« first day (1588 days earlier)      last day (3357 days later) » 

12:09 AM
Does anyone see any issues in my RFC before I announce it?
 
@kelunik I think it's ok for going into discussion phase, just one point: maybe add a section explaining why you implemented it "strict" is a good idea. It will probably be asked anyway.
 
@ircmaxell I suppose this is what you meant? github.com/narfbg/php-src/compare/hash_hkdf
 
@marcio Good point, thanks.
 
@kelunik Traversable?
 
@NikiC Oh, right, I forgot about that.
 
12:20 AM
@kelunik oh, and maybe talk about the precedence of the new in operator, giving some examples to illustrate it.
 
@kelunik "For stings"
 
@marcio should have a higher precedence than boolean not IMO.
on the same level than instanceof and non-assoc.
 
12:38 AM
@bwoebi yes, and it's good to clarify that because not everybody will look at the patch before jumping into conclusions.
 
yeah… \cc @kelunik
 
@marcio Yes, I've added it to my current edit.
 
"New reserved keyword in. This affects function, class and method names." Would that be changed by Marcio's RFC?
 
yes. If it is done in time for 7.0
That means it needs to be proposed in the next few days.
 
@Danack :D yes, it would become just "This affects functions and constant names"
@kelunik another edit FY "New reserved keyword in. This affects function, constants, class and method names."
@bwoebi don't worry I'm about to fix the typehint bug and put into discussion ASAP.
 
12:53 AM
tbh then @kelunik - it would be more likely to pass once that is done, otherwise this would be quite annoying.
 
@Danack Yes, I know. Unfortunately, there's not the time do put it to vote afterwards.
Maybe we have to offer three options: "Yes", "Yes, but only if that other RFC passes", "No".
 
@kelunik i) I wish @bwoebi shared your enthusiasm for deadlines (how 'bout that API for PHPDBG?) ii) I don't think the RFC has to pass before March 15th, it just has to be raised and be under discussion.
It may be worth asking for clarification - I really doubt that that RFC would pass with the current keyword situation.....far more likely if it didn't break one of the most widely used libraries in PHP.
 
@Danack yes. phpdbg will get some updates before beta.
@Danack valid point… hmm
 
I thought you were going to get the API RFC raised?
 
@Danack no.
 
12:59 AM
Just do it? as in just do the code without an rfc?
 
the API is in php 7.
just needs some more docs etc.
Also, there still some bugs need to be fixed etc.
 
pfft. bugs.
 
no API bugs
phpdbg bugs in general.
 
@Danack I think I'll announce it tomorrow. We don't have to put it to vote after two weeks, but there have to be two weeks of discussion at a minimum.
 
@kelunik If you do, maybe ask for clarification of when stuff needs to get passed by for 7? If that question is asked in an RFC announcement, people will be more willing to get RFCs voted post March 15th as it would relieve the tsunami wave we're seeing now.
Seriously though, who is Francois?
 
1:19 AM
what are all the typehints we have?
array, callable...
 
@marcio Aside from classes and interfaces, that's it.
 
I just found out I'll have to forbid classes, traits, interfaces and namespaces to be named as Array and Callable. No loss, it's already impossible.
+ any other typehint we have, if we have any other
 
@marcio For what feature?
 
@LeviMorrison k
don't we have a "resource" typehint?
 
@marcio No.
 
1:23 AM
hehe, google search for "type hints php", the so called RFC will be there before the docs :D
 
1:36 AM
@bwoebi is there a way to skip a R2C rule after a hit? something like:
 
<ST_IN_SCRIPTING>{myrule} {
	if(cond) {
		return T_SOMETHING;
	}
    yyless(0);
	// continue to next rule...
    // not goto restart, it needs to go to next rule
}
 
@Narf yup. Thanks :-)
 
 
2 hours later…
3:58 AM
ping
 
user895378
There goes @Sara pinging the room again.
 
yo
 
user895378
See ... the "scalar type hints" Rebecca bait isn't even remotely believable.
 
user895378
That's like hiding a friday link behind ZOMG SCIENCE DISCOVERS UNICORNS ARE REAL!!!!11
 
I clicked because I love the baker cat theme but it was yet another rebbeca link :/
 
4:03 AM
@rdlowrey teh gheys have been keeping them secret from us because they're too fabulous:
 
zan
Good Morning
 
user895378
@Danack they do look pretty fabulous
 
@bwoebi nevermind the previous question, I just needed a snack and now I don't hate RE2C anymore :D
 
PHP 4 Life
 
user895378
PHP 7 Life
3
 
4:42 AM
Should setcookie be okay to run after a PDO update query? seemed to be causing an issue
 
 
2 hours later…
6:21 AM
Just out of curiosity how did SO chat become the de facto place you PHP bigwigs use to discuss all your endeavours? A lot of other projects seem to rely on IRC on freenode etc.
 
good morning
to all lenovo users blog.erratasec.com/2015/02/…
 
morning
 
6:37 AM
I find that Superfish thing pretty appalling. I have always been frustrated by PC laptops and the fact you can't just get a clean OS install image.
 
Well some of them are sold without a preinstalled OS
have a lenovo myself, the first thing I did is replaced the os and all the unnecessary lenovo branded stuff
 
Mornings
 
6:53 AM
morning Ronni
 
moin
anyone using android 5 yet ?
my phone got update last night ... mostly looks like eye candy ... dunno why it's a new version and not just a new theme ...
 
7:10 AM
@JoeWatkins what phone do you have?
 
I heard very good reviews about lollipop, but still wait for my xperia z to get the updates
 
I've found one good thing about it ... notifications appear on lock screen and are double clickable ...
also there is a torch and cast screen button in the notifications pull down on home screen ... nice touches ...
but I was expecting something a bit more spectacular ...
 
what are those?
 
what are what ?
 
7:13 AM
torch and cast screen
have read somewhere the priority notification system is a good feature
 
torch using the flash of camera for a light, flash light == torch
cast screen is for chromecast, not new, but more accessible now ...
 
oh
yeah I missed the flash light feature, had to set up an app for that
 
yeah me too, and it came with adds ... that was the first thing I uninstalled after upgrade
the priority notifications is the showing notifications while locked, that's neat, I haven't looked at how to configure it yet ...
it's a good job phones are too large for pockets now ... that notifications thing just wouldn't work in your pocket ...
the last generation of handsets used a combination of presses to unlock because the chance of accidentally pressing that combination in your pocket was near nil, however these are very large buttons, it seems quite likely that you would press it in your pocket ... if it could go in a pocket ...
 
I use a flipcase and it fits in the pocket ok, I remember in 4.1 you could bypass the screen unlock using the sms notification
highly secure :)
 
ah I don't use unlock ... I wonder if it gets past a lock still
mine hangs out of pocket, always ends up in hand ...
 
7:27 AM
because g5 :)
 
case probably makes it worse but I've had a few serious drops so not taking out of case ...
 
I'm thinking more and more about buying a simple phone for calls and a tablet
 
I got a tablet, it's behind one of these screens with a flat battery ...
 
yeah, cases save phones frequently
 
I use it about once a month, watching television on the ferry (which I do monthly) is the only legitimate use I have for a tablet ...
it goes flat before the journey is over ...
 
7:31 AM
room, FYI the Context Sensitive Lexer RFC is now on discussion phase news.php.net/php.internals/83272 :)
 
seens sony glasses ?
omg I just saw them, they are just horrible ...
I'm not putting that on my face ...
@marcio edit the tagged and pinned message and I'll pin it ...
 
posted on February 20, 2015 by kbironneau

/* by jack2k */

 
@marcio update status on rfc, says draft
 
@JoeWatkins Done, thanks.
 
7:37 AM
np ;)
 
@JoeWatkins could you please also add wiki.php.net/rfc/parser-extension-api
 
chill
 
Morning! )
 
@Alexander is it already on discussion?
 
7:40 AM
@marcio yes, this can be included into 7.0 (first part). Second part will be moved to another RFC after discussion
@JoeWatkins E_TOO_MANY_RFC ))
 
@Alexander ok, missed this one E_TOO_MANY_RFC
 
@marcio you are welcome for discussion
 
sure, I'll catch up with the discussion soon.
 
@marcio nice RFC, definitely I want this to be done for PHP7
 
uuuh
just read the changelog for 5.6.6
isn't this BC break?
> Removed support for multi-line headers, as the are deprecated by RFC 7230.
 
8:12 AM
I am trying to figure out where the file goes when the web server has sent complete response but browser is still receiving it in case of file downloading.
 
@FlorianMargaine ... or a security fix :) Anyway, it's been discussed on internals, you could follow-up there
 
@m6w6 haven't seen it on internals
 
@m6w6 thanks
 
you're welcome
 
8:36 AM
good morning!
 
I need help
 
@Joseph don't we all? :)
 
@kodeart i need it more
 
@Joseph you are really greedy
 
@kodeart let's put it this way : optimistic and have faith in humanity
 
8:46 AM
@Joseph :)
 
@kodeart uh... no.
 
ah the dude with the three dots syndrome
 
There are 2 kinds of people here: the ones who come here to discuss, and the ones who come here to get help.
 
@Joseph urm ... that's me ... I think ...
 
oh right i forgot ...
 
8:48 AM
@FlorianMargaine and those who come to share kitten images
 
@JoeWatkins they're the first kind :P
 
so they are ... I just wanted to mention kittens
 
/me going to merge my old php-src fork with master. Wish me luck...
 
I forgot the 3rd kind: trolls
@Leri oh dear
 
@Leri is your aura clean enough? Have you made a sacrifice? Cleaned the magic ball?
 
8:53 AM
@SergeyTelshevsky I've been waiting for this day for a month already. I think I am ready for it!
:D
 
Morning
 
@Leri good luck then! :)
 
in the midst of it all i will shoot this at anyone willing to help , when sending data via post or get requests in JavaScript and if this data contains spaces, upon retrieving data (say some file name) , when testing if the files exists i get a false , knowing that the file exists and the name is the right one . Renaming the file without the spaces -> issue is gone
 
@Fabor Friday nazi. -.-
 
8:55 AM
wiki.php.net/rfc/context_sensitive_lexer someone benched the performance hit?
 
morning
 
> You've earned the "jquery" tag badge.
:P
Morning
Master of jquery
 
Just a question. Um... . Which should be done first? Design or Development?
 
@PeeHaa Silver badge in jquery and just bronze in javascript. Shame on you. :-)
 
one of them is alive !!!
 
8:59 AM
@user3002233 How do you develop if you don't design? Also what do you mean by design? Code design or graphical design? My first question implies that you meant code design.
 
@Leri Graphic design. like CSS, HTML, etc.
 
Shaun, the guinea pig, won't be told he can't be an #elephpant #shaun #php http://t.co/jvgSJogug4
2
 
@user3002233 Oh, I'd say it depends then. They can also be done simultaneously if project gives possibilities.
 
@PeeHaa That might screw up the sender/target info, not sure. It's pretty weak if the host doesn't offer that as an option though :-(
 
@JoeWatkins so... kittens or guinea pigs? Choose your camp!
 
9:01 AM
moin
@JoeWatkins ooh, ohh, it's the purple one isn't it?
 
@Leri Do you follow any specific process in creating a website?
 
@FlorianMargaine anything small and furry, and either looks hilarious or does hilarious things ...
@DaveRandom fraid not :D
 
@Leri :)
 
Yes. There're 3 types of sites I build:

1. I buy template and do my back-end stuff.
2. Hire designer and front-ender. In this case I let designer to draw design first. Once it's approved by client and functionality is known. front-end and me start building stuff simultaneously and once we are done merge them.
3. I am just providing rest api and I don't care about the client.
 
@JoeWatkins For me, the only thing better than an original blue elephpant would be a real live elephpant
@PeeHaa buuuurrrn
 
9:09 AM
@Leri So generally speaking, design comes first.
 
if before I die, there isn't a PHP party with a real live elephant (painted, with shoes on, hopefully, negotiable), then my life will have been completely wasted ...
 
@user3002233 Nah, functionality comes first.
 
@Leri ?! Like what? What do you mean by functionality?
 
@user3002233 I always require a document that describes the system they want to be implemented. That has few advantages. Written document is easier to understand, it's always there so you won't miss anything and when the client starts wanting more you can point to the document and require additional charge or simply reject client's new requirement.
 
I should really branch out my elephpant herd, colour-wise...
 
9:14 AM
I need some moar colours ...
 
@Leri so it's like "information gathering". right?
 
@JoeWatkins I only have blue * 4
 
and should probably buy another set so I don't have to be the dad in the lego movie
 
@user3002233 Kinda.
 
@Leri Ok. Thanks.
 
9:28 AM
Unit Testing question: I wan't to test a index page (which shows all entries of an entity)
Should I split up my twig templates so that I can check if the data is retrieved?
This isn't really reliable: $this->assertTrue( FALSE !== strpos($result->getContent(), $entity->getId()) );
 
posted on February 20, 2015 by kbironneau

/* by JoonasL */

 
9:55 AM
 
so I could use smth like this: $this->assertTrue( FALSE !== strpos($content, $this->templating->render('entity/row.html.twig', array('entity' => $entity)), $entity->getId()) )
 
@CSᵠ Bastard :P
 
ThW
Morning
 
10:06 AM
Hi, I am trying to figure out where the file goes when the web server has sent complete response but browser is still receiving it in case of file downloading. It's driving me crazy... I feel like I know nothing about networking.
 
10:21 AM
how do I unit test a service without duplicating the logic?
SomeService->getPoints

SomeServiceTest->testGetPoints
 
10:40 AM
Hola, Hello, Hallo!
1
Q: PHP password_hash function value isn't same for each string

Lwin Kyaw MyatI'm try to hash user password with using password_hash() PHP function.But,it function is work hashing,not constant. <?php echo password_hash('a',PASSWORD_BCRYPT,array( 'cost' => 12 )); ?> Result for 4th testing time 1. $2y$12$SRmipqM7AsYkx3Xc8QGHNex69rGXeVyWGTYrh9T8s...

Did I answer it well enough, upon the information he needed and I gave to him? {opinions please}
 
In my opinion your answer isn't good
 
@MarcelBurkhard Explain please.
 
It starts with "As I explained in my comment, but for hence sake I will post it as answer."
which is superflous
reader won't have the context
also "but for hence sake" seems wrong to me (i'm not native english though)
 
@MarcelBurkhard me neither.
I will edit it and remove it
 
"As some suggest MD5 NEVER EVER DO IT ANYMORE FOR PASSWORD HASHING!

Well now to answer your question how to check if a password matches"

Try to always write something like there was no context and you write some wiki page or smth.

E.g. It is strongly discouraged to use MD5 for hashing, because of security concerns.
If you have a source you'll link it at the bottom of your answer
Then remove "
I hope I have explained it correctly enough.

Yours sincerely,

Mike M."
 
10:47 AM
@MarcelBurkhard s/nowadays/
 
other than that I like the answer
@PeeHaa ?
 
I will find the source with it. for now I didn't use a link as I read this before :P
 
@MarcelBurkhard md5 was never meant for hashing password
 
@MikeM. you don't HAVE to link it but it improves your answer
because readers might like to know what's the issue with md5
 
10:50 AM
@PeeHaa not, it was about the 2 answers you just posted here...
 
ah
 
just to remind the OP never ever to use md5 for password hashing.
 
Although I think the hate towards md5 is little over the top
For most non-critical applications it's just fine
 
@MarcelBurkhard you could just as well not use md5
"cracking" md5 is so easy that storing as plain text is the same, really
just google "rainbow md5 table"
 
I don't agree
Cracking md5 is easy ok
but reading plaintext passwords is MUCH easier
I personally don't use the same password for more than 1 account/site/whatever
 
10:55 AM
sure... it takes 5 minutes instead of 1 to crack the admin password...
... if I'm doing this manually
 
Well once you have the md5 hash?
 
Probably more like 30 seconds instead of 1
 
but the real difficulty is to get the hash
 
@MarcelBurkhard same as getting the plaintext password...
 
10:56 AM
youtube.com/… - I just like it... :-)
 
I don't use md5 anyway but I don't see it as that big of an issue in say an old cms
 
it is... is what I'm trying to tell you
 
compared to sql injection et cetera
if an user is using the same password on two sites he's a douche anyway
 
I'd say it's worse. Not even the site builder should have access to the user's passwords.
@MarcelBurkhard then 99% of users are douches...
 
ThW
@MarcelBurkhard Different line of defense.
 
10:58 AM
@MarcelBurkhard wut??????
 
@FlorianMargaine Which doesn't mean that it isn't true
 
@PeeHaa yeah. Plaintext all the way baby.
 
@MarcelBurkhard I use the same password for every game "site" I am on [well almost every game "site"]
 
You should have your IDE taken away from you :P
 
@PeeHaa he was saying that he's not using md5 but something correct like password_hash, I guess :P
 
11:00 AM
yes
sha512 normally
gotta grab some food now though, brb
 
ThW
@MarcelBurkhard Don't insult users for that - provide better ways
 
@MarcelBurkhard uh, are you serious?
 
@MarcelBurkhard Isn't that like every user?
 
 
As a user, why should I trust a website that my password will be saved in a secure way?
 
11:12 AM
@MarcelBurkhard that's how we think, that's not how the "others" think...
 
Anyway I didn't mean to offend anyone in here, sorry. You probably have valid reasons to use the same password on multiple sites (e.g. no sensitive data and thus you don't care)
 
Most people don't think by a website it's security unless they are aware of what can happen if security is not correctly done.
 
@MikeM. I'm securely hashing passwords, I just don't think its viable to migrate old near end-of-life applications
from md5 to some other algorithm
there is more pressing concerns like sql injection et cetera
 
@MarcelBurkhard I am not saying you don't but let's think, before you started to get into security or development at all, did you know what md5 was?
 
If someone hacks an old application he might as well grab the plaintext passwords in the login form
@MikeM. No I did not, but not knowing about hashing is not an excuse for this. You'd probably even assume they have to know your password and could use that data to try to login to e.g. your gmail account
 
ThW
11:16 AM
@MarcelBurkhard So why don't you provide login services (OAuth) and multi factor authentication?
 
@ThW because I don't deal with e-banking or any other data that is both sensitive and of interest to a potential attacker
 
e-banking is usually the worst...
 
ThW
@MarcelBurkhard But you blame users? Sorry, but this is arrogant.
 
I think nationwide's is okay.
 
@MarcelBurkhard When I first started signing up for a site, I never thought about the security.
 
11:18 AM
nationwide is a bank?
 
@ThW I don't blame users, I "defend" md5 for old simple non-sensitive stuff
 
Bank and building ociety
 
ThW
You wrote: "if an user is using the same password on two sites he's a douche anyway"
 
When I started developing into php, I became more and more curious about security.
 
@MikeM. Neither did I, but we should have. I consider myself say 6 years ago a "douche" by that standard I applied before.
whereas "douche" means non-educated for that matter
@ThW Yes you're right, that was not objective, sorry.
 
11:21 AM
At my current state I am learning more and more.

so ye all I wanted to say: unless someone is into it, they don't mind it.

That's why (atleast here in the netherlands) there are more and more commercials indicating about security.
and I think every country shall do that {if they didn't already}.
 
@MikeM. Mostly its more of a "mix uppercase and lowercase and numbers and use atleast 8 chars"-advice which ends up users setting their password to "Password2015" instead of "password"
doesn't really help against bruteforcing
 
@MarcelBurkhard Is it that "mix uppercase and lowercase and numbers and use atleast 8 chars" is going about?
 
nor that they should not follow patterns
 
@MarcelBurkhard Then that problem is not into the "mix uppercase and lowercase and numbers and use atleast 8 chars" advice.
@MarcelBurkhard That's indeed correct.
but you can't take "mix uppercase and lowercase and numbers and use atleast 8 chars" as a patern as it's not limited as: "use 1 uppercase and the rest must be lowercase and use 8 chars"

each are said as "minimum"
 
I think it is
its the same problem with anti-virus programs
 
11:28 AM
yo
 
they convey a false sense of security
 
Security or Safety?
Hello, @JoeWatkins
 
as in "Mymomsname2015" adheres to the guidelines of passwords on [RandomSite] hence it is a safe password
@MikeM. doesn't really matter, security or the safety of your data
If you educate people, do it right
 
it CAN be a safe enough password.
MyMoMSName2015 can be as unsafe as Mymomsname2015
 
I meant something like Angela2015
 
11:32 AM
however
Mymomsname2015 is safer than mymom2015
Well, I got to work further atm.
 
11:45 AM
hello everyone
 
hi @anantkumarsingh
 
mornings
 
hi @tereško
 
what have I missed?
 
how long where you gone? ^^
 
11:49 AM
back
 
10 hours .. I think
 
Good Morning @tereško and hi there @anantkumarsingh
 
@tereško can't help you then, been around for 2
 
@tereško I think I seen a part of it before.
 
11:53 AM
then watch all of it
 
@tereško I will later on, when I have a bit more time for it, so I don't skip over it.
Is it for my answer on that password_hash() question?
 
It's not just about understanding password_hash() usage but why.
 

« first day (1588 days earlier)      last day (3357 days later) »