« first day (2387 days earlier)      last day (2555 days later) » 
00:00 - 18:0019:00 - 23:00

7:14 PM
@Jeeves you're a day early buddy
 
@DaveRandom No I'm not.
 
@Jeeves why did the sand blush?
 
@DaveRandom It saw the salad dressing?
 
hallo
 
hello
 
7:25 PM
puu.sh/vzKAO/a2724e7e50.png trying to make it so i can click those links and it will sort the file in order by name
having a tough time
I wasnt aware you can update the same page in php without refreshing?
 
You can't
PHP is serverside. It has no idea what that filthy client side is doing
 
right that makes sense D:
so, is using a header the best?
 
For what? :P
 
I just wanted to make it so that I could click the link and it would execute the sorting code on the file
and I could refresh the page
but i dont know how to implement that
 
Either do it all entirely on the client side or refresh all of them using xhr
 
7:39 PM
dat screen name
 
@DaveRandom How far is the DNS rewrite for Amp v2?
 
approximately 60% and actually on the screen in front of me right now
misses is out for the evening and I am going to bloody finish it if it is the last thing I do
 
!!dave
 
@DaveRandom should work on DNS lib.
 
7:46 PM
:P
 
@ahmedyasser seeking a video streamed via PHP is totally seekable, you just have to implement it that way
 
7:59 PM
halp, need a quick sanity check, to make sure that I am not leaving something out
so
a user has registered in the system, but has not verified the account ... and does not remember the password anymore ... so, the fucker goes though the password recover process
 
:P
 
am I correct to think, that this also would automatically make the user's account verified, if the above mentioned fucker completed the recovery?
or have I forgotten something
 
Seems reasonable to me, if "verified account" === "verified that the signup email is valid"
 
if user isn't verified he doesn't need password
 
@DaveRandom yes, that is the assumption
@iroegbu wat
 
8:04 PM
Do people click "forgot password?" before verifying account? Well, people
 
@tereško Then I would say that yes, any mechanism that gives you a 100% certainty that the use has received an email you sent them is valid. However, I would also comment that it adds a possibly unnecessary level of complexity to the system - personally as a user I would not have an issue if, after password recovery, I still has a "your account is not verified" message.
I would say it definitely needs a comment at the point where you set the "verified" flag during password recovery, if nothing else
It feels like the sort of thing that some other dev could come to and cause an accidental security issue, unless it's made obvious why that logic is where it is
 
so, in short, you answer @DaveRandom is: yes, but it needs to be documented
 
that would be the tl;dr, yes
 
Wes
@NikiC no remove_node here? github.com/nikic/PHP-Parser/blob/…
 
I would say "no", because you are going to send link to change password to an email address you haven't verified to belong to the user
 
8:11 PM
hmmm
 
not sure how it would be a problem
 
Depends on what information you have stored about the person
 
hell, you got a mail to the "wrong account" already, when someone registered, and it could have contained "click here, if you did not register"
 
While the responsibility for the error is the user's in that case, he might have a point. e.g. if user A has given you their home address/phone and an incorrect email, it probably shouldn't be possible for user B who owns of the email user A entered to find out those details by doing a password reset.
Maybe you should just not let unverified accounts reset their pw, but rather on the result page of "reset password" you should add a message of "if your account is not verified, you cannot reset you password, click here to resend your verification email"
 
that would also require a manual dispatching of the verification mail
 
8:19 PM
?
 
in that case, you cannot send the verification mail automatically, because you still would risk exposure of private information
the user must have logged in once at least and would have to manually request the verification
or the scenario, that @iroegbu described still is possible
 
Oh right yeh user B can just verify the account, duh
ugh
 
^ that is my current state
 
ping @ScottArciszewski?
If any of the semi-regulars can give you a good answer, he's your man
 
@ScottArciszewski haaaalp
 
8:26 PM
twitter might be a better bet for rapid-ish response
 
I dont think I can explain this in 140 characters
 
neo
is there anyway to find list of all websites other than alexa top 10 million ?
through some rather IP ping ?
 
List of all websites makes no sense
 
there is no way to find all websites
 
@PeeHaa tell google.
 
8:32 PM
@DaveRandom They already know
 
oh tiny
 
It's kinda what they do :p
@DaveRandom oooh :D
 
a large portion of websites is only visible from specific IP ranges or only via Tor
and then there are sites, that dont have public DNS entries
 
neo
@tereško is there some sort of IP order followed by popular server providers ?
 
no, not anymore
@neo google does not know all the websites .. what chance do you have?
 
neo
8:35 PM
@tereško i'm mainly concetrating on websites likes shops and restaurants
 
lol
 
@Wes yes. what would it even do?
 
neo
@tereško yeah weird but i think its valuable
 
@neo it also is impossible
 
neo
there are 12 crores of website
in .com domain
 
Wes
8:38 PM
@NikiC i see why it's not allowed, it's just frustrating guessing what the parent is, i have to whitelist all those node types that can stay in an array, right?
 
neo
or I can scrape facebook directory
 
@Wes what are you trying to do?
 
neo
but block on 256 http requests
 
which part of "impossible" caused the confusion?
 
At a guess, what you want to do is return remove_node for a stmt\expression, rather than the expression it contains?
 
neo
8:40 PM
@tereško i was just talking,i know its impossible
 
if you want to say meaningless bullshit, talk to your cat
 
neo
I dont have a cat :D
 
Wes
@NikiC correct. what i'm doing exactly is removing from a php file anything that is not a symbol declaration. say for instance:
<?php
namespace X;
const A = 1;
echo "FOO"; // remove
class Bar{}
 
@ScottArciszewski basically I would like to pick your brain about the problems regarding password recover in relation to email verification. I assume, it would be a bad idea to let unverified users to recover password, but then, what would be the best approach in actually performing the verification?
 
Wes
what i did so far, probably not a good idea, dont_traverse_children in anything but namespaces, in enternode
if($node instanceof Namespace_) return NULL;
return NodeTraverser::DONT_TRAVERSE_CHILDREN;
then remove in leave node, except that i have to guess what's what
 
8:44 PM
@Wes I think it would be easier to collect what you want to keep in this case than the other way around
 
Wes
i think it will be simpler to just do foreach(namespaces) foreach(namespace->stmts)
maybe.
yes :B
 
Wes
i always pick the hardest way...
actually, it's actually the same code :B
 
@Linus not really, but it gives me an idea, that is somewhat unrelated
 
Wes
pastebin.com/xF0h7mcv @NikiC there has to be a better way...?
 
8:52 PM
let me try more..
 
Wes
i still can't adapt my neurons to this kind of logic :B
@NikiC
a nice thing to have would be, in enter node, specifying which kind of children are to be traversed, e.g.
enterNode($node){
    if($node instanceof Namespace_) return new TraverseProperty($node, "stmts"); // this sucks, but you get the idea...
    return NodeTraverser::DONT_TRAVERSE_CHILDREN;
}
 
@DaveRandom I think a working solution would be issuing a generate PIN code, when user click "verify my email account", but there are two issue with that: 1. it starts to smell like overkill, 2. email reception times are not all that trustworthy and you can loose that PIN in the meantime
 
@Wes out of scope
traverser logic is super complicated, it's not worthwhile to handle special cases
@Wes I'd just look over the statements + the statements in namespaces and drop everything unnecessary there
 
paragonie.com/blog/2015/04/… read account recovery part tereško
 
Wes
enterNode($node, $children){
    $children->excludeAll();
    $children->include("stmts");
    return $children;
}
 
8:57 PM
Your problem is shallow (restricted to just two levels), so solving it with deeply recursive traversals is not necessary
 
Wes
indeed
 
@Linus aw deer, I read the 3rd point in recommendations and it made me laugh
 
Wes
you did a great piece of software. you created a monster (me) i'm now enabled to do all the mad things i ever wanted to do :B
 
@tereško GnuPG one?
 
yeah
 
Wes
9:01 PM
...that you will certainly hate and that will make you regret creating phpparser :B
 
neo
why whatsapp groups is limited to 256 member ? is that any bcs of server issues ?
 
why? ;p
 
emm .. ok, a different question to the auditorium: how the fuck do I test this: github.com/teresko/palladium/blob/master/src/Palladium/Service/… ... basically all I can do is test the class of the returned instance
 
im trying to buid something like imdbnator .. is there anyway to sanitize such strings and recover movie name in passable format .." Keanu.2016.720p.BluRay.x264-[YTS.AG] "
 
@Hisham machine learning?
 
9:09 PM
nope
 
that was the suggested way
 
how is it even possible
 
well .. you know ho ordinary people view developer, as if they are performing some arcane rituals ... that's how ordinary developers see those, who know how to write machine learning algorithms
 
i think they search inside some db before passing it to imdb
 
they probably just have bunch of regexp filters
 
9:12 PM
thats the only possible way
no way ..
 
the names they put to these things are unpredictable
 
not really, there seem to be quite simple patterns
of course it might be, that you dont understand, what those names actually mean, in which case it might seem to you "unpredictable"
 
@NikiC In php extension, can we use malloc directly within a single request init/shutdown? I was looking to use flatbuffer and by default it uses malloc/free.
 
@JAamish yes
 
9:18 PM
@NikiC So when exactly should one use emalloc
I understand that pemalloc is across requests
 
@JAamish for per-request memory, if you can
It's not a problem if malloc is used, emalloc is just better
 
can you write a simple regxp function to filter these two
array(2) { [0]=> string(25) "C:\bkupx\gasew\New folder" [1]=> string(40) "Keanu.2016.720p.BluRay.x264-[YTS.AG].mp4" } array(2) { [0]=> string(25) "C:\bkupx\gasew\New folder" [1]=> string(32) "Sicario.2015.BRRip.XViD-ETRG.avi" }
 
Because it's faster, will definitely prevent across-request leaks and counts towards the memory limit
But if you can't use it because of a library it's not an issue either
 
@NikiC you mean using emalloc is faster and counts towards memory limit of php itself
 
yeah
 
9:21 PM
Ok. Thx. Let me dig further into flatbuffer, to check if I can manually replace the calls to emalloc/efree
 
@tereško
 
@Hisham no, I dont want to
 
cmon , prove your point..may be
there is a pattern .. but you will not filter past ten items using those
 
 
1 hour later…
10:34 PM
PHP Warning: session_name(): Cannot change session name when headers already – #74514
 
!!lxr session_name
 
@Danack Nothing went wrong but I couldn't find a suitable definition
 
yeah, me neither.
 
Also no repro?
But I blame him anyway
 
I guess the static throws it off somehow
@tereško seems reasonable. With regards to people losing the pin... I seem there's only just so much stupidity you can code around...
 
10:43 PM
it's not the stupidity
it's the limitation of technology
if it takes 10 min for the verification mail to arrive, you will loose the pin, if you are not careful
hell ... even if you are careful, your browser can crash
 
well yeh but you can just go round again if that happens (?)
 
and wait another 10 minutes?
taht's some special UX there
I quess it could be partially solved by storing it in a cookie, but that assumes, that you do not open verification mails on a different device
in short: it becomes a user experience problem .. and not the "should this button be blue or gray" type of problem, but a serious one
 
Well it actually doesn't seem that bad to me, but also I recognise that optimal UX around security is critical or people will just slip into bad practices
maybe you should ask a question on main site? there must be some combination of tags that won't attract 1000 terrible answers in 5 minutes
 
it's one of those "hard to explain" questions
but I will consider that option
 
I still don't really understand the point of this site but I think maybe softwareengineering.stackexchange.com ?
there's also ux.stackexchange.com
 
10:57 PM
I still need to finish testing my palladium project
and write some docs
I guess I will go with the PIN as an optional feature
 
00:00 - 18:0019:00 - 23:00

« first day (2387 days earlier)      last day (2555 days later) »