« first day (1678 days earlier)      last day (3270 days later) » 

9:00 PM
@samaYo "Good morning" when you come in, "Good night" when you leave, regardless of local time :)
 
@bwoebi BTW, should I add a note to upgrading.internals?
 
@ircmaxell for the password_hash change? I can't give you a good advice here. I wouldn't for a normal function… but … well… it's password_hash()… no idea.
 
@bwoebi no, for the php_crypt() change
it's just a function signature change
actually, screw it, I'll just ignore it.
 
@ircmaxell If we'd note everything what changed in PHP 7 there, we'd have a few MB of text^^
(also, didn't notice that you said ….internals)
 
Goodnight!
 
9:13 PM
@ircmaxell can you shed some light on:
> If you are serving a redirect, that redirect must have the HSTS header, not the page it redirects to
 
what now?
 
I read that as the non https version should already add the hsts header, however:
> An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.
 
right, you need to upgrade first
 
So that line on the chromium page is talking about when (you do a redirect when) you are already in the tls "environment"
?
 
9:48 PM
@ircmaxell was that my fault when I "fixed" the DES stuff in bcrypt?
 
@Leigh no, it was my fault when I added the deprecated notice to the DES fallback salt
 
ok, good :)
 
btw, I'm planning when I get a few minutes (likely 2-3 weeks out) to refactor password_hash to use the internal random API provided by your patch
 
\o/
Relocating for a new job in 2 weeks, will be around more when I'm settled there.
 
and possibly look at refactoring session generation (tho I don't know that area as well, so may not touch it either)
 
9:49 PM
I want to reply to Scotts libsodium RFC too
I've brushed sessions in the past, they're kind of horrible and could do with a clean-up
although, haven't looked since Yasuo had at them
 
@Leigh we're working on a "PDO" for crypto
 
"we"?
 
basically an abstraction layer on top of libsodium or openssl (or any others)
@Leigh Scott and I
 
@Leigh s/do with a clean-up/nuking from orbit/
 
right, well, I'd like to be involved, do you have a public repo?
+1 for abstraction layer, that's what I proposed in my mail about revamping crypto several months ago
And do you have some kind of roadmap/todo list?
 
9:58 PM
@ircmaxell squeezed into PHP 7? (I know… but I can dream?)
 
@bwoebi no
@Leigh right now, we're just tossing around ideas
 
@ircmaxell ok, well, I'd still like to throw in my 2c
 
a lot of details will change from that (like the constants, etc)
but we're talking in #php.security on freenode
 
of course
ok, I'll be there soon(tm), online via phone right now, and it annoys me a lot, so I generally just stay offline
 
we're not talking now
 
10:01 PM
by soon I meant, in the coming weeks :p
 
ty
 
I'm thinking about a dsn of sorts: openssl:cipher=aes256; with good defaults and error-checks to prevent insecure methods and modes (no ECB, etc)
 
@ircmaxell Line 63… decrypting with a public key?!
oh… just a typo… I see, the variable is correctly named
 
Eh, you might need to allow stupid things like ECB for interop with external broken stuff.
 
10:03 PM
you also might need ECB to implement unavailable cipher modes in userland
 
@Charles no
 
@Charles In that case just use the primitives… it's anyway broken…
 
@bwoebi precisely that
this is an abstraction, not exposing primitives
 
Fair enough.
 
I'm thinking along the lines of password_hash
sane defaults, only secure (with forward compatibility in mind), but not a catch-all sollution
 
10:05 PM
Sorry guys, I need help on block ilovevitaly, around the web I found this solution using htaccess:
SetEnvIfNoCase Referer ILoveVitaly.com spam=yes
SetEnvIfNoCase Referer ILoveVitaly.ru spam=yes
SetEnvIfNoCase User-Agent ILoveVitaly.com spam=yes
SetEnvIfNoCase User-Agent ILoveVitaly.ru spam=yes
SetEnvIfNoCase Referer ILoveVitaly.org spam=yes
SetEnvIfNoCase Referer ILoveVitaly.co spam=yes
SetEnvIfNoCase Referer ILoveVitaly.info spam=yes
SetEnvIfNoCase Referer ILoveVitaly.net spam=yes
SetEnvIfNoCase Referer ILoveItaly.ru spam=yes
SetEnvIfNoCase Referer shopping.ilovevitaly.ru spam=yes
SetEnvIfNoCase Referer maps.ilovevitaly.ru spam=yes
is it good proceed this way? I think it's a bad thing for time loading
 
@Simone Why don't you just try it and measure the performance change?
 
I wanna ask to the experts here
is it a good practice?
 
@Simone Why don't you just try it and measure the performance change?
 
I think no, especially if you need to block many different referer
@Danack I understood, but I wish to know your suggestion
 
My suggestion is to try it. The actual effect may or may not be fine for your system, but that will depend on a large number of factors, so the only sensible thing to do is to measure your sites page load time with and without that stuff.
 
10:11 PM
ok thanks
@Danack I'm only a bit confuse because I don't know if it's better using this or mod_security from apache or something else
@Danack I'm using AWS so do you think it's better using group rules for this?
 
@samaYo :-)
 
user1648409
10:27 PM
Someone any idea how to remove a lot of whitespaces in an xml string with php? Looks like that:
<node>Test text, normal text                       with a unnecessary break</node>
 
@Shiuyin preg_replace('/ +/', ' ', $string); // getting the string is an exercise for the user
The use of a literal space instead of \s is intentional.
 
user1648409
@Charles thanks a lot!
 
11:47 PM
I'm new to PHP and I'd like some feedback for a small writeup I did about OOP. deeflat.wordpress.com/2015/05/21/summary-of-oop-basics If I've got the wrong idea about aspects of it then please let me know.
 
Had an idea.
Compiling PHP to JS requires writing or using a PHP parser to produce an AST, then compiling to JS operations, right?
Thought: Why not let the Zend Engine compile down to Zend opcodes for you, then compile the opcodes to JS?
Much easier.
 
recommendation: http-colon-slash-slash yts dot to/movie/kingsman-the-secret-service-2014
this was an awesome action/comedy
 
@Andrea Technically, you could just, erm I 'guess brute' force is the best description, the translation: github.com/Danack/PHP-to-Javascript
 

« first day (1678 days earlier)      last day (3270 days later) »