« first day (787 days earlier)      last day (4177 days later) » 

3:04 PM
posted on December 11, 2012 by Paul M. Jones

The guys at PHPMagazin have posted a followup question about the Aura Project for PHP. Here is our original English conversation. I’d like to follow up on the last point where we talked about other frameworks. I think that the … Continue reading →

 
anyone heard about vadic maths ?
 
^ copying over code not knowing what it does and then asking instead of reading and learning. Fail.
 
Guys can I ask you a question regarding to the regex @Touki showed me and usage of preg_match_all ?
I can understand that index 0 is going to contain string that matches my full regex rule
but how do you assign index 1 and 2 like @Touki did ?
/{test((\d)+(?:,\s?([^)]+))?)}/i
 
Parenthesis do the job
$matches[0] always contain the full match
 
check this vedicmath.50webs.com/tutorial2.html fastest way to calculate ....
 
3:24 PM
@Touki cool thx. it works :)
 
4:08 PM
hi
how can we read emails by providing username and password in php? Any ideas???
 
read emails from what
 
posted on December 11, 2012 by Brandon Savage

I do not wholeheartedly believe that private methods are evil, or that they were mistakenly included in the PHP language by the core development team. Nor do I believe that there are only two true options when it comes to devising visibility requirements: public and protected. There is a place for private methods, in PHP [...]

 
ex:user@gmail.com pass:password. when we enter these parameters ,we can access the emails for that particular email address
@MikeB
 
@Feeds Private Methods Considered Harmful?? What is this about? I only understand central station.
 
4:14 PM
Thanks @MikeB. can we use imap for this?
 
I'm kind of happy feeds issues us with daily bullshit, makes me happier about my own coding practices.
6
 
@Leigh right? I regularly visit the worst questions in the last 24 hours just for that reason
"thank god I'm not that guy!" :p
for instance
-13
Q: how to disable notepad,word,paint excel when any window is open using php and javascript

Anchal GuptaI want to disable notepad,word,excel,paint when html page is open. Is it possible with using php and javascript, that till page is not closed all the application should not working? Basically i want to protect my data so that no user can take print screen and use alt+tab and copy my data

 
Sometimes I consider not helping people on purpose, for that enhanced sense of job security.
The more people out there who can't get it right, the higher my wages... well... that should be how it goes :/
 
@Leigh You need @BizzaroLeigh to post bad-practice, yet technically correct, answers
 
@MikeB Oh I have no problem doing that with this account. I am an avid defender of answering the question that was asked, not sidestepping with "you shouldn't do that"
 
4:30 PM
@Leigh You disagree with the latest @Feeds post?
 
@LeviMorrison I don't agree that private methods need to be avoided.
 
@Leigh Avoided in what sense?
 
@LeviMorrison I'd always heard declaring private anything only demonstrates arrogance.. I don't really feel that passionate about it but it's served me well
 
^ put your hand on your heart. just del-vote.
 
4:33 PM
@LeviMorrison In the general sense of "private methods should be avoided", which is what the title of the post implies (and I haven't read the post)
 
@Leigh Even if you disagree, it's worth reading.
 
My response was mainly from seeing hakres response to the feeds post
 
@Leigh It is a follow-up to a post that considers private methods harmful. But whatever the point is the author wants to make, I don't see it.
 
I use private methods pretty much for two things:
 
@LeviMorrison Those are private, it's not interesting. ;)
 
4:35 PM
Use case A: My code complexity is too high. I split out the inner code into a function that is useless without the calling context.
 
@LeviMorrison I use private for utility methods in the base class, things that should never be overloaded because it would break functionality, but deserve to be in their own method.
 
Use case B: this private method is integral to the functioning of the object and I will not tolerate tampering. I don't even want you to know it exists. Pretend it doesn't.
However.
 
@LeviMorrison Right, but that is nothing specific for private access. I mean each function we know is useless without the calling context.
 
That post makes the case that how is final protected worse than private in that case?
I can then expose it for unit testing.
 
@LeviMorrison To me that stings of arrogance
 
4:38 PM
There's nothing wrong with being arrogant
 
@MikeB Have you ever written a post-order binary search tree iterator?
 
@LeviMorrison I have no clue. I actually can not imagine whenever final protected would make any sense. Only for more complex inheritance structures, but probably a smell.
 
I can't envision a situation where I (as a developer) wouldn't benefit from knowing about and understanding what you deem to be an internal-private method
 
@MikeB Unit testing.
 
You can do the same with protected
 
4:39 PM
Ah, but then they can tamper.
Is that arrogant? Maybe.
Is it a sign of a code-smell? Maybe.
 
@LeviMorrison I don't mean to call you arrogant, it's just the word I've clung to when discussing privates :)
 
I don't think that is arrogant. You have used final protected?
 
I'm just saying that if something is important enough to be private, it probably needs solid unit testing.
 
You don't test the private parts of the unit (for good reasons). So I wonder why Unit-Testing is brought up as a reason (in my eyes it is none).
 
Which leads to final protected if you don't want modification.
@hakre I will call BS on that any day.
Maybe someone smart said it.
But it's still BS.
 
4:41 PM
By definition for a unit there is no private.
 
You should test (read cover) your non-public stuff via public members
 
@MikeB I was trying to think of a good way to say that :p
 
If you consider the private function the unit under test, go ahead and access it. It's easy with PHP.
 
@hakre Okay, fair, I'll leave it as "testing" instead of "unit testing".
But I am going to test the bajeebees out of that private method.
It's object-behavior critical.
 
> You don't test the private parts of the unit
I certainly don't want the private parts of my unit to be tested
 
4:43 PM
You test each method individually? Or create tests that cover every code path?
 
(yes, I am that childish)
 
@Leigh Depending on complexity, both.
 
@LeviMorrison Yes then you treat it as a unit. A function can be a unit, too. So just for your testing purposes make it accessible in your test-case for that unit.
 
@DaveRandom so many 34 references!
 
@hakre And if I don't want to deal with Reflection, that means final protected instead of private.
To be honest, I've never used final in PHP.
 
4:44 PM
@MikeB Still not as good as private long parts;
 
I'm just stating that it sounds like a very solid point.
 
@LeviMorrison If you don't want to deal with Reflection you probably also do not want to deal with Visibility.
 
@hakre Nah, visibility is easy.
Extend and expose.
With reflection I have to create a few more objects in my test code. I'm not quite sure why, but that bothers me.
 
@LeviMorrison Well, because technically, you should not test internals of an object. In the example of a (private) function you gave, you might want to create a method object that covers the processing in there instead so you can actually test the unit properly.
 
@hakre Give me good reasons why I should not test the internals of my objects?
 
4:48 PM
@LeviMorrison Because you always test the parts of an object that interact with other objects, not the internals. That is done to cover changes of the codebase. At least that was the original idea behind. To speed up refactoring code.
 
@LeviMorrison job security :D
 
boredom strike...
class ArrogantClass() {
	public function __construct() {
		if (false !== array_search('PHPUnit_Framework_TestCase', get_declared_classes())) {
			throw new BadMethodCallException("I'm a BAD method!");
		}
	}
}
 
@hakre Sacrificing code stability for maintainability sounds . . . counter-productive at best.
 
@LeviMorrison You do not sacrifice code stability with unit-tests. I dunno why you say so.
 
@hakre Proper system behavior is made up of tiny little parts.
You need to make sure the parts act correctly.
 
4:50 PM
@LeviMorrison The so called units.
 
You also need to make sure they act correctly with each other.
 
@LeviMorrison That is why you test the public members.
Because those are in (possible) interaction with other units public members.
The private members are never direct part of this kind of interaction. This is why they are not tested. You can even change them, the important part is only the public interface and that it is tested confirming that internal changes didn't break anything publicly.
Let's say you do a refactoring and extract a private method so to reduce code complexity. You just ensure the tests still pass. You don't start to test the newly extracted method.
 
@hakre That's fine. I'm not saying that's wrong.
What I get tired of hearing is that I shouldn't test my private methods.
As if by testing them I'm doing something wrong.
 
@LeviMorrison It's a should. I'd say normally there is no need. If you feel there is a need, look closer if it's really the case and then know what you're doing. It's a should not a must.
 
@hakre "should" still implies incorrect behavior.
 
4:55 PM
@LeviMorrison Well maybe programmers are just too binary. Words have a better grey area than source-code definitions ;)
 
@LeviMorrison You shouldn't test your private methods
directly
test them through the public API. Which then tests the behavior, rather than the implementation. Which is what you want...
 
@ircmaxell There are the cases where the implementation is what is key, not the external behavior.
 
not sure I agree there... Do you have any examples?
 
@ircmaxell Sure: checking for runtime algorithm correctness.
 
4:59 PM
No, I mean where the implementation details are more important than the behavior
 
@ircmaxell The outward behavior of contains is always the same.
Does it include it or not?
The real question with contains is: how long did it take you to figure that out?
 
@LeviMorrison As written, consider in that case the function to be the unit under test. Create an own testcase for it.
 
@LeviMorrison But that's not what a Unit test is supposed to test
 
18 mins ago, by Levi Morrison
@hakre Okay, fair, I'll leave it as "testing" instead of "unit testing".
But I'm still going to test it.
 
So in that case, I'd have a Unit test confirming behavior (of the public API), and another test to confirm the performance angle...
 
5:02 PM
good day
 
@NikiC Welcome :)
 
@NikiC hi!
 
Good evening
 
@ircmaxell Agreed.
 
What's up?
 
5:03 PM
@NikiC A decent conversation starting around here:
40 mins ago, by Leigh
I'm kind of happy feeds issues us with daily bullshit, makes me happier about my own coding practices.
 
Wondering about why somebody considers private methods harmful.
 
blog.ircmaxell.com/2012/12/… <-- my response to those posts
3
 
Do I have to read that stuff?
 
nope
 
hey guys, a client of mine wants to add video to their site which uses H.256 for iOS and OGG for other platforms, and where both fail Flash. I am confused over whether patents need to be licensed to do this. Videos will be encoded using an off-the-shelf package, then uploaded to the server and then finally downloaded and played using an off-the-shelf player. any ideas guys?
 
5:07 PM
as far as patents, my suggestion is to hire a lawyer
 
H.256? :x
 
hey guys anyone can suggest me where to start if 'i want to offer wordpress.com like service on a custom.domain? ie. wordpress for anyone.custom.domain'
 
@Prasanth Not here. Checkout the Wordpress forums they have the information: wordpress.org/support - The feature you're looking for is called multisite: wordpress.org/support/forum/multisite
 
@Prasanth Think about the various parts you need. DNS routing, storage, etc.
You can figure it out.
And if you can't, you are probably doomed to fail.
 
It was my understanding that if one purchased something then the vendor of the product would need to license a patent. Like a special kind of screw, I buy it from a tool shop, use it and done. So if that is equated to H.256 then would the vendor of the encoder and decoder be the only ones required to license the patent?
 
Sorry, I'm not a legal expert or even a novice.
 
Anyone else get the feeling that Pierre is acting like an asshole in the PHP 5.3 EOL thread?
 
Are there any safe multi-platform formats that can be used?
 
231
A: Best way to use PHP to encrypt and decrypt passwords?

Alix AxelYou should not encrypt passwords, instead you should hash them using an algorithm like bcrypt. Still, here is how you would encrypt/decrypt: $key = 'password to (en/de)crypt'; $string = ' string to be encrypted '; // note the spaces To Encrypt: $iv = mcrypt_create_iv( mcrypt_get_iv_size(M...

 
@ircmaxell . . . didn't he get it backwards? You shouldn't just hash passwords but instead encrypt them?
@NikiC He's been very . . . aggressive lately.
 
5:13 PM
@ircmaxell What? It's an XY answer
 
I have a stupid css issue that is stumping me!
 
Or you mean that it's factually incorrect (i.e. the encryption itself is wrong)
 
@NikiC The encryption itself is slightly wrong, it's missing padding. But mainly that he starts off by saying use bcrypt, but then encrypts a hash anyway
 
@LeaHayes streaminglearningcenter.com/articles/… Read the last paragraph about who has to pay royalties
 
so it's not actually encrypting the password, it's still a one-way algorithm. And as such, doesn't answer the question
 
5:14 PM
Does anyone know the correct behavior for json_decode when provided the string "true"?
 
On this page templeisrael staff and the contact info is supposed to be lined up with the bottom of the picture and it does line up in Firefox but in Safari and Chrome it doesn't
 
@NikiC in the EOL thread? I think in general lately
@LeviMorrison quotes?
 
@ircmaxell That's what the question asked. I think the answer isn't wrong by that account. It could have made the bcrypt part of it more promient though, also linking to an answer demoing that
 
@ircmaxell None, just the string true.
 
@LeviMorrison bool(true)
@NikiC Well, the point being that it doesn't encrypt the password, but the hash of it. Which defeats the point of encrypting
 
5:16 PM
oh
 
@ircmaxell Heh, I edited that one not so long ago... it was using md5(md5($key)) for the iv :/
 
lol
i didn't look at the code :D
well that's crap then ^^
 
which is my point.
 
and md5($key) for the key... gg filling half your key with null chars
 
I don't care about adding encryption to the answer (I've done that before as well)
 
5:16 PM
@Leigh interesting, so that makes it sound as though the web hosting company has to pay for said royalties
 
posted on December 11, 2012 by Anthony Ferrara

Brandon Savage has recently posted two blog posts portraying his opinion that using private visibility on class methods can be considered harmful in a lot of situations. While I understand the point he is trying to make, I can't say that I agree with it. I do like private visibility and think that it's actually under-used in a lot of software. But it's not because I think Brandon is wrong... R

 
@Feeds Timely.
 
;-)
 
Although:
54 mins ago, by Leigh
I'm kind of happy feeds issues us with daily bullshit, makes me happier about my own coding practices.
@Leigh If all @Feeds posts are . . . :)
 
@ircmaxell So what we do about that answer?
 
5:18 PM
@NikiC I tossed this comment
 
I saw your comment
 
Holy hell. This is bad even as a suggestion for how to store passwords. It's not even reversible (so why are you using encryption in the first place)... And it doesn't use bcrypt (which you mention in the first line). As far as how to encrypt data, take a look at this SO Answer which includes the proper tools to set it up correctly... Example: you're missing padding (which CBC requires)... — ircmaxell 7 mins ago
 
I'm asking how we get rid of it :D
 
as far as what to do, I don't know.
If we flag it, it won't really do much...
dv won't do a thing (too highly voted)
 
Get @TimPost in here?
 
user1125394
5:19 PM
someone has Chrome under Linux here?
 
unless we edit it with a banner at the top stating the issues with it...
 
Who's flagging random posts?
 
please dont flag ... just because message is stupid
 
@cyril Yo Version 20.0.1132.47 Ubuntu 12.04 (144678)
 
Woah what's going on? The flags are disappearing instantly.
 
user1125394
5:20 PM
yo mike
 
@Mysticial That's because people are counter-flagging them
 
user1125394
can't get this damned applet run mdns.sipthor.net/… on Chrome
 
Who is flagging what?
 
@DaveRandom Well, yeah. But when something gets counter-flagged instantly, it usually means someone is pissed off and is (inappropriately) flagging random things.
 
user1125394
I need icedTea, but whe I installed it, from package mgr, it said too old version, but I try to build it I have this error (configure: error: Could not find CUPS library; install CUPS.)
 
5:21 PM
@LeviMorrison A couple of posts with extremely minor bad language
 
@cyril cups is a printer thing
 
@ircmaxell So basically that answer doesn't encrypt passwords, but it rather uses a password to encrypt something else
 
user1125394
@MikeB yes I know, can you try the above link?
 
Do I need a login?
 
user1125394
else I need to download Firefox, it would really suck
 
5:23 PM
@ircmaxell So it's basically the answer to the wrong question
 
@Mysticial That's what it looks like to me. There is no need to flag minor swears - flagging gets the people who posted kicked from chat for 30 minutes. We get way worse than that in here without it being flagged.
 
@NikiC Ahh, good point. And if that's the case, then it's even worse, since he needs to use a KDF (key derivation function, preferably PBKDF2) to derive the key, rather than a simple hash...
 
user1125394
@MikeB nope but the java applet is working for you?
 
@ircmaxell AES 256 uses 128 bit blocks and a 256 bit key right?
 
@DaveRandom Meh... that's nothing. :P We get a lot of "adult" topics on our side. They never get flagged unless an ultra-conservative passerby happens to drop in.
 
5:25 PM
They both have the same base problem but go off into tangents about how they think it should be done.. yet they both have the same solution
 
The second answer is BAD...
No, no no. This is not good. First, it uses ECB mode, which is NOT good. Then, it uses an insecure method for generating IVs. It won't work in a secure way at all. Instead, take a look at something like this answer provides or just use a library. THIS IS NOT SECUREircmaxell 18 secs ago
 
@DaveRandom private long what?
 
@Leigh correct
 
@ircmaxell Then how come mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC) returns 32, which is a 256 bit IV - The IV is only applied to the first block right?
 
Could any of you tell me where I'm going wrong here please: stackoverflow.com/questions/13825054/…
 
5:29 PM
@cyril All I see is a login page, no applets in sight
 
@Leigh because RIJNDAEL_256 is a 256 bit block size. The RIJNDAEL_(\d) refers to block size, where AES(\d) refers to key size. It's confusing and arbitrary
 
@ircmaxell you didn't just write the whole posting?
 
ping @@timpost
 
@ircmaxell Right, yes confusing. More confusing that I have been lead to belive that RIJNDAEL_256 is AES256
 
evening everyone
 
5:30 PM
@Leigh a lot of people make that mistake (including me for a long time)
AES === RIJNDAEL_128.
 
I need to change some of my documentation :p
 
;-)
 
@AndrewCharlton The biggest place you are going wrong is the part where you didn't provide enough information in the question. Some other places are that you are using ext/mysql and your code is almost completely unindented so it's very hard to read.
But see my comment on the question for suggestions as to how to make it answerable.
 
I guess technically AES256 is not NIST approved
 
yes it is
 
5:34 PM
thanks @DaveRandom
 
@Leigh lol, as I suspected the hosting company gave the most cryptic response to my question about licensing that patent
 
@Leigh AES 128, 192 and 256 are all FIPS certified: csrc.nist.gov/publications/fips/fips197/fips-197.pdf
 
Sorry.. What I meant was... I guess Rijndael 256 is not NIST approved
Since apparently rijndael 256 != aes 256
 
@Leigh correct
 
5:38 PM
Hi guys does anyone know if its possible to install mssql on a linux machine ?
 
@MikeB I'm not sure that's appropriate... for a few reasons. First the one you're closing is older than the other
 
@ircmaxell I believe the quality of answers trumps that (as you've pointed out)
 
fair
but I still feel we need a mod
 
Because of its prominence?
 
for one
 
5:48 PM
Closed.
 
@ircmaxell In your answer, the stretch() represents the KDF?
 
I'm refactoring it now, but yes
 
@ircmaxell I tend to forget, does the IV have to be CS random?
I.e. for the sane modes
 
user1125394
@MikeB did you have the popup alert on top: i.imgur.com/3hBBt.png
 
Do we delv the Q?
Also @ircmaxell, I blame this on you, for not handling bugs.php.net/bug.php?id=62453 :P
 
5:56 PM
No, only unique
 
@NikiC No need to confiscate legitimately earned rep, just edit it with a note that says "these answers are wrong" (only nicer, obviously)
 
@DaveRandom Legitimately earned rep?
@DaveRandom In any case, all answers in there seem to be rather broken. So I don't know if it makes sense to retain it in any form
 
@NikiC yeh the q is like 3 years old, a few people would lose a lot of rep if it were deleted. In particular, the asker - 170+, 0-, I think he'd be (and rightly so) annoyed if the question was deleted just because the answers are wrong. Better merge than delete, says I...
 
@NikiC I think yes because the current answers suck
They're certainly not 100+ votes better than ircmaxell's
 
@DaveRandom I don't think that merging it would be benefitial
 
6:04 PM
@NikiC Fair enough, delete it if you want - but I won't be voting, because I think it's forcing your will on the site. I don't want to persecute the asker for getting bad answers. (Also, to be fair, I don't know enough about the topic to know for sure that the answers are that bad. You guys could all be wrong :-P )
 
@DaveRandom Regardless of the answers can you find any difference in the question?
 
@DaveRandom agreed ....close question as duplicate is good enough ...
 
@MikeB Not relevant, since it was closed as a dupe of a later question.
 
@DaveRandom But you didn't have a hand in that (you weren't part of the close-vote) so we're past that. Now we're deciding if a closed question warrants deletion. imho it does because its an exact duplicate - the questions can't distinguish themselves from each other.
So you're forced to rectify the situation and remove one.. which one? Why the one that's already been closed :)
 
@MikeB Not necessarily. If that were the case, every closed question should be deleted, in which case, why does the site bother having distinction between the two?
 
6:11 PM
@DaveRandom Because the same answer can be arrived at via 2 different questions - since the questions are the same I don't know why you'd keep both
 
The issue I see with deleting that question isn't some moral bullshit, but rather that it has 130k views, so it's probably linked from a lot of places
 
That's why I say "put a big fat notice in the question" for Google hitters, and leave it at that
 
@NikiC That's very valid
 
So @DaveRandom's variant probably makes more sense
 
Why didn't you say that to begin with @DaveRandom :p
 
6:15 PM
 
I don't really wake up until >10pm
 
Anyone feeling a bit odd about that quote?
 
On the subject of which: I'm off home, I'll catch y'all in a bit :-)
 
user895378
<-- doesn't feel strongly about the current topic, but highly recommends the southern pacific coast of mexico for future vacations.
 
why hello mister lowrey
 
user895378
6:19 PM
hola!
 
i saw some time a mod note ...on question why not request to mod to show note
 
> **BEWARE! All the answers given to this question have various security issues. Do NOT use the code samples presented here.**
>
> For a proper encryption scheme implemented in PHP see this question:
>
> [**PHP 2-way encryption: I need to store passwords that can be retrieved**](stackoverflow.com/questions/5089841/…)
>
> This question is only preserved to prevent breaking links to this page.
3
Insert that at the top?
 
sounds good to me, would love a mod's opinion
 
either top or bottom of question (above close thing ) would be fine
 
user1125394
is it a good idea to have a single file to handle all ajax calls, and redirect all "/ajax/(.*)" into it
 
6:30 PM
@rdlowrey ¡hola muchacho!
 
user895378
@webarto como estas? cuánto para tu madre?
 
user895378
lol okay no more espanol for me.
 
muchacho == boy isn't it big
 
puta madre something something
Universal language.
 
@webarto google translate
but it think its
 
6:36 PM
Conference rejection day is always so nerve racking
 
What conference?
 
Wow, completed the talk selection for @SunShinePHP, this is going to be an awesome lineup. Announcements and emails to follow soon. #ssphp
 
Good luck :)
 
thanks. We'll see how it goes
 
Let us know :) Miami is nice.
 
6:50 PM
0
Q: Extending stripos($_SERVER['REQUEST_URI'] to check for more URLs

user1895523I am a hack PHP'er and am having trouble getting this figured out. I am using stripos to modify a active navigation class <?php if (stripos($_SERVER['REQUEST_URI'],'/members/login') !== false) {echo 'class="active"';} ?> It works like a charm However I need to add another REQUEST_URI ...

lol...hack PHP'er ....!!!...:P
 
I am a hack PHP'er
 
@NickFury What is "a hack PHP'er " ?
 
@NullPointer no idea lol, just funny thats all
 
hrm, I need to figure out two more blog posts for this week
bbl, meetings...
 
@NullPointer Meaning he probably copy/paste code and sometimes it works.
 
6:54 PM
@webarto ....(:
@ircmaxell watched some of your video .... are worthy/great ...
 
On a similar note, don't shoot videos in low-light, you can make a lightbox out of a ordinary box, add 4 cold light bulbs (to reduce shadows), and that should work.
 

« first day (787 days earlier)      last day (4177 days later) »