« first day (2415 days earlier)      last day (2527 days later) » 

12:40 AM
yow
 
Wes
12:59 AM
i had \users\me\appdata\local\temp occupying 72gb
fucking windows
 
1:37 AM
gaming?
 
2:22 AM
p0rn
 
 
3 hours later…
5:09 AM
Multiple subdomains source code disclosure and directory browsing – #74662
 
posted on May 27, 2017

New Cyanide and Happiness Comic

 
 
3 hours later…
8:00 AM
@Patrick are you still writing the book/abandoned?
 
8:26 AM
@tereško do you know something similar for linux? (ubuntu)
 
arch, fedora, centos, freebsd, linspire
 
and which one is your suggestion?
 
for what purpose?
 
me and co workers are working on a server. currently we upload our code by using filezilla. now we want to make a repository on the server and just push codes
that server has a linux OS
 
I'm not 100% sure I understand what you want to do
if it is your development environment, then using git to push code to it would be all that efficient
because you would want to simplify getting the code to the development machine and doing it as fast as possible
 
8:40 AM
I don't want to write code on the local .. I want to write code on the server directly
 
then the best option would be to mount a filesystem from that server on your local machine
 
this mechanism is for when we upload the website on the server and will be faced with some bugs (while the website is ok on the local)
 
wait
you want to set up a staging server?
 
no, I want to make a remote to a repository on the server
 
what does "remote ta a repository" mean?
 
8:43 AM
suppose you have a repository on the github, you can pull and push to it. right? now I want to make a repository on my server and do pull and push to it
so I need to install git on the server, right?
 
yes
 
so which one? arch, fedora, centos, freebsd, linspire
 
but you should use only "pull" on that server
you can install git on ubuntu too
 
@tereško good
@tereško why just "pull" ?
permissions?
 
because you shouldnt be writing code on a remote server
and if you do not write code on it, there is nothing to "push"
 
8:47 AM
look, I want to upload my website on the server, what's your suggested approach?
 
@NikiC @Ekin Fixed the menu order. :-)
 
simplest way is just to call git clone //link.to/repository
 
@tereško where are you executing this command? on the server
?
 
yes
 
alright, so git should be installed on the server, right?
 
8:50 AM
yes (we already covered that)
 
alright, now suppose I've developed my website, how to upload new version on the server?
 
@Shafizadeh when it is done, you merge your code into master branch and push it to your repository. Then you connect to your website's server and clone or pull the master branch on that server
 
why are you making this hard? I can push my codes on the server
 
I have no idea what the fuck you are talking about
you are making no sense
 
@tereško ok, what do you mean ". . . and push it to your repository"? which repository? on the local or server?
 
8:57 AM
the only server that you can push to is your repository server
 
@NikiC We should really just fix our version numbers and always use Major.Patch.
 
@tereško ok, should I do something after pushing? when I push codes to the repository server, then the website will be updated as well, so what's "pull" here?
 
@Shafizadeh no, the website will not be magically up to date, just because you pushed to bitbucket server or your your personal git server
web server != git server
 
morngin
 
even if those servers exist on same machi\ne
 
9:02 AM
well I want to devote this path /var/www/html as repository .. I mean I want to make a repository on the working directory
 
that's an exceptionally bad idea
 
why?
 
first of all, because each repository will be in a separate directory, with all of your code .. including .git folder, that will have human-readable code in it
second: your project's root should not be the same as your webserver document root
@Shafizadeh single responsibility principle is as important for sysadmins as it is for developers
 
eem, yes you are right
@tereško I will follow this
 
@Shafizadeh you can automate the "pull" being called on the webserver, with got hooks
 
9:08 AM
just one note, I always work on the master branch, so I don't need to use merge at all, right?
@tereško what's hooks?
 
in the master brunch should only go the code, that is "ready for production"
well ... also git hooks
but I am not actually 100% certain, that it would work
 
@tereško seems sweet. so if I use hooks, then my website will be update automatically when I push the codes on the repository, right?
 
maaaaaybe
 
ok ok :-)
thx
 
I am not sure it actually can work that way, because I tent to deploy my personal projects manually (by running git pullon the webserver)
 
9:14 AM
nevermind .. I will pull the new version on the web server every time I've pushed something new.
see? interesting! I don't know English and we are contacting together in English! :-)
oh one more thing, when I install git on the server, my code will be only on the server, I mean there isn't any connection to github, or bitbucket, right? I mean is it safe? (that's my company's question)
 
9:30 AM
@Shafizadeh git itself is just a tool (kinda like apt-get or firefox). It does not create a repository server. And it does not come with any pre-existing connections. When you clone a repository to your server (even from github), that doesn't create any "persistent connection". Instead it just stores the "last used URL", so that your git client knows, where to send code or from where to receive it.
you can look at the .git/config file in your project
 
I see, thank you
 
9:55 AM
@DaveRandom I need to throw some stuff at you
Get in here
 
morning
 
ohai o/
 
\o
 
Hi Folks,
 
yo
 
10:09 AM
Thanks, Can u go through this link i have some issue.
https://stackoverflow.com/questions/44215452/facebook-sharing-callback-response-return-nothing
 
@PeeHaa ohai
you got about 7 minutes
 
@DaveRandom I am going to properly handle responses in v2 of asynctwitter nstead of v1 so I can just finish v1
yay or nay?
and 2) I was shortsighted and didn't realize that e.g. /account/settings are actually two endpoint GET and POST (yes I am stupid)
How to separate them \Account\PostSettings, \Account\GetSettings or \Post\Account\Settings and \Get\Account\Settings or something entirely different
Can also answer sometime later this weekend
fwiw I am leaning towards \Get` and \Post` namespaces
Yes I think that makes sense now I wrote it down, because it follows the APi nicely
tnx
 
10:26 AM
@PeeHaa fine
@PeeHaa don't like, but no better suggestion immediately
 
k tnx. Will give you sometime to think about it
 
The over-engineering side of me doesn't like the leak of implementation details
but that's probably not useful here
I doubt there will ever be a twitter API over a protocol other than HTTP
 
Request respresent well... requests so I don't think it's an actual implementation detail
 
It's the leak of the HTTP method I don't like
 
kk
 
10:28 AM
e.g. strictly I'd prefer Account\GetSettings and Account\UpdateSettings
since that is the purpose of those requests
 
correct
 
this is mostly just nitpicking though
 
But as it is now it's follows 1:1 the api including the docs which is a good thing I think
 
but e.g. at some point twitter might change that POST to a PUT, or even UPDATE
 
@DaveRandom ugh
It's worse
There is 1 endpoint that supports both because stupid
 
10:30 AM
@PeeHaa sure, future version scope
 
GET for small requests and POST for larger ones
 
@PeeHaa doesn't mean we have to
I assume you can POST a small request?
 
I was indeed thinking about doing just the post one
Yeah sure
@DaveRandom Also I have a long weekend and am drinking beer so nitpick away whenever you have (more) time
 
I must say I feel like an RPC-type API might be better
i.e. (new AccountManager($client))->getSettings(), rather than having the public xxxRequest classes
horrible naming is horrible
 
Maybe just drop the manager because it will all basically be a manager
 
10:33 AM
sure
 
BTW that would also fix the response parsing / handling
Well not fix it but make it easier
hmm food for thought
Aaaaaaaand 5 steps back \o/
 
Yeh that's what I mean, in general I think it's better to have an object model of twitter's problem domain, rather than an object model of the API itself
@PeeHaa going to this today and have a lot of stuff to do first
 
Yes I am inclined to agree
kk
Don't want to keep you here
Have fun
 
Wes
@NikiC when i do a position swap in robin hood, i have existing entry E removed and replaced with the new entry N, right? i'm going to probe E, and i noticed that i can start the traversal of E from hash(E) + 1 distance, rather than hash(E) + 0 distance
as 0 distance is always occupied by N
does that seem right to you?
 
@PeeHaa I have to do a bunch of housework first so I'm sure I will get bored/distracted shortly
@PeeHaa thinking about it, changing the public API in that way doesn't require rewriting much of what's already there, and it probably doesn't even require backwards-incompatible changes
it would just be another layer on top of what's already there
It would also make your original suggestion of \Get and \Post namespaces the correct approach, because the layer that's already there is modelling the HTTP layer
/me goes to do stuff
 
10:50 AM
Yeah have fun
As always thanks for letting me throw stuff at you
 
user6845426
Hi guys
 
user6845426
What editors do you guys use when writing your code?
 
Most are ysing either a texteditor (e.g. sublime) or and ide (probably mostly phpstorm)
 
user6845426
ahhh i liked phpstorm. it costs though right
 
Yeah but it's worth it
Ino
Imo*
Even though I have a free one for cough open source cough
 
user6845426
10:59 AM
ooo
 
user6845426
Easily obtainable??
 
I got a license from php, but they are known to sponsor big open source projects with licenses in general
 
user6845426
I'm going to have a look at pricing now
 
But again it's totally worth the monies
 
user6845426
I've been using Sublime for years but im ready for change
 
user6845426
11:03 AM
They have something for students too. Didn't realise that
 
I believe you can use the early access version of PHPStorm without paying - but it requires updating every 45 days (if I recall correctly) and there's not always an early access version available
 
user6845426
yaay i get it for free too
 
\o/
 
user6845426
I love the benefits of being a student
 
user6845426
I managed to get MATLAB for free too
 
11:07 AM
As Peehaa said if you use it for work, or even just regularly for hobby programming, IMO the time saved using PHPStorm makes it well worth the money
 
user6845426
I've got until may 2018 to get the funds for my first year ;)
 
user6845426
Thanks guys
 
I think the only other IDE I found that came somewhat close to PHPStorm for PHP was ZendStudio, but the extra benefits you get from the fact that JetBrains make IDEs for multiple languages make PHPStorm better.
Netbeans and the like just don't cut it for PHP IMO - the PHP support always feels "hacked in" and incomplete.
 
user6845426
Ah I used to use Netbeans for Java dev. Quickly switched to Eclipse
 
Wes
11:29 AM
@PeeHaa not following f1 this year?
 
@Wes monaco or in general?
 
Wes
in general
 
user6845426
I've got a script that connects to MySql. Atm, I'm repeating the code on each .php page which needs to be connected. Can I put the php connection script in a different file to avoid repeating the code accross multiple pages? I'm a beginner in php. I'm not really sure how to structure any of my code efficiently
 
Wes
you are just a VER fanboy :B anyway, redbulls have a chance today
 
I am :p
 
user6845426
11:47 AM
Oh config files
 
evenin ladies and gentlemen
 
Hey
 
Yo
!!dad
 
I hate jokes about german sausages They're the wurst
 
12:11 PM
this room is sad
 
 
1 hour later…
1:15 PM
o/
@HassanAlthaf yes
 
user6845426
1:36 PM
Does anyone here use the PEAR library?
 
@dipper no
 
user6845426
I've been reading a post on secure file upload and it recommeneded to use it
 
@dipper Don't trust anything that recommends PEAR, especially not when it contains the word "secure".
 
@dipper Look at the date on that post
 
user6845426
Thanks for the tip
 
user6845426
1:44 PM
anyone have any good reading material?
 
about what?
 
What specifically about file uploads are you looking to make secure?
 
Segfault with opcache.memory_protect and validate_timestamp – #74663
 
I'm clearly not a designer :/
 
Security for file uploads has really these main points:
- NEVER place uploaded files in a public directory
- NEVER trust the file name, file extension or type information sent by the client
- ALWAYS post-process the data of an uploaded file to validate and normalize it before attempting to *use* it
 
user6845426
1:46 PM
I'm not making a commerical site that holds important info, i'm just trying to find what standard security measures to take for file uploads, where to store the files etc
 
user6845426
Thanks @DaveRandom
 
@dipper The most important thing is that you must ensure it is not possible to in any way "execute" an uploaded file
 
user6845426
Can you expand on the validate and normalization point?
 
It's highly application-specific, what sort of files will be uploaded?
 
user6845426
I'd been saving the files in the web root xD i didn't realise the potential exploits
 
1:49 PM
@Patrick I've seen worse…
 
user6845426
At the moment i'm just using pictures png, jpg
 
@DaveRandom I really like how Aerys makes the first two obsolete. (At least the first one) :D
 
@dipper so what happens if I upload a php file and then open it?
 
@kelunik how does Aerys make the second obsolete?
 
user6845426
@Patrick i'd been checking the content types to ensure they are the correct format, i didn't realise there were exploits to get around that
 
1:50 PM
@bwoebi As it doesn't matter to Aerys. Everything that isn't covered by Aerys is covered by point 3.
 
user6845426
is what i ment
 
@kelunik ah that you mean, yea
 
@Patrick If you go an easy way like that, I'd make the darker side of the gradient on the bottom.
 
user6845426
Aerys?
 
For images it's pretty simple @dipper - firstly you need to set a reasonable size limit for individual files (2MB is generally reasonable?), then you should use gd to firstly validate that the dimensions are reasonable and can be loaded into memory as an aRGB bitmap (which is how gd represents images internally) then you copy the pixel data to a new image file
see:
 
1:52 PM
@kelunik noted. Fewer things on there - fewer things that I can mess up ^^
 
!!docs getimagesize
 
[ getimagesize() ] Get the size of an image
 
!!docs imagecopyresampled
 
[ imagecopyresampled() ] Copy and resize part of an image with resampling
 
1:53 PM
@Patrick Just ask @Wes for a draft :D
@bwoebi The menu order of amphp.org/amp is fine now?
 
You must use getimagesize() to verify that loading the image won't take up 100s of MB of RAM, otherwise you leave yourself open to DoS attacks.
Also you should do this post-processing with a job queue that only processes a resonable number of images concurrently, to ensure that many simultaneous uploads is not an attack vector
 
@kelunik yep
 
It's really nice to compare amphp.org/amp to amphp.org/docs/amp, a lot better now.
 
/me has stuff to do but I'm sure someone else can give you more info
 
@DaveRandom … like caring about amphp/dns? Am I correct? :-P
 
1:56 PM
@DaveRandom FYI: I'd like to have amphp/dns ready before the Amp v2 release if possible.
 
Currently the task at hand is... washing the fucking dishes a-fucking-gain.
 
@kelunik Indeed
 
@kelunik yeah, would be awesome … dns is quite a dep of many libraries
 
@bwoebi Also because I want to use LibDNS in Artax for example.
 
user6845426
Oh final question; web template systems? Are the used/useful
 
user6845426
2:02 PM
I've looked at Smartly template engine
 
bob
Guys I can't find a good tutorial on php classes, I can find some examples that do nothing just shows the basics. but i can't find a real world example that shows what you can use them for. Thanks
 
@dipper where do you find all this outdated stuff?
use something like twig
 
user6845426
Lol i've been using DuckDuckGo
 
Hello
 
bob
@Patrick Legend, that's what i'm looking for.
 
2:11 PM
morninigs
 
hey ronnimon
 
yo PeeHaaChu
happy weekend (=
 
Have been baking in the sun for two days now
People moving by start taklnig English to me
 
Yea, the sun is reaaaaly nice atm
I should go for a walk and meet some birds and cats or etc
 
Maybe a little bit too hot.
 
2:19 PM
yes, and I am all pale, but one can hides in teh shadows
 
32°C today, 33°C tomorrow
 
user6845426
where abouts are you @kelunik?
 
@dipper Karlsruhe, Germany
 
user6845426
nice
 
killer weather
 
user6845426
2:23 PM
I had 23 yestarday, that was enough
 
@RonniSkansing Same for me hence the English remark :P
 
(= lol
 
They opened a new park recently with a small artificial pond, but unfortunately the park is that new that all trees are too small for proper shadow.
 
@kelunik Yes but on the other side te people over there make a fuckton of beers
beers > trees
 
3:02 PM
…dangit I still want enums and algebraic data types
I should Just Do It™
specifically:
enum AccountCreationStatus {
    Success(int $userId),
    ExistingUsername,
    InvalidUsername,
    InvalidPassword
}

class UserManager {
    function createUser(string $username, string $password): AccountCreationStatus {
        if (/* ... */) {
            return AccountCreationStatus::ExistingUsername();
        }
        /* … */
        return AccountCreationStatus($userId);
    }
}

$um = new UserManager;
$status = $um->createUser($name, $pwd);
if ($status->kind === AccountCreationStatus::InvalidPassword) {
would be better with actual pattern matching though, but hey
alternatively:
$status instanceof AccountCreationStatus::InvalidPassword
which would require a little magic but that'd be nicer
fuck it let's implement it
 
@Andrea can you please remove the () from enum values without attached data?
 
@bwoebi I'd like to too, but it's troublesome
 
also, === should match for non-algebraic types too
 
@bwoebi good point, yes
 
@Andrea why?
 
3:15 PM
@bwoebi and obviously == would work for the ADTs, though you shouldn't use it
@bwoebi constants can't be objects
 
@Andrea there's no thing like AccountCreationStatus::Success constant. It is a static method giving you an instance of AccountCreationStatus::Success
 
@bwoebi constants and methods are different namespaces though?
 
@Andrea that's actually one reason I introduced IS_ENUM in my patch back then
 
@bwoebi yeah, I can understand the motivation
 
@Andrea how do you mean?
 
3:18 PM
@bwoebi Foo::bar and Foo::bar() can coexist and are different things
 
@Andrea yes
 
anyway what bothers me about the () thing is that if we drop it for value-less members, assuming we do implement enums as classes, we'd either have to return an object from the constant, or return an integer/string or something meaning value-less members would be different from their kin
also it's kinda inconsistent, functions taking no arguments don't omit the ()… OTOH constructors do. hmm
hey, what if I did new Foo::bar and new Foo:baz($a, $b)? :p
 
@Andrea /me runs
 
@bwoebi heh
 
it's a totally redundant word here
 
3:24 PM
@bwoebi new? yeah.
 
yep
 
hmm, it would mean there could be no constructor functions on the base class though :D
…wait oh god no
I know exactly how that would be misused
 
hm?
@Andrea yes
 
if SomeEnum::Member is a constant containing the name of the subclass… people would just use the string instead of, uh, an instance of the subclass…
though actually, that's not necessarily a problem
 
I do not see it as a clean solution though
 
3:35 PM
mm :/
another approach I've previously considered is having the enum subclasses be namespaced
that is
namespace example;
enum Foo { // example\Foo
    Bar,   // example\Foo\Bar
    Baz    // example\Foo\Baz
}
but then they look like independent things
 
yeah, It wouldn't do that
I really would use them as constants
whether we search a way to allow objects in there or have a dedicated enum type, I don't care
 
so the current idea is like, Foo::Bar() returns an instance of example\Foo$Bar I guess
 
@Andrea or just example\Foo::Bar actually
 
@bwoebi yeah, or that!
the thing is I'd rather not expose constants containing the class names
in which case… how do you check which member it is?
could generate isBar() and isBaz() methods perhaps
 
@Andrea how do you mean?
 
3:41 PM
…oh my god.
 
$foo == Foo::Bar and $foo instanceof Foo::Bar would be both valid
 
@bwoebi that requires Foo::Bar to be a constant containing the class name
anyway I just realised a cool way to do this
pattern matching with no new syntax:
 
@Andrea no
@Andrea instanceof expects a classname as bare T_STRING currently
 
@bwoebi yeah, it'd have to be modified
@bwoebi I suppose we could have special logic for enums, but it'd be… weird
anyway, my idea:
$um = new UserManager;
$status = $um->createUser($name, $pwd);
if ($status->matchInvalidPassword()) {
    die("oh no");
} else if ($status->matchSuccess($userId)) {
    echo "Hello new user, ", $userId;
}
we could generate match methods for each member (returning a boolean of course), and for members that contain data, it could extract the values for you (using references)
 
ummmm
 
3:46 PM
…I know, it's an… interesting approach :p
 
Wes
\o
 
@Wes o/
 
Wes
hey @Andrea i got a scary php feature too! i remember you were wondering about having e.g. constant "strlen" containing a closure, Closure::fromCallable("strlen"). i did that :B and it was simpler than i thought it would've been, it's all already supported basically
i just copied the code from define() but i allow anything to be set into a constant
 
@Wes well I meant having there automatically be such a constant
@Wes probably going to get segfaults and stuff if you enable opcache :p
 
Wes
lol
you sure? nikic's extension scalar_objects supports e.g. false->method()
and i don't think there is magic for handling that kind of stuff
i didn't overload the -> operator though, the best i could do is (strlen)->__invoke()
 
4:01 PM
@Wes different magic
 
Wes
would be great to have constants being constant variable references, not strictly "immutable" data
 
@Andrea I'm not sure … what about extracting the data from the algebraic types?
 
@bwoebi it does it for you, look at the second branch
 
@Andrea no, to get the actual user id
oh
I see
you pass by ref
 
yeah
 
4:12 PM
I hate this implicit by-ref passing
brml
 
I know, right
I tried to write a patch that let you optionally use & for by-ref
but it was tricky to do and I don't know that part of the VM well enough
 
@Andrea Well, if you RFC such a thing, I'll provide the impl ASAP…
 
@bwoebi I would happily write an RFC for that.
 
@Andrea I'm just wondering about selling this to internals?
 
@bwoebi I mean it sells itself, it means you can tell what's by-ref from looking at a call, if whoever wrote it was so kind.
Would it pass? I don't know, but hopefully.
The annoying thing is obviously we can't force people to use the & right now.
Though maybe we could deprecate it or produce an E_NOTICE
 
4:16 PM
@Andrea well… yeah, we first need to pass it and then deprecate
yes
 
can't deprecate in 7.2 though because of BC annoyances
 
@Andrea sure
 
but maybe in 7.4 or 8.0 or something
 
yes
 
I see we are of one mind ^^
 
4:17 PM
:-)
 
I wonder if English “mind” and German „meinen“ are related. Probably. Obviously they don't mean quite the same thing…
 
@Andrea well, wiktionary at least lists old Englisch myntan = to mean … so perhaps.
 
hmm
I could stick enum decl functions in Zend/zend_API.c but for my own sanity I think I'll make them their own file
 
@Andrea yeah, good idea
 
a nice thing here is that there won't be an internals-userland enum distinction
I mean you can still do silly stuff from an extension, but there's no need for separate APIs
 
4:59 PM
anyone knows a good api for global shipping calculation?
 

« first day (2415 days earlier)      last day (2527 days later) »