« first day (1966 days earlier)      last day (2979 days later) » 

6:00 PM
@PeeHaa Can U give me a small example please
 
I think I can
Let me grab a beer first
 
Take your time :)
 
hmm. Am I correctly understanding that the configuration options are really there just to instruct php to use external resources, not to take care of their installation?
 
@DavidWilkins what's the full oracle error message you get?
 
Ok, I added types/lengths to the bind statements. I assumed the type to supply for the user defined JOURNAL_CUR is "named type", but I got this error on that line: PHP Warning: oci_bind_by_name(): Unable to find collection property in /home/dwilkins/sp_2_test.php on line 68
the previous error was: PHP Warning: oci_execute(): ORA-06553: PLS-306: wrong number or types of arguments in call to 'SP_J1_SL_RT_JL' in /home/dwilkins/sp_2_test.php on line 123
 
6:07 PM
@NaiTreNo ok let me write something and see how horrible it is
 
@ircmaxell According to this answer, "It should suffice to say whether bcrypt or SHA-512 (in the context of an appropriate algorithm like PBKDF2) is good enough. And the answer is yes, either algorithm is secure enough that a breach will occur through an implementation flaw, not cryptanalysis."
Do you agree?
 
@PeeHaa OK I'm waiting :D
 
So your earlier comment @DaveRandom about sessions...You mean a session on the Oracle server? I'm not sure how to do that, but I can look into it
 
> password_hash() uses a strong hash, generates a strong salt, and applies proper rounds automatically. password_hash() is a simple crypt() wrapper and compatible with existing password hashes. Use of password_hash() is encouraged.
 
3v4l.org/Eqrqp @NaiTreNo
 
6:10 PM
@DavidWilkins I have to go make dinner, but try executing var :JCUR JOURNAL_CUR before you execute that proc, then don't bind :JCUR before executing
 
ok will try it, and thanks
 
bbiab (like 2 hrs prob)
 
Honestly, based on what I can find the evidence suggests that mishandling of passwords is a significantly larger threat than the actual algorithm used.
If this is true (and I think it is) then we absolutely should support SHA-512 in password_hash.
Default to bcrypt. Encourage bcrypt.
But there are people out there who cannot use bcrypt.
 
Aha! I think I found my answer
 
We should make it easy for them to correctly use another algorithm.
 
6:12 PM
@PeeHaa Thanks man :D That was awesome really nice code from u :D I've been searching for more than 2 days and you've just given me what I want in a few minutes :D
 
@NaiTreNo You can thank me by trying to understand what the code is doing before just copy/pasting it in your code :-)
 
Yes ofc, I've understood it that it will get the value between ':;' then remove all strings which values are less than the specific number then it will return the string after replace :D
But I was wondering that if 'My name is' is not the same always so it can be something else will I be able to use (.*?) to get the value of it ?
 
Yeah you could loosen it up
 
:3 thanks again for ur help :)
 
np
 
6:21 PM
when you feel dumb. ofc if I don't build extensions they won't be built. thanks @alll.
 
6:33 PM
@PeeHaa sorry for bothering but, I've tried that code on this but it didn't return anything the string is 'RewriteCond %{TIME} <20160305040430
RewriteRule ^QSoYCaLOygRrJoEaKwICQT2vDSBACJY1IBAZgY8ND9TsRr9SBnaEtBF6GGUejHKVxATesb20OSCixjbZY3K6dJQWQJTGxU3FtaJiKDt3WQjYj1/test.mp4$ %{ENV:link} [QSA,L]
RewriteCond %{REMOTE_ADDR} ^::1
RewriteCond %{TIME} <20160305041121'
 
@LeviMorrison yes, however crypt-sha512 is demonstrably weaker than bcrypt. Both are safe, but bcrypt is safer by a good margin. And argon is even safer. Think of it like this: md5 is a 1, sha512 is a 5, crypt-sha512 is a 5000, bcrypt is a 10000.
 
is there a way where i can get the executable name of a file during upload?
 
@ircmaxell But if #1 isn't an option we should make #2 easier to do correctly, yes?
 
@LeviMorrison and they can use crypt.
 
@ircmaxell And expose themselves to misimplementation.
 
6:35 PM
@LeviMorrison it is only not an option in an extremely narrow set of cases.
 
and the preg_replace_callback code became '/(.*?)(RewriteCond %{TIME} <(\d+)(.*?)RewriteRule(.*?)])/si'
 
@ircmaxell I suspect it is not as narrow as you think.
 
But it didnt work :(
 
@LeviMorrison then use a library. Passwordlib still supports crypt-sha512
@LeviMorrison I still think your use case isn't valid, because you shouldn't be authing against shaddow anyway, you should be using LDAP or Pam. Shadow is meant for a very specific purpose.
Or rather, it is valid because your constraints are invalid.
 
@ircmaxell You are incorrect here, actually.
I'll explain in a second.
 
6:38 PM
@PeeHaa a tagged template proposal
 
Using LDAP or connecting to the database inside of PAM puts you in a realm where you cannot log in if the DB or service goes down.
Now you may say "fall back to /etc/shadow when that happens"
But since /etc/shadow doesn't support bcrypt we are falling back to sha512
 
@NaiTreNo Create a fiddle on 3v4l
 
And since we have sha512 it doesn't matter that bcrypt is used elsewhere.
Any attack will have access to both hashes.
There is no benefit there at all.
 
@BenjaminGruenbaum Link?
 
I've not got that please be more clear
 
6:41 PM
And switching all of our servers to another OS that does support bcrypt in /etc/shadow would be incredibly costly.
That cost is not warranted when SHA-512 is significantly better than the other hashing mechanisms.
 
Does php does not recommended One-Class-One-File model like pastebin.com/QY33npGj ?
 
so, my PAM suggestion got shot down?
 
@tereško If these services already relied on the database we would probably use PAM. Since we don't it's adding another bottleneck that would stop all work when the db has issues.
 
@PeeHaa please focus on my code for a bit :'(
 
We could try rolling our own way to store the bcrypt'd passwords and use PAM that way but hopefully the words "roll our own" triggered alarms.
 
6:45 PM
@LeviMorrison I am getting a feeling that you are trying to stop boat from sinking with a teaspoon
 
Our boat doesn't sink if the db goes down.
We still can do significant amounts of research if the db goes down.
Research is our mission.
 
wait .. what !??
 
But if we tie it to the db and the db goes down then we cannot do any research.
Nobody* can authenticate.
 
why exactly is it that you cant use PAM_KRB5 ?
 
That's again another networked solution that we already don't rely on.
Adding another network point for failure is bad. It would be different if we already can't do work if it goes down, but that's not true.
 
6:48 PM
 
I think because this is the PHP room you are all too focused on websites. In most websites if you can't contact the db or some other network service you just can't do anything. It's normal.
 
ya know what, if you want to use /etc/shadow to authenticate users on website, more power to you
 
That's just it, that's what you aren't getting.
We have a website that does not use /etc/shadow for authentication.
It uses a normal DB method you are probably used to.
But those same credentials are used to log into our clusters.
Those clusters are the whole reason we exist. They enable the research.
 
It seems that the environment is pretty hot down here....
 
And those clusters should still be able to do their research if the DB has a problem.
Those are the systems using /etc/shadow.
The unified authentication is necessary and it honestly cannot be that unique. I know hosts of other organizations that do something similar.
 
6:52 PM
does it has some AI involvment "And those clusters should still be able to do their research if the DB has a problem." <-- am i getting it correctly
 
Some of them use LDAP and when LDAP fails they just accept their service goes down too.
Others, like us, build in more reliability. If you can reach our systems then you can do your research, end of story.
 
@LeviMorrison Downgrading (even possibly because people are stupid) a function because of some limited use case sounds like a bad idea to me
 
That's just it, it's really not that limited.
 
It isn't?
 
And furthermore, by not adding support for sha-512 we open up the possibility of mishandling the password.
It's a bigger security risk to not add it.
Mishandling the password >>>>>> using sha-512 instead of bcypt.
 
6:54 PM
It feels like the rest have to suffer because somebody needs it
 
Why do they suffer?
Bcrypt would still be the default.
It would still be the recommendation.
 
That's the people are stupid comment in my previous post.
We have something that works pretty well for most use cases. Don't make it worse I would say
 
I feel like everyone here is putting too much emphasis on perfect instead of accepting good. SHA-512 is a good solution. It's not bad. It's not as good as bcrypt but the reality is that plenty of people cannot use bcrypt.
@PeeHaa How is adding another option that isn't the default making it worse?
 
And furthermore it's a better option when people don't have bcrypt.
 
6:57 PM
@LeviMorrison Because people will see sha512 and will think. I know that one!
 
You are minimizing the worst case.
 
If it isn't there there is no way to pick it
 
it is not about SHA
 
Exactly, so you roll your own wrappers around crypt and open yourself to screwing it up, which is far worse than picking a weak(er) algorithm.
 
Also I realize sha512 isn't terribad
 
6:58 PM
it's about you wanting to use /etc/shadow for something it is not intended for
 
@tereško You do understand we are talking about multiple systems here, right?
I am not using /etc/shadow for web logins...
 
but want to
 
No, I don't want to use /etc/shadow for web logins.
 
or at least that how I read waht you have been saying
@SunMaungOo what?
 
@LeviMorrison Same could be said of other algo's
brb inserts beer
 
7:01 PM
Thnx peehaa and Florian for the responses.... Would try to implement them in the next couple of days...
 
Cool \o/
 
@PeeHaa I agree, but we don't need to have all algorithms. Just more than one.
Everyone who has MD5 almost certainly has SHA.
The same cannot be said of bcrypt, which is the issue.
 
@LeviMorrison what if instead of authenticatunf yourself by hahsing passwords, you open a process call to ask the OS to validate the password for you
@LeviMorrison everyone has bcrypt. 5.3.6+
 
Anyway..... Night guys... Cya later!!
 
@ircmaxell The library is there but cannot use it in a number of applications, such as /etc/shadow.
@ircmaxell Can you explain this more?
Not sure what you mean.
 
7:04 PM
4
A: How to check the password entered is a valid password for this user?

muruYou can misuse sudo for this. sudo has the -l option, for testing the sudo privileges that the user has, and -S for reading in the password from stdin. However, no matter what privilege level the user has, if successfully authenticated, sudo returns with exit status 0. So, you can take any other ...

@LeviMorrison you can use it. You are trying to do an integration. Which will always have special case requirements.
Also, you can verify the password without creating a new one. And password verify supports that already. You won't be writing into shadow file manually, will you?
 
@ircmaxell We provide the hashes that go into shadow.
 
@Saitama later
 
@LeviMorrison why? Why does the web app do that?
 
@ircmaxell It doesn't. It just stores them in a database. Some other process will periodically sync the db to shadow.
 
description of "brain surgery through anus" comes to mind
@SunMaungOo where did you read that it is not recommended? Also, please learn about autoloaders.
 
7:12 PM
@tereško , thank for telling me about autoloader.
 
@LeviMorrison shouldn't you do the opposite flow?
 
@SunMaungOo you probably shouldn't build your own, but instead use the one that comes with Composer
 
@ircmaxell I don't think so. Can you explain why you think it should go the other way?
 
I don't trust anything writing into shadow. would rather the OS manage it, then read from it to verify
 
I wonder, which option did you choose: lowering the restrictions regarding write access for /etc/shadow OR running a service as root
 
7:18 PM
Our headnode can write the /etc/shadow file. Only root on that system can do it.
The rest of the nodes are just images.
@ircmaxell According to a sys admin we do assemble the /etc/shadow file ourself.
@ircmaxell You mean from a perspective of misuse of file permissions or?
 
@LeviMorrison anything touching shadow scares me. Especially a web process
 
@ircmaxell Again, the web process doesn't touch /etc/shadow.
It just computes the hash and stores it.
 
7:38 PM
I have an application that is deployed in many customer's dedicated servers. Whenever new updates or hot fix are needed we do it manually one by one. To improve this process we decided to move to git tag based versioning and automated deployment. I wrote an api to check version and update to latest version using git tag name. Changes in mysql tabels are also executed. We tested it out and it all works fine. But i have no idea how to roll back a bad deployment.
Of course Code checking out to old tag will roll back code. But database changes cant be rolled back. Does anyone have any suggestions on how to solve this problem ?
 
If you want to roll back database changes, you need your database migrations to provide both forward and backwards migration queries.
 
yes true, is there any way prevent data loss?
 
well, that's really going to depend on the migrations
honestly, the best thing to do in this sort of case is to design your changes and do deployments in stages, so that you never need to roll back your database changes.
e.g. first add the new fields you need to your schema and deploy the changes that write to both the old and new locations
When that's confirmed to work, then change your code that reads from the db to read from the new schema
When that's confirmed to work, only then do you remove the old schema
alternatively, don't ever make a schema change that can't be reversed (e.g. loss of data) until you're absolutely sure that you will never need to go backwards.
 
my php-fpm restart thingy is staying at home eating xbox and playing doritos
 
I am sticking to the second suggestion at the moment. not making any changes that will result in loss of data.
@jbafford thanks
 
7:51 PM
/me waves
 
/me waves back
 
herro
@DavidWilkins any progress?
 
Is there a way in a IteratorIterator to get the key of the parent?
That IteratirIteratorIteratorIterator magic never stops confusing me
Is this a "you are stupid and you should feel bad" silence? :)
I'll just assume that is a yes
 
8:05 PM
I prefer to see them as everyone suddenly has something very important to do silence
I fell less of an dumbass
 
hii is anyone using sublime?
 
@DaveRandom ooooohhh you can put arguments in the thing :P
Ty
 
Doesn't seem to be be any sane way of doing it, but I'd argue that an iteratoriterator is probably the wrong tool for that job anyway, since that's really just for turning an opaque multi-dim struct into an enumerable, whereas your code seems to know something about the the structure so there's no point making life harder for yourself @PeeHaa
 
@PeeHaa yes
 
8:08 PM
@JacobRaccuia few
do you have anything specific you need to know?
 
@DaveRandom Well I have two nested foreaches which looked ugly so I thought maybe if I throw random classes at the problem it would somehow get better :P
 
Sounds legit
 
@JoeWatkins :D
 
@tereško yeah. randomly one day my <?php ?> tag colors stopped working. I have confirmed like 100x that my color scheme has the proper code
and no other colors stopped working, but they are black and I want them to be red and it's soooo annoying lol
 
have you tried simply do a clean reinstall?
 
8:10 PM
I think I still like it better than nested foreaches
 
I mean, remove all the stuff in programm files and AppData
 
Not sure anymore
 
I haven't
i should try that
 
yes, you really should
@JacobRaccuia and while you are at it: sublimetext.com/3dev
 
i will do that and try and report back
and i will do that!
thank you
 
8:11 PM
@bitNinja for the code you probably will want to look at cappistrano (capistranorb.com) or some other deployment tool
for DB .. well ... it's kinda complicated. As a rule, you should avoid DB schema changes whenever possible
 
Appy frydai!
 
Happy Rebecca @RonniSkansing
 
Thanks, I havent found any time to make some rebecca bait today
 
you could do a schema dump before updating to latest version and/or create incremental migration scripts
 
@PeeHaa Sometimes what you need is a nested loop. I used to go to insane lengths to eliminate them, but in the given example I personally think the nested approach is more readable. YMMV.
 
8:14 PM
Uggghhh choices... choices... :(
 
If PHP was a better language there might be a better way, but it isn't so there isn't.
 
So what do you suggest? Convert the project to jabba?
 
Or just get drunk and git commit -am "Fuck you, future me" && git push -f
 
The thing I am working on already has a too big I am getting killed for this factor
 
What's the actual use case here?
 
8:19 PM
That matrix is a map. the elements are game tiles. The keys are the x/y positions. I need to loop through them and create the game tiles
 
a game is it ?? sounds hi-tech ...
 
I thought a single foreach with a ::somehowMagicallyGetTheParentKey() would be tits
@JoeWatkins Very low-tech game
 
Then yeh, multi-dim input, multi-dim output, that's a nested loop
 
:p
 
You could do something like:
 
8:21 PM
@DaveRandom Fine! have it your way!
gees
We're waiting @DaveRandom...
 
this must be the platform you are developing that will finally grant me the power I pray for so much ...
 
:-)
 
It's still the same structure fundamentally, but the loop might look cleaner in the place where you use it
 
I've been reading ruby stuff ... for a screencast or screencasts, I'm doing silly changes to php, to illustrate how it's done ... maybe it'll spawn some rfc authors ... anyway ...
 
Very much YMMV
I probably would just do the nested loop in situ
 
8:28 PM
@DaveRandom Hiding the mess. That's exactly how I clean my home!
 
how the fuck do people read ruby code ... I remember when rails came out I was genuinely excited for ten minutes ... I'm glad I never had to use it ... I'd hate to have to debug anything of complexity there ...
class Rack::Builder
  def initialize(&block)
    @ins = []
    instance_eval(&block) if block_given?
  end

  def use(middleware, *args, &block)
    @ins << lambda { |app| middleware.new(app, *args, &block) }
  end

  def run(app)
    @ins << app #lambda { |nothing| app }
  end
end
this is held up as an example of "nice" code ...
 
@JoeWatkins hehe I thought it was just me
 
people complain about magic in php ... ruby is basically just a ball of magic, but somehow escapes the reputation ...
 
Yeah, that's pretty boiler plate. I only have to deal with it when I want to update Chef and sometimes even that's too much
 
@JoeWatkins if you think that's bad, try coffeescript
 
8:31 PM
instance_eval(&block) if block_given? definitely reads like "maybe this will do what I want?"
The question mark on the end adds an air of uncertainty
 
:-D
 
I super hate it ... next time someone tries to lecture me about the virtues of ruby, I'm gonna hurt 'em ...
 
Actually @PeeHaa I forgot you can do this in 7, this genuinely is probably better for that case: 3v4l.org/CAbX4
Turn the co-ords into a struct and key the iteration by it
 
I learned something new today, not just that I super hate ruby, and that idiomatic to ruby developers seems to mean "write it like an idiot" ... but also, I know where the seemingly irrational hatred C devs have for using words like "clazz" or "klazz" ... it's ruby ...
63
Q: What is the difference between Class and Klass in ruby?

s84What is the difference between Class and Klass?

I'm done, I'm done ...
 
8:44 PM
@DaveRandom huh wait wat
 
You could even create a Point class and yield that as the key if you wanted, then it would effectively behave as a flat structure of Point => DataAtPoint
 
I've had enough of today ... night all ...
 
nn :-)
 
@GotaloveCode yes but everything you learn also applies to working with a framework. It's about much more than just creating an app without a framework. No specific reason for requiring >5.5. Once I can find some time to work on it, i will probably update it to 7 anyways
gn8
 
@DaveRandom I actually have a Coords class already
noice
@JoeWatkins night
Damnit. Now I'm thinking Point is better than Coordinates
My productivity of tonight so far has been thinking about improving 10 lines of code tops
hmm i would have expected phpstorm to replace all instances of coords with point
Bad IDE bad
 
8:53 PM
@PeeHaa What, a rename refactoring didn't work?
I don't think I've ever had that fail
 
@DaveRandom Nope. It showed the refactor popup with the checkboxes, but didn't actually renamed throughout the project
 
Sometimes it gives you a preview window at the bottom and you have to do "apply refactoring"
Not sure why or under what circumstances it does that
 
Oh
There manual replaced. Makes me feel alive
 
:-D
 
Damn that key as whateverthefuckyouwant thing is pretty nice
 
9:01 PM
 
I keep getting distracted by her face, I can't work out if she's in pain or it's supposed to be somehow sensual
 
Wes
9:37 PM
evenings
 
sera o/
 
that seems like the way dunmer greets newcomers in morrowind.
 
!!wiki morrowind
 
The Elder Scrolls III: Morrowind is an open world fantasy action role-playing video game developed by Bethesda Game Studios, and published by Bethesda Softworks and Ubisoft. It is the third installment in The Elder Scrolls series of games, following The Elder Scrolls II: Daggerfall, and preceding The Elder Scrolls IV: Oblivion. It was released in North America in 2002 for Microsoft Windows and the Xbox. Well-received publicly and critically, with over four million sales and more than 60 awards (including Game of the Year), the game spawned two expansion packs for the PC: Tribunal and Bloodmoon...
 
Wes
!!wiki dunmer
 
9:39 PM
The Elder Scrolls series of role-playing video games are populated with a number of fantasy races, ten of which are playable. Generally, these races fall into one of three distinct archetypes, namely, humans, elvenkind, and beastfolk. Within the lore of the Elder Scrolls universe, men and mer (elves) are descended from an ancestral race known as the "Ehlnofey", and are capable of interbreeding. == Playable races == There are ten different races from which the player can choose: Altmer (High Elf), Bosmer (Wood Elf), Dunmer (Dark Elf), Orsimer (Orc), Breton, Argonian, Khajiit, Nord, Imperial, and...
 
probably the best game there ever was, or ever will be.
I see however your sera was not from there
 
I think it's an italian evening
 
Wes
\o goedenavond
 
\o/
 
Wes
@PeeHaa yes, one with spaghetti and things :P
 
9:41 PM
spaghetti + wine + rai uno that's how you all spend your nights
 
Wes
lol
i don't watch tv
 
no, tv watches YOU!
btw, one hell of a great rfc. asshole.
 
Wes
you mean the real one or the fake one
 
the fake real one.
 
Wes
haha
 
9:44 PM
Did I miss a real one?
!!rfcs
 
there's also a real fake one
 
Wes
@PeeHaa don't share it yet
 
kk
 
I'm getting a bit edgy. cli php and server php on the box on the cloud are showing two different php versions. I can't seem to succeed in restarting php-fpm (not even sure if that would help). christ.
not even sure what to start doing
... so here's the silence I was writing about @PeeHaa
 
9:48 PM
Which one is the correct one?
 
What does your service look like?
 
reconfigured and recompiled php to add curl support. server can't seem to be aware of it
 
Assuming systemd
 
... what do you mean?
 
9:49 PM
What init system do you use?
 
it's a simple newbily configured nginx server
I don't restart boxes lol, why would I do that
 
systemd is not an init system
it's a huge monolithic kernel wrapper
 
???
lolz
 
@tereško Sorry I meant OS :P
 
oh
so fucking much clearer./
red hat
 
9:51 PM
Yeah you are using systemd if your are on centos
 
@PeeHaa depends on his version...
 
Locate the fpm service file
@FlorianMargaine Oh I read "newbily" as "newly "
 
it's at /etc/rc.d/init/php-fpm
as far as I can tell
hmm wait service file?
 
@FélixGagnon-Grenier Either fix it there or symlink the correct version
 
if you ever wanted to backdoor all of the linux systems, injecting it into kernel would be almost impossible, since it is heavily audited ... so the next best thing is to create a PID 1 process, through which all the communication with kernel happens
and if it is big enough, it becomes really hard to audit
 
9:54 PM
@tereško yeah, systemd is totally bigger than the kernel
 
@PeeHaa so that's the thing. I ran php-fpm restart with that file. in fact with nearly any php-fpm executable I can find. I think that php-fpm restart should restart it and let it use the new binary?
> in fact with nearly any php-fpm executable
which is in fact one file
 
I am not saying that systemd was thought up in corridors of NSA ... but if I worked there, it would be how I would approach that particular problem
 
did you even look at the code?
it's actually very modular
the code itself is seriously well written
 
actually it's not
 
@FélixGagnon-Grenier If you have multiple php binaries and it points to the wrong one you can restart all your want, but it will always start the "wrong" one
:-)
 
9:57 PM
heh.
 
I don't agree with some of systemd ecosystem, like systemd-login et al, but the systemd core (aka services management) is very well done
@tereško did you read it?
 
What does locate fpm give you?
 
let me read my php-fpm conf again
 
After updatedb obviously
 

« first day (1966 days earlier)      last day (2979 days later) »