« first day (2010 days earlier)      last day (2956 days later) » 

6:00 PM
@QueueOverflow Jetbrains' IDEs are clutter-free. They're better than most IDEs I've used.
 
If want a more approachable api, that always wins.
approachable > easy
approachable > elegant
approachable > simple
 
@MadaraUchiha I'm not sure whether globals are really appealing to beginners
 
@bwoebi It's a way to bypass all those pesky scope rules
 
Thanks, guys! I will try it :)
 
6:01 PM
And to be fair, at least PHP handles them with an explicit keyword
JS just goes "yeah, it's global by default, lol"
(unless you use strict mode, which you should, but a beginner is likely not to)
 
I have another question. Is it a good approach to join all javascript files of libraries (such as jquery plugins, angular modules and etc) in a single js file? I think sometime that the better idea is download that libraries from some CDN. Is it so?
 
@BenjaminGruenbaum because as @MadaraUchiha pointed out, PHP abstracts away HTTP's request/response model entirely for the user. He comes to node and doesn't understand why his code must be inside a function and why he can't just echo something on the screen.
 
@bwoebi PHP abuses stdout for the response data, while that's really neat and super simple to grasp for a beginner, it makes things like sane logging more annoying.
 
user5992646
@BenjaminGruenbaum nice use of comparison operator.
 
6:03 PM
@MadaraUchiha eih, you don't have a real stdout/stderr at all when attached to mod_php
 
@jarvis the user is right though, generally users don't care about intricacies of HTTP, I bet a lot of php users have no idea what headers are and get along just fine.
 
@bwoebi Right, and while easy to understand and ignore those concepts altogether, pretty much every other programming language out there does have an stdout and stderr
 
^^ some people just don't care
 
@littlepootis s/some/most/
 
@QueueOverflow I prefer CDNs usually, but there is no clear winner here.
 
6:04 PM
@MadaraUchiha just like cli has.
 
@TodoPertin ok I guess?
 
@bwoebi Yes, but PHP makes no distinction between the two.
 
@jarvis hangouts
 
With Java, you have stdout, and the servlet API to respond to requests (at the very low level)
 
@BenjaminGruenbaum exactly. 4 days ago I literally hated (secretly) PHP for not making the HTTP concepts clear for users from the start. The discussion during that time made me think and now I am pretty sure that PHP is doing the right thing here.
 
6:05 PM
Node also handles HTTP responses and stdout differently
so does Python
 
user5992646
@BenjaminGruenbaum it was very cool. atleast for a sorry noob like me.
 
@Abhishrek can't. doesn't work on IE mobile.
 
@MadaraUchiha so do webservers written in PHP.
 
@jarvis aiiyo
why are you on IE Mobile ?
 
> IE mobile
 
6:06 PM
reasons
 
@bwoebi Of which the % of users is asymptotically 0.
 
@jarvis right.
 
We're talking about sane defaults, remember?
 
@MadaraUchiha sure, just pointing out, that everywhere where the ecosystem is not directly tied to the webserver needs, we have that.
 
6:07 PM
@bwoebi Look, both PHP and JavaScript (and Java and Python) are turing complete languages, you can do anything in either one
That's not the point here, really...
 
@BenjaminGruenbaum well so what is wrong with having similar helpful stuff/framework/lib/whatever for node too? :P
 
What makes PHP very popular is how easy it is to approach it, and it's easy to approach it because the abuse of stdout, and because of the superglobals, and because you don't need to know what HTTP is to write a server-side app
 
@jarvis no, Node aims to do another thing. It makes it easy to write rest (and other more advanced protocols) APIs and consume them in the client.
Node is also simple, but it abstracts other things.
 
@Zirak right you are.
 
6:09 PM
sureā€¦ I'm just saying that the web SAPI is special casing some behaviors like redirecting print to the browser. I'm sure you could do the same sandbox in node.
 
@BenjaminGruenbaum I would like to disagree upfront, but state your reasons first?
 
I'm buying a patch of things on amazon. Anything cheap but useful I should add?
 
@jarvis disagree with what part?
 
@BenjaminGruenbaum "It makes it easy to write rest"
 
@bwoebi of course you can do the same for Node, but why? It's fighting against the grain. It'll never be as approchable.
@jarvis app.get("/", (req, res) => res.json("Hello!")) pretty easy, you get pretty fast performance, you can share the client and server code and you can test them together.
 
6:11 PM
@BenjaminGruenbaum I mean, you could redirect output to browser directly, have request superglobals etc. in threads managed by a mod_v8 in apache
 
@bwoebi and then you'd have to write all the drivers
 
@BenjaminGruenbaum Not just being pedantic here, but that's expressjs, and laravel does the same for PHP.
 
and change all the ecosystem, it was tried but it's not great.
@jarvis it's not as easy with laravel and there is no easy shared state, deployment is harder, performance is worse, the ecosystem is smaller and packages are more work to install
 
@BenjaminGruenbaum It's probably just as great as with PHP. (which is as you say, not great, but very approachable for beginners)
 
@bwoebi Yes, "not".
 
6:12 PM
@bwoebi php has a pretty nice ecosystem for simple stuff.
 
@BenjaminGruenbaum jip, which you could add to node too, global by default, always available.
 
@bwoebi Node isn't global by default
 
@BenjaminGruenbaum it is literally the same code with laravel just with the php syntax... the performance point sounds meh and the ecosystem part I'd just take your word for it. How are packages more work to install? composer install $package vs npm install $package...
 
Unlike browser's JS, to make something global, you need to add it as a property of the global object
 
@MadaraUchiha am I now conflating browser JS and node maybe?
 
6:14 PM
Browser's js is i = 0, i is now global
In node, i is still local to the module it was defined in
 
@MadaraUchiha no. in any node module, i = 0 will attach i to global
 
@MadaraUchiha but it's the same in PHP, just inverse relation (you make explicitly global vs. you explicitly fetch from global)
 
@BenjaminGruenbaum Is there a approach to automate this process?
 
@bwoebi Yup
@jarvis No, without var
 
@QueueOverflow there are many ways, yeah
 
6:16 PM
but ultimately obviously PHP's semantics are saner in the grand image, that's why it's still better with PHP :-D
 
@jarvis Hmmm, yeah, you're right. My bad.
 
@MadaraUchiha so, that possibly should be even more approachable to beginners then?
 
SameSite specifier for cookies (spec). Basically: Just like you can specify HttpOnly or Secure, you will be able to specify that only requests originating from your domain will send the cookies in the request. Helps prevent CSRF.
4
Read up on it!
 
@Zirak dear lord finally! Aaaaaand ofcourse this is by google.
 
@Zirak I have noticed Cap no longer unoneboxes others' gifs automatically. Why so?
 
6:23 PM
It was never a bot feature, it was some script that rlemon ran on the bot's account.
 
Please restore
 
@rlemon
 
@Zirak just another 5 years (or more) until we can finally rely on it.
 
Hello people of the world.
 
I can think of a couple ways to shim it if JS and localStorage support is guaranteed
 
6:25 PM
$('#checkoutProcedure').load('cart.php #select_dropdown');
 
@bwoebi nah, I think we're at a better place now. HttpOnly and Secure are standard (a shame they're not the default, but oh well...), plus you should defend from CSRF anyway. So....yay?
 
Why does my CSS Styling get messed up when I reload this section?
 
@jarvis How? You can't touch the Cookie header from js.
Plus, CORS
 
As I understand it's not reading the <head> again, but is there a way to do that?
 
@Zirak service workers can do that, no?
 
6:26 PM
@Zirak Yeah, we still have to use the common mechanisms, relying in that feature still won't work.
 
well... they are not well supported either
 
@Zirak You can still read and write the cookies that are already stored
 
@jarvis Yeah...if you've got service workers then you're probably good.
 
@JanDvorak not httponly ones
 
I'm not so sure about the point of httponly ā€¦ because if you can access the cookies, you just can outright do the requests too.
 
6:27 PM
@JanDvorak On your domain, not on XHRs.
 
oh, I seeā€¦
 
oh. Why do cross-origin requests even send cookies?
 
@bwoebi The point is that they won't appear in document.cookie
 
@Zirak right, but I'm not sure what the benefit of that is
 
@JanDvorak you can omit them. fetch does that by default, for instance.
 
6:28 PM
@JanDvorak That's CSRF for you. Why GET requests send cookie is clear - if you click on a link to SO, you want to be logged in when you land.
 
whether you do some XHR requests or directly hijack the session
 
@bwoebi Because if your site's auth cookie is visible in document.cookie and there's an xss all of your users are screwed.
 
@Zirak That's navigation, not XHR
 
@Zirak if there's an xss, you can just launch xhr requests ā€¦ you're even same origin then, so everything allowed
 
@Zirak less so if you only store an IP-bound auth token there
 
6:30 PM
IMO POST to crossorigins should simply not be allowed. A preflight OPTIONS request must be sent to the other origin first and see if it is ok with the request coming in (via cors headers), and then allow the original POST request.
 
@JanDvorak Well, if you can send cross-origin requests to something that means the 3rd party agreed to that.
 
@Zirak no you can send them without 3rd party's agreement. you just can't access the response...
 
@bwoebi You won't get the auth token, js can't read cookie headers on XHRs.
 
the "sending" part should not be allowed by default
 
@jarvis POST requests? From js?
 
6:31 PM
@jarvis so, do you want to require PREFLIGHT even with GET? Why?
 
Maybe if you create an iframe, inject a form and send
 
@Zirak why not? what else does XHR do?
 
GETs should be idempotent
 
@JanDvorak When did I say that>
 
@Zirak yeah, but what do you need the actual token for? you just straightahead execute your malicious actions?
 
6:32 PM
@jarvis I can't send an xhr POST to gmail.com
 
misclick, sorry
 
@bwoebi My goal is to farm accounts
 
@Zirak auth tokens won't help you with that
usernames are nice, but usernames are no secret
 
@Zirak you mean to say fetch('http://gmail.com', {method: 'POST'}) doesn't show a request to gmail.com in the devtools when run on this page's console?
 
Of course, accessing an account won't help me in obtaining accounts
 
6:33 PM
@Zirak are you assuming the auth token to be persistent?
 
@bwoebi Are you seriously assuming it's *not*>
 
@Zirak yes
I'm assuming them to expire after a while
 
ten years
 
@jarvis It does, and then it gets cancelled
@bwoebi And by then I'd have sold your account
 
@Zirak eih, I'm not talking about more than one day
 
6:35 PM
Have you ever logged in to anywhere? I don't remember the last time I logged into SO
 
@TomáÅ”Zato Is it possible to reload a page in ajax and select a newly created database item from the dropdown?
 
Not to mention my gmail
 
@Zirak That's usually something separate (cookies to remember your authorization, not an actual session key)
 
@Zirak it reaches the server... spin up a local server and check yourselves
 
And we're talking about significantly smaller fish
@bwoebi Dude, have you ever been to a website or wrote one? We're not talking ideals, we're talking real stuff.
 
6:37 PM
@Zirak The latter, yes; the former I'm not so sure about.
 
@BenjaminGruenbaum beer tomorrow?
cc @Zirak
 
Besides, an auth cookie is the login. A "remember me" cookie is a username+password in one. You do a request with one and you're in.
That's what they do by design.
 
for a limited time
 
Yeah, "limited"
 
:D
 
6:39 PM
These tokens should be IP-bound, really
 
@jarvis I executed a proof-of-concept attack not so long ago, by faking our login screen and the two factor authentication screen
 
The two SO cookies which look to be related to accounts expire in half a year, and I dunno when they were set.
 
The web service instantly runs a selenium instance that logs in with those details (TFA included), and obtains a valid session
The TFA code is valid for one minute
 
@JanDvorak There should be a lot of things
 
"limited time" is really meaningless when you can write a bot that acts instantly.
 
6:40 PM
It still means you can't store the stuff for later use
 
A remember-me cookie should have a validity of exactly one time. @Zirak
 
@bwoebi Which poses a problem when someone obtains it
Because now the attacker is in, and the real user is out :P
 
so, "remember me" = "log me in twice"?
 
There are best practices with remember mes
 
@MadaraUchiha sure, it should be invalidated when the user logs himself in.
 
6:41 PM
@bwoebi And the user is unaware that someone broke in.
There's the one best practice with the chain token
which handles that case.
 
@MadaraUchiha hmm?
 
@Zirak tell me seriously, your browser doesn't send POST requests to crossorigins from xhr/fetch?! or were you just trolling me?
 
@bwoebi Original one from 2004: fishbowl.pastiche.org/2004/01/19/…
Improved one from 2006: jaspan.com/improved_persistent_login_cookie_best_practice (with chain, to alert user of theft)
And the most updated one, from 2015: paragonie.com/blog/2015/04/… (full blown guide)
 
@jarvis shouldn't it send an OPTIONS first to check if it can actually make a POST ?
 
All interesting reads
 
user5992646
6:44 PM
is a 32 word css selector too long?
 
@TodoPertin Yes.
 
@TodoPertin wat
 
@TodoPertin very
 
user5992646
@MadaraUchiha aww :( I have one.
 
no... that's the entire point why you need CSRF. Either I have gone mad or you are both getting Biggest Troll award for 2016
 
6:45 PM
@TodoPertin sure, why?
 
user5992646
@littlepootis yep.
 
@TodoPertin what is the selector?
 
@MadaraUchiha Yep, that's what I'm pointing to (that it should be invalidated when user logs in with original remember-me cookie)
 
@jarvis No, CSRF does not protect you from, say, malicious extensions with access to document.cookie on all websites
 
6:45 PM
@bwoebi The improved one also has another chain token
 
@MadaraUchiha you realize a malicious extension can do much worse than just accessing document.cookie, right?
 
@MadaraUchiha I can do it, no Magshimim tomorrow, but I might finish work late.
 
which the server can not protect in any way possible, leave CSRF alone
 
By which you can then determine whether the logged in user is an attacker or a genuine user
i.e. if there's a conflict in chains
 
user5992646
I use a third party plugin which I have done a lot of modification to. when I view source code I can see.
 
6:47 PM
"chain" being like a device ID
 
@jarvis (ļ¾‰ā—•ćƒ®ā—•)ļ¾‰*:ļ½„ļ¾Ÿāœ§ āœ§ļ¾Ÿļ½„: *ćƒ½(ā—•ćƒ®ā—•ćƒ½)
 
user5992646
It div > div > div > span > ul > li > a... something like that.
 
So if you see a chain token with a non-matching auth token, you assume theft.
 
yip
 
what does that mean...
 
6:48 PM
@bwoebi And then what? The user has to login again? Or the token gets refreshed?
 
@jarvis You log in for the first time
 
user5992646
I do not know if it's purely selector but looks like one.
 
If the former it's a useless remember me, if the latter it's a useless security measure and it's a lock-out.
 
I generate 2 strong random tokens for you
 
6:48 PM
@TodoPertin You should feel bad for writing that
 
@jarvis That is an emoticon
 
@TodoPertin is that in CSS, or just breadcrumbs in the DOM browser?
 
@Zirak everyone with this user id is logged out and the user gets a warning and has to log in again.
 
@Zirak Here's the flow:
You log in for the first time
 
6:49 PM
@MadaraUchiha which is expressing what?
 
@jarvis Dunno, I didn't say it
 
@JanDvorak lol
 
I generate 2 tokens for you, a "chain" token, and an "auth" token
 
Look, I'm not arguing that it's impossible to make it work. I'm arguing that it's not done in practice.
 
@Zirak it's not a lock-out, you'll just have to access with user and password again.
 
6:49 PM
@JanDvorak hahaha
 
Both are kept in the database and given the the user
 
Your grandma's baking site won't do it, that vbulletin forum won't do it, so in effect, it's not done.
 
@Zirak not sure what exactly gmail is doing.
 
!!tell TodoPertin google "CSS Tricks Optimized CSS"
 
@Abhishrek Don't be annoying, drop the @, nobody likes a double-ping.
 
6:50 PM
That it can be done is irrelevant, because a lot of things can be done.
 
@MadaraUchiha was worth asking vOv. could have been some Iceland specific thing
 
@TodoPertin There are no search results. Run.
 
:o
 
hahahahahaha that's awesome
 
user5992646
@CapricaSix what?
 
6:50 PM
@Abhishrek No quotes
@TodoPertin RUUUUUUUUN!
 
uh
@TodoPertin just google css-tricks optimized css
 
That selector has the specificity of Jon Skeet's bakery.
 
there is an article by chris coyer
 
!!sleep or not?
 
@jarvis sleep
 
6:51 PM
@TodoPertin Let's start with that
 
it explains indepth what CSS selectors do
 
user5992646
!!code or not?
 
and everything wrong with what you did
 
@TodoPertin not
 
If you have an #id component anywhere in your selector
Delete everything to the left of it.
 
6:52 PM
!!> ${Math.random()*10} minutes
 
@jarvis "46.53855930772968 minutes"
 
element selectors (top level) are performance hog
 
@jarvis "76.5121136351074 minutes"
 
user5992646
@Abhishrek ok
 
prefer class selectors
 
6:52 PM
find whatever element you're selecting and add an id to it
 
@jarvis "6.152574085461428 minutes"
 
ok
 
@littlepootis or class
 
user5992646
!!tell jarvis sandbox xD
 
@jarvis Please go and play in the Sandbox
 
6:52 PM
or if you're selecting multiple elements, just use classes
 
@MadaraUchiha and if something breaks, run?
 
@TodoPertin no u
 
@BenjaminGruenbaum Sure, around 19:00~20:00 or so?
 
Sure, but you'll have to check with me again tomorrow I might have a too long day
 
user5992646
who thought the mother would be the father. very meaningful for my code. sorry. xD
 
6:55 PM
React people
https://github.com/darkyen/react-ui-components/ demo at https://darkyen.github.io/react-ui-components/#/home/
 
Why need the point in the following path string:
 require("./your_file.js");
 
@QueueOverflow / is root. ./ is current working directory.
 
Why not just your_file.js?
 
user5992646
can I use a css selector like div.className ul in my JS to manipulate with the gap?
 
Which gap?
 
user5992646
6:57 PM
before the ul
 
@littlepootis Thanks.
 
seems legit
 
@TodoPertin why would you want to use the div.className ?
can you drop the div ?
 
user5992646
@JanDvorak thanks JD. :) I can atleast try.
 
@TodoPertin You can anytime
 
6:58 PM
This is what happens the browser has to fetch all the div's in the document and then filter for .className
 
@Abhishrek ?
 
@Abhishrek or fetch by classname and filter by tagname
 
@JanDvorak IIRC chris wrote an article about it
 
1 message moved to Trash can
@TodoPertin Please don't post unformatted code - hit Ctrl+K before sending, use up-arrow to edit messages, and see the faq. For posting large code blocks, use a paste site like gist.github.com, hastebin.com or pastie.org
 

« first day (2010 days earlier)      last day (2956 days later) »