« first day (447 days earlier)      last day (4498 days later) » 

6:00 PM
oh so that link you sent me already has a function in php that works?
 
0
Q: an active alternative to SUMO Access Management?

CyberKingI'm a great fan of the SUMO access management system, however it has not been in development for a few years. does anybody know of an alternative? I do have a few requirements: LDAP integration multiple LDAP servers, selectable from entering a 'site code' at login 'ranks' simple integration in...

Is this question appropriate?
 
hm not true actually
 
@CharlesSprayberry No, but I'm not sure where it should go. I cv-ed as off topic
 
@ircmaxell Ok, thanks for the guidance
 
:-D
 
6:11 PM
Hi! I have low memory VPS (512 mb) so Im trying to implement Apache worker MPM + FastCGI + PHP. Main focus is on security and speed as it will be shared hosting. Question is - how to arrange folders and settings? For example, /srv/www/cgi-bin, /srv/www/htdocs. Does cgi-bin directory is hidden from user (ftp)? How other people come arround this problem?
 
@ircmaxell remember our talk yesterday about that 'coding license'?
Check this out: The reaction of the webdeveloper on a recent SQLi hack of Kluwer Software website.
"We already limited the maximum password length to 12 characters to prevent this type of attack, but this wasn't sufficient."
The article (in Dutch): tweakers.net/nieuws/79151/…
The reason this wasn't sufficient according the webdeveloper is because they used a SQLi string of only 10 characters!!!?!?!? How could they!?!? Damn hackxorz :P
 
@PeeHaa huh? Oh yeah. Idiots. They were storing the password in plain text!?!?!?
 
@ircmaxell of course. How would one be able to check for the correct login of the user? ;)
 
Is there any logical reason to limit passwords like that? I mean, if you're hashing/salting...
 
@CharlesSprayberry ofc not :P
@CharlesSprayberry it only makes it less secure...
You could say if I only allow 1 char passwords that would be 100% sqli safe :D
 
6:18 PM
@CharlesSprayberry Well, there can be. There are some classes of DOS attacks against REALLY REALLY long passwords
(like in the megabyte range)
 
Then I wonder what the company's thought processes were when it decided on a 12-char limit.
 
@CharlesSprayberry Tons out there do. Lots of banks do
 
@CharlesSprayberry simple. Some people just shouldn't be allowed to do any coding. period
 
give me an unlimited length password, with no restricted characters
 
@ircmaxell Yea, I think at the teleconferencing operation I worked for there was some stupid limit on password length.
 
6:20 PM
stupid
 
Yea, this place was the embodiment of stupid policies. But, they still made tons of money /shrug
 
@CharlesSprayberry Drupal and Wordpress are proof positive that even bad designs and bad code can be very successful...
 
I think webdevelopers should be held legally responsible when dealing with user data
 
@PeeHaa only if they are neglegent in development. Having a bug is not neglegent. Taking no mitigating factors or not understanding them at all is...
 
@ircmaxell Well. Idunno. It is an interesting question though.
But you do have a valid point
 
6:23 PM
@PeeHaa It is interesting. How would you determine if a developer is negligent in this regard though?
 
hi, i have a query in building master page with php
 
@PeeHaa Yes, it is...
 
Are there any 'no cure no pay' audit firms out there?
 
Shalom all
 
ola @Neal
 
6:27 PM
@PeeHaa ^_^
@MBharnidharan And I have a nose
:-D
 
@Neal wat u meant ?
 
@MBharnidharan I meant what i said :-D
 
@neal, i need 2 query
 
@MBharnidharan And I need to pick
 
@Neal, is it good to load php pages in iframe, i just made a master page like tat in my application
@Neal, swapping pages with javascript
 
6:31 PM
@Neal I'm not into going through other peoples code right now :) But I will do so later
 
@Neal cool
 
@Neal btw doesn't it have a router?
 
@PeeHaa What do you mean?
 
How do you handle URL's?
/controller/action ?
 
news.ycombinator.com/item?id=3433436 (anyone want to give some upvote love)?
 
6:42 PM
@PeeHaa According to RFC 3986.
e.g.:
/local/path/to/resource
/local/path/to/resource?query=query-params
 
is a question too localized when someone asks to write his own unit testing platform?
 
what does she asks?
 
2
Q: Is it possible for PHP to write additional PHP functions like a Lisp macro?

phizzleI'm writing a unit testing platform and I want to be able to dynamically generate a function based off of each function in the web service I am testing. The dynamic function would be generated with default(correct) values for each argument in the web service and allow them to be easily traded out...

 
@hakre My question was more about how to decide which controller / action to use
 
I normally organize them hierarchically in the application, so you have areas where things are placed.
 
6:46 PM
anyone up for my question
 
@hakre so you would have a folder structure like: /local/path/to/resource/somecontroller.php ???
 
7:01 PM
more like /docs/help/interface/article?id=2122
 
@hakre I thought we killed query strings a couple of years ago (at least in most cases) :P
 
well I did never, which actually is the correct way I think.
it took some years that google came to the same conclusion.
But if you read the rfc closely, this make sense for various reasons.
but apart from the query-info-part of an URI, a hierarchy allows you to group things in your application.
That can make things pretty accessible IMHO.
 
7:23 PM
Hello anybody online? can anyone suggest me how i can pass variable from one form to another
 
@mann do you have any context with that?
 
@PeeHaa hello. yes. actually i have a form image.php and there is one variable $count. this contains some no. now i want to show value of count into another form which is feeds.php.
Nothing else
 
Well you could add it to a session
session_start();
$_SESSION['count'] = $count;
 
then how can i access it in feeds page
 
7:27 PM
session_start();
print($_SESSION['count']);
 
oh yah thanks. was just wondering is this the only way to transfer variables. like Php is developed language. n this is very important feature. there should be proper way to do so
 
oO
 
@ircmaxell ?
 
Is o_O better? ;)
 
hey does anybody has experience with Interspire Email Marketer? (php email marketing script)
 
7:32 PM
Much better!
 
I suppose if you were session-averse, you could try to implement something using memcached.
 
@PeeHaa thanks mate your suggestion works for me :D appreciate
 
i feel like such an idiot. how do i actually implement code.google.com/p/mod-auth-token on my apache server?
 
ôÓ
 
gtg cya all
 
7:39 PM
ಠ_ಠ
 
ugh this installation stuff is so over my head
='(
thats my emoticon crying
 
Hi , is anyone using Chrome on a mac?
 
@FrankAstin nope. nobody uses that combination
 
@Gordon Got your final close vote just now :) Gotta love the XML questions
@ircmaxell Is that sarcasm?
 
7:54 PM
@JMRboosties ask your sysadmin. if I run against a wall with such stuff, I normally call my nice sysadmin and he not only does it for me but also explains which error I did (if he's in a good mood).
 
@LeviMorrison :-P
 
@FrankAstin What's your issue?
 
@hakre good idea, i will try that
 
There is a message about patents displayed and that the browser can not be allowed to make use of the apple OS ^^
@JMRboosties often it's just a command I did not know or a missing library to compile against or such stuff.
let me check my docs what I did last time compiling an apache module
 
im just clueless when it comes to adding this to my config
im so bad i dont even know if thats the right terminology
 
8:01 PM
$Node = $DomDocument->documentElement->firstChild->nextSibling->firstChild->nextSibling;
I must confess I wrote that code minutes ago.
It is going into the project just like that.
 
so many ->s
 
Only time will tell what damage I have done.
 
@JMRboosties what config? apache config?
 
yea i go through apisnetworks which runs apache
let me get some specific stats
@hakre id love to be able to tell you exactly what it is running but sadly i cant figure out where to find the apache version and whatnot
 
httpd -v?
 
8:17 PM
is that a console command you are recommending?
 
@JMRboosties Works for me, tells me the Apache version and when it was built
 
get ready to laugh: i cant find where to open cmd on my server
 
@JMRboosties I assume you are actually remotely logged in and it looks like a normal computer? User interface, you have a mouse, etc?
 
@LeviMorrison im just on my dashboard atm, im pretty new as you can tell and thusfar only really use phpmyadmin and ftp to interact with the server. im not remotely logged in like you would with remote access for instance
 
People still use FTP these days? It boggles me...
 
8:21 PM
what do you use?
 
@ircmaxell My last webhost provider FTP was the best way to upload content sadly.
 
SCP and Rsync+ssh mainly...
 
ftp is pretty convenient for me, just login go to directory and dump
 
sometimes SFTP or FTPS if all else fails
but never raw FTP
in fact, my servers don't have FTP at all
 
hm, well anyway i need to get into the server shell
 
8:27 PM
@JMRboosties Are you using Windows, Mac, or Linux (or other)?
 
@LeviMorrison my physical computer i am using is windows
 
@JMRboosties Assuming your host allows ssh, you'll need to use a program called Putty or something similar to get in.
 
@LeviMorrison server running Linux 3.1.4
ok, i will look into that
im gonna do a support ticket as well, see if i can get any info on the logistics behind getting my server to support mod_auth_token
btw i found apache ver its 2.2.4
oh.. i believe my subscription plan doesnt support ssh
=(
 
8:43 PM
@JMRboosties To me it seems you should get a different host ;)
 
im paying 5 bucks a month for this host, lol
 
Get a real host. A VPS preferably
 
yea, i dont have shell access. what is a VPS?
 
It's a Virtual Private Server. Using virtualization, you're the only one using the OS and virtual machine
 
i see
so without shell access im pretty much SOL on implementing mod_auth_token, or any other addon for that matter right?
 
8:47 PM
basically
 
got it
 
@JMRboosties If you go with vpslink.com/vps-hosting then I would recommend using Debian as your OS.
 
im gonna speak with my current host about upgrading first, but i'll keep these links in mind if i end up switching
 
@LeviMorrison Why debian?
 
@ircmaxell I prefer Debian over Fedora / Red Hat simply because the default Debian packages always seem to be what I want, whereas the ones for Fedora I ALWAYS have to configure. There are a few other reasons, but that's the main one. The systems admins here at my work share the same opinion. Feel free to disagree.
 
8:58 PM
@LeviMorrison My experience is that the Debian packages seem to be updated more often than RHEL, but it's nearly impossible to get current packages, where as with RHEL it's just a repo away...
 
9:34 PM
And for desktop, I'm very confident what Fedora offers me as a PHP dev.
 
@hakre Debian > Fedora. Their packages Just Work. Fedora ones require lots of configurations. I'm talking about latest versions of both. I went through the process of setting up two virtual hosts on a machine with both OSes and Debian was far, far easier and I had more confidence in it.
It may have not always been that way.
The one thing that didn't play nice in Debian was PHPUnit. I had to manually configure that one.
Ater using StackOverflow's chat for a while, I feel like I'm dealing with junk when I use anything else.
 
@LeviMorrison Their packages Just Work funny, cause I've had the exact opposite expereince
 
@PeeHaa If you spam that adresse, I trace your IP and I sell it to virus creator ;)
 
@ircmaxell On the latest Debian?
 
see, Debian has the god aweful habit of patching their applications to work more "debian-esque" (changing where log files go, where application files reside, etc). This is nice if all you ever do is debian. but it makes interoperability an absolute PITA
And don't compare Debian to Fedora. One is a server os, and the other is a bleading edge desktop OS
if you want to compare: Fedora to Ubuntu, or Debian to RHEL/CentOS...
 
9:45 PM
Anybody running Fedora in production is a nutjob.
I'm stuck with my three main production machines on Fedora.
Fedora 4.
Fedora 4.
Do you have any idea how screwed I am?
 
@ircmaxell Well, I haven't used any modern RHEL/CentOS systems. I have used the newest Fedora.
And if I am comparing Fedora and Ubuntu, Ubuntu wins, even though I like GNOME SHELL better than Unity. That fact alone does not make Fedora better.
And for the record, I like GNOME 2 more than 3.
@ircmaxell I actually LIKE the Debian way of doing things. . .
@ircmaxell I didn't grow up compiling my own kernel. Did you?
 
@LeviMorrison I was talking about desktop not server.
 
@hakre You are talking about Fedora 16? I imagine 15 is essentially the same for web development.
 
I have not yet upgraded the one desktop to fedora 16, but IIRC it has latest eclipse now via the package manager.
Fedora 14 and 15 on the others, working very fine.
 
10:00 PM
@LeviMorrison I think it's the smartest concept that's really not that useful at all
@LeviMorrison I started on Linux kernel version 0 (starting on Slackware, I still have a Slackware 2.0 CD somewhere)...
 
@ircmaxell That's probably a big part of the difference between us on this one :)
 
Prob...
That's my new catch-image
 
 
10:17 PM
hi all how are you?
 
Doing good, waiting for things to wind down for the week
youself?
 
yeah
 
hi
 
Hey there @NikiC
 
10:27 PM
@ircmaxell looks like some complex system architecture actually works.
 
@ircmaxell anything interesting happend in the meantime?
 
@ircmaxell im doing ok too thanks
 
@NikiC Not really. My post today didn't get anywhere near the same level of attention that Wednesday's did... :-(
 
@ircmaxell It's always the question whether it makes HN or /r/programmers or not ;)
 
didn't even make it onto /r/programmers, wasn't approved (I eventually just deleted it)
 
10:32 PM
hi @NikiC
 
hi @hakre :)
 
All my votes are already gone now.
:(
It's a hard job to get you above 20k
 
@hakre Once I hit 3k I quit trying to help SO users. I started projects and I haven't had time :/
 
@LeviMorrison Same here for 29k...
my last 2 or 3 k have been from residual upvotes on past answers
 
But there are soooo many badges to obtain ;)
SO is the best browsergame since longtime.
 
10:36 PM
@hakre Oh, it's only about 93 upvotes to go :D
 
If you make 20k, I will dedicate one blog post to you listing what I think are the best answers.
 
lol
 
You have some cool regex related stuff which I think is worth to have listed somehow.
 
@hakre Ah, now you are following the reverse approach of upvoting my low-voted answers, interesting :P
@hakre lol
 
Yeah, some of them needed some voting love.
I mean the one downvote was a rage-downvote by someone.
That's not okay.
Someone needs to care about those as well.
ah, while you're here
 
10:40 PM
I'm still trying to figure out who I pissed off enough today to get chain-downvoted.
 
@Charles Don't try
 
@Charles: don't bother.
 
You'll never find out and will only have bad mood because of that ;)
It's only -2 rep anyways ^^
 
Yeah.
 
@NikiC: You had some grammar compiler to PHP classes or so. Can you share the link again?
 
10:41 PM
It used to be possible because they didn't quite have the rep graph tweaked well enough. Alas.
 
@Charles which question/answer?
 
"Gee, this person is mysteriously missing X/2 rep"
@hakre Whoever it was downvoted all (three) of my questions.
So it's not like it's a bunch of rep
 
@hakre grammar compiler to PHP classes?
 
@NikiC something taking a grammar (BNF?) and creates PHP code out of it that can parse with that grammar.
 
@hakre ah, right, give me a sec
It's a forked version of kmyacc that fixes some problems with php variables in grammars ;)
 
10:47 PM
does it output PHP?
 
The default PHP template is using functions and other globals stuff though. Here is the template that I use: github.com/nikic/PHP-Parser/blob/master/grammar/… (it's slightly adjusted for my usecase though)
@hakre Yes ;) It can output anything you want :)
 
okay, thanks for the links. I'll keep them this time. I might do some restart with a project.
 
@hakre by the way, don't try to understand the parsing algorithm. I tried and failed ^^ All I know is that it somehow magically works :)
 
well I actually started to learn lex & yacc.
was an interesting read.
 
actually, can one get yacc somewhere?
 
10:52 PM
@NikiC thx, I have one other include function that does not use any variable names inside the local-scope function. I might link it there... .
 
some while ago I was looking for an example of terrible code and thought that yacc would probably be terrible, but I just couldn't find any source on the inet
 
check your distro
it's bison
 
hm, interesting idea (though I don't even know how to do that on ubuntu ^^)
It is? Isn't bison just a compatible but better variant?
 
"bison ist bis auf wenigen ausnahmen kompatibel mit yacc"
 
@hakre yes, compatible. but it's noted based on yacc afaik
 
10:57 PM
Ubuntu package search: packages.ubuntu.com/…
 
@hakre Yes, bison is available. It's just that yacc isn't available ^^
 
I will go on the hunt for the yacc tomorrow
because now I will go on the hunt for something else :)
 
@hakre tell me if you find it ;)
@hakre what will you hunt now?
 
@NikiC: Please no more votes until 01:00 local time :)
 
anyone know about domain protecting a script
 
11:00 PM
@hakre oh, sorry, didn't notice the rep cap
 
@NikiC Just going away from the computer and take a look who's around.
Hi @LondonBoy.
 
@hakre hi Hakre
 
@LondonBoy You need to make the domain name the shared secret between the script and the server.
 
do you know any sample code?
 
You take your PHP code, gzdeflate it, then you XOR it with the domain name. Then you put that binary garbage into the PHP file.
Before that garbage you add this speical function: php.net/manual/en/function.halt-compiler.php
and before that you obtain the domain name from server vars.
then you obtain that binary data from the __FILE__ itself.
then you XOR it again with the domain name
then you uncompress it.
then you eval it.
 
11:06 PM
im not so advanced in php as you are :)
 
that are all functions in the manual. However, this is only a protection as long as the domain name is known to the attacker.
no idea if that is what you're looking for.
 
i have a player which plays videos and it graps the videos from youtube into xml
i want to share this player with only the websites i want
 
@hakre XORing sounds terribly insecure
 
well I wanted to keep it simple. but if you could quickly tell me a way by using a key to encrypt/decrypt with PHP, would be cool ;)
 
@hakre äh hm ... mcrypt?
 
11:11 PM
@NikiC is it easy to use? I mean like a short function call to en/decrypt?
 
Though I don't really think that I get the problem, so no idea whether it's appropriate
@hakre never used it ^^ ask ircmaxell
 
@ircmaxell: We miss some quick mcrypt usage examples to encrypt / decrypt binary data.
 
does this need STREAM mode?
 
hum?
 
11:14 PM
> mode: One of the MCRYPT_MODE_modename constants, or one of the following strings: "ecb", "cbc", "cfb", "ofb", "nofb" or "stream".
@LondonBoy it's easier with contracts.
 
and every user get's a slightly modified version of the code.
if code leaks you know by whom.
 
yeah i think that way should be more easy but i really dont know where to start from
 
@hakre So the mode is some crypto stuff, not how you provide the data ;)
 
but IIRC it sometimes works only with a specific length of data, you probably need to pad it or so?
@LondonBoy start with building trust and healthy business relations.
It's less a technical issue.
 
11:18 PM
@hakre uhm, really no idea ;) @ircmaxell probably knows
 
11:29 PM
@lon
Oops
 
@Fleep yes?
good night all and Hakre
 
This question boggles me...the guy wants to declare an abstract constant. I wanna reach through the monitor and bonk him in the back of the head.
 
11:45 PM
@NikiC huh?
 
aren't all constants abstract?
 
@CharlesSprayberry hi Charles how are you doing?
 
@ircmaxell encrypting and decrypting with PHP
 
@hakre you want MCRYPT_MODE_CBC unless you know you need anything different
 
okay, thx.
 
11:46 PM
(which is very rare)
 
@hakre No, like he wants to declare in an interface that implementing classes need to define a constant with, apparently, different values in each implementation
 
Is there some shorty to do this with one call, or do I need to init always?
 
Ok, heading home
 
bye
 
later
 
11:46 PM
@ircmaxell could you maybe give a quick overview what those things are for?
ah, okay, laters
 
later I'll be off, but later then I'll be on again
 
37
A: PHP 2-way encryption: I need to store passwords that can be retrieved

ircmaxellPersonally, I would use mcrypt like others posted. But there is much more to note... How do I encrypt and decrypt a password in PHP? See below for a strong class that takes care of everything for you: What is the safest algorithm to encrypt the passwords with? safest? any of them. The safe...

 
thx!
 
@NikiC real quick: mcrypt uses what's called block ciphers. Meaning that they can only encrypt a fixed size block of data (typically 128 bit, 512 bit, etc)
So, when you have more bytes than that, you need to encrypt multiple times
if you just did enc(part1) + enc(part2), that would be what's called ElectronicCodeBook (ECB)
 
and CBC is contineous?
like grab some binary string - various length - just encrypt, I don't wanna care about length?
but you wanted to leave, I'll read that answer.
 
11:49 PM
other modes are more inteligent, and make later parts dependent on the result of the prior. CBC (cipher block chaining) where the cipher text output from enc(part1) is xored with part2 as enc(part2 ^ enc(part1))
In cryptography, modes of operation is the procedure of enabling the repeated and secure use of a block cipher under a single key. A block cipher by itself allows encryption only of a single data block of the cipher's block length. When targeting a variable-length message, the data must first be partitioned into separate cipher blocks. Typically, the last block must also be extended to match the cipher's block length using a suitable padding scheme. A mode of operation describes the process of encrypting each of these blocks, and generally uses randomization based on an additional input...
 
and do I need to do the parts on my own, or does mcrypt handle that for me?
and now the super question:
 
@hakre MCrypt does it for you
 
Can I get the hash of the encrypted stuff and use it as a key for decryption?
Like doing an collision attack?
so that the contents can not be changed until another collision is found that works for the changed content?
 
@hakre you don't want to do that
don't try to figure out the algorithm on your own, it's too difficult and too fragile
 
will take ages to calculate probably
 
11:52 PM
later, I'm out
 
cu
 
@ircmaxell Thx, really helpful
 

« first day (447 days earlier)      last day (4498 days later) »