« first day (2822 days earlier)      last day (2111 days later) » 

12:26 AM
Is there a better way to store session id's than in cookies?
With Safari starting to limit multi-site cookies and what it thinks are tracking cookies, my idea for SSO authentication that carries a browser id which in the database may link to a session id would be considered a trackable cookie. It would be used for the SSO Auth website to determine if a browser has already authenticated to a session if that session has been locked or timed out - in order to authenticate the second website - similar to OAuth, just a bit more controlled.
 
12:41 AM
what about using https and installing a certificate specific to that machine or browser which becomes the machine id?
 
 
2 hours later…
2:23 AM
I found how to check for a client certificate but how do I generate one?
 
3:21 AM
Bus Error due to unaligned access in zend_ini.c OnUpdateLong – #76594
 
posted on July 07, 2018

New Cyanide and Happiness Comic

 
 
1 hour later…
Wes
4:33 AM
user image
6
morn
 
4:53 AM
lol
 
5:41 AM
I feel the same way about PHP.
 
 
2 hours later…
8:00 AM
bravura a display of daring; brilliant performance.
 
morning
and happy Sunday all.
If someone leaves programming for short duration then want to come back in IT industry then does it require more effort then before???
 
8:18 AM
morns
@Wes lol
 
@Linus depends
if you had solid understanding, then that has not vanished
but if you were basically a glorified junior, then it might take more effort than before, because stillwill have no clue, will have forgotten the "lessons" that you had memorized without understanding and also have the misguided perception of "seniority" regarding yourself
 
 
1 hour later…
9:48 AM
Morning
 
\o
 
10:41 AM
@tereško thanks
@tereško i count myself below so there's no perception about myself , but there still somethings that i wanna try but can't able to try:(
 
 
1 hour later…
bob
12:11 PM
Ok, so here's probably a dumb question. If you have a brand new local project using vagrant, virtualbox and scotchbox. and you want to install a css framework like materialize, where do you install it? in the root, public or ventor folder?
 
user1804599
Does PHP-FPM implement the FastCGI protocol or does it use libfcgi?
 
@bob I normally have something like:
/
/src - the source code
/site_front_end - all the files related to the site
/site_front_end/public - all the public files
/vendor
And then setup the appropriate build tools to build from the css/js libraries into the public directory in the appropriate place.
!!lxr libfcgi
 
@Danack Nothing went wrong but I couldn't find a suitable definition
 
bob
@Danack Thanks :)
@Danack Just one thing, when you say 'appropriate build tools' that would be an autoloader right?
 
12:36 PM
@bob if it's CSS/JS then probably npm...
 
bob
@Danack Got it, cheers
 
12:49 PM
Morgens
 
bob
1:05 PM
I'm struggling to connect everything up, I've downloaded all the packages I need but how to I include or reference them in a file? like for example with materialize, how do use the damn thing? lol
It's not with a <link rel="stylesheet" is it? in the head.
 
hello guys
 
1:22 PM
@bob rtfm
Instead of asking in a php room do your research
 
bob
@PeeHaa where?
 
Help yourself
 
bob
I'm trying!
 
No you are not
 
bob
yes. I am.
 
1:24 PM
How much time did you spend on their site?
 
This is not a good place to ask questions that are better answered by Google.
 
bob
@Danack google what???
what is the question....
 
Figure it out
If you cannot figure that out you are doomed either way even if you figure out how to install it
 
bob
@PeeHaa I have installed it and have the packages installed.
that's not the issue.
 
Ok
 
bob
1:25 PM
how can I use the damn packages in a file?
 
That's part of the installation you said you just did
But glad you figured it out
 
bob
@PeeHaa that's not the same thing...
 
Ok
Good luck!
 
bob
@PeeHaa Thanks for all your help..
 
Hello mates
 
1:28 PM
@rightfold iirc there's a fastcgi "library" in php-src
 
Could someone please tell me how I can pass this to my login.ts in ionic if($count >0) {

//$response = "Your Login success";
return ['operation' => 'Your Login success', 'data' => $row];

}else {

$response= "Your Login Email or Password is invalid";

}

echo json_encode( $response);
Here is a code from login.ts
this.http.post('http://edomonitor.com/school-evaluation-api/login.php',data,options)

.map(res => res.json())

.subscribe(res => {

console.log(data)


loader.dismiss()

if(res.operation == "Your Login success"){

this.authService.setToken(data.token, data.id, data.name, data.email);

//this.authService.setToken(data.token, data.id, data.name, data.email);

/*let alert = this.alertCtrl.create({

title:"CONGRATS",

subTitle:(res),

buttons: ['OK']

});

alert.present();*/
}
 
2:01 PM
Look at that rep.It's beautiful
 
> 47,998
What's special about that?
 
:D
I actually rechecked :D
 
is it possible to do authentication client-side and still be secure? using any front-end language to handle authentication or user identity seems like a really bad idea
 
No. Only client side is never going to work
 
but even if authentication is done server-side, and user identity is done in front-end?
or is using tokens the right way on the front-end?
 
2:13 PM
> and user identity is done in front-end
What does that even mean? :P
 
like...identity management
SSO
 
How?
SSO is server side
 
confirming a person is who they say they are
 
You mean a shared token?
 
or showing things to a person who has verified they are who they say they are
 
2:14 PM
Based on what?
 
that's what I'm wondering
what's the ideal way of doing it? shared token? what if it's hijacked?
 
How do you know it's client side then? :P
@Tiffany What if the session cookie gets stolen?
 
person's question above ^ using angular with a token
I need to read the security guide on paragonie
 
@Tiffany check out asymmetric encryption, e.g. pgp
 
@Tiffany I assume it's just an access token?
Not generic SSO?
Then again it's JS so I ignored the hell out of it :P
 
2:18 PM
Other than understanding this better, I think one of my goals is rewriting a PL/SQL package at work that has pretty shitty security, but I haven't figured out a good way to rewrite it. I may end up rewriting it as PHP web app, using phpcas and some other stuff.
granted the last time I tried rewriting it was over six years ago, and I hadn't grasped how tokens work yet
 
3:02 PM
I wrote a comment system system where the admin can add Regex for filtering posted content. My solution for storing all the regex was an array structured like this ('checking_for' is meant for the return value of `preg_match`):
$regexArray('/(?i)fuck|badwords/' => array('enabled' => true, 'checking_for' => true));

is it shit?
there is a = missing above
 
3:20 PM
@yessure yes. Just make different functions without the boolean flags.
 
lol i would have bet on it
but it's an array not a function what do you mean?
 
3:40 PM
@Danack
 
3:59 PM
Should PHP have a Number interface?
 
4:17 PM
@rtheunissen what would it have?
 
toNumber, I guess.
 
convert any primitive to number?
random question: what's the difference between using a magic method like __toString, or any other variation of "to<Type>", versus casting a variable to another type?
I think I might put that on SO main
 
So like what's the difference between $a->__toInteger() and (int)$a ?
 
yes
more specific, internally in PHP
 
4:32 PM
The number interface would be for objects to be converted to a number. So is_numeric would return true for it.
I believe it's the same thing. The cast calls the conversion handler of the object.
 
here's a specific example: what's the difference between __toString and (string)$price?
__toString is explicit to objects, and type casting is explicit to primitives?
 
4:48 PM
that looks like the only difference. I'm not sure that it's possible to do something like (string)(object)(string)$var. Not that it's even practical to so do.
 
@Tiffany __toInteger isn't a thing.
 
yeah, I realized __toString is the only one
 
only _toString is. and doing the (string) calls that magic method.
 
ah
is there any performance difference between the two?
 
There's a difference between (int)$a and intval($a), in that the overhead of the intval() function call is skipped.
@Tiffany there shouldn't be.
 
4:50 PM
I imagine type-juggling, especially if there's more than one type, could be more consuming than __toString
 
> if there's more than one type
?
 
(string)(object)(string)$var I'm not condoning using this.
I doubt there's a practical reason to use it
finally have a whiteboard up, I can plan stuff out for my VPS \o/
 
5:45 PM
@bob You're being lazy. What you really want is someone to do it for you- in that case you need to hire someone. If you really want to learn you need to use Google and do some trial and error. Your question should display the efforts you have made by taking us step by step through what you have done, what result you expected, and what it actually did. There should be multiple scenarios you have went through before asking. Just some advice. =)
Houses built out of cob are so interesting to me.
 
Ok @tereško ..! Since you are too busy these days and you cannot check your Asana profile (and we have no time and should launch the project), please take a look at this paragraph (I've written this from your side) and let me know if it is either ok or needs to be modified:
> I’m a PHP developer and have more than 8 years of experiences in programming. I live in a small and cold country named Larvia. It’s about 2 years I’m somewhat working on Lamtakam’s technical algorithms and made them better in some cases. I do some code reviewing for Lamtakam and I am a fan of it. Also, the steam wishlish, if I accidentally do something really helpful.
 
6:04 PM
"It's about 2 years I'm somewhat working on Lamtakam's..." should be "I've been somewhat working on Lamtakam's technical algorithms for two years and improved it in some cases."
"I do some code reviewing..." to "I provide some code reviewing for ..."
 
ah .. thank you so much
 
Assuming the final product will be in English. If it isn't then ignore what I said. :P
 
maybe I fell on my head, but I don't seem to be able to figure out how to use modifiers on the pattern when using mb_ereg_replace. for instance I'd like to do something like mb_ereg_replace('/(?:\r\n|\r|\n)/gm', '<br>', $markdown) but the pattern is not recognized, since the function expects the contained pattern, without the delimiters
the fourth parameter is supposed to take options, but they are not pattern modifiers as far as I can understand from here php.net/manual/en/function.mb-regex-set-options.php
 
thanks for reminding me, I haven't accomplished reading some of my regex book the five days I'm off... need to go do that...
 
bob
6:18 PM
@StatikStasis No, i'm not being lazy. just shocked me how intolerant and rude people were, what is the point of this room if people don't offer help when they can. I've read the docs over and over (i'm not just saying that). It tells you how to install the package in your project which creates a node_modules directory. But no where does it state how to access and use the packages just installed. it's only a stupid question if you know how to do it already.
 
@Tiffany well it is not in English, but I prefer to apply your tips on the context, since we have some English native users that know Persian a bit and going on to answer English questions ;-)
 
@bob deciding for everyone how they have the right to interact with other people, like you just did, is much, much ruder than telling you that you are being lazy, or that you should read the docs. You are not owed anything. No one is entitled to anything for you.
 
bob
@FélixGagnon-Grenier No, I didn't just do that and I nor did I say I was owed anything... it's in the description of the room "Support group for those afflicted with PHP."
 
> just shocked me how intolerant and rude people were, what is the point of this room if people don't offer help when they can.
value judgment, deciding the way people interacted with you does not fit your viewpoint. that's pretty much what thinking that people owe you something amounts to...
also... node happens to be in javascript...
 
6:35 PM
The question you originally asked is something that you can google pretty easily "how to use materialize css framework," "how to include materialize css framework in project" etc
 
in any event, I don't want to make you angry(ier) or anything, but it's getting tiring to read people that drop in here, read the guideline and there and then decide they get to tell everyone they're intolerant if they have the slightest response
 
bob
@FélixGagnon-Grenier Yes, in my opinion some people were unreasonable rude to my question, just don't reply if you don't want to answer and that is a general statement and plural, implying that everyone should help everyone and yes it's javascript...
 
please don't decide for me how and to whom I can reply. there is no rule of "don't reply if you don't want to answer". you have no right deciding how I can interact with people that ask questions.
 
bob
@FélixGagnon-Grenier I'm not and again that is the general and plural use of the word 'you'....
 
gods.
so, you're like, saying that you want people to act in a precise way, but then hide behind "oh I'm not really saying it, I use general formulation"...
 
6:39 PM
Because 9/10, documentation specifies how to include the package into your project. If it's through npm, then read npm documentation on how to include packages in your project. Based on your question, you were expecting a spoon-fed answer. And that's okay sometimes, but realize that you're looking for a spoon-fed answer, and you'll likely be ostracized for it.
 
bob
@FélixGagnon-Grenier No, that's just how English works...
 
bob
@FélixGagnon-Grenier ummm, yes. google it
 
that's how people that are passively aggressively saying stuff act
stand by your words. If you believe a guideline applies in a situation, it's because you are saying that it applies in that situation, to the people present. stop hiding.
if I were to say "people should generally not ask questions in a certain way", it applies to the individuals.
and these individuals are bound to react to whatever it is that I am trying to tell tgem to do.
 
bob
6:43 PM
@FélixGagnon-Grenier I'm not hiding. yes, the rules do apply. firstly I shouldn't have asked the question here. secondly people shouldn't have been rude. that's not me talking, that's the room Guidelines.
 
... There was nothing rude in how the people here told you to google your questions.
 
Yes, we can be condescending at times. From our point of view, there's at least one person a day who comes into the room, asks a question without putting much effort into figuring it out themselves. It's tiring. If you had specified in your original question that you've read the documentation and it doesn't explain how to include it in your project, and you're not exactly sure what to Google to find out, people would've been more receptive.
 
bob
@FélixGagnon-Grenier In your opinion, fine.
@Tiffany I completely agree, my question was very badly phrased and I imagine confusing.
 
It's part of "asking a good question"
 
@bob would you be able to link to a precise comment where you consider something was rude? I'm genuinely curious. There was no name calling. You were given guidelines from the start. People answered succinctly and instructed you on how to best solve your problem.
 
6:53 PM
@FélixGagnon-Grenier I think "rtfm" can be interpreted as condescending, if you're unused to that sort of reaction in an internet chatroom
I ask a lot of dumb questions, but I recognize when they're dumb questions, and I don't get upset when someone points it out and gives me a hard time about it. I didn't put the effort into figuring the answer myself, and expecting someone to take time out of their day to do it for me, for free, is unfair to the other person.
@Wes keeps enabling me, when I have CSS troubles...
 
bob
@FélixGagnon-Grenier With all text, it really depends on how you read it and the context of your own situation. I was just extremely frustrated and had been at it for hours, i'm not suggesting that because of that someone had to answer. It was a stupid question, but I was just really hoping for help.
 
I have a database (the size is about 1 GB), It takes 30sec to be imported on my local computer. But (so far) it has taken 5min on the server and importing not finished yet .. is it ok?
 
@bob it's ok to fail at asking questions sometimes, don't let that frustrate you too much. I hope you'll find what you need.
 
@Shafizadeh are you importing the database to the server over the Internet (from your computer, or another server) or is the database located locally on the server?
 
@Tiffany I'm importing the database (which is located on the server) on the server.
I uploaded it first
@Tiffany Lets say this way: ignore "local" ..! I'm importing a database on the server (mysql -u root -p<password> dbname < path/to/file.sql) and the file.sql is uploaded on the server
but it is not finished yet .. seems strange to me. Since that file will be imported in less than 30sec on my local computer
 
7:03 PM
Alright. It could be the performance of the server (if the specs are worse than your main computer, for example, if the server doesn't have an SSD), or the method of how the server is importing the database is slow
 
bob
@FélixGagnon-Grenier Thank you, I'll try.
 
@Shafizadeh does your computer have an SSD? And are you using that drive?
 
@Tiffany :-( ..! My server has 1 core CPU. it importing related to it?
@Tiffany Either my local computer or server computer?
 
Both
 
my local computer has SSD, but I'm not sure about the storage of the sarver .. probably it is HHD
 
7:06 PM
That's my guess why it's slow on the server
 
lemme run this cat /sys/block/sda/queue/rotational
 
Your local computer is on an SSD which makes reading/writing data incredibly fast, whereas a platter harddrive is orders of magnitude slower
 
It is HHD :-(
Hetzner told our servers have SSD :-(
 
Can you complain to your hosting provider?
 
I'm doing ..
 
7:09 PM
:)
 
 
1 hour later…
8:20 PM
O/
 
8:42 PM
So I'm thinking of using SSL certificates as a way of Identifying a "computer" for authentication/SSO instead of cookies?
I know how to read some of the SSL information (added some varaibles to my hosts file) but I want to be able to get the unique id of the SSL certificate issued from the server to the client to secure the communication - OR - like a cookie, install a certificate to that computer that "Secures" it and authenticates it to the SSO - allowing for simple, non-cookie based, security.
Or do I simple not understand how SSL certificates work?
 
whatever the problem is you're trying to solve, the answer can probably be found in here: paragonie.com/blog/2017/12/…
 
how can I make sure that the new caching_sha2_password auth for mysql is supported by my installation of PDO using docker?
 
I guess try it and if it doesn't fail it works?
 
I know that if fails
I want to make it work
*it
I need a way to install a PDO that works
RUN docker-php-ext-install pdo_mysql
now I am just doing that
 Uncaught PDOException: PDO::__construct(): The server requested authentication method unknown to the client [caching_sha2_password]
 
That linked helped with other development concerns @Tiffany
But I'm trying to build a solid Single sign on system that's both secure and easy to use
A way to authenticate a user without storing any cookie data would enable a HTTP "State-less" approach that leaves "Session state" information to the server. Really, I'm just trying to secure the SSO enough to be happy.
I like the idea of authenticating a machine or browser as a "device" and on the backend authenticating a "device" and allowing the user the "Google" treatment to "deactivate" a "device" using a web portal.
rather de-associating a device - if none of this makes sense, its not you... its most likly me being very confused.
 
9:00 PM
8 hours ago, by Danack
This is not a good place to ask questions that are better answered by Google.
 
I only come here after google produces very poor results.
I've been researching this for a few days now.
 
@JustinKaz the little arrow shows which message sometime is a reply to.
 
oh
I feel dump.
 
Is ZEND_PARSE_PARAMETERS_START the old or the new way?
 
@Nerva there's a note on the page php.net/manual/en/ref.pdo-mysql.php
@rtheunissen must be old - there's an article from 2005 with it.
 
9:04 PM
Thanks @Danack
 
9:19 PM
Now, this is interesting... apparently, a "keygen" html5 element exists that will generate a certificate, store a private key and sent a public key to the server. The only downside is IE doesn't support it.
 
somethingsomethingfuckIEsomething
does anyone else use gist to store random tidbits for safekeeping?
like for example, a link to a build for a game
 
certificate authentication seems like the best idea - in THEORY - and the worst idea to make happen.
I suppose if it was easy, anyone would be doing it.
I find no way to tell a browser - "Hey, install this certificate!"
 
@JustinKaz That will be removed from all browsers
 
I heard because it's built on old hash or something.
I just want to secure my app - that's all - how hard can it be... 1 person and a fleet of Google pages telling me how everything I am doing, or want to do, or desire to do is impossible, insecure, the worst idea since sliced bread, or the Google page simply does not exist.
Slow clap.
 
@Tiffany I never said it doesn't have it, however I will have said one or more of 1) it has better ways to do a lot of the things that mod_rewrite is often used for 2) it does not have an htaccess-like thing (I'm sure there are modules that can do similar stuff, but they are not "standard") 3) you should not use URL rewriting /cc @FlorianMargaine
that last one is one of those gross over-simplifications that is "good enough for newbies", i.e. there are valid use cases for it, but they are typically edge-case problems and by the time you need to solve one of those problems you will know what you need
sort of like "PDO should be used over mysqli"
@rtheunissen new wiki.php.net/rfc/fast_zpp /cc @Danack
 
@JustinKaz It is a massive pita to manage, I used to work with a service that did it. Even from the PoV of a client it's really complicated to use. The core problem is that you only have two options in practice - either you have to use a 3rd party CA to issue the certificates, or you need to run your own CA. Technically none of it is that hard to get a minimally working solution, but when you factor in people, and the fact that they are idiots, it gets difficult to manage real fast.
"People" do dumb shit like losing their private keys, having their private keys stolen, losing their certificates, getting new laptops and getting rid of their old one and oh did I need to move the cert to my new machine I thought it was magic
You start needing to maintain revocation lists, and implement OCSP, and... tl;dr it's a sucky pain:gain ratio
I'd really love it if client certs were more practical for day-to-day operations, but they just aren't I'm afraid, because people suck.
 
Which is why I'm researching a way to do all that installing and generating for the client - silently... like a cookie. The good news is I do not have a user authenticated by a certificate - just a device. The use still signs in like normal - the certificate just authenticates the session - the user get's paired to it... kind of like how Google can show you a list of connected devices.
Yes, it's not as secure as a pure client certification method - but it's a decent hybrid and allows me the ability to make the sign in quick and simple with leveraging the ability to "deactivate a device" by simply removing the cert from the user's active sessions.
 
@JustinKaz you can't do that
the client needs to have a protected private key
you can't magically protect it with no user interaction
 
> just a device
what sort of device?
 
@DaveRandom I like gist cause it's in the cloud. Some of the things I store in it, I want to be able to use from another computer. Typically they are things I want to store longer than what post-it notes are utilized for
 
9:57 PM
A device could be a "browser", a "mobile app", or a secured device (one with the ssl built in the hardware... but who would ever do that... lol).
And it can even be transitory.
But it would allow me to enable a user to "quick" sign in with much more security than a cookie... plus Safari is killing multi-site tracking cookies and this kind of cookie could be considered that... although it won't be used in that fashion.
 
@JustinKaz have you looked at how asciinema does it?
 
nope... but googling now
 
just sign up on it, then login etc
I signed up this weekend to show something to @DaveRandom and was pleasantly surprised
 
@FlorianMargaine that name is almost unfortunate
 
I feel like it would be a cookie tho
Yep looks like a user management cookie through a token-based link to your email.
 
10:08 PM
@Tiffany I have a solution for that as well, but no time to explain atm, remind me tomorrow
 
PHP's memory_limit scope is for each request or for the entire pool of requests from the application?
I have a VPS with 2GB to run a single site, should I leave memory_limit at 2048M?
 
@LucasBustamante it's for each active worker thread. And worker threads/processes are something you'll want to read about when configuring your webserver.
 
@Danack isn't worker thread == single request in PHP's shared-nothing model?
also... thread?
 
10:27 PM
@Danack I'm searching for intuitive tutorials on the subject but couldn't find. Pool, worker, threads, requests, how does PHP deal with that?
Any idea of tutorial or video?
 
10:50 PM
@DaveRandom so ZEND_PARSE_PARAMETERS_START is the faster/better way? Unless I'm reading that RFC way wrong.
 
@rtheunissen I am not a great person to ask tbh, but I do know that's the "new" way. Looking at the def though, to my highly untrained eye it seems like it would be faster, because it directly inlines a bunch of stuff rather than what the "old" api does, an fcall that does it with an iterative approach
 
Yeah makes sense to me too, I'll use the new way then. :)
 
Ahhh! You aint smart bot
!!reminder take out the trash at two days from yesterday
 
However I also know that while a lot of stuff was ported to the new way, a load of stuff wasn't, I don't know if there are technical considerations behind that @rtheunissen, you should definitely ask Nikita/Bob/Joe etc to clarify whether it can be considered a magic replacement hammer or not
 
7 messages moved to Trash
3 messages moved to Trash
 
11:09 PM
Cba with mobile chat any more /out
 
I noticed that PDO uses the new way, and was wondering whether that needs an update, but it seems not.
 
oops
 
The bot just invited me to join trash. :/
Is that a hint?
 
maybe
buying a whiteboard is one of my smarter buying decisions. I'm a little sad I didn't go with a bigger one, but I was afraid anything bigger wouldn't fit. Maybe I should just see if my landlord will let me use clearcoat whiteboard paint on a wall...
 
11:33 PM
Do you guys have any video to indicate that explains how PHP really works?
We all know that any language is ultimately binary. How does this proccess work in PHP?
watching this right now, wish me luck
 
@rtheunissen I'm on mobile so I cba linking specifics but you should search the transcript of this room for "Fast zpp" and "fast_zpp", there are a number of historical convos in this room that highlight pros and cons of it, it's certainly not a cut-and-dry old is bad/new is good situation, there are reasons that you might still choose the old api (e.g. readability/portability/simpler code for non-strict args)
@LucasBustamante you should do some general reading about how "interpreted languages" are implemented
 

« first day (2822 days earlier)      last day (2111 days later) »