitising actually needed ?
 
@LeviMorrison I do, but not coding experience, and also we're talking about an intern not a senior - that is someone who is still a student and will probably not work here full time.
 
10:35 PM
@BenjaminGruenbaum our definitions of "basic" vs "cursory" may be different
 
Maybe I just live in a tech-blessed part of the world.
Our juniors are all students too.
 
lolz
 
You probably graduate with 4 years of work experience and a degree.
 
@ircmaxell maybe - I guess my point is that while education is one thing we should strive for, it should be supplemented with designing simpler APIs and platforms that make making mistakes harder.
 
^^ the first 10 seconds
 
10:38 PM
@BenjaminGruenbaum I'm curious why you are looking for an intern and not a junior developer, to be honest.
 
@BenjaminGruenbaum absolutely. But a simpler API isn't a replacement for the education. It's a step after it
 
@ShowTime It depends what kind of sanitisation. You still need to use htmlspecialchars() when you output data into html, you still need to urlencode() things when you are putting data into a URL string... "sanitising" data is done whenever you take some data you don't have absolute control over (i.e. anything that's not hard coded) and use it in a situation where the presence of special character sequences could cause unintended effect.
But it's not a single one-shot thing you do somewhere in your application, it's done at the appropriate point (just before usage) all over the code
 
.@freebsdgirl http://t.co/BUa48vRS8f
 
@LeviMorrison me too, but it's not my call. If it were up to me I'd hire another senior. I don't think that a fairly small company should work with juniors or interns to begin with, (the other intern insisted on being an intern because their education program demands that) - I think that people without any experience don't have a lot of business value coding in general.
@ircmaxell if we need to educate less because there is less room to mistake - that's a big win in my opinion. I guess that's what I was trying to say.
 
@ircmaxell I preferred the giant bacon cocktail thing you put on one of the slides for one of your phpnw talks last year
 
10:42 PM
@BenjaminGruenbaum and I disagree that because we have simpler APIs that justifies educating less.
 
@DaveRandom just got the whole idea. What you say is, whilist you can use prepared statements to insert data in MySQL you still need to escape it properly for output, otherwise XSS attacks might occur. Thank you for the help.
 
@DaveRandom yeah, that one was amazing.
 
My mistake is I was directly using htmlspecialchars() so I'd no longer have to escape the output.
 
@LeviMorrison if the average intern works at your company for a year, how many interns do you think it would take to develop as fast as you do? Or as fast as people like JoeWatkins, rdlowrey, tereško or ircmaxell do? Do you think over a year including education* training 5 people would be as effective as any one of you?

* stuff like how to use tooling, source control, proper reports etc. Hours of pair programming, teaching them coding concepts, architecture etc.
 
@BenjaminGruenbaum As I think you suspect, the answer is no.
 
10:45 PM
@ShowTime Yeh, the point is really that you always keep data raw until the point where you need it escaped - similarly, don't call htmlspecialchars before you put the data into the database, otherwise you'll find it much harder to manipulate
 
Unless you count the time I take to train them away from my productivity, then at some point they'd overtake me ^^
 
@LeviMorrison because, in contrast to what perhaps was implied, I don't make 3 times as much as a junior developer or intern. We treat everyone fairly and as part of the team, they all have all the benefits, they get the same days off and paid company fun days at the beach and golf course. Just because someone is a junior here doesn't mean they get any worse treatment. They're simply not a very cost-effective imo.
 
@DaveRandom I'll keep that in mind when working on my current project.
 
Even if we start underpaying junior developers and interns and start paying seniors more - 5 junior developers is still 2-3 seniors who understand non trivial concepts that take years to master.
My CTO disagrees though :D
 
@BenjaminGruenbaum ... you don't make 3x what an intern does? I think your company might have some payscale issues.
 
10:48 PM
@LeviMorrison seconded
or at least 2x
 
Yeah, 3x maybe not but 2x definitely.
 
I don't fully agree, but in this case, yes
 
I'm not sure what you can and can't disclose, but can you say roughly what you pay an intern?
 
I'm very content with my salary and I'm proud that we treat everyone well. I get more equity and other benefits though.
 
And if it's hourly, how many hours they work?
I can understand that it isn't all about money; my paygrade isn't that high but I have excellent benefits, such as free tuition and time to use it.
 
10:50 PM
@LeviMorrison I'm really not sure we can disclose that, but we pay fairly.
 
user895378
@Danack Hmm ... I forgot to look at the connections to ensure they're limited per-host. As for the noobcore echo debugging, I fixed and re-pushed that ;)
 
We're very competitive in both what we pay and what we offer.
 
@BenjaminGruenbaum How many hours per week do interns work? Same as senior (minus maybe some extra on-call type stuff)?
 
user895378
@BenjaminGruenbaum For any sufficiently advanced PHP dev WordPress is nothing more than a rest-stop on the highway to high blood pressure and eventual rage-quitting.
 
@LeviMorrison hours are very flexible, however people who use the flexible hours the most usually work hourly.
 
10:53 PM
...but the intern is in the office roughly the same amount as the senior? That's what I'm trying to ask. Normal, 40-hour work week (or whatever is normal in your country).
 
@rdlowrey I don't think that's the case. I think that a sufficiently advanced developer knows when a project like a blog is simple enough to use an existing framework and modify it slightly rather than built it from scratch. Not less important, when to bail on the framework and rewrite when you need to add actual logic or change the product.
@LeviMorrison generally? yes. However there are special cases. For example right now I'm taking university courses so I'm only working 2-3 days a week.
 
user895378
@BenjaminGruenbaum I completely agree, but asking a legit PHP dev to work with WP all day is like asking Richard Feynman to teach third-grade handwriting class.
 
user895378
In any case, I'm not a good person to ask about hiring PHP people as all my PHP time is spent trying to devise ways to avoid dealing with standard enterprise PHP code/frameworks.
 
@rdlowrey I'd expect a legit dev to do whatever is best to get the job done. It is my personal opinion that pride over a particular technology or framework is a very unprofessional thing when it affects a business decision.
Which is why we have PHP code to begin with :D
 
10:56 PM
@rdlowrey agree, I wouldn't touch WP with a 10ft pole. It has nothing to do with stigma and everything to do with a desire not to write hateful code, and I can't see any way not to write hateful code with WP.
 
user895378
@BenjaminGruenbaum Which is why I'd never take a job like that -- I'm only speaking for myself, clearly.
 
user895378
I'm not saying it's a bad requirement.
 
Yeah, I understand.
 
user895378
I'm just saying that any dev who's legitimately happy and intellectually stimulated working with Wordpress all day is someone I fundamentally can't relate to :)
 
Never underestimate the value of getting things done.
@rdlowrey I'm happy working with WordPress and I hate it from a technological perspective.
 
@BenjaminGruenbaum It's not about pride. WP has a large number of objectively bad things about it, and one can professionally explain why it shouldn't be used for a project that has anything to do with any business decision (e.g. never-ending list of security problems, very difficult to write maintainable code using it).
 
@DaveRandom let's say I want to write a blog. Please explain to me why I should not use wordpress.
 
user895378
@BenjaminGruenbaum It's fantastic for that.
 
It's easy to scale, easy to use, comes with an easy editor, it auto updates with security fixes, it has a lot of free themes and I don't have to write code if I don't want to.
The fact it's shit from an architecture point of view is at best... irrelevant.
 
If you want to write a blog, knock yourself out. If your business wants to write a blog and it can be effectively ring-fenced off from the business critical systems, go ahead. But as soon as it becomes more than a play-thing, you need something that isn't a 0-day security flaw factory.
 
user895378
11:00 PM
But the moment you have to put your hands into the code it ceases to be fantastic. Of course, that's why you pay someone to deal with that awful mess.
 
But you have to click around in a control panel
 
@rdlowrey if your blog has anything to do that's less than 40 lines of code a WP plugin isn't that bad. If it's more well you can always rewrite, at the worst scenario you're starting to write when you understand your business requirements better and you only spent a very short amount of time since WP takes very short time to set up.
@DaveRandom right, so you think you can do a better job at security than something that powers about 30% of the web and has automatic security updates?
 
@ThW "$this->$name" ?
 
user895378
@BenjaminGruenbaum I'm not arguing WP, man :) I'm just saying I can't help you with hiring requirements lol
 
Just because wordpress has its security issues published doesn't mean they don't exist in your code. Just because your code isn't scrutinized doesn't mean it's flawless.
@rdlowrey oh, I'm mainly arguing the case against 'hating' a framework or technology.
 
user895378
11:03 PM
@ircmaxell It's pretty garbage that a server can't deal with multiple SP when parsing a request line. You have to account for variations in input.
 
user895378
(in the real world, I mean)
 
user895378
You can't just expect everything to follow the spec perfectly.
 
@BenjaminGruenbaum I think I can do better at security than something that's ~15 years old and has never had a complete rewrite, and was designed from the outset in such a way that it relies heavily on global state and as such is very easy to accidentally write security flaws into code that would work fine if I didn't name that variable $posts
 
ThW
@Danack only fallback
 
@rdlowrey yup
 
11:04 PM
@DaveRandom how is it being 15 years old relevant? Code doesn't rust.
 
user895378
@Danack Anyway, I'll look into the new connection creation a bit later this evening. It wouldn't surprise me if it's messed up -- that's the newest code in the library.
 
Volume is not a measure of security, and neither is automatic fix rollouts (just look at Windows)
 
@DaveRandom the fact companies have security experts evaluate and scrutinize it is though.
No offense, if you were to write a blog in php I do not think anyone in this room would deploy your new, never tested blog system over wordpress if security was an issue.
Assuming it would be more secure than something that has been attacked for 15 years is brave.
 
ThW
@Danack it all works with php but not with hhvm
2
 
user895378
@ThW You're expecting a lot if you expect code to "just work" on hhvm despite the marketing ...
 
11:09 PM
@ThW solution: don't use hhvm until they fix it then?
 
ThW
set hhvm to allow_failures
 
ThW
@rdlowrey I did not, but it worked before, I "just" added some new stuff
 
@BenjaminGruenbaum nice
 
That's one way to call it :D
 
user895378
11:13 PM
I understand strict parsing rules when it makes a real difference for performance at scale, but not in THAT case. That's just lazy programming IMO.
 
it saves a branch during parsing. 1 branch out of a few hundred that already exist
 
user895378
@Danack Yeah, you're right, it's definitely opening new connections for every request ... talk about perf slowdown :(
 
@BenjaminGruenbaum I don't really have an idea about wordpress code. All you can ask is a bit about PHP language and knowledge of a few functions I think. And then ask one or the other question to see if he's not overqualified...
 
user895378
Should be able to fix it tonight.
 
I'm surprised nobody has said a single thing about my Hacklang comment on roundtable
 
user895378
11:15 PM
@ircmaxell I haven't seen it. Got a link handy so I can put in the queue?
 
@rdlowrey Cool. And yeah, my poor little router is not so good at hundred(s?) of simultaneous SSL transfers.
 
@rdlowrey phproundtable.com <-- episode #5
 
@BenjaminGruenbaum I don't have a big enough ego to say I can write something that I know would be more secure, I do know that I could write something that would be more controllable though. I don't have a problem with NIH, I do have a problem with something that is so openly exposed being part of my infrastructure
 
@DaveRandom well, Forbes doesn't :D
 
user895378
@Danack no wonder you were running into open file descriptor limits ... brutal. Oh well, at least the previous push resolved some other issues as well. Once again, thanks for being a guinea pig on this :)
 
user895378
11:18 PM
@ircmaxell thanks.
 
@BenjaminGruenbaum Neither do many others. But "if all your friends jumped off a bridge would you?" yada yada. Wordpress is great for what it is, but when you introduce it into a business environment, 99% of the time very quickly someone in charge wants to turn it into something it isn't (based on what I've seen).
 
@DaveRandom right, what I'm arguing is not to keep using WordPress after that point but rather that 1) that point might not come and b) if it does, you're better off doing it in wordpress and then redoing it when you know your business requirements later than doing it from scratch the first time.
 
@DaveRandom xkcd 1170
 
11:45 PM
@Danack thanks, I couldn't be bothered looking for that :-P
@BenjaminGruenbaum My reservation about that is that, in my experience, it never works like that - the people in charge won't ever give you that time to rewrite, they'll be much more accepting of "it'll take 3 weeks" at the beginning than they will be when they want <insert shiny new feature here> yesterday or preferably earlier thanks very much in fact why didn't you do it this way from the start???
If you work in an environment where you can be comfortable that it will work like that, then more power to you
 
Perhaps
That's a good point though
 

« first day (1472 days earlier)      last day (3490 days later) »