« first day (800 days earlier)      last day (4141 days later) » 

12:04 AM
@ircmaxell Say, what happened to your Reddit account?
 
I was banned a while ago
 
Why is that?
 
and I finally said screw it, if they want to ban me, I can live without them
and I can tell you, it's been nice
Violation of rules (posting content from my own site)
 
Uh, wait, that's not allowed?
 
Nope.
> NOT OK: Submitting only links to your blog or personal website.
 
12:05 AM
Did this come from r/PHP or from somewhere else?
 
Actually, that's changed
it used to not have only in there
No, it was an automated ban. I could have fought it, but life's been better without Reddit's comments. Even though I really do miss the traffic spikes. And would love to get the programming with anthony series up there...
 
So how come the supr PHP guru expert professional uber smart guy hasn't been banned :(
Shit I forgot military grade
 
@PeeHaa Not talking about good old php_experts.pro, are you?
 
@ircmaxell That is unfortunate. I've already been wondering why I haven't seen any of your stuff on reddit lately ^^
Say, does anyone of you know an easy way to trigger a destruct during shutdown?
I.e. to make sure that a certain object is only destroyed during request shutdown and not earlier
Need this to cause a segfault that I think should exist
 
12:11 AM
Yeah, Colonel Rosa and FrozenFire offered to fight for me with the admins, but I figured it's a good excuse for a break from that troll haven...
@NikiC PHP or C?
 
@ircmaxell PHP
 
Well, one way would be to bind a shutdown function with a reference to the object... Or store a static reference to it (which will prevent deallocation until shutdown)
 
a static reference to it where?
 
I know this is not the css or html room, but I here is a question: How can I create a DIV that points somewhere? You know how facebook, when there is a new feature, it shows a div with info about the feature and the div is pointing to something?
how would I create such a pointing div?
 
@ircmaxell I.e. what do you mean by "static reference" here?
As in static property or as in static variable?
 
12:14 AM
Foo::$bar = $obj
either would work
 
oh wait
I'm stupid
5
 
Starred :-P
 
it was doing the right thing all along, I just didn't read the output correctly
 
:-)
 
lol
 
12:17 AM
> Please share expirience.
 
Hrm, when to make this blog post go live
 
Must... resist... to.... pin... that :)
 
I would do it tomorrow, but it's Christmas Eve, and not sure if that's smart...
I could wait until Friday, but eiw
tomorrow at 10am it is...
 
Oh Christmas features on the chat. Some sled popped up and vanished a moment ago :)
 
@ircmaxell perfectly fitting, isn't it?
 
12:24 AM
huh?
 
@ircmaxell presents for christmas.
> Thanks in advance for all the help, im new to StackOverflow and im LOVING it!
 
hehehe
 
Right I'm hittin' the hay, nighty night and a Merry Christmas to all
 
night
 
@DaveRandom Laters and try to behave around your family
 
12:31 AM
hey just discovered this feature in chrome, didn't know:
 
What is it? Something for games etc so that the mouse cannot leave the screen?
 
It means you can easily stop scripts from taking control of your cursor in that manner. It hides the cursor and freezes it in the center, I believe.
 
Hrm, need to figure out how to do a redirect with blogger (make a URL shortener)
 
IIIRC only Chrome offers mouse lock currently.
 
@NikiC compiling PHP-5.5 :)
 
12:43 AM
@RossBearman So you are saying you can control the mouse clientside with javascript?
 
Aye, this probably explains it better than I can: blog.chromium.org/2012/09/…
 
> I treat your suggestions as possible answers. much appreciated!
 
@RossBearman Ah I see. tnx
Initially it sounded like a very very stupid idea
 
hi
 
Yes. I assume it's set to "Ask by default", by default as well
 
12:49 AM
nice, got it working
 
one sentence says it all:
> So if anyone knows of whether what I'm trying to achieve is possible, or if the answer is staring me directly in the face, I'd love to hear from you. Thank you for your time.
 
1:07 AM
@ircmaxell that's how I got here
 
@igorw be sure to report any bugs you find ;)
 
Is anyone here testing out 5.5alpha2? I'm getting multiple PECL extensions failing to compile, all of which compiled fine under alpha1 =o(
 
> Thank you very much guys, i am learning so much with you.
 
@cryptic What kind of exts are that?
@cryptic We had a few changes in the executor in alpha2, so it will affect lower-level exts
 
1:17 AM
@NikiC APC and Bcompiler both failed. Let me see if I have the compile log still and show you the error.
 
Well APC not working is no big surprise.
 
@cryptic yeah, those two are no surprise
they are very low-level ;)
 
APC 2012-09-03 compiled under alpha1 though =o\ but dont under alpha2. So should I just drop them?
@NikiC, @Charles should I consider dropping any of these as well? bbcode, geoip, gnupg, memcache, oauth, timezonedb, v8js, xdebug?
 
xdebug may not work, but I'm not an authority. I was mostly just taking an easy jab at how broken APC has been on and off since 5.3.
anything that's going to care about the internals of the VM being upset by the new features may well care a lot.
 
@cryptic Alpha 1 was still basically the same as PHP 5.4 from an ABI perspective, that's why it worked ;)
@cryptic I think those exts should be okay apart from xdebug (and maybe v8js, though I'm not sure how it works)
 
1:29 AM
I HATE YOU ALL!
Uh... I mean.. Merry Christmas...
The keys are right next to each other :(
 
We love you too, @Leigh.
 
ah ok. I dropped APC and bcompiler. I'll try to compile with xdebug and v8js if it doesn't work will disable those and try again.
@Leigh hugs, don't be a Grinch. =oP
 
@cryptic I'm more of a scrooge than a grinch :p
anyway, I'm off doing family stuff, wont be around to wish everyone well over the holiday, so doing it early...
@NikiC make sure you go out, get very drunk, and touch some girls in rude places
 
@Leigh ...
 
Sounds like a sure way to spend x-mas night in jail with a methhead Santa. O.o
 
lol
@NikiC: we gotta get you to come out to one of the conferences and speak sometime soon...
 
Gotta get a PHP conf in the US Pacific Northwest so I can actually attend. :p
 
Set it up, and I'm in
 
Yeah, we tried, couldn't get traction. All we have is a small Linux conf north of Seattle and OSCon in Portland.
 
Well, I'll likely be submitting to DrupalCon in Portland... who knows if i'll be accepted (or if you want to come to that), but...
 
1:40 AM
Drupal's not my thing. Isn't there another one down in Portland next year?
 
no clue
it's not my thing either, but work wants me to...
 
> any help would be great, only helpful responses please! Any suggestions on how to fix this would be great. What steps are required? Can anyone help me out here? Many thanks Can anyone help me to fix this... apologies my english!!! Is this code correct? If not, what should I change? More Phrases Than Ever Before
 
Hey, if they're gonna pay for you to fly cross-country... Just make sure it's during summer.
@hakre Where are you getting these?
 
May, IIRC
 
@Charles From PHP5 tag cleaning. Often placed at the end of questions.
 
1:42 AM
Right in the middle of the eight month rainy season ;)
 
> Cheers.. Can anyone help? Thanks in advance. Thanks in advance . Any links to articles which may be helpful? How can I do this?? or else what will be an alternate solution for this?? Does anyone have smart solutions(algorithms) for the issue? I would appreciate your input. Thanks! Can somebody please help me with it?
 
@ircmaxell :)
 
I had some issues with 5.5, it breaks PEAR
I started debugging, but there's quite a few layers of obscure bugs
 
How the hell do you break PEAR. Isn't PEAR pure-PHP?
 
the tar extraction code does some weird stuff, I guess it's specific to null bytes in binary strings or something.
if someone is able to hold my hand while I debug and tell me where to submit fixes to, I'll gladly dig deeper and get more useful reports
 
1:47 AM
@igorw If you can get a reproducable use-case, let me know and I can dig into it...
actually, speaking of which, let me run that against my cryptlib as well...
 
this is how it starts out: gist.github.com/04b91e42110b16939a07
 
ooh. pecl != pear
 
Is Suhosin officially dead? Is there any alternative?
 
from what I can tell, pecl and pear mostly share the same code base
and the tar extraction is likely to be an issue with pear install as well
 
1:53 AM
@cryptic if it was up to me, yes it would
 
@Charles The right question is: How can you break something that never worked in the first place?
@cryptic Suhosin is actively discouraged by core
 
@NikiC If a pecl crashes in a forest, does anybody care?
 
@NikiC Why?
 
VLD is broken against master
 
@PeeHaa Mostly useless and intrusive
 
2:03 AM
Well it did prevent the hash table collision attack didn't it?
 
I wonder if people's impressions of it would be different if whatshisface wasn't such a dick.
 
True that
 
@PeeHaa securityfocus.com/columnists/432 this is the article that got me to first install it long ago. I don't know if things have changed since then, but there are some nice features in Suhosin I wish one day to be put into core.
@Charles Steffan Esser
 
@PeeHaa prevent is a weird word for that
 
@cryptic Thanks, keep confusing him and Sebastian Bergmann and would rather not insult the wrong one.
 
2:07 AM
@ircmaxell Didn't it prevent it in the same as PHP does now?
 
@igorw My CryptLib test vectors all pass (20k assersions, and it does a LOT of low level bitwise and string operations)...
 
Or am I way off?
 
@PeeHaa neither prevent, they mitigate, but it's not actually preventing anything (because it's not stopping the vulnerability, just putting arbitrary limits to control exploiting it)
 
@cryptic Most of the suhosin stuff is in PHP ^^
 
@ircmaxell my DNS stuff works too
 
2:10 AM
Yeah I get that. But wasn't the reason suhosin install were "less affected" based on the same thing. A.k.a. the limiting?
 
@NikiC A ton of it isn't
for example: the buffer overflow protection... He uses canaries to detect buffer overflow...
 
@PeeHaa Oh, people were affected?
 
@NikiC Ummmm. yes
:)
 
Ahhhh, so I was reported as a spammer: reddit.com/r/reportthespammers/comments/12x76s/…
 
2:16 AM
@PeeHaa Do we have actual stats on that?
 
Musta angered one of those "experts."
 
wow
 
@NikiC The fact people had to upgrade? That alone means people were affected.
 
@PeeHaa No that means that it's common sense to upgrade if your current version has security vulnerabilites
It does not actually say anything about whether or not it was actively used in the wild and on what scale it was used
 
Sure it's common sense. Still. It doesn't mean no one is affected by the bug
 
2:20 AM
I.e. I absolutely don't doubt that some script kiddies tried it out on a few servers, but I certainly do doubt whether there were any larger scale attacks and even more doubt that suhosin prevented them ;)
 
@NikiC I know I did. But you are missing the point here. Whether is was being widely exploited doesn't really matter. People were affected either way. Whether it was directly or indirectly.
 
@PeeHaa You mean they were affected because they had to upgrade their PHP version?
I.e. you mean not actually affected by the attack, but affected in the sense of being forced to do some action?
 
Exactly. And I understand people should upgrade either way. But that's not something you want to rush.
 
@ircmaxell I'm getting closer, looks like unpack is behaving differently, no longer trimming null bytes.
 
Oh really?
 
2:25 AM
@igorw uuuuhhh
Blame it on the google guy ;)
He made some unpack changes relating to nul handling
 
is there an online php shell that has 5.5? 3v4l does not, apparently
 
@PeeHaa a better example would be header() according to php.net/manual/en/… adding additional headers was possible until 4.4.2 and 5.1.2, but Suhosin prevented it. It does the same for mail() but current PHP as far as I know is still vuln to it, correct me if I am wrong.
 
http://codepad.viper-7.com/18QRNg
http://codepad.viper-7.com/sAs8tL
 
2:30 AM
IMHO the new behavior is the correct one
BUT it's still a BC break...
 
is it documented anywhere?
ah yes, in UPGRADING
 
night
 
@nikic 'night, cheers ;-)
 
Nite @NikiC
 
good night
 
2:33 AM
 
@igorw: I'd still bring it up on list though, I don't remember that being discussed...
 
Haven't read all of it yet, too tired
 
@NikiC Yeah, it's a wall of text, that's got some really interesting stuff in it...
 
@ircmaxell the previous "a" is now "Z", correct?
 
not sure, haven't looked much at it
 
2:43 AM
replacing it with Z fixed it
ok, so how do we fix this upstream?
 
Thank you in advance for the good night all :)
 
@igorw revert the patch
I'd suggest posting this to list...
IMHO a should retain original behavior, and Z should be the new one...
 
@hakre Good night all
 
@ircmaxell do I just send an e-mail to internals@lists.php.net? do I need to sign up somewhere? I've never posted to internals before.
 
yeah, sign up to the list
 
2:54 AM
will digest do or do I need to subscribe to the full one?
I tried to subscribe to internals-digest, it asked me to send a confirmation mail. I sent the confirmation, it asked me to confirm the confirmation. I must be doing something terribly wrong...
 
Digest will do. You'll get direct replies...
 
ok, looks like I'm confirmed now. will give it a shot, thanks.
 
:-)
thank you!
 
3:17 AM
@ircmaxell done
I think I failed with newlines, sorry about that
 
 
1 hour later…
4:18 AM
1 hour later…
 
can someone help me out?
hello?
hello?
 
4:46 AM
@javawarrior > Discussion for all things PHP - Don't ask whether someone is here or can help. Just tell us your problem. If anybody can and wants to help, they will.
 
ok
i need to get around 100000000 different numbers
how long would it take me to do so?
 
Different numbers as in random numbers? Or would the numbers from 1 to 100000000 work?
:)
 
posted on December 24, 2012 by PHP Advent

We who work on the Web, as Noah Stokes wrote in an earlier article, have a privileged opportunity to create things that can change the world more easily than most; to make a difference. This concept is inherent to the essence — the very nature — of the Web. I believe this depends in part on us maintaining and supporting what’s already been done. I’ll illustrate. How I started I’ll not pret

 
1 to 10000000000
or if needed 10000000000000000
i need to make a script that returns a password
so if i can get help
 
You want to use just numbers as a password?
 
4:54 AM
no
it's kind of an evil project
if you want to help, contact me on skype
i'm theamazinggya
 
So you just need a bunch of random numbers?
 
Sequential numbers?
 
well, i cycle through numbers
when a number meets a specific criteria, it stops
 
Okay, um. Sequential is fine?
for($i = 1; $i <= 10000000000; $i++) # stuff
I think I'm not quite understanding your question.
 
4:57 AM
Same
 
ok
so there's this site that has a really bad security system
and basically they check if people's password and username match by using an open php script
i found the script by looking around n the source
and i want to use base 32 to find passwords
i start at one, and i'd use a while loop
i want to know what kind of speed i'll ge
 
generating the numbers (the for loop) will be extremely fast
 
*get
 
Wait... are they hashed, or something?
 
how fast?
minitech, what is hashed?
 
5:00 AM
I'm sure even low end computers would run through millions in a seconds
 
i need more then a million
 
Validating your password against a a remote site would take far longer though
Try it out javaw
I'm sure you could generate literally billions in a short amount of time
(And by try it I mean the generating numbers part, not the trying to brute force a website part)
 
what's javaw?
 
your name
 
@javawarrior Your username, truncated.
 
5:04 AM
can someone write a script for me?
 
@javawarrior When a password is irreversibly* transformed for secure storage and verification.
Okay, so if they’re not hashed... how is it that the passwords are stored, apart from "insecurely"?
 
probably by some mysql database
 
Can you post a link to the PHP script?
If you don’t have the database, then the speed of generating numbers is completely irrelevant.
 
it's a GET post
no it is not
 
Erm, if the username / passwords are in a database and you're trying to brute force it with a POST, it'd take forever
 
5:05 AM
no
it's GET
 
Same thing
You still have to send the request and wait for a response
Even if the target server is really fast, brute forcing a password would take forever
 
Wow
 
haha
 
GET request with no SSL
 
5:07 AM
yep
it's really weird
and what's even stupider is that people can use credit cards to buy stuff
 
page says reguser though, you sure its not the signup form?
 
i'm sure
here
i'll setup a fake account
ok
 
That’s not too terribly insecure, and it’s not "open".
 
in the GET post
user is jeevano and pass is jeevan
 
GET is more or less the same as POST when it comes to security.
 
5:09 AM
but it was out in the open
and so many people have modified scripts, as in they can modify how many points they have
 
As minitech said that is pretty standard practice. You could basically brute force any site using the same method you're thinking of using for the chatablanca site
 
not really
 
The GET request makes it easier and the fact that they return a nice clean response ("validreg=true/false") instead of a full HTML page makes it even simpler
 
a lot of sites have lockout, or they have captcha
 
Yeah
 
5:12 AM
but this site is a freaking flash site
they don't check emails
 
Rate limiting and IP blocks and such, from the look of the site it doesnt seem that they spent much time on security
 
Yep, but it’s still not terribly insecure, and cracking things by brute force will be impractical. Technology has nothing to do with it.
Good night :)
 
But then again, doesn't seem like they need to either considering its just a simple chat service
 
Anonymous
@minitech I wander at which age you started programming
 
it's not just a simple chat program
people have credit card info on there
 
5:14 AM
Ouch
 
@minitech I don't know that I've ever seen you in here
 
i want someone to write a script for me
in return, you will get a java program
 
no one will write a program for you in exchange for you writing a program for them
but if you know java you can probably pick up php basics very quickly
 
Anonymous
@javawarrior I am affraid things don't roll down like this in this world
 
noooooooooo
 
6:17 AM
Just because I'm curious... what script?
 
6:41 AM
@NullPointer agreed
 
@Gerry with gravatar.sucks ??
or cv's ?
 
yes
Gravatar
 
=================================================
Note: Firstly, I realise 99% of PHP developers use the error suppression operator (I used to be one of them), so I'm expecting any PHP dev who sees this to down vote me, but please bookmark this so that you can come back and change it to an up vote in a couple of years when you realise I was right. =================================================
 
lol
 
@Gerry i am not entirely agree with that 99%
 
6:45 AM
Back when I wrote it a lot more people were using it
 
i even not used one @
 
Good!
 
but i am agree with bad part a and rest part +1 for a nice answer
 
:0
* :)
Thanks :)
 
hi everyone!
 
6:47 AM
Hi Allen
 
@Allen hola
 
i was hoping to ask people, how is PHP in the startup scene as of now? is it still the most popular language? or is now ruby/python?
 
@NullPointer Thanks for the +1 that just bumped me up to being able to create tag synonyms. More powa!!!
 
@Gerry :)
 
@Allen: I think it's been Ruby for quite some time (just based on conferences I've attended). That might not be a popular view in here though. ;)
 
@Charles ahh already requested here to
 
@Allen PHP still has a well-deserved reputation for being a language for newbies and the unwary. It's certainly not trendy in the startup scene, but it's not absent. Finding a good PHP dev is just as hard as finding good Python or Ruby dev.
 
@Charles are you using dav cv-pls plugin
 
@NullPointer No, but I've been meaning to try it out.
 
try this ...you will find it really worthy ...
 
6:53 AM
thanks guys :)
 
There are three hundred fifteen potential duplicates containing the error message you have provided. Every last one of them has the same core issue. The query failed and returned a bool. You need to add error checking to your code, and you need to fix the underlying SQL error. Hover over the downvote arrow. One of the reasons suggested there is "this question does not show any research effort," and it doesn't. — Charles 8 mins ago
@Charles lol
 
I love posting that variant on "how do I format this timestamp" questions. Nothing like a few thousand potential dupes to humble someone.
 

« first day (800 days earlier)      last day (4141 days later) »