« first day (1271 days earlier)      last day (3677 days later) » 

4:00 PM
hey guys
 
@DaveRandom :D
 
i have a problem with my php code
can someone please help me out?
 
Still A
 
@DaveRandom Not many people do databasepublishing print and web in a sane way. Aaaaaand not many people do print either way so there is still a pretty big market for us
 
4:01 PM
Oops, wrong A. Fixed.
 
@iWumbo Ask a question and someone might.
 
Having a sales guy helps a lot
 
@iWumbo Don't ask to ask questions, just ask your question please
 
@PeeHaa AKA having a guy to talk to clients instead of you.
 
@LeviMorrison A
 
4:03 PM
Why A?
 
familiarity
and the content feels more centered
 
@PeeHaa Something like darkhorseanalytics.com?
 
Every other two-column layout on our side puts the sidebar on the right.
 
how do i upload my code hgere?
 
@LeviMorrison I don't like the underlines/HR personally
 
4:04 PM
@PeeHaa This is what happens when you get your own business dumpert.nl/mediabase/6592795/cbf056b2/… ahahahaha
 
@iWumbo Put it on pastie.org and link it.
 
In all my IDEs I have all the layout and file hierarchy on the left, and the code middle to right so most of the code is down the middle - that's why it feels more familiar to me to have the nav on the left
 
heres a link to my code, im getting an error for some reason
 
And the error is?
 
doesnt show the error lol just says what I have in the else statement
 
4:09 PM
@iWumbo what a mess, it's almost impossible to remotely debug it
 
Where's that fire gif? :P
 
@HamZa lol seen it
 
What can I do to remove the mess
 
can anybody tell me how I can integrate payment gateway in india for indian banks both public and private.
 
@iWumbo So if you're hitting your 'else' statement. Have you tried debugging what's inside the if one?
 
4:11 PM
Hello everyone
 
My debugging doesn't work, for netbeans, can you recommend another debugger please?
 
Can I also ask questions about an idea I've got for a little project
 
@iWumbo Your brain?
 
@MikeM. Hey! Please read room-11.github.io before asking a question in this room.
 
4:13 PM
@iWumbo PHPStorm.
 
@Fabien You misspelled mysqli_prepare
 
/me appears
 
lol
 
@JoeWatkins Aaaaarrrrrgh! Don't do that to me...
 
@SecondRikudo nice attitude..
 
4:14 PM
@iWumbo I wasn't kidding.
 
sneaky sneaky ...
 
@SecondRikudo There's too much to be done.
 
@Danack thank you
 
For 99% of my projects, I don't use a debugger at all.
 
@iWumbo Have you tried to integrate xdebug with netbeans?
 
4:15 PM
@SecondRikudo Don't generally need debuggers for flat html files :P
 
It's a very good skill to be able to read and follow your own (and others') code and be able to spot problems when they happen.
 
Or upgrade to 5.6 and use phpdbg :D
 
@Leigh Heh, I wish
 
Second rikudo can I take it that I can ask such idea related questions because its not mentioned
 
@MikeM. Specifically, read Don't #3.
 
4:16 PM
@MikeM. The main point is to not ask whether you can ask questions :P
Just ask :P
 
Although technically asking to ask a question IS asking a question.
 
Oh damnit didnt got that I was doing that
My excuses
 
@Fabien Shut it!
 
lol
 
4:17 PM
@JoeWatkins Your thoughts on this: A or B?
 
Well would it be a good idea to start up a ticket support project
 
I'm left handed, so because of the inherent evilness of that ... A ...
 
@PeeHaa hey, did you ever find out what the issue was with this one? github.com/Lusitanian/PHPoAuthLib/issues/224
 
@MikeM. Depends on why you are making it I guess.
 
Because I am just making updates for my news letter script
 
4:18 PM
@MikeM. Why not use an existing one?
There are advantages on rolling your own (educational, new features, etc), but why are you doing it?
 
Well I want to release scripts for public usage at my own site
 
@LeviMorrison I choose C actually ...C is an option on my.php.net that lets me choose which side of the screen to have menus, I' always choose left ...
 
@JoeWatkins Can't be bothered to maintain that ^^
 
oh I thought it'd be easy
 
4:20 PM
Be safe.
 
I am just updating. The news letterscript and want to start a new additional project :)
 
@Fabien a moment of silence is in order ...
that'll do ... carry on ...
 
pours out a little gin
 
So would it be a good second project?
 
@MikeM. Sounds a little like github... public scripts.
 
4:22 PM
@JoeWatkins Sure, but it's a complexity I'd rather not maintain.
 
Well ye its going to be 100% public :) its the second url in my signature
 
I'm not sure how much maintenance it would need ... I can see that if we ever sprout another arm things will be tricky but not withstanding that, it should be easy :D
 
 
lol
 
because, PHP
 
4:24 PM
D should be an option that replaces every character on the page with a tiny kitten ...
 
Also everyone can remove the powered by in the footer but we won't give any support if it is removed... (MyBB style)
 
Just typed in ... http://youtube.php ... I need to get hammered.
 
or sober....
 
heh, remove the "powered by" and start a rumour that the site is now powered by python.. next year, april 1st
 
4:25 PM
.php would be an awesome tld
 
Xd
 
@Joe and E is the option to just show a huge My Little Pony image instead of php.net if someone doesn't have JS enabled, right? :>
of course, that last one could never happen.
 
Because people don't disable JS?
 
well ... developers kinda do
anyone who knows enough to run noscript
 
@tereško if they know that, they know also how to enable it
supporting <noscript> is like supporting the mom of the guy who installed noscript on his mother's computer and misconfigured it to make her angry :P
2
 
4:29 PM
so , if your core userbase is "developers or computer-savvy users", then the site should at least looks acceptable without JS
 
Sometimes I disable 'some' javascript by attempting to mash ESC at the right time.
Like the Wikipedia blackout a while back.
 
@Ocramius Here, have a star.
People who disable JS and want to have "expierence" while browsing are losers and nolifers.
 
An 'experience' while browsing. Sounds so buzzwordy
Well in some context of misunderstanding UE
!work-time
 
Well, browsing PHP.net with noscript enabled in january certainly was an experience. :D github.com/php/web-php/commit/…
 
Isn't that UX or whatever.
git revert bb84c7b
#YOLO
I bet @bjori wouldn't appreciate it :D
 
4:34 PM
the commit I linked was the revert
 
But if you revert a revert, what happens?
 
if you revert a revert, you can actually break the internet.
 
Let's try.
 
/me grabs the popcorn
 
@webarto revert is a commit
So it's basically another commit..
 
4:37 PM
Yeah, but it would show ponies, that's what I'm talking about.
 
@LeviMorrison anything from sara yet ?
 
Nope. I sent emails out to Will Fitch and Felipe too because they are previous RFC authors on the subject. No response from them either.
 
user895378
@Fabien The @webarto Experience ... sounds like a prog-metal band name.
 
Changes to be committed:
  (use "git reset HEAD <file>..." to unstage)

        new file:   images/noscript.jpg
        modified:   include/header.inc
@TobiasGies ^ Here comes ponies.
@rdlowrey :D
 
Surprisingly (or maybe unsurprisingly) the noscript.jpg really fits our color scheme
 
4:45 PM
It's a perfect fit.
Only thing, it should probably be PNG.
 
felipe is usually available in irc
my os is totally vulnerable to this heartbleed bug ...
 
Yes, but BYU's IP is blocked by efnet so I can't connect.
 
wtf redhat ... dick heads ...
 
can anyone please help to solve this : stackoverflow.com/questions/22968984/…
 
user895378
@JoeWatkins Really? I'm surprised RHEL would be packaging OpenSSL 1.0.1
 
user895378
4:52 PM
They've historically been very slow adopters of new OpenSSL versions.
 
fc20
[joe@localhost backend]$ openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
 
user895378
lol
 
I know, I find it all a bit strange, 0.98 was the only version anyone used for like, ever ...
fc20
 
user895378
Yeah I'm in the process of changing all my passwords ...
 
well fuck, what do we do now daniel, do I need new public keys or what ?
I know, I find it all a bit strange, 0.98 was the only version anyone used for like, ever ...
I've had same key forever and use it for absolutely everything ...
I know, I find it all a bit strange, 0.98 was the only version anyone used for like, ever ...
well fuck, what do we do now daniel, do I need new public keys or what ?
 
user895378
4:54 PM
I'm replacing my public keys too to be on the safe side.
 
user895378
It's a real PITA.
 
openssl version
OpenSSL 0.9.8h 28 May 2008
:)
 
Where is openssl good for?
 
user895378
@webarto Yeah but say you use the same (strong) password for almost everything. You logged into a compromised server with a username/password. An attacker (probably the NSA) could very well have the login info you use for everything.
 
@rdlowrey Aaaaaaaah, so change all of the passwords.
 
user895378
4:57 PM
Pretty much everyone should consider updating passwords.
 
Thanks for the info.
I will change my Facebook password.
 
user895378
I mean, this heartbleed thing is massive.
 
1 message moved to bin
@rdlowrey I've noticed few major services going berserk.
23 hours ago, by webarto
As of 1:45AM EDT on April 8, 2014, all Nexcess managed systems vulnerable to CVE-2014-0160 were patched. http://nexc.es/1eouPDn #OpenSSL
We (in company) haven't changed anything regarding passwords, probably because you have to SSH to one server, to get to other one.
 
user895378
@MikeM. Have you ever accessed an https:// site? Chances are it was using openssl.
 
ye I have
but but https// are paid certifications right?
 
user895378
5:01 PM
That has nothing to do with anything.
 
I assume ssl certifications (to get https://) are paid certifications
 
the best thing to do if you don't know about something is stop talking and listen ... advice for life ;)
 
user895378
Most are. Again, that has nothing to do with the vulnerabilities presented by the heartbleed bug.
 
So openssl can support such certificates for free or am I at the wrong point now..
 
...
 
5:05 PM
well atleast the seem "real" but they aren't if I am correct...
 
I ain't changing my passwords fer' noooooobody!
 
You pay for certificate signature by authority (which can be trusted). You can generate your own but it's not trusted unless user adds it as trusted.
 
user895378
Openssl has nothing to do with free vs. paid certificates. You can generate and sign a certificate yourself for free using openssl. You can also verify that cert yourself for free using openssl.
 
user895378
When you pay a certificate authority for a signed certificate you're paying them because other people (browsers) trust that the CA is trustworthy.
 
@DanLugg woman, get me mah gun
 
5:08 PM
ah rdlowrey I got it now.
 
Rarely anyone will trust certificate signed by Hordijk's WhoreDicks @PeeHaa.
4
 
thanks for taking your time to explain it @ both of you (webarto & rdlowrey)
 
user895378
I trust Hordijk's WhoreDicks Most Premium Televisions Package CA Service for all my encryption needs!
 
:D
Better Call Saul type of certificates :D
 
@DanLugg E_BEARD
 
user895378
5:10 PM
@webarto \o/
 
*sigh* Overnight someone recreated and .
 
user895378
It seems fishy to me that OpenSSL's heartbeat extension support could not be enabled/disabled at runtime. Most of the TLS extensions have this capability.
 
Hack Developer Day is streaming! http://www.ustream.tv/channel/hack-developer-day /cc @HipHopVM @HackLang #hack #hhvm
a day of hack :D
 
Awesome video.
@Ocramius Kewl.
 
user895378
5:15 PM
I wish all the people who splooged over the "oooh shiny" of hack contributed the same energy to PHP improvements.
 
user895378
(not directed at you, @Ocramius ... I'm saying that in general)
 
@Ocramius Seems to have streaming problems. Very jittery for me.
 
Yeah, but with Hack, you don't have to deal with the php-internals list.
 
user895378
With php you also don't have to deal with internals
 
@rdlowrey you can actually say that to me tbh, I wouldn't be offended. I contributed already a dozen times to HHVM and probably only 2 or 3 to php-src
 
5:18 PM
@Ocramius In both projects so far I've only contributed test fixes ^^ Although I have pretty much designed PHP.net and wiki.php.net
 
I just feel bad every time I read the mailing list. It is an unfriendly environment, and I don't like being in it
 
user895378
internals is a time sinkhole.
 
user895378
If you have something useful to contribute, write the code. If it's worthwhile it will be merged.
 
@rdlowrey it is depressing. It makes me want to abandon PHP for that only
 
user895378
As always, writing about writing code rarely helps anyone.
 
5:18 PM
so yeah, I talked a lot personally also with sara and paul and they're nice/friendly/etc. So I like that approach
 
Sara still pops in on Internals from time to time.
 
and I'm more keen to help ;-)
 
@rdlowrey "if it's worthwhile it will be merged" [citation-needed] E_SUBJECTIVE
 
Yes, but internals can be distilled to Lester & Stas
:P
 
user895378
@DanLugg What PR's have you submitted that weren't merged that lead you to doubt that?
 
5:19 PM
@rdlowrey All none of them. And I'm sorely disappointed.
 
@Ocramius So far its been boring.
lol
 
user895378
Also, I don't know how anyone trusts FB. I'm not about to contribute an ounce of my volunteer time to that for-profit venture.
 
I don't trust them, but Zend competition is good.
 
@rdlowrey I don't trust Facebook, I trust Sara, Paul, Sean, etc
 
user895378
Zend competition is great
 
5:20 PM
And I don't trust Zend either.
Even if I work as a teacher/contributor for them
I trust Matthew, Enrico and Ralph
 
user895378
That's like saying you trust someone you know who works at the NSA.
 
user895378
Not applicable to the larger operation.
 
I couldn't care less about "Zend" the company except for the money they pay me :)
 
Daniel, it's only openssl that is affected not openssh, does that get me out of updating keys ?
 
user895378
@JoeWatkins It does, but I'm doing it for this reason:
 
user895378
5:23 PM
26 mins ago, by rdlowrey
@webarto Yeah but say you use the same (strong) password for almost everything. You logged into a compromised server with a username/password. An attacker (probably the NSA) could very well have the login info you use for everything.
 
user895378
Because I use the same passphrase on my public keys that I use for many of my logins.
 
I hope something like the story of C# happens with Hack. Specifications written and revised and repeat. Eventual ECMA submission and acceptance. Facebook == M$, but C# is still a great language, and Hack can be too.
 
user895378
It may be going overboard to regenerate keys, but I'm doing it just because it makes me feel better.
 
user895378
I wouldn't say it's critically important for everyone to create new keys, but I'd rather be on the safe side.
 
You should especially if you have push right for OS projects.
 
user895378
5:27 PM
In any case, who knows if I've done something stupid before to leak my keys or something. Regenerating a new one every now and then is probably a smart thing to do anyway.
 
Who is the dude that speaks at this stream, annoying a bit.
 
I've had the same key for about 5 years and use it for everything ... I feel like I'm putting down an old family dog ...
 
LOL
BUY THEM ALL
 
aw duude ... don't try to make it more emotional ...
I'm already a nervous wreck ...
 
I have a jack russell terrier, he found a girlfriend, now I want puppies, lots of them.
@rdlowrey if let's say, @JoeWatkins didn't use his keys in recently, can someone still exploit it? Hope it makes any sense.
 
user895378
5:32 PM
Again, SSH keys are NOT affected ...
 
user895378
BUT ...
 
Right, right, got it.
 
user895378
Because this is such a massive exploit it's entirely possible that malicious persons have been able to access your logins and passwords when you've accessed online resources.
 
user895378
And if you reuse a lot of the same user/pass combos it's entirely possible people have full access to your system.
 
this kind of thing isn't meant to happen to real computers ... only windows ...
 
user895378
5:34 PM
I know a lot of this is paranoia, but still.
 
In last 10 days I think only thing I was logged in was GMail and SO (via Google).
And twatter.
 
user895378
Well, this exploit has existed for ~2 years apparently.
 
O_o o_O
 
user895378
Yeah. Kind of frightening.
 
those are some fucked up boobs ... if that's what they are ...
fedora update servers seem stretched pretty thin...
and after about 10 minutes of waiting ...
the version they offer me as an upgrade ...
1:1.0.1e-37.fc20.1
ffs
so recompiling openssl and breaking everything then I suppose .
 
user895378
5:38 PM
Supposedly distros will have just patched the problematic versions, but I hate that approach because then how do you know for sure that your system is fixed without then going and performing more tests of your own?
 
what can I look at to tell if they done that ?
 
user895378
not sure -- I would think RHEL would have a page up telling you about it somewhere.
 
plus it doesn't really help ... what about all the static linking ...
well this is shit, I'm going to end up wiping my disk before I can regenerate keys
 
user895378
Yeah ... I've been weighing how badly I really want to wipe disks and do a fresh install :/
 
user895378
Paranoia's a bitch.
 
5:44 PM
I'm not sure it really is paranoia, I mean this is happening ... I'm not thinking about wiping my disks because this might happen, it has happened, its a thing ...
 
Shit hit the fan.
 
so much shit on so many fans ...
 
user895378
Yeah this is definitely the worst thing that's happened on the internet since I've been aware of security issues (which isn't really saying much, but still).
 
It was probably done on purpose </paranoia>
 
Cool, the vulnerability was reported by a Googler
 
user895378
5:47 PM
32 mins ago, by rdlowrey
It seems fishy to me that OpenSSL's heartbeat extension support could not be enabled/disabled at runtime. Most of the TLS extensions have this capability.
 
user895378
Most of these things you can enable/disable dynamically using various OpenSSL macros at runtime.
 
user895378
But this one can only be controlled with a compile option
 
is the heartbeat extension what I think it is without looking ?? related to the hearbeat protocol/ha stuff ?
isn't some of that done using pretty low level wizardry ??
might be the reason ... I guess there must be a reason ...
 
@rdlowrey Exactly.
 
user895378
I'm unfamiliar with the "heartbeat protocol/ha" stuff you're talking about ... I don't know exactly what it does but I assume it's like any other heartbeat functionality ... there to keep connections alive.
 
So basically, we were unprotected this whole time to whom it matters.
 
good morning
 
user895378
As a TLS extension it's something both parties would have to agree on during the handshake. Without knowing much more about it I don't see why it would require any more "low level wizardry" than anything else ...
 
@ircmaxell lol? nevermind.
 
user895378
You should simply be able to say, "Don't advertise support for this extension" like you would with the other extensions.
 
user895378
5:52 PM
Although, I'm sure we've all created APIs where we said, "No one will ever want to modify this setting at runtime" :)
 
the only other time I've heard the word heartbeat is when messing with high availability stuff, drbd and the heartbeat software, drbd is supported by low level kernel features that could I guess need to be a compile time option ... it does look like it' something to do with that ...
 
@rdlowrey I think SSL is one of those where nobody should be able to modify settings at runtime
if you can go in and turn the extension off, you can upgrade the version.
 
user895378
Well I agree with you for the most part
 
probably better to aim not to have a break.everything option at compile or runtime :D
leak.all_my_shit
 
user895378
I'd definitely prefer to not need to know anything about SSL. I want my software to hide ALL of those details.
 
user895378
5:55 PM
That's what I was aiming for with the SSL/TLS things I did for 5.6, anyway.
 
@rdlowrey yeah, crypto should be left up to those focusing on it. Admins should never be able to (or worse, have to) make decisions on that front.
 
user895378
Makes me feel bad for the OpenSSL people ...
 
user895378
Having an "oops" that so demonstrably affects so many people in such a negative way would be really tough.
 
why? everyone writes code with bugs.
 
dude, it's me having to put down an old family dog ...
 
user895378
5:57 PM
@ircmaxell Totally, that's why I feel bad for them -- they'll catch a lot of flak for it but in reality I know I'd be perfectly capable of accidentally doing the same thing.
 
yeah hap shittens, we move forward ... if people remember this good thing, if they do not, good thing ...
 
an old fire chief told me something interesting once
 
OH: "I've had the same key for about 5 years and use it for everything ... I feel like I'm putting down an old family dog" @krakjoe
I'm totally in b4 @ircmaxell :D
 
"If you crash a truck, I will thank you for doing it. Not because it isn't a pain in the ass (it is), but because you donated your time, and no matter what happens that's worth more than any damage to any truck"
4
 

« first day (1271 days earlier)      last day (3677 days later) »