« first day (858 days earlier)      last day (4105 days later) » 

2:02 PM
@AdamLynch Let me spend some time with it then.. can i have some simple but fast blogs or a tutorial for json
@AdamLynch And Thanks for ur help and Time
 
@ircmaxell This one (as a large exception) may actually know what he's talking about (to some degree. He is a Ruby guy after all, so he can't be that smart :P)
 
@ScoRpion... I ran into that problem when working on a class which converts objects to JSON complying with this json-rpc.org/wiki/specification
ya no prob
 
@NikiC which is why I followed up with a question...
 
@NikiC from my last 24 hours dealing with ruby I disagree with that statement. ruby guys are exceptionally smart. they are so smart that they even outsmart themselves by writing code that is so smart that it wont work
5
which is why I am now changing the stupid pretty printing to google prettify (javascript)
 
@Gordon Just FYI, I meant that in a friendly way, not in the "ur dumb asshole" way :)
 
2:05 PM
@NikiC themeforest.net (in top world sites) 1.) They don't know s* about XSS 2.) Don't know s* about CSRF 3.) Obviously suck at don't know much RoR :) But I think that is because they rely to much on libraries and RoR itself.
 
@Gordon Debugging code is about twice as hard as writing it in the first place. Which is why if you write the most clever code you can, you by very definition are not smart enough to debug it
 
@ircmaxell yes. that was the quote I was aiming at ;)
 
:-D
 
Anyway, Egor is one of the people who tries to push things like CSRF in the Ruby world.
 
I figured that's what you were after
 
2:06 PM
Though from what I've seen they have been quite resistant to security practices :P
 
@ircmaxell that is a nice one
 
ruby is too magical to debug
 
@NikiC Cool, didn't recognize him. I just wish he'd clarify what he meant. If what he says is valid, all the better. if not, then...
 
you just write code and it works
you can endeavor to fix magic, it works as it works
 
Though I think he's mostly known for having hacked GitHub ^^
Which obviously was once again the result of Rails great insecure-by-default approach ^^
 
2:08 PM
off to work, later
 
@NikiC guess that's the first step in fixing ruby security issues
@NikiC github cannot be in Rails
it just cannot
 
@NikiC well, rails is for RAD and RAD by definition will give you technical debt because you will not focus on all aspects, so they basically reap what they sowed
 
@andho It cannot? a) Numerous security issues b) Major outage every other week. Sounds a lot like Rails :P
 
@andho Wikipedia says otherwise
 
haha, i'm sold
 
2:10 PM
@andho it is in RoR. The mass asignment vulnerability was a ror vulnerability
 
@Gordon An application vulnerability facilitated by Rails
I mean, if they had specified the necessary checks, everything would have been good. But Rails is very inviting of not doing things right, it seems
 
@NikiC like phalcon php :P
 
some cool free kindle books
 
@webarto Yes, I mean why should we learn from the mistakes others did?
 
so the mass assignment vulnerability is because people don't validate the data they assign to the models?
 
2:17 PM
@NikiC Only if you are sadomasochist :) I feel like he wasn't even aware of that issue and just blindingly made it work like other AR ORM's. Just taking him as an example, pretty sure there are more.
 
@andho RoR allowed you to do that
and by default it did that
 
@webarto i don't agree with your proposal
i don't want to give a whitelist everytime
 
@andho Yes and no, you should never trust user input, e.g. pass entire $_POST to be written in database, you could pass $_POST['is_admin'] = 1 and that .. [I stopped writing here]
 
i already have my validation chain checking it
 
OK
 
2:19 PM
guess i don't understand Rails, what does 'is_admin' do?
i guess it would override model validations
 
@andho It's more than simply validation. It's about hey some variable is coming in over HTTP lets see if we can update just any internal variable with it
 
@PeeHaa not really, ruby has a very veryyy easy way of setting validations in their models. If the field doesn't match validation it raise an error. If the dev really didn't want to set all of the fields in the model (which is usually the case) then he can specify the whitelist
i don't understand the security vulnerability, that's all
 
The vuln was that it was possible by default to do it
 
In order to fix the register_globals-removal bug in PHP 5.4, just use extract($_REQUEST); at the start of your code!
 
Those who cannot remember the past, are condemned to repeat it.
 
2:23 PM
@NikiC nice one
 
@NikiC THANKS SO MUCH <3
 
@webarto I know, total life-saver
 
@webarto Any further info on the server?
 
We really might have to remove that one though ;)
 
@NikiC I'm going to use it in ALL of my projects!
@Jimbo Not at the moment :) I'll let you know, I'm waiting for feedback too.
 
2:25 PM
@webarto Cool, thanks
 
@andho If what we are saying is wrong, then Mr. Phalcon would just have closed the Issue.
 
@NikiC I asked in pecl to change the default EXTR_OVERWRITE but the only who answered was the @salathe and he was against it
 
@webarto i'm not saying you are wrong. Saying I don't get it. But I don't understand security issues in general though.
 
ok. Syntax Highlighting is now working. Thank you Google for making google-code-prettify.googlecode.com/svn/trunk/README.html
 
@Gordon He is always against everything :D
 
2:28 PM
@webarto i know
 
@Gordon Thank you for sharing. Wasn't aware of that.
 
@Gordon ;)
 
@andho Anyways, it's optional parameter.
 
@Gordon "It doesn't work on <obfuscated code sample>?

Yes. Prettifying obfuscated code is like putting lipstick on a pig — i.e. outside the scope of this tool." - I like the comparison.
 
i found another blogpost that suggested its what SO uses, too.
 
2:32 PM
@Gordon why are you setting up a blog on github?
 
@webarto because posterous is closing down in april after they have been acquired by twitter
 
:)
 
so i needed an alternative and it was supposed to be simple to use gh with jekyll
it wasnt
but now its sufficiently working
 
wordpress is the best
and they aren't gonna shutdown so easily
 
@Gordon so you'll use the js thingy rather than the {% highlight %} pygment blocks in jekyll?
 
2:35 PM
@andho yeah, i considered that but like @ircmaxell said, why would anyone install a vulnerability on their servers
@NikiC yes
 
@Gordon why?
 
@NikiC because none of the ruby based solutions would highlight anything at all
 
@Gordon Yeah I had my issues too (esp on Windows)
 
I tried it too, it didn't highlight, on ubuntu
 
a) Because Ruby and b) Because Python (you know how awesome Python is in regards to different versions....)
 
2:37 PM
@NikiC i couldnt even get the required gems to compile on Windows so it was pretty much blind trial and error until I installed on my ubuntu. there i made highlighting work with kramdown but when I pushed it: nothing.
 
@Gordon I had to patch a few gems on windows
 
@NikiC i used the ruby installer and devkit and followed the instructions by the book but there was still plenty of errors and I wasnt willing to go digging into ruby that deep
 
I guess none of the Jekyll folk ever considered that people might want to use their software on niche operating systems like Windows :P
 
@NikiC I guess none of the Jekyll folk ever considered that people might want to use their software. Full stop.
 
@Gordon :D That too
 
2:39 PM
:D
 
At least from the error messages it provides I can very well imagine that you're right
The error messages are definitely not designed to be consumer-friendly
 
the only problem I've had with jekyll is when it doesn't give me errors at all
apart from that it's quite fine
 
My usual approach to debugging jekyll is bisecting the document
just delete random chunks from it and see when it starts compiling...
anyway, time to do something useful
 
yupp, time to get my earmold now
 
@NikiC tweak those templates!
 
I freaking hate 3rd party crap
 
I'm getting zapped by my Mac keyboard again :(
 
@PeeHaa I freaking hate 1st party crap ;)
 
I would much rather swim in my own crap than someone else's.
imho of course
 
2:52 PM
Understandable. I still don't like it.
This is hypothetical of course, I've never written bad code (eyeroll here)
 
@PeeHaa Same here bro.
 
:-D
 
Hey @DaveRandom, any chance you could throw me some ballpark eta for that special 'thing' I'm after? My company are wanting a 'thing' built into our framework, and I want to tell them to hold off on development until this 'thing' comes out
And all: 'thing' is no innuendo
 
@Jimbo You would have to ask @rdlowrey, but it's not likely to be what you are looking for if you are talking about frameworks, what are you actually needing to do?
 
@DaveRandom Okay so all our applications are built on our in-house full stack framework - and the tech director wants a comet node.js push system built into the framework as a kind of 'module' to be used in any application that needs it
I'd love to work on it, but if there's something that's going to make it easier / more efficient like what we talked about, I would want to tell them to hold off until I get to see that
 
3:00 PM
i want to create new web browser using PHP, can someone suggest best tutorial
13
 
Insta-star
 
I didn't just star that...
He listed socketo.me as something to look at - but when I showed this to you guys, it was possible there's another way...
 
@pbvamsi um, a browser using PHP?
 
Rockstar @pbvamsi
 
instastar
@DaveRandom ah, beat me to it :D
@DaveRandom php.news how do you like that, bitch?
 
3:04 PM
@Pheagey isn't it possible
 
@Jimbo Yeh what we are talking about there probably isn't suitable for that (yet, possibly ever). The real crux of the problem is that websockets with a PHP-driven backend are not particularly well implemented by anyone, simply because of the nature of the way web servers work. You basically end up needing to use a different port (bad for proxy traversal) or a whole different "server" (read: vhost) which is a waste of resources and bad for SOP.
 
@DaveRandom When you say bad for proxy traversal, what do you mean? Trying to figure out if this will be an issue
 
I have a table with column desc how can I run this query
`select desc from table` as desc inbuilt in sql for descending
 
@pbvamsi I would lean toward highly improbable. As nothing is 'impossible', but worth it? Probably not.
 
@BasicBridge : SELECT desc FROM table
Although it's bad practice to use reserved words like "desc"
use backticks either side of "desc"
 
3:06 PM
@Jimbo thanks back-ticks works
 
@BasicBridge If desc is short for "description", change it to "description" - because you can "DESC table;" as it's a reserved word
 
@Jimbo If your site is open to the general public, it is an issue. Basically anyone sitting behind a proxy (many large corporate networks, universities etc) may have problems if you require connectivity to non-standard ports. It depends how good the proxy is, and if you are making stuff for internal use by customer X then things can be set up right to circumvent the problem.
 
and
ORDER BY col_name DESC
 
@DaveRandom Ouch, not simple at all then :(
 
@Jimbo yes i'm doing that just right now. I realise it too late
 
3:08 PM
@Jimbo tbh though, what you probably want to be doing is focusing on creating a client side framework with an abstract connectivity interface, so you can drive it with server push/long polling/websockets/whatever and it doesn't matter what the backend is. /cc @PeeHaa (we should do this)
@Jimbo Well no, but what you are talking about is in general not simple.
 
@DaveRandom Okay, so a client-side framework with a connectivity interface that doesn't have to know how the data is given to it - separation of concerns
 
OH: " a) Numerous security issues b) Major outage every other week. Sounds a lot like Rails" (referring to @github) ;-)
 
@Jimbo Ive played with websockets briefly. It's still a very immature tech. Promising, but technical issues yet to overcome.
 
@Pheagey Did you find anything that I should know before embarking? :P
 
@DaveRandom You read my last night's mind :)
But first I want to spit out a chatdemo tonight which has some features
 
3:12 PM
@Jimbo Prepare to have your hair turn grey...
 
@Pheagey Like what technical issues?
 
@PeeHaa the guys have covered everything I ran into and more.
 
@Jimbo Precisely, something you can build an application on top off with a sendData() call and a onData() callback (possibly other things as well), then you can just build drop-in modules to power the communication. Every actual app is likely to have a fairly heavily customised back end (otherwise you'd just be churning out the same app every time) so it'd be good to focus on building that abstract API before you worry about the nuts and bolts of what it actually does.
 
@ircmaxell Thief :P
 
3:14 PM
@Jimbo @PeeHaa It was a brief afair...
 
@Jimbo For any given app, you may find that Node is better or PHP is better at the backend, depending on what it actually does
(or <insert other server side env here>)
 
@NikiC at least I said "OH" and didn't just say it myself...
 
@ircmaxell Can you remind me again why you don't think short-syntax for anonymous functions should be closures?
 
@DaveRandom This is really interesting, I'll do some research and get some code done :) No idea about PHP vs node yet, but I'll find out
 
@Pheagey What guys? :P
 
3:18 PM
@LeviMorrison I don't think they should be explicit closures. If you want to make them implicit ones (where you don't have that retarted use syntax), I'm game...
 
@ircmaxell I think that @NikiC would like that, but then we have this split behavior in closures. Not sure that helps PHP at all.
 
@PeeHaa DaveRandom specifically.
 
I know.
 
Also related: if PHP used an AST they could determine which variables to automatically 'use' without exporting the whole scope.
 
@LeviMorrison We can also do that without AST ;)
just go through the CV list
 
3:20 PM
@Pheagey Ah right :) Yep. Good guy @DaveRandom rocks
 
@NikiC So why didn't they do that in the first place?
 
@LeviMorrison dunno
I think having the explicit uses has a certain charm to it
 
@NikiC well, variable variables
 
@PeeHaa Yea, he seems to have been around the block a few times.
 
C++ chose to do it this way too
@ircmaxell yeah sure, AST doesn't change nothing about that though ^^
 
3:22 PM
@NikiC I wouldn't mind it if it was an actual use. But it's a variable copy, not a scope import. Which means ref counting is affected. Which is not cool
 
@NikiC Yeah but their syntax is terse and ours isn't.
 
@ircmaxell variable copy makes most sense mostly
Imho by-ref important usually lead to nasty busy
See: Any language using by-ref imports by default
I remember seeing some completely crazy issues in C# with LINQ in a loop because of that
where you wouldn't get different lambdas for every iteration and instead got always the same lambda for the last value of the loop variable...
or something like that
 
Muahhahahahahahahah cough cough repwhore:
1
A: How to get an element inside nested divs by class name?

PeeHaadocument.querySelector('.Grand.grand.child');

Related: close as TL?
 
@PeeHaa I say no, but I'm not a fan of TL in general.
 
3:29 PM
@NikiC I'm not saying it should use by ref. It should use the scope's variable as-is. Import the scope, not the variable...
 
@ircmaxell not sure I understand
it can only be by-ref or by-val. Or is there some other option?
 
2 weeks StackOverflow and I started hating non-native English speakers even though I'm not one myself... Does it get any better?
 
@Ocramius Njet. Not non-native, but crooked Engrish.
 
The "Pls someone help. I have application with <problem>. How can I do? Thank you."
:D
 
@Ocramius Define non-native
Mostly they are coming from a specific region (the ones I dont like)
 
3:35 PM
Say it.
 
Thank you come again
:)
 
Anonymous
@Ocramius Stop hatin! or you'll make me release the teresko on you
 
noes :(
 
@NikiC there is another option: scope import
meaning copy the variable exactly as-is...
 
@Ocramius FOUND IT courtesy of @hakre :)
 
3:42 PM
the paaaaaaaaaaaaaain
 
@ircmaxell isn't that by-val if you copy it?
 
hehe
What is this $ function? It does not seem to work: jsfiddle.net/jhnZd. — Felix Kling 7 mins ago
 
@NikiC I'm saying it shouldn't be a copy. It should just be a pointer...
 
@PeeHaa He doesn't know Javascript or what? :D (:P)
 
3:44 PM
@Chris That has been a while
 
@Chris welcome (back)
 
@ircmaxell so you are talking by-ref after all?
 
@NikiC to me that's the entire point of a closure. That it closes around the scope of its parent, thereby having access to the variables over time...
@NikiC No! I'm saying no change to the zval should happen
 
@ircmaxell That's just not possible
 
@NikiC it absolutely is possible...
 
3:47 PM
You can't reference a zval without actually adding a ref
 
Yes you can, because you're not referencing it. You're referencing it's scope
which is the biggest mistake people make about closures
 
@ircmaxell You can't just reference the scope. The scope may die before the closure does
 
they think it's about variables. It's not. It's about variable scope
@NikiC the scope is kept alive by the closure
 
I'm not yet seeing the benefit to what you are describing
and in particular how it differs from a by-ref binding
 
It differs from by-ref because you can still do copy-on-write. And it doesn't fork the original zval...
 
3:49 PM
@ircmaxell so you aren't talking about different behavior and just about performance?
 
No,
 
@webarto Heh, how goes it! I've been "around", just super-busy trying to wrap up a quagmire project.
 
then maybe a code sample would be good, cause I really don't get it ^^
 
I'm talking about it working the same way that functions work today. That the closure becomes less of a unique function and more of a callback that is returned.
that's how JS does it. Scopes are closed around. The scope is what matters, not the variables contained
 
I love javascript closures; every step PHP makes to be more like Javascript makes me happy (not sarcastic)
 
3:53 PM
@Chris JS certainly didn't come up with the idea, though.
 
@Chris JS closures are terrible
Or at least this in JS closures is terrible :)
 
I love them, and hoisting.
And the way scope is treated.
 
@NikiC Did you mean: $(this) :P
 
@NikiC nah, JS closures work incredibly...
 
	$cat = {
		'color':'green',
		'smell':'terible'
	};
	print $cat->color;
This is what I want next ^^
 
3:57 PM
@ircmaxell Are you sure you ever wrote any JS? :P
 
@NikiC have you ever learned any JS ?
 
I really don't get how anyone could like them ^^
 
@NikiC As long as you understand scoping they are better than what PHP makes you do.
 
@NikiC I write a lot of JS... One app I'm currently working on has about 300k lines of JS
 
I'll come clean and say that I like them because it is where I learned about the concept.
I fiddled with them in PHP as soon as they hit, and wound up setting them down in disappointment
 
3:59 PM
@ircmaxell And you never had any crazy issues with their closures? (Especially the aforementioned this-binding)?
 
@NikiC Nope. I spent a while figuring out how things got bound, but once I did, it's so bloody powerful that I wouldn't want it a different way...
 
The ability to bind this is one of the best parts! :p
 

« first day (858 days earlier)      last day (4105 days later) »