« first day (674 days earlier)      last day (4260 days later) » 

6:01 PM
@ircmaxell he makes me cringe, on IRC and on the list.
 
I ignored him on IRC
 
His ML contributions have got better recently though. At least I think so.
Or maybe he's just posting less? dunno
 
@ircmaxell , how large "cost parameter" should i set when hashing with blowfish ?
 
@tereško 317
 
6:06 PM
no
 
@tereško 316?
 
@tereško I target between 200ms and 500ms
 
so , it should be based on servers performance , instead of some fixed number
 
correct
 
that actually makes sense
 
6:11 PM
@ircmaxell I asked him today to tone it down a bit. He has been doing better.
If he makes an RFC and puts it to vote we're going to need to come out quickly and vote no.
 
@NikiC ZF1 executes in 1s, over 200 Doctrine queries, huge database, shitty code... renders these "benchmarks" useless... pokit.org/get/img/ed036b9fbe799ca54913fe6e738c2de6.png
 
I have a suspicion that because voting isn't blind people will continue to vote in accordance with the current trend most of the time.
 
rad
waddup guys!
 
So if the first 4 votes are no it will likely die.
 
@webarto what do you used foe generating those ?
 
rad
6:14 PM
guys, this is totally unrelated, my friend's webcam has some problem, to the person on the other side, the image appears pinkish for some reason..
how can this be resolved?
 
@tereško kcachegrind IIRC
 
xdebug & kcachegrind @tereško
 
noted
 
@rad remove the nail polish from the webcam?
 
rad
6:15 PM
@salathe lol, I wish it was that easy
 
@rad , did you notice that this is a PHP CHAT ROOM ?!
 
rad
@tereško I did :-|
sorry
 
@tereško fixWebCam(). problem solved.
 
rad
I wish
 
@NikiC Coding standards please… fix_web_cam()
 
6:19 PM
@salathe Ah right, it's a function...
though I'd probably make my functions camel case too ^^
 
rad
lol
@salathe any particular reason for not using camelCase? :)
 
@tereško xdebug profiler generates a file like this pokit.org/get/img/214b5f5770cbdbed11a5a5622c106021.png and you use kcachegrind to load it, and it makes all these useful graphs and data pokit.org/get/img/3d2ff15bb3764c6f4205f4875156172f.png e.g. I removed this php::filesize and gained 0.2s (it was not necessary on every call) ... haven't used it previously really... if you code from scratch you probably are already doing it right...
 
@rad Coding standards, duh.
 
We need bigger coding standards
 
rad
@salathe I understand that its a standard, my question is why? I guess beacause its more readable..
 
6:25 PM
So we can cite it like "That's defined in §137a Abs 2 PSR-2"
 
@salathe hahahaha
 
That would make it sound like serious business
 
evening all
 
evening morning :)
 
@rad I think you either missed the joke, or... missed the joke.
 
rad
6:26 PM
afternoon
 
@rad Coding standards by definition go without reasoning ;)
 
@NikiC like PSR's!
 
rad
@salathe I think I missed it
I was curious to know the reason
 
@salathe Especially those :)
 
evening
Question: Does ActiveRecord violates the LSP extending a base class with persistence logic?
 
6:41 PM
"I do prefer Yii over all other PHP frameworks ... is 100% true OOP framework." ...
 
@webarto Programmers are certainly the demographic doing most jokes (though most of them don't realize)
 
@Keyne , it violates SRP, OCP and LSP
 
"I prefer Yii Framework.
Features :
Fastest than other framework.
Nice Documentation.
Nice Features like widgets, extensions.
Best Caching features.
Complete OOP Supported.
Less Code.
Easy GII Tool to create CRUD operations.
Nice support to your problems through forum.
Proper directory structure & layout system.
Easy to upgrade previous version."

@NikiC don't know if joking, or just idiotic :)
 
lol
documentation is just horrid , widgets are tied to jquery , most of code is based on global state
 
@webarto omfg. where do you keep getting this stuff?
 
6:51 PM
stackoverflow.com/questions/667382/… don't know how I managed to find myself on that question...
 
can you give your two cents here?
http://stackoverflow.com/questions/12026020/weaknesses-and-forces-of-doctrine-2-and-propel-1-6/12030560#12030560
 
- only Doctrine 2.x uses some of datamapper ideas
- developers still think that AR is the ambrosia from gods
- you need to mention inability to test separately from DB
2
 
5
A: Which PHP framework should I choose between ZendFramework and YII?

ajsiezend = windows yii = mac the author of yii knows what user-friendlyness is. that is a VERY important aspect. yes, zend got a huge codebase, but just have a look at their online api documentation...than you take a look at yii:s..and that is the difference you should be concerned about. a userfr...

this one is the best, framework has to "look nice"
 
@tereško I've found this quite informative programmers.stackexchange.com/questions/119352/…
 
@webarto god, let's give that a round of
 
6:57 PM
active record pattern should be used for prototyping and domain object with next-to-no behavior
if you use it for anything else , you are inviting problems in future
 
@tereško Will you post it there or can I add the reference to the chat?
 
just update your post
i do not hold any copyrights on conventional wisdom
@Keyne , you made an effort to write that post, you should reap the benefits
 
@tereško :) okay
 
@NikiC I just hope they regret now what they wrote earlier... stackoverflow.com/users/206446/ajsie ... well doesn't surprise me now... 4xx questions...
 
user895378
 
user895378
7:01 PM
That's what I think of anyone with > 500 rep who answers a question like that.
 
@Keyne ,also you might want to add some link , especially for the principles that you mentioned ( both to wiki and images )
 
Actually, let's close & delete
The Q is complete BS
 
Close complete.
 
Great, let's move to the next level
 
user895378
I really need to get to 10k so I can cast delete votes :/
 
7:03 PM
-1
A: Which PHP framework should I choose between ZendFramework and YII?

ls_tttYii 1.1.X is better choise now,.. simply better design, faster, simple, OO, web2.0 widgets, code generators, etc,.. Zf has no chance at all,.. but Zend2 will be a clone of Sf2 so it will be really something! Use Yii or wait until Zf2 because will be rewritten from scratch..

 
hahaha
 
done
@rdlowrey , just start trolling , or
additionally you will work towards quite rare badges
 
user895378
@tereško Good point.
 
7:06 PM
but it is painful journey, might lead you to suicidal thoughts...
 
user895378
Or a complete loss of faith in humanity.
 
hmm .. actually in your case and might be better
 
@rdlowrey 10k by october, are you in?
 
user895378
Eh, I'm commitment-phobic. Too many important things that might interfere with my time rep-whoring
 
user895378
I'll just keep plodding along for now.
 
7:08 PM
well .. if you write a good large-format answer , we might throw some bounties in
 
@rdlowrey To be expected :/
 
@tereško Too depressing.
 
user895378
Parallelized architecture is hard. I have things working just fine, but my code just feels so disorganized.
 
you would get better results using some language which is better at it .. like erlang or haskell
 
user895378
No doubt about that.
 
7:13 PM
@rdlowrey You still working on parallel Artax\Http\Client requests?
 
user895378
@LeviMorrison Well, not so much working on it -- it's been perfectly functional for several days. I'm just trying to refactor to a sensible architecture before moving on. Otherwise it will be a maintainability nightmare.
 
Gotcha.
 
@tereško Updated
 
user895378
@rlemon lol, this is going to be awesome.
 
user895378
7:17 PM
> I was open to Visual Studio so I started ripping some mad VBscripts
 
@truth why did you change this? stackoverflow.com/posts/60496/revisions. AFAIK mysqli doesn't support emulated prepared statements
 
hi Everyone. I created a new dateobject $today = new \DateTime('09-09-2012',$timezone); How can I tell that the first 09 is the day of the month and the second one is the month?
 
@LeviMorrison of course
tnx
 
@sanders That's just how PHP parses that format, it won't be the other way around.
 
@salathe sorry dont understand what you mean
 
7:45 PM
@sanders PHP won't see 09-09-2012 as month-day-year.
 
owh but that's important. @salathe how can I enforce it
because i need to make sunrise calculations based on the date
 
@sanders enforce what?
 
that php sees for example 4-11-2012 as november 4th and not as april 4th
@salathe ^^^
 
You don't enforce anything, there are a set of rules about how PHP will interpret the dates based on documented formats.
 
@salathe What's wrong with: $date = DateTime::createFromFormat('d-m-Y', '09-09-2012', $timezone); ?
 
7:47 PM
@LeviMorrison nothing?
 
@salathe so how can I be sure that php interperts it the right way?
 
@sanders sorry, I don't understand the question.
 
@sanders Just use createFromFormat and you'll be okay.
 
@sanders PHP will not see that as April 4th. Ever.
 
@salathe got to go now will post a question on sto
ttyl
 
7:49 PM
@sanders ciao
@sanders Good luck to whoever answers that one. :)
 
@salathe I'd get some easy rep on it . . .
 
@LeviMorrison I'm not sure it would be easy!
 
@salathe huh?
nvm :)
 
@PeeHaa lol, engage brain.
 
@salathe :D
 
7:55 PM
@PeeHaa Saw your message
29 mins ago, by PeeHaa
@truth why did you change this? http://stackoverflow.com/posts/60496/revisions. AFAIK mysqli doesn't support emulated prepared statements
Does mysql_* support emulated prepared statements? Or even prepared statements at all?
 
I rolled back in the mean while... :) Couldn't understand the change. Feel free to correct me
 
Or have I misunderstood your comment?
 
@Truth hmmm maybe the sentence is whacky it's about the mysql driver in combination with pdo
 
@PeeHaa So you shouldn't say mysql and PDO
Maybe just PDO, or PDO accessing a MySQL database or something similar
 
@Truth It has to be in there. other database drivers act just fine
It's just that pesky mysql ;)
@Truth I like the latter
 
7:58 PM
 
guys , can anyone suggest a good tool for making ER diagrams ?
 
@Truth What's wrong with some nice regex?
 
@tereško tried this? lucidchart.com
@PeeHaa Regex is like JavaScript
When something is (easily) solved without it, it's probably for the best.
 
@Truth It is powerful? ;)
 
@Truth i was aiming at something for desktop
 
8:01 PM
@tereško MSPaint FTW?
 
@salathe I respect you opinion, they are useful for me and I am accustomed to them. They are of less use to a rookie who should know slashes are the norm, but since i explain it in my text i think it's ok. — Mihai Stancu 3 mins ago
:P
 
@PeeHaa Self-centered little sod.
 
yep
 
user1125394
Hi people
 
@Truth By the way, that was created by BYU CS students.
 
8:12 PM
@PeeHaa Ha, he's trying to be all defensive about it.
 
A while back, anyway. Certainly aren't students anymore.
 
@tereško Have you tried MySQL Workbench?
 
yes , and it's not what i am looking for
 
@PeeHaa it consumes server's resources, not client's. — Evandro Silva 11 mins ago
:P
 
Anyone tried using clang to compile PHP to LLVM?
 
user1125394
8:22 PM
@Truth lucidchart.com rly cool, the bad thing is it seems to lack connectors and layouts, I was using yEd for graphs
 
Why is everyone calling basename() a hack? :(
 
user895378
@LeviMorrison Is it worth broadcasting a Client::EVENT_IO_ERROR event when a network error occurs mid-transfer if the very next line is just going to throw a TransferException?
 
It seems to me you should do one or the other.
 
user895378
Well the problem is that for blocking requests an exception needs to be thrown to indicate the exceptional circumstance, but for parallel non-blocking requests such an occurrence shouldn't throw because it would break all the other parallel transfers if one particular request failed.
 
user1125394
8:35 PM
you ctach it
 
user895378
Yeah I know, but that has no bearing on whether or not to broadcast an event to interested listeners as well.
 
@Pierre So you are telling me that if ($_POST["request"])==10 isn't producing an syntax error where you live? That would be... strange — PeeHaa 33 secs ago
 
h-o-l-a
good morning
 
@Lusitanian evening :)
 
8:48 PM
no, morning. UGT.
it's actually evening here too
 
Sorry. morning @Lusitanian!
 
Hey
Levi, you there?
 
@JordanRichards Yep.
 
8:55 PM
Uhh I was wondering, could you go back to that room?
 
h̭̗͛͟ë̈́ͨ̓̉͏͕̹l͈͐̏p̰̭͔̗͂́ ͤṽ̛̻͉͉͕͚ͦ̏̍̎̇͑ã̧̑ͨͣͨm̛̩͍͈̝̯̻ͬ̀ͧ̓͐ͣp͕̳̓͛͊̚î͖̰͍͓́̇ͯr̅̂ͤ̀̑͞ḛ̥̝̖̥ͯͩ̂s͛ͭ̈ͩͮ̿ ̱̉ͪ͢.̞̩̼̖͖̊̆̾ͭ̈́ͦ̚.̮̭̭̘̪͉̻̄ͫͫ̅̂̔.̟̟̬̝̣̪̊͛ͫ͋̒̌̂ ̖̝͇̰̖̬t̪͉̙ͅh̻̮̱̓̽̾̅e̹̗̫͉͔͇̗̐ͦ̇̽ͦͬ̓ỷ̮̦̬̉ͫ ̧̦̗̼̲̞͍͓̀c̢̘̤͈͙͒̔͌̿ͪͬo̸͕͍͗̏ͨ̈̍̚m̬̰͉̪͔̖̲͠e̅́!̖͎͆̐̀͐̆
 
@webarto It doesn't work as well in chat :P
 
@PeeHaa awesome
 
good
 
9:00 PM
@Truth needs moar jQuery :P
$.ajax({type: 'post', url:'http://chat.stackoverflow.com/chats/11/messages/new', data:{text: '
h̭̗͛͟ë̈́ͨ̓̉͏͕̹l͈͐̏p̰̭͔̗͂́ ͤṽ̛̻͉͉͕͚ͦ̏̍̎̇͑ã̧̑ͨͣͨm̛̩͍͈̝̯̻ͬ̀ͧ̓͐ͣp͕̳̓͛͊̚î͖̰͍͓́̇ͯr̅̂ͤ̀̑͞ḛ̥̝̖̥ͯͩ̂s͛ͭ̈ͩͮ̿ ̱̉ͪ͢.̞̩̼̖͖̊̆̾ͭ̈́ͦ̚.̮̭̭̘̪͉̻̄ͫͫ̅̂̔.̟̟̬̝̣̪̊͛ͫ͋̒̌̂ ̖̝͇̰̖̬t̪͉̙ͅh̻̮̱̓̽̾̅e̹̗̫͉͔͇̗̐ͦ̇̽ͦͬ̓ỷ̮̦̬̉ͫ ̧̦̗̼̲̞͍͓̀c̢̘̤͈͙͒̔͌̿ͪͬo̸͕͍͗̏ͨ̈̍̚m̬̰͉̪͔̖̲͠e̅́!̖͎͆̐̀͐̆', 'fkey': $('#fkey').val()}})
 
1
Q: URL encode can bypass xss filetering?

LettermanThe second piece of code here http://anautonomouszone.com/blog/xss-cheat-sheet, claims to bypass html special chars filtering (meaning, <>) by url encoding: Bypass filter when it strips <script> tags: %253cscript%253ealert(document.cookie)%253c/script%253e Obviously this is URL encodi...

just can't get it..
 
hello world
how do i encode my girlfriend without her throwing an exception?
 
encode? is that code for anything sexual i'm unaware of?
 
Where does it state is bypasses the htmlspecialchars filter? Looks more like a blacklist filter prevention. — PeeHaa 16 secs ago
 
is there not a "•" character in ISO-8859-1?
 
9:10 PM
it says it bypass filtering of these chars < >
 
@Letterman what kind of filtering? Nowhere it says htmlspecialchars() right?
 
@salathe still here?
 
it doesn't mention the function htmlspecialchars() specifically
@PeeHaa but it mention striping <script > tags
 
@AndyPerlitch Not in the low numbered ascii table. Lemme double check whether it is in extended
@Letterman By what means. For all you know it's about blacklisting / simple search and replace
 
@PeeHaa like example 2 here: owasp.org/index.php/Double_Encoding
 
9:13 PM
generating a pdf on the fly with FPDF and the • came out all weird
 
@PeeHaa No problem. I just don' t get when does it decode back to <script >
 
ok, i just set a var to chr(149) and interpolated that wherever the bullet was
 
Now you're just plain copying! — Truth 32 secs ago
@salathe
 
@Letterman All that stuff is about filtering
If you do htmlspecialchars() with the correct encoding the can even triple or quadruple encode it. It won't matter.
htmlsepcialchars() doesn't filter. It encodes
 
@PeeHaa so what are they saying? example 2 here: owasp.org/index.php/Double_Encoding. "owever, the web application can have a character filter which prohibits characters such as “< “, “>” and “/”, since they are used to perform web application attacks. The attacker could use a double encoding technique to bypass the filter and exploit the client’s session."
 
9:16 PM
@Letterman Again. That's about filtering.
And using a blacklist of characters not allowed. Which is the wrong way to do these things to begin with
In most cases
 
@PeeHaa Obviously white list is always preferable
Anyway, so what can the attaker do to bypass the filtering of < >
 
@Letterman I like to be very very easy on my users. If they want a username of <script>alert('Immahaxzor!');</script> they can have it. I don't care :)
 
@Letterman Filter is preferable only if input may contain html
Then you just use a filter to remove evil tags etc
 
@PeeHaa XDDDD
 
And if you want the user to input HTML (which will fail if you use htmlspecialchars() for obvious reasons) you should use HTML purifier.
Don't try to create your own black- / whitelist. It will either get in the way of the user (false positives) or will leave holes in your application :)
 
9:21 PM
@PeeHaa I see. But what (they are saying) the attacker can do to bypass filtering of < > ? how double encoding helps him here?
him/her* !
 
@AndyPerlitch 167 is as close as you can get I think with ISO-8859-1
 
htmlpurifier > *
@PeeHaa change your profile photo back to firefox girl
(:
 
Friday my friend :D
 
lolwut
oh gender friday again?
 
@Truth DateTime::createFromFormat('d', 21)
 
9:23 PM
@PeeHaa hm... i am getting § for 167. 149 is giving me the bullet (•)
 
i finally bothered to install composer systemwide
 
sooo im guessing im not actually in iso 8859
haha
 
@AndyPerlitch sorry my bad
:)
@Letterman example:
 
@Truth the OP accepted the hardcoded answer... good job!
 
@PeeHaa no not at all, appreciate the help
 
9:25 PM
example is coming! behold!
 
Is there anything wrong with this code:
$xmlvals = array(
		new xmlrpcval($url),
		new xmlrpcval($siteName),
		new xmlrpcval($version)
	);
The PHP checker I'm using is giving me Error: There is 1 array declaration that contain text character variables or values without quotations: on that line
 
extending SEChatModifications.user.js
 
@salathe Yeah -_-
 
to do what
 
@PeeHaa ?
 
9:30 PM
@Lusitanian I want to be able to save messages from the transcript to clips
 
i am so dumb...i just renamed my composer binary to "cp" for convienence purposes
lmao
 
function validString($string) {
    $decodedString = someDecodeFunction($string)

    if (strpos($decodedString, '<') === false) {
        return true;
    }

    return false;
}

echo validString('&amp;lt;');
Looks valid, but it still contains an encoded <.
 
echo $conversation->directionHeaded(); // "nowhere"
 
@PeeHaa very well. but how come the *DECODED string comes to the user?
 
It doesn't...
 
9:33 PM
so that's not an XSS!!
 
it isn't
 
user1125394
sry very noob question but I'm struggling with that, can you explain the differences between that stuff
 
user1125394
echo (strpos("index.php?action=QSD","index.php?action=login") === false)."\n";
echo (!strpos("index.php?action=QSD","index.php?action=login") === false)."\n";
echo (strpos("index.php?action=QSD","index.php?action=login") !== false)."\n";
echo (!strpos("index.php?action=QSD","index.php?action=login") !== false)."\n";
echo (strpos("index.php?action=QSD","index.php?action=login") === 0)."\n";
echo (!strpos("index.php?action=QSD","index.php?action=login") === 0)."\n";
echo (strpos("index.php?action=QSD","index.php?action=login") !== 0)."\n";
 
user1125394
1


1


1
1
 
user1125394
I just basically want to know when a string begin with "index.php?action=login"
 
9:36 PM
function httprequest($userName) {
$decodedString = someDecodeFunction($string)
if (validString($string))
{
echo $userName; # NOT AN XSS!!
}
}

function validString($string) {

if (strpos($decodedString, '<') === false) {
return true;
}

return false;
}
 
Walls of code. Polluting chat rooms since the dawn of IRC.
 
@Letterman It shouldn't. Unless there are other funky stuff going on, because it will still be encoded. It may become a problem when doing it over HTTP which decodes it or when docoing it yourself.
 
but HTTP content is plain text!!..... it's not encoded
 
sigh
 
@cyril You sure you used enough ! in that piece of code?
 
9:37 PM
@PeeHaa i've checked it now....
 
@PeeHaa echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!true;
 
user1125394
all possib :)
 
user1125394
actually seems liek UI should not use === 0 right?
 
user1125394
php fails for !1
 
user1125394
is !strpos($stuff, $b) === false alwayse equal strpos($stuff, $b) !== false
 
9:41 PM
@Letterman Try this: type in the addressbar the following: http://yoursite.com?somevar=%3C and now try to access the somevar using $_GET. Is it < or is it %3C?
@cyril perhaps you should just tell us what you want to do
 
user1125394
I just basically want to know when a string begin with "index.php?action=login"
 
if( strpos($string, 'index.php?action=login') === 0 ) { // string begins with that }
 
@PeeHaa I can't check now. but it doesn't matter what it is. first you decode, then you validate then you send back to client... can't imagine how can this double encoding help any attacker
 
user1125394
then if( ! strpos($string, 'index.php?action=login') === 0 ) { // string that doesn't begin with that } ?
 
9:44 PM
if(strpos($string, 'index.php?action=login') !== 0 ) { // string that doesn't begin with that }
 
user1125394
Edit: I just basically want to know when a string Doesn't begin with "index.php?action=login"
 
user1125394
ok thx
 
You should be able to figure that out ;)
 
@PeeHaa I've edited the original post. maybe that we help us understand each another. stackoverflow.com/questions/12044342/…
 
@Lusitanian Awesome function. Thanks for it. I am going to use it right now.
And I'll let you know how it goes
 
9:52 PM
heh thanks. that was just a quick example, obviously modify as ya see fit (:
 
Yeah. I haven't used PHP enough to actually write something like that, but I do see what it is doing :-)
 
alright, let me know if you have another question. also note that you can only use that shortened array syntax if you have php 5.4 (which you definetly should)
@PeeHaa the codeigniter guy says they won't drop support for php 5.2 because php 5.3 isn't widespread enough
i can't stand it.
php 5.2 is ancient
 
or anyone else what to help me with the xss?
 
@Lusitanian :-) I actually don't know what I run, but I assume I have 5.4...
 
If it gives you a syntax error with the array syntax then you have < 5.4
 
9:55 PM
Oh dear! I am running 5.2
:-(
At least according to phpinfo();
 
ouch
install php 5.4
 
Yah. I didn't know.
 
guessing based on your gravatar you're a mac person
 
@Lusitanian I'm gonna have to figure that one out...
 
9:57 PM
@Lusitanian :-) Yes I am, but I'm hosting my website with bluehost, which is Linux
 
ohhh, not good
shared hosting is terrible
get a vps for $5
 
@Lusitanian It has been fine for me, except for the trouble they had with the server last week.
 
terrible in that you have no control over your environment ;)
shared hosting is like living in someone else's house
 
Yah. I really would love to have my own server, but I don't have that kind of $$ :-)
 

« first day (674 days earlier)      last day (4260 days later) »