« first day (1997 days earlier)      last day (2951 days later) » 

11:00 AM
Whats the real danger behind eval'ing like I am?
 
the real danger is the fact you're including source over http
 
@Jimbo I've only ridden a few 600's, and one >litre ... but agree, the bigger they are the more stable they feel, it's a remarkable difference
 
that can be intercepted and an evil payload injected
 
@Leigh https would be better?
 
nope
 
11:02 AM
@Leigh Oh.
 
@JoeWatkins It's the fact that it's a v-twin as well, lovely smooth power delivery, nothing to catch you out really
 
well I tested some others, but only for a matter of hours ... I don't think I'll be going downwards from 1050 ...
 
@Leigh Is it a danger to us or the client though?
 
The client
Unless somewhere you allow them to upload code to run on your servers :p
 
is it loud or does it have a stupid exhaust on it @Jimbo ?
 
11:04 AM
@JoeWatkins Stupid EU exhaust, but still pretty loud, and sounds bloody lovely, like a real throaty growl, not like an inline 4 sports bike which is like a bee farting
 
@Leigh Nah, it just DL's the code, loads a whole load of variables in from files, places that in some JS, loads the template and the JS replaces all the template variables with the client settings.
 
you can't tell that, if what I'm looking at is standard exhaust ...
mine is terrible, totally covers single sided swing arm too ... I don't get that ... can't wait to put it in cupboard ...
 
@MattCowley theoretical scenario. Hackers manage to get into your clients edge network and want to elevate to a web server to provide malware downloads. They set up some dns entries on the router to point cdn.unreal-designs.co.uk to an attacker controlled IP address. Your client now downloads code from that attacker controlled IP and runs it
 
@JoeWatkins They had the underslung one which looked lovely, but had to put a side mounted dual exhaust because of the new shitty EU emissions standard (EU4 or something?)
 
Yeah, I see your point.

Should I put the DL on one line, and check it has a certain string in it, then eval it? (As a precaution)?
 
11:12 AM
Found the / bug... the return of the last method is fucked up
 
:P
 
@MattCowley no
 
@JoeWatkins Why not?
 
@MattCowley btw, you probably want to turn error reporting off, on your public facing web servers... Notice: Undefined index: small in C:\wwwroot\cdn.unreal-designs.co.uk\cont\consoleTitle\index.php on line 70
 
@Leigh Yeah, they are on atm as I was testing this template thing.
Done ;)
 
11:16 AM
let's assume the hacker can code shall we ... and will just do whatever necessary to make them run the code ...
 
@JoeWatkins As a basic precaution.
 
the problem is not how you are doing it, the problem is that you are doing it at all ...
 
Feb 10 at 13:03, by Andrew
maybe renaming eval() to evil() would raise awareness.... ha
 
basic precautions do not tend to protect anyone from the kind of actor who just took control over a large part of a network, just in order to exploit a single machine ... if you find yourself in that position, basic precautions are worth precisely fuck all ...
 
@MattCowley a basic precaution is not opening a remote code execution vulnerability in the name of some perverse idea of "security" in the first place
 
11:20 AM
Oct 22 '13 at 9:56, by Jimbo
Every time someone kills a kitten, someone uses .eval()
^^
 
@PeeHaa did you fix escaping ?
!!lick
 
hi
someone please help me with this
0
Q: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result but it is working fine on other condition?

A.MujeebI have a scenario where a customer will select item and set a date and after submitting a list of items will appear. CODE: $connection = database_connection(); $table= "cement_weekly_item"; $query = "SELECT * FROM {$table} "; if(isset($_POST['item_name']) && !empty($_POST['item_name'])){ ...

 
@JoeWatkins Nope I'm doing actual paid work right now ;-)
 
@A.Mujeeb MrCode's answer seems correct to me.
 
@PeeHaa fair enough ...
can't get going for some reason ...
 
11:49 AM
What do you think about this syntax for short closures? |Foo $foo|: Bar => $foo->bar(); It can work both with typed returns/params and without them
|Foo $foo| $foo->bar() would be for untyped return
|$foo| $foo->bar() for completely untyped function
 
@nikita2206 Multiple parameters?
 
@MadaraUchiha |$foo, $bar, ...| $foo->bar() etc.
The main problem with initial syntax (~> stuff) was that it was impossible to make it work with typed parameters. But this one works
 
@nikita2206 The question is whether you want types at all here
 
Ah one mistake
 
I mean, lambdas are usually used in places where you know the types well in advance (or alternatively, don't care)
 
11:59 AM
T_DOUBLE_ARROW would be in typeless functions too: |$foo| => $foo->bar()
 
For example, as an argument to array_map()
 
Would your syntax accept a use() or is that out of scope (pardon the pun)?
 
When used in a use case like that, you don't want to constrict parameter types, because it doesn't make any sense
(Either typecheck the array, or you don't want to typecheck at all)
The return typecheck might have value, but then again, I'd rather type the result of array_map() and infer the types from that.
That is, if I have an int[] that goes through array_map() and comes out as string[], I know that the mapping function accepts int and returns string.
This is something that Java does well methinks.
It doesn't bother you with the types at all, until there's a type problem or mismatch.
 
@MadaraUchiha I would say it isn't true, lots of cases where you actually care about types. In other languages they usually can infer types and that gives them a way to not write redundant type information on closures, but we don't have this ability yet. In any way this feature (to use types in short closure) is opt-in, you're not required to use it
 
@nikita2206 Other than interfacing (that is, requiring a parameter of type callable Event->bool), in what case would you, as someone creating the lambda and passing it around, would want to have typechecks?
 
12:04 PM
@salathe I think it's better to use CVs (just because it's shorter). The only case where autocompiling scoped vars wouldn't work is where you use variable variables and in that case you could just use long syntax
 
What you said makes sense if you can ask for a callable that accepts type X and returns type Y.
But you don't have it, so you're saying that only the consumer can limit themselves should they want to
 
@MadaraUchiha only in that case. I have one RFC waiting for me to finish it exactly about what you just said (e.g. requiring a callable that returns specified type - function (callable(): A $a) {})
 
@JoeWatkins I know those feels
 
@nikita2206 That would be amazing.
 
@JoeWatkins do I need to make any special considerations when writing an extension to be built in ZTS mode? (I'm not accessing any globals)
 
12:07 PM
Because who cares about the types of the callable?
Not the person writing the callable
Only the person using it.
 
@MadaraUchiha you're talking about generic types/type constructors. Yeah that would be awesome if that would work, but it's pretty much out of scope right now
 
@Leigh no, only to include what the skeleton script generates ...
 
@MadaraUchiha Ah no, I misinterpreted you
 
@nikita2206 No, I'm talking about function(callable(A, B) : C $fn) {
 
12:12 PM
why would you be targeting zts ?
 
@MadaraUchiha yeah, got it now :)
BTW have anyone seen @marcio here recently?
 
been a while @nikita2206
 
@JoeWatkins thanks :)
 
@PeeHaa github.com/Room-11/Jeeves/pull/27 is untested, so please check once before merging. thanks.
 
Nice PR!!
 
user6079755
12:24 PM
hello i am look help for this:
 
user6079755
-1
Q: PHP Intantiation class and reference external file

Walter NuñezHello friend i got this error Fatal error: Call to undefined method Class_Main::Getdata1() The Main function is this: <?php require_once ('config/config.classlib.php'); require_once ('config/config.classdep.php'); $objectClass = new stdClass(); $objectClass -> TEST1 = new Class_...

 
@Gordon void? :P
 
@PeeHaa my IDE didnt complain and the RFC said implemented in 7.1
 
That's... future proof
:)
 
I haven't written any proper PHP in six months. What do I know which version we currently have
everyone in here is talking about PHP 11 already :P
 
12:26 PM
Hehehehe
No worries will fix it. Otherwise lgtm
 
Lgtm? Let's get that made?
 
@Jimbo lgtm = looks good to me
@PeeHaa we might want to use a still version of the gif in case of too much annoyance though. they offer that in the returned json
 
0
Q: Google App script - Non execution of a function

CodesterI have created the below function in the script editor of Google spreadsheet, function newfunc() { SpreadsheetApp.getActiveSheet().getRange('F2').setValue('Hello'); } function doGet() { return HtmlService.createHtmlOutputFromFile('Index') .setSandboxMode(HtmlService.SandboxMode.IFRAME...

Any helps on the above ?
 
@Gordon PHP, Room 11 Edition? What?
 
@Gordon Yes. Also cap un-oneboxes images automagically after some time. Maybe also worth looknig into
 
Wes
12:33 PM
for the whole morning got my testies grinded with 40 sandpaper by youtube "my big fat greek wedding 2" trailer ads
 
Just ffing install an adblocker
 
Some websites detect that now and force you to disable it before reading content
Bloody annoying
 
@Jimbo There are adblockerblockerblockers now
 
brb building an ad blocker blocker blockers blocker.
 
12:35 PM
it will change the world!
 
TBH I turn off adverts for people I watch/read a lot off.
I have google play though which means I should get youtube red. Lousy country restrictions.
 
@Fabor you're special...
 
@Fabor The internet is scary without an adblocker
 
Wes
you guys suck though. you work with web. you should know that web without ads would not exist, for a big part
 
The moment people stop using crap ad trading platform I might reconsider
 
12:37 PM
turn off advert blockers *
 
Wes
i'm a good guy, i don't use ad blockers, except on my own sites
 
@Wes Fuck that shit. I work in the ad industry. I know better..
 
@Wes that's a whole new level
 
@PeeHaa's Ads usually revolve around him standing in front of a glass window with a red-light on though.
2
 
I sometimes have trouble finding the content on pages with advertisements all over them.
 
12:38 PM
@Wes a huge portion of that wouldn't be considered a loss
 
@Fabor lol
 
Yeah, I would actually like to be able to block specific page region adverts on an adblocker.
 
Wes
@PeeHaa wondering what kind of sites you visit... you pervert fuck :B google ads are not invasive at all.
 
Nope. But possibly malicious
BTW also google serves "download now" buttons
And targeted like hell
Hell I'm sure I could target you in doubleclick based on the size of you wiener
 
Wes
lol
 
12:42 PM
@PeeHaa Unable to find weiner, did you mean cocktail sausage?
 
:P
 
WTH is this?
 
@Fabor the link says reddit, so probably bad advice
!!rfcs
 
@Fabor Looks like Engrish
 
12:46 PM
heh
 
@Jeeves How does that even need an RFC..
 
@Fabor obviously there are no tips to be had
anyway, time to get my ass to the interview
 
Wes
gl
 
@tereško good luck
 
12:50 PM
tnx
 
By that I mean, I hope your interviewers aren't idiots :)
 
I hope I got the right building
 
@Leigh I'm one of them :D
so pretty much idiots
 
someone call for an idiot? :p
@tereško good luck
 
Tnx
 
1:05 PM
For an sql table with 40k rows, it should probably take seconds to add a new index, right?
 
what are we talking, ints, strings?
but yea, not many rows, shouldn't take long
 
How shall I choose a video that is in previous file inside ffmpeg code?
' ../ ' gives me an error
 
Anonymous
1:22 PM
I don't understand why you can't remove your flags on this site..
 
I should add a pattern-matching construct to PHP
 
@Andrea first class regex?
 
@Andrea you mean like perl's =~
 
@Leigh not that kind
In computer science, pattern matching is the act of checking a given sequence of tokens for the presence of the constituents of some pattern. In contrast to pattern recognition, the match usually has to be exact. The patterns generally have the form of either sequences or tree structures. Uses of pattern matching include outputting the locations (if any) of a pattern within a token sequence, to output some component of the matched pattern, and to substitute the matching pattern with some other token sequence (i.e., search and replace). Sequence patterns (e.g., a text string) are often described...
it's one of my favourite Haskell features and it can make some types of code really elegant
 
tereško is actually a really nice guy :P I was disappointed about the hair though
 
1:34 PM
hello everyone
 
@SergeyTelshevsky you met him IRL?
 
i want to fetch records from database who have date less than current date
my query is like this SELECT tableorderId FROM tableorder WHERE DATE(orderDate) < 2016-04-04
but still not getting result with this query
 
Is there an upcoming event that the regs are going to this year? Totally not for stalking purposes
 
@Sean Probably going to attend phpconference.nl
 
@PrashantBhatt aren't you getting an error? Have you tried with quotes? "201...04"?
 
1:40 PM
no i am not geeting error
but its give no result
 
@PeeHaa Did you have time to have a closer look at github.com/kelunik/acme-client/pull/26?
 
@SergeyTelshevsky Asked him about Yii and CodeIgniter?
 
@HamZa just now
 
@HamZa i m missing quote that's y not working
 
@iroegbu not me, but yeah, I was trying to not laugh
@tereško probably the funniest was the MVC
 
1:42 PM
@PrashantBhatt ok
 
@HamZa now i m getting result just adding quote
@HamZa thanks for remember me for add quotes
 
glhf!
 
@kelunik Nope. Not yet :( Sorry. My cert is expiring the 14th though so I will have to look into it before that :)
 
@PeeHaa Don't worry, have enough open issues I can work on currently.
 
@tereško skype me when you will be available
 
user6079755
1:48 PM
hello
 
user6079755
friend any can help me
 
user6079755
with
 
user6079755
this
 
user6079755
 
Anonymous
2:08 PM
When comparing secure strings, why is it important to return false as soon as the lengths do not match? For example, if comparing a user input string to a secret key. Wouldn't it be more secure for me to ignore the length difference and continue with the comparison function (knowing that they don't match)?
 
2:18 PM
@SergeyTelshevsky You mean he doesn't actually have a ginger mane?
 
cc @Saitama
 
@iroegbu yeah, and I realized that it would be less pain to use CodeIgniter
 
He's just a developer for fun.
 
@tereško How did your interview go?
 
@Fabor Hey, he's a registered class B developer.
 
2:25 PM
@Oldskool good enough. Felt kinda rushed.
 
The release cycle of that manga is frustratingly slow.
@tereško What kind of work do they do?
 
@tereško Oh, like they pushed to end the interview earlier then you expected?
 
nobody had any questions to ask
 
@tereško Hmm, that can either mean they have no clue what the job is about or that they already know the answer.
 
@Fabor do you think he has a developing slave helper?
 
2:27 PM
So can still go both ways I guess.
 
Like @DaveRandom's mum ^
2
 
@Fabor medium size projects, mostly for USA
 
@tereško They do awkward hours to appease the US clients?
 
nope
 
That's good. Though I wish you'd stop building websites.
 
2:29 PM
I actually asked indeirectly inquired about that
.. and for some reason, HR had marked me for "frontend"
 
Huh. Bizarre :p
 
@tereško I can't imagine you as a front-ender, I thought you liked the clever stuff
 
@Jimbo I do clever frontend stuff
but they seem to be working basically with jquery and angular, not my cup of tea
if I again end up teaching front team what "partials" are, I will be really sad
 
@BenjaminGruenbaum ping
 
@MadaraUchiha ;-)
 
2:50 PM
Thanks @Gordon
 
lol
 
@Jimbo Did you already endorse his sword fighting skill? ;)
 
video or it didn't happen
 
bahaha
 
user6079755
-1
Q: PHP Intantiation class and reference external file

Walter NuñezHello friend i got this error Fatal error: Call to undefined method Class_Main::Getdata1() The Main function is this: <?php require_once ('config/config.classlib.php'); require_once ('config/config.classdep.php'); $objectClass = new stdClass(); $objectClass -> TEST1 = new Class_...

 
3:07 PM
well, anyway, I was disappointed @tereško is not this grumpy redhead I always imagined :(
 
He was in "interview mode", give him time
 
Don't forget these classic interview tips.
2
repost ftr, but I love it.
 
Just out of interest, has anyone had an interview where they ask for "data structures and algorithms" knowledge? Anyone have any tips here - links, sites etc. I have not once had to worry about this sort of stuff in 5 years
 
@Jimbo Hmm, not so much about data structures or algorithms, but more about design patterns.
 
3:17 PM
bro, my friend and i was arguing if $this->input can be called inside model? and is it right by the mvc concept?
 
Monrnigs
 
bro? Is this suddenly a frat?
 
@DaveRandom You missed the memo, dude?
It's always on in frathouse 11!
 
Yes homie, apparently I did
 
@SergeyTelshevsky now you are just being mean
I am not redheaded
 
3:19 PM
but the photo
but..
 
@DaveRandom just trying to be close with you
 
all I've believed... it was a lie..
:)
 
Photo does not lie
He's a ginger
 
I never imagined someone thinking that I am ginger
 
@RonniSkansing Morning.
 
3:20 PM
so is it right ? if i call $this->input inside model (codeigniter)
 
scarred for life
 
I am a firm believer of "burn all gingers" tradition
4
 
@Jimbo you are very welcome
 
@Gordon You've got some good ones back, although they may take some time to come through
They tell a story, too
 
@RidleSambow That is a property. It is not a model, and it has nothing to do with MVC. It is a property, it's that simple.
 
3:21 PM
I need to get new photo .. some time in this decade
 
This decade is overrated. Wait until you've verified that you'll survive into the next one, don't want to over-commit.
 
\o
I need to cut my hair off
its too much..
 
gingers all over the place
 
We could send them all into space and use the reflection on their hair as the next goldeneye
 
3:22 PM
What the fuck is going on here? #gingerlivesmatter
4
 
@Jimbo I had entirely forgotten to endorse you for last weekend, rectified
 
I'm staaaaaarrrring in the rain... just staaaaaarrrring in the rain.. what a gloorious feeling..
 
I'm soaking again
 
@DaveRandom Is this ginger talk exciting you?
 
3:25 PM
@tereško I must've taken one photo of you today...
 
i mean let's say i need to save a username inputted by a user. which is right by the mvc concept (codeigniter):
controller/login
`$uname = $this->input->post('username');`
`$this->login_model->insertUname($uname);`
or i could just directly access the input
`model/login_model`
`$this->login_model->insertUname($uname);`
 
that would be a blast for this room, actually
 
I would probably look like horse's ass in it :P
 
nope, looked just fine, nice t-shirt btw
 
@Jimbo No it was just a memory of last weekend, as mentioned
 
3:27 PM
you're too kind
 
it's spreading
 
I'm trying really, really hard not to cry with laughter
 
@Gordon I totally read that first tag wrong
 
:D
 
@PeeHaa this.
 
3:29 PM
lol
 
@PeeHaa I can't see any right way to read it, tbh
 
@PeeHaa LOL .. me too, actually. I guess our sane minds are killed by the internet.
 
:P
 
@PeeHaa Me too
Especially in that small onebox
 
Gross @Jimbo, get rid of that YAML tag.
 
3:30 PM
sorry guys to be so insistent, but so which one is right? :(
 
@Fabor Had to finish it off with something short and sweet
 
@RidleSambow put the code in a pastie and ask again, the question was abit vague, and I think the formatting of the code made it worse =)
 
@RidleSambow No clue whatsoever.
 
@RidleSambow I would consider: controller performs checks that input (post) contains expected values and grabs those values out. Then, you pass that $username value to the model layer, which then does whatever else with it
 
@PeeHaa Same here. Was wondering why that would even be a skill tag
 
3:32 PM
@DaveRandom LMAO
user image
10
Can I endorse you for endorsements? These are very good.
 
hahaha
 
@Jimbo what is this, linkedin or something
 
@Leigh Yep, it's supposedly for professionals
 
@Jimbo that is truly telling a story
 
@RonniSkansing codeigniter best practice:
should i call $this->input->post('text'); inside controller or model?
 
3:34 PM
I've dodged it, mainly because privacy
 
@Jimbo I think he just endorsed you for the role of Thomas in Downton Abbey
 
@Jimbo oh ok, thank you
 
@RidleSambow Controller should have your instance of Input, not the model
Model contains domain and business logic. Is it business logic to grab what the user is providing to the application? Nope.
 
What if my business is a sperm bank
 
found similar question
http://stackoverflow.com/questions/4096632/codeigniter-best-practice-in-accessing-this-input-post
 
3:37 PM
@Leigh $x->([o])
 
@Leigh I'm not sure what your users provide to the application, but I'm pretty sure that now I don't want to know!
 
@RidleSambow =), like Jimbo said.. in the controller
 
@Jimbo Is that some sort of new pseudo-language? :)
 
@Oldskool I was guessing it was some kind of ascii labia
and other things
 
@Oldskool It can be whatever you want it to be ;)
 
3:39 PM
A true artist ;)
 
@Jimbo Well.... maybe. phpr0n sure has an intriguing ring to it... ;-)
 
Many multiple rings
Wait, please say that's not a real thing
 
How do you guys/garls feel about saving the user state on the client.. in a encrypted cookie for example
Is it ok?
 
@RonniSkansing NOPE.
 
why not?
 
3:41 PM
@RonniSkansing @Oldskool @Jimbo Thank you for your answers, bros.
 
Even encrypted, it can still be altered by the user when you save it on their side of the line.
 
@RonniSkansing Please no.
 
@Oldskool how?
 
Wrong ping ^
 
yea
 
3:41 PM
@RonniSkansing Anything you give to the client can't be trusted. PHP automatically does magic to make sure the client is who they say they are for us
 
Stop posting messages when I am crafting a reply
 
ah
haha
 
@RonniSkansing If they figure out your encryption or just enter garbage, it means your app will start behaving differently because of something the user has done.
You're pretty much giving the user ownership of their account data (albeit encrypted). That's just not a good idea in general. What would your use-case even be?
 
@Jimbo I dont trust the client, but the trust the client has not decrypted and reencrypted it
The usecase is client side state
 
$ whois php.sex
NOT FOUND
The results for php.xxx are slightly more disturbing
 
3:44 PM
The client cant just encrypt some garbage and that will change his/her user_id
 
Admin Name: joseph kony
Admin Organization:
Admin Street: if you're reading this your
Admin Street: children have already been kidnapped
Admin City: uganda
3
lol (SFW)
2
 
@RonniSkansing No, but if for some reason your encryption method gets cracked (which is unlikely, but not something you should ignore therefor), the user can promote themselves to admin without having access to your server.
That's almost as bad as SQL injection.
 
Okay, so just to put it inside my head
 
3:46 PM
Encrypting state and sending it to the user is insecure??
 
\o/ moar bugs
 
@PeeHaa Hmm LOL seems like JEeves needs to parse HTML ;-)
 
nice html in your tweet
 
@RonniSkansing When you say state. You mean actual state and not some identifier right?
 
(both)
 
3:47 PM
@PeeHaa meant to ask - why did you ask me about deleted messages the other day?
 
@RonniSkansing Storing the user state on their side is insecure by default. It's like putting the key to your car in a lockbox at your neighbours house and assume he's not going to crack open the lockbox and steal your car.
 
@Leigh Expensive joke. Those TLDs are like $100
 
@Machavity £8 for .xxx on gandi.net
 
Thanks guys
 
3:48 PM
@Oldskool but you'd only leave your keys at a neighbour you trusted - isn't that the point?
 
@Leigh Ah. Someone is undercutting the market. Cool :)
 
@JonClements Somebody pointed out to me that somebody was a proper asshole in here when I was asleep. I wanted to find out exactly what happened so I can take measures
@AnmolRaghuvanshiVersion1.0 o/
 
@JonClements Yes, trust being the keyword. But: chat.stackoverflow.com/transcript/message/29747403#29747403
 
3:49 PM
@Leigh awesome
btw, be warned that DNS records are being widely used for doxxing
 
@PeeHaa ahhh... we get to see exactly the same thing as ROs do re: deleted messages - I think the only thing we have on top of that is that we can see them in the transcript (or in user pages) rather than directly in the room itself.
 
Anyway, off for the daily commute back home. See ya guys later.
 
@JonClements Can you see this one? drumroll
 
@DaveRandom I've put a lot of effort into yours, I hope you like it
 
Encrypting and sending to the browser doesn't necessarily mean insecure (you're going to encrypt then mac right, and verify the mac before decrypting on the receiving side).

My main objection would be to the size of the payload, how big will the state become? People use "cookieless domains" for a reason
That state will be sent on every request, (images, js, css, etc.) which is an unnecessary overhead
 
3:57 PM
Yes, I also considered the size could be problemattic
 
Unless of course, they are all hosted on a cookieless domain themselves :)
 
but It was really nice to read some more pro/cons
and the unnescessary overhead is a good one imo
 
Dare I say this is an XY problem? :)
 
I bet your do!
 
@RonniSkansing Related: github.com/Ocramius/PSR7Session
 
3:59 PM
Actually the question comes from looking at a application today that did this
the cookie key was a long crypted string and the value was a long crypted string
 

« first day (1997 days earlier)      last day (2951 days later) »