« first day (1822 days earlier)      last day (3145 days later) » 

crl
9:02 PM
i.sstatic.net/uXKuM.png < 2 imgur tabs opened
 
Yeah but not all your ram was gone
 
Is lemon not working today? I haven't seen him
 
revoke his RO status
 
crl
@Loktar hehe, at least it prevents me from staying too long on it
he's probably actually really working
 
9:04 PM
On my Express.js server, I’m doing text.indexOf(term), where text is data stored on the server, and term is received from the user via an Ajax request. Do I need to sanitize term in this scenario?
 
Not working today no.
Canadian hokiday
 
(other than doing String(term) to make I’m working with a string)
 
Oh that's right Happy Thanksgiving buddy
 
!!wiki Canadian thanks giving
 
@rlemon The Gods of Wikipedia did not bless us
 
crl
9:06 PM
well if you sanitize it, you won't perform the same search. Else I don't think it's necessary but wait for other's replies
 
@SterlingArcher thanks
 
@crl sanitize = prevent attacks (if that's even possible in this scenario); think SQL injection attacks
 
It is basically the day we celebrate the backstabbing of of my people
So yay
 
Soooo tofurkey for you tonight? lol
 
If you're accepting arbitrary data form the client, it is always a good idea to sanitize the request
 
crl
9:08 PM
How could you execute any code from .. wait checking indexOf source code
 
I don't think there's any risk of indexOf needing sanitization, no.
 
Standing in my garage vaping waiting for the finish to dry. Made a pond filter
 
@nick I’d like to know how to sanitize it, besides converting to String.
 
Sounds majestic
 
Totoes
 
9:09 PM
Welp, home time for me. Bye!
Enjoy dat filter
 
Damn phone. Can't spell anything fight
 
@ŠimeVidas actually I didn't read your initial question properly; frankly there's probably not much you need to do
 
@ŠimeVidas No
 
The data is first handled by the 'body-parser' Express middleware, then JSON.parse()-d by my code, and lastly I do String() to ensure I’m working with the correct data type.
So server-side JavaScript is pretty safe then... huh?
 
@ŠimeVidas like anything else on the server, it's about as safe as the programmer
 
9:13 PM
I’m pretty much clueless about server security stuff…
 
you could check certain basic conditions, like if the term string is far larger than anything expected and throw out the request, but indexOf is a pretty safe operation
 
!!google node helmet
 
^^ that'll help some
 
crl
as long as you don't do execSql(thatString) or eval it..
 
9:14 PM
(but is by no means exhaustive)
 
eval(term)
 
Hey, this is kinda related to a discussion we've been having at work. How shouldyou handle potential security issues in node modules? There's not really anything stopping anyone adding code that scrapes a machine and sends everything it finds to some third party. And it's not really practical to read all the code of every module, and even then you could miss stuff anyways. Do any of you work for companies who have some sort of way to reasonably measure trust?
 
The three places you really need sanitization is anything going into a database, anything going HTML, and anything going into eval. (And, really, just don't, on that last one)
 
@phenomnomnominal Security by crossed fingers.
 
@phenomnomnominal You carefully select modules which are popular and widespread (bit of a mixed blessing, since those are also sexier targets) and if it touches really critical parts (middleware is one example) consider reviewing it yourself.
Most node modules are really thin bags of nothing, I found myself wasting only a few hours auditing all my non-hefty dependencies
For lesser known modules, wait a bit before updating and review if you have doubts.
 
9:25 PM
This isn't anything unique to Node. I know there are projects to audit popular modules.
 
Also correct. You face the same problems in all other server-side environments. It's just that node modules are more far more widespread.
In both express and django, if someone gets the maintainer's ssh keys then everyone loses
 
@Zirak Yeah, it's just a bit scarier to our security council I think
 
ooh, a security council
 
"new" environment, huge push to code reuse
I'd like to go back to them with more than, "meh, it is what it is" haha
 
That term is supposed to sound scary, but I can't help but imagine a bunch of people dressed up as paladins sitting around arguing about whether corrosion eats through both armour and skin.
 
9:29 PM
That's exactly what it is
 
our dependency proxy server does the auditing automatically
 
@Zirak that's literally what happens here.
 
Anything with the word "council" in it is required to meet in dark rooms with robes, I believe.
 
@ssube who wrote the auditing tool?
 
to survive the annual s3 outage, everything goes through there, and it warns us about any known CVEs
 
9:30 PM
Wasn't @copy's company working on detecting malicious JS?
 
@phenomnomnominal it's sonatype nexus
 
@phenomnomnominal Defer to authority, say Walmart and Yahoo use node.
 
@SomeKittens Among other malicious things, yes
 
Throw a Love Potion in the mix and you win
 
for scraping, I want to eventually put in a connection whitelist on CIDRs, which will break that
especially on our build agents, since npm packages can pull in github repos
 
9:32 PM
@ssube What do you mean on CIDRs? Your routers/firewalls?
 
@Zirak We're basically proposing an audit on all the third party stuff we use before launch, then basically being pretty brutal when anyone else wants to pull something in. And pull out dependencies wherever we can.
 
@Zirak at the (virtual) router level, block all outgoing traffic that's not 10.0.0.0/8
 
@phenomnomnominal which makes dev's lives MUCH harder.
 
We're also using Synopia for internal repos, so we might add some auditing stuff behind that.
 
@SomeKittens only if you're the kind of person to rampantly pull in things you don't understand
 
9:33 PM
@ssube along those lines, we block port 22
@ssube "hey, there's a module that handles our problem in a nifty manner" "Alright, go audit all of it"
 
@SomeKittens it does, but this is pretty much only a front end project, the API is .NET (there's a node server in there for real-time too)
So there actually shouldn't be too many changes to build processes etc once we go out
 
@phenomnomnominal oh, how's Sinopia working out for you? Do you happen to run it offline?
 
@SomeKittens the audit should always be done automatically, people can't reliably do that
 
I've been looking for an offline npm for ages
 
And the damage that can be done on the client is a lot less that what could happen on the server
 
9:35 PM
@Zirak nexus, dude
 
@ssube same with testing, and we know how well that goes
 
@ssube Elaborate?
I'm talking full offline
 
Once nexus has a module in its cache, it can keep it forever.
 
@Zirak it's pretty sweet! That was why we wanted it, so that if our internet connection goes down we can still build
 
9:36 PM
you run your software a few times (or just ask for every module once) and prime the cache
 
As in, do a bunch of stuff online, save that in a zip, put it on an offline computer, use as npm
 
@ssube nexus has 8 stars on github. That's already enough to scare me haha
 
@phenomnomnominal it's on github?
 
oh this might be something different :P
 
@ssube they have a FOSS version
 
9:37 PM
there's a free version without good LDAP/AD support and release mgmt, but it's not really open source
there's just the small-scale version and the enterprise versions (we're on the small-scale one now, but serving a few 100k artifacts/month, so buying the pro version)
 
doesn't do composer - yay!
 
what is that, some kind of california v0.0.01 thing?
 
@ssube could you point me towards the auditing stuff?
 
@ssube PHP package manager
 
@SomeKittens lol
@phenomnomnominal I'm not aware of a good node auditing tool. Most of the auditing in nexus is for java stuff.
 
9:41 PM
How is Nexus OSS with detecting security vulns?
 
@ssube ahh, that's a shame
 
does it just say "oh, things are bad" and tell you to upgrade?
 
We use it for auditing and proxying java and just proxying npm
@SomeKittens yes or you can have it block deps with known vulns
so if a dev tries to use one, they'll get a forbidden
 
Hey React peeps, why is it an onClick event won't fire if the element that it's bound to doesn't have any content? For example <span onClick={this.doSomething}></span> doesn't do anything, but <span onClick={this.doSomething}>Foo</span> behaves as expected. (NOTE: height and width are set with styles, so it's not that the element doesn't occupy any space)
 
@ssube eh, not that great, just BANHAMMER if something's off.
 
9:42 PM
@SomeKittens it's by policy
 
how configurable are those?
 
Mongo is so irritating with subdocuments sometimes
 
@SomeKittens too
 
!!s/with.*//
 
@SomeKittens Mongo is so irritating (source)
 
9:43 PM
@corvid why are you using those? don't.
storage performance is bad enough without subdocs
even wiredtiger isn't particularly good, it turns out
 
@Zirak about hy...
!!xkcd standards
 
@ssube what am I supposed to do?
 
@corvid What are you trying to accomplish?
 
9:45 PM
@monners I wonder if it's an issue with fixed sizing and spans not playing nicely togethre?
 
^ interesting
 
Yeah, we all know I'm interesting :P
 
I am trying to make a one-to-many relationship, that's all really. I think arrays are just a pain to deal with in mongo
 
@phenomnomnominal
@corvid Yes, because Mongo isn't built to handle relational data.
You don't "model relationships", you denormalize
 
@SomeKittens valid
 
9:49 PM
How do you denormalize? It seems like in this use case, it's hard to put all the relevant data in the same collection.
 
first you stop thinking about collections like SQL
protip: a collection can have all sorts of different kind of junk in it
 
@corvid easy, don't normalize ;-)
 
@Retsam I don't see why sizing should have anything to do with whether an onClick event gets fired or not. I think it might have something to do with there not being a change to rendered content (although I am changing a class name, so that shouldn't really be it either)
 
@corvid Right, because you're trying to shove relational data into a non-relational database.
I don't really have much to offer in help
square peg, round hole.
 
I should probably just use postgres .-.
 
10:02 PM
usually, yes
 
Yeeeeep.
 
true
 
Mongo is great if you have data that in no way relates to other data. In all other cases, you'll run into problems.
 
and very little real data is completely relationless
 
Why does meteor use it by default?
 
10:06 PM
essentially, MongoDB is good at hype/marketing
 
because meteor is a poorly designed comprehensive "framework"
 
meteor needs to hit it
 
Lots of folks picked it up so they didn't have to do db migrations (which are a chore sometimes)
and then found what they'd gained in migrations, they'd more than sacrificed in sanity & JOINability
 
DB migrations aren't too bad, with all the tools out there
 
the MEAN stack is (mostly) garbage...
 
10:08 PM
@Claies Mongo's the only garbage part.
Express is very good at what it does, Node is, well, Node, and Angular is a very powerful frontend framework.
 
Node is bretty good
 
We'd use Postgres instead of Mongo, but then it'd be PEAN and... ick.
 
@Retsam I've heard it PANE
 
well, yes, each of the pieces (sans Mongo) are good, but any "generators" that generate a "full stack" of MEAN tend to encompass a lot of fluff and useless nonsense.
 
oh yeah, those are pretty annoying
 
crl
10:11 PM
meh, you make me feel bad, using Mongo, but I can see how it's not really better than PostGre
 
The trouble with Mongo is there's no way to succinctly say "Gimme all of the posts by a user"
 
crl
reading angular2 code feels so weird, when you've only doing 1.x since few weeks syntaxsuccess.com/viewarticle/recursive-treeview-in-angular-2.0
 
Angular2, TypeScript, or ES6?
 
Yeah, which bit
I find it really nice to read
 
crl
@SomeKittens all :)
 
10:14 PM
look, Mongo is GREAT for things like user settings or configuration data, but for real world user interaction, it's quicksand
 
Hey guys! Quick question about general ajax(jquery) to a general server
 
crl
even the templates: the attributes in brackets
 
I'm not really sure why, but when I have a localhost:8080 set up, and I have a clientside
 
10 mins ago, by SomeKittens
Mongo is great if you have data that in no way relates to other data. In all other cases, you'll run into problems.
 
I use TypeScript for Angular 1.4 right now, I find it to be pretty solid
 
10:14 PM
We also use ubuntu and spring, the PEANUS stack
 
Some cases for analytics too
 
that's ajax calling it via POST.. it's giving me back some CORS issues
 
XMLHttpRequest cannot load http://localhost:8080/SpringMVC/diagnoseUser. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.
 
crl
@corvid there's github.com/sabymike/mongoose-relationship, find it useful for adding and removing to the parent's children field
 
10:17 PM
@OneRaynyDay did you see this question?
3
Q: 'Access-Control-Allow-Origin' error MVC Spring + Zepto POST

Lombrici'm trying to POST a JSON object to my MVC spring controller, but i only receive an 'Access-Control-Allow-Origin' error MY CONTROLLER @RequestMapping(value= "/add", method = RequestMethod.POST, headers = {"content-type=application/json"}) public @ResponseBody Reponse addUser(Model model, ...

 
@Claies oh I actually haven't - thank you so much! I googled the error code and was not able to see this
 
course that could just as well apply to Angular instead of Zepto, or Node/Express rather than Spring, but there are quite a few questions answered on SO that are all some variation of this one.
 
that's my bad on the searching part - thank you so much!
Yeah, I see the response header thing and I added it but not through a filter - that might be why
 
on a brighter note, I had the most delicious Barbeque Chicken Salad for dinner... :)
 
10:35 PM
hello, anyone ever used dimple ?
 
crl
I don't feel secure with relationships in Mongo, for doing recursive relationships "recursive populate" (in their terms), but I guess at the end Mongo or Pg do the same things with relationships, there's no magic
 
dimple is basically a low friction entry point into d3 charting.... it's interesting, but it's target audience is more analysts than developers
 
i am sorry if i asked in the wrong room
 
crl
What's the best Node ORM for Postgre anyway?
@hmm did you know c3js too? found it randomly recently
 
for what i need i could use d3 or dimple.. since it was said that dimple is easier.. and i only need it basically as tool.. i wanted just to make a nice graph and move on
 
10:45 PM
so I'm watching the new heroes
and I gotta say
 
Can Dimple do realtime?
 
the writing is the shittiest sack of shit I've ever seen
 
@Mosho So it's just like the old Heroes, then?
 
far worse
take a great idea
fuck it in the ass until it bleeds to death
 
crl
!!s/orse/est/
 
10:46 PM
@crl BookshelfJS seems pretty standard; I haven't used it myself, I've stuck to KnexJS which is the query builder, without any ORM attached, so far.
 
@crl far west (source)
 
crl
@Retsam thanks ok
 
If you want a good story about people with superpowers; (and don't mind reading) Worm is phenomenal.
 
Should a (back end) framework be responsible for caching, or should that be up to the framework's user?
 
@Retsam don't need more on my reading backlog, tyvm
 
10:49 PM
I didn't mean to suggest you asked the wrong room, just that the people in this room might not be the target audience. That being said, Dimple is basically a wrapper over d3, and they even say that they expose the entire d3 api for you to use as you get more familiar with it.
 
@Mosho Mine's pretty massive too; but I was able to get away with reading Worm because it's on the web, so I just pulled it up on my phone whenever I had downtime.
 
phones can play pdfs now
toilet is where I get most of my reading
 
but not animated pdfs
 
My phone probably can't. It's ancient.
 
@Nick it depends
 
10:51 PM
i just wanted to fight overplotting with a single command concerning the color :
 
I have no idea, really, but I'm sure it depends
 
myChart.assignColor("opacity" , 0);
 
@Mosho on what?
 
Heroes never really was very good; The first season got a bump in hype over Hayden Panettiere's 9 months of "Save the Cheerleader, Save the world!" commercials, but if it hadn't been for that writer's strike extended break, it wouldn't have made it into season 2
 
@Retsam The first post got me. Favorite for after my GoT reading.
 
10:52 PM
59 secs ago, by Mosho
I have no idea, really, but I'm sure it depends
 
@crl I use bookshelf. I would consider sequelize if I was starting again from scratch.
 
@Claies I remember her, she confused my dick
 
@Nick Generally, I think yes; since the back end is usually a layer in front of some data store and you want to minimize requests into that data store if you can.
 
Bookshelf isn't very feature-ful, but you can often extend it to do that you need. Sadly, this is often.
 
@Mosho that is sooooo bad.
 
10:55 PM
Even if that data store is just a DB running on the same machine (though that's hardly a scalable solution), you're still better off with a cache lookup than a DB query, and once you have a distributed database, you really want to cache.
 
do people actually read what they have written before they submit questions? and if so, is that the way they actually speak?
 
@Claies English isn't everyone's first language.
 
I understand that, but I'm not talking about language barriers here
this is a good example of what I mean (not JavaScript, but still)....
-3
Q: Authetification Advice Requiired

Essex MaleBeen searching the web for a few days now and are trying to work out what is best for my requirements and would like the advice. First of all, I come from a VB background using Winforms with a few Webforms (won't ever touch MVC) projects. I have no experience with Entity Framework 6 or C# and kn...

 
> Authetification
 
it's extra Requiired
 
10:58 PM
womandatory.
 
I just got upvoted on an extremely old question and reading through it made me shift uncomfortably in my chair
anyone know dat feel
 
Not in that context.
Did you old question have some prediction of the future that came true?
 
no, I was just a dumb piece of shit
 
ahh. that's normal and good. it means you can learn.
congrats. some people can't.
 
yeah, you gave some crazy misguided answer that you don't remember why you even thought that might be close to right?
 
11:06 PM
no, my answers are and always were concise and on point
pokerface
 
> One solution would be to include jQuery in your app.
 
Have that happen sometimes, I've deleted questions that people upvoted a year later
 
hmm ... I think my next gaming PC will have a custom water-cooling loop
it looks way too much fun to not have one
 
@tereško hah yeah I've thought of doing that
 
f that. I have 0 interesting in fiddling with liquids in my PC.
 
11:07 PM
my dad does.. looks damn amazing
 
But yes, they look cool. I wonder if there are fake water-cooling kits for posers.
probably..
just a tube of LEDs.
 
they make closed loop kits now, pretty easy to install, and no maintenance required
 
I have an AIO cooler .. that's not the same thing
 
i don't overclokc and don't think i need any more cooling than I have. I'm boring.
 
user2620028
@luggage you know you can use non conductive liquids right?
 
11:09 PM
I don't pay enough attention to the heat getting generated, only reason I would mess with any of that is the noise
 
ohh, it's not the risk of a short, it's just hassle.
Yea, quiet is good.
 
@dievardump are you in Berlin?
 
Yep @BadgerCat, why?
 
@copy and I are going tomorrow :D
 
Oh nice, how long ?
 
11:13 PM
2 days :(
 
Oh :( you might not have time for a bier
 
We do! do you?
 
For a bier? Always
 
@BadgerCat why are women so complicated? :(
 
What? How so?
 
11:16 PM
I don't even know how to put this current situation into words
 
When have you time ? When are you arriving/leaving ?
 
Draw a picture.
 
@dievardump We're arriving at around 10am today. And we leave Thursday morning. We could do today (Tuesday) at 9 maybe?
 
Should be good I guess.
 
Awesome! Do you know any good place?
 
11:20 PM
There is a lot of good place for a drink. Depends on what kind of environment you like but I know a bunch of bars yeah
 
French people only drink wine
 
this has no USA option... how strange packardbell.com/index.html
is this what other countries feel like when they are left out?
Also Packard Bell still exists
 
I'm gonna drink my feelings away
 
I just pick UK @Luggage :p
heh I have a ton of games from Europe with no USA option, them bastards!
 
What is USA ?
 
11:24 PM
@dievardump You probably know better, whatever you like
Here's my number 01575-1664705
 
noted
 
user2620028
I used to think it really funny whenever i would get emails (doing customer service for a software) and people would send me angry letters as to why USA shouldnt be listed at the top of the list of countries out of order.
 
@HatterisMad haha
 
user2620028
they were also especially pissed to hear that it was changed to be that way because the majority of users using the software requested it to be that way for convenience sake.
 
Because if you accidentally click UAE, the government starts watching you.
 
11:27 PM
@BadgerCat just texted you
Where are you guys staying? So I know where it can be easier to meet and find a good bar at the same time
 
@Nick Use JavaScript
 
Javascript his feelings away?
 
Got it :) Tempelhof-schöneberg
 
delete this.feelings; //fml
 
fallInLove.then(() => throw Error('fuck this shit')).catch(die);
 
11:32 PM
I would have use the nopeNopeNope catch.
 
that's the onPossiblyUnhandledRejection handler for my life
 
20 hours ago, by phenomnomnominal
function nopeNopeNopeFuckThisImOut (e) {
    error()(e);
    process.exit(1);
}
.catch(nopeNopeNopeFuckThisImOut)
 
user2620028
I think it is currently the coldest day in thailand since i have gotten here o.O
 
how cold is that?
 
user2620028
77
 
11:36 PM
I hope that's fahrenheit.
 
user2620028
yeah
 
user2620028
25c
 
user2620028
i believe
 
i didn't know Thailand was that hot
not that 77 is hot, but if that's the coldest..
 
Everything is hot that close to the equator
 
11:39 PM
then i'm almost glad i live up here
-5 - 100˚F
not 77 - 10000
 
@phenomnomnominal It's a very complex situation with a girl that I went to high school with. Seriously, you can't make this shit up.
I could write a whole book
 
@Nick burn it all and run my man
 
but instead, I'll just get drunk
 
@BadgerCat well I think going in Kreuzberg or Neukkoln area can be a good idea. I'll think of a bar for tonight and text you
 
My love life is always complicated; therefore women are complicated. Or Im just retarded
 
11:44 PM
@dievardump great! :D
 
blame it on the a-a-a-a-a-alcohol
Getting drunk on a Monday night is really unwise
 
user2620028
@luggage thailand actually isn't as hot as some people like to say it is... it just is never cold
 
is it humid?
 
@HatterisMad #muggy
 
user2620028
@phenomnomnominal definitely
 
11:47 PM
thailand has more dick per capita than most other places; they just disguise it
 
user2620028
lol in what way do you mean that nick
 
user2620028
oh
 
user2620028
Oh
 
user2620028
OH
 
user2620028
FACT
 
11:48 PM
Hum, right click does not seems to function on my new flashy windows 10
 
I'm drinking straight rum right now; anything I saw can't be held against me
 
@Nick Why don't you tell us what happened?
 
You know what? I blame technology
So, this is gonna be long
 
user2620028
try to use spoiler tags
 
gets tissues and ice cream.
 
11:50 PM
You need to tell what are the tissues for.
 
depends on the story.
 
part 1: There's this girl I went to high school with; I was very socially awkward, and she really brought me out of my "shell". Her and I flirted a lot, but it never went anywhere (yes, it really was flirting, I didn;t misinterpret). Anyways, I've been away for the last 3 years, and I finally come back to MN. We hang out twice, and I get back some old feelings that are resurfacing. Anyways, she breaks up with her abusive boyfriend, and goes out to drinks with me that same night (Tuesday)
part 2: She had been texting and snapchatting me a lot the week leading up, and then a lot this past week. Anyways, she's really depressed, for a few reasons, but we had plans to go hiking this past weekend. It all seemed like it was gonna happen, but she got really depressed, and stopped replying to messages.
part 3: However, whenever she drinks, even just a little bit, she messages me again, and even snapchats me a lot. We were gonna hang out today, since we didn;t go hiking on Sunday, but she didn't respond to any of my messages, even though she seemed interested
tl;dr: She's pretty depressed, just got out of an abusive relationship. She used to message me a lot, today she didn;t reply at all.
It seems complicated, or I'm just reatarded and I don't know how to interpret women
 
user2620028
Uhh doesn't sound like she is really stable right now man.....
 
That's probably the case
but now I'm really buzzed
Dammit, this feels like 8th grade all over again. It seems so silly to spell it all out
I feel better
Still gonna drink, though
Can't stop, won;t stop
 
HAMMERTIME!
 
11:57 PM
agreed, cap
WHY CAN I NEVER HAVE HEALTHY RELATIONSHIPS
 
as you age, your health decreases, that's why you can never... have any
 

« first day (1822 days earlier)      last day (3145 days later) »