« first day (4028 days earlier)      last day (911 days later) » 

12:11 AM
also, TIL I can't spell tell-tale
 
 
5 hours later…
5:28 AM
@cmb imo, this should actually be merged in 7.3, it's still supported and the patch is available (and the same as 7.4) ...
when it comes to assessing the impact of the bug, it appears to be mostly shared hosts that are of concern ... however, we consider shared hosting fundamentally insecure, so I wouldn't rate it as urgent ...
when it comes to assessing the impact of the fix to the bug, it's already been merged into higher branches, why should we assume that it will impact 7.3 any more or any differently than any other branch !?
I think the patch is ready and so ship it ... the position "we have a patch for a thing we classified as a security bug with a CVE and are not going to merge that fix into a security release in a sec only branch" makes no sense on it's face
 
5:59 AM
posted on October 26, 2021

 
 
2 hours later…
cmb
8:25 AM
@JoeWatkins apparently, neither stas nor bukka wants to do this; see bugs.php.net/bug.php?id=81026#1635189957 ff
 
@cmb I read it, don't see any knockdown reason why we shouldn't be acting normally, it's a sec issue with a patch available and 7.3 is in security cycle ...
"in case there are problems" is not a very good reason is it ? what if there are problems in 7.4 or any other branch ?
 
IMO the argument that it is quite invasive is valid... I think we should merge it but potentially allow for further security/bug fixes against FPM for a while longer (beyond Dec 31) to counter potential problems with this new code.
 
yeah, I was going to mention, we can always extend the support to accomodate another release in the unlikely event it is required ...
extending it for another release or two makes more sense than not doing anything
 
Let me add that to the bug
 
cmb
That might be an option, but often such issues are only found month or even years after a patch release.
 
8:33 AM
well yeah, but right now we're supposed to be merging sec fixes into the branch, it says so in bright colours on the website ... if in a year someone finds something wrong, nobody expects us to do anything, right now though we're expected to do something
 
Yeah, in the unlikely case such a bug would be found in the FPM part, we can make an ad-hoc release.
 
yeah, I'm all for that, and volunteer Christoph's time to do it :D
 
:-þ
 
Hi guys, I'm also +1 to backport this security fix in 7.3 (and possible upcoming fix for issues related to this fix, even if not "security" related)
 
we should do noise on the bug
 
8:39 AM
(FYI, I already have thousands of download of 7.3 with this patch applied on my repo, and nobody complain yet)
(AFAIK, ondrej also apply it on its debian builds)
 
@RemiCollet Mention that on the report?
FWIW, we can just back port it. Neither Stas or Bukka are release managers :D
 
yeah, it's on rms really ...
 
comment added
 
> FYI this is already applied on various distribution packages repo (Remi's RPM, Ondrej's DEB, ...) and after thousands of downloads, nobody have report any issue.
confidence++
a little, surely ... @cmb
 
@JoeWatkins I even apply it on 5.6, 7.0, 7.1 and 7.2 ;)
 
8:45 AM
You crazy crazy.... something. :-)
@RemiCollet Does RedHat still support PHP 5.3 in some product? :-)
 
cmb
@Derick stas is 7.3 RM, though :)
 
and so are you... I have never seen Stas do anything about/with that though?
 
still, he's outvoted
 
@Derick en RHEL-7, 5.4 and 7.3, en RHEL-8, 7.3 and 7.4 (RHEL-9 will have 8.0)
 
FWIW, I wonder what @Sara and @GabrielCaruso have to say too?
 
8:48 AM
(8.0 should appears in 8)
 
@RemiCollet So nothing for 5.3?
 
no
5.3 was in RHEL-6 which is EOL for a while (and EUS doesn't cover PHP)
 
I bet they don't have zlib compiled in, although the first issue does show that it is?
 
it (php) could have failed to compile with --enable-zlib
there would be a warning in build log
 
I think it has to do with their zlib being old, as from what I know @cmb mentioned that this gzfwrite was only exported in later PHP versions... but I don't remember which ones.
 
cmb
8:56 AM
see chat.stackoverflow.com/transcript/message/53330904#53330904; I commented on the ticket as well
 
Oh, I missed that - sorry.
 
cmb
np; I'll have a look at the other ticket in a while
 
they're using 7.4.9, so I bet it's the same problem
 
cmb
9:22 AM
@Derick right; need at least 7.4.20
btw "xdebug 3.1.1 failes to load on php 7.4.9 where 3.0.4 does" makes no sense ;)
 
I think they're trying to say that 3.0.4 does load?
 
cmb
9:41 AM
yes :)
 
10:03 AM
I was reading an article, I saw this sentence:
"It (gRPC) is a member of CNCF" .. What does it mean exactly? Based on some research, I understood, CNCF stands for "Cloud Native Computing Foundation", but still I don't know how its membership would work
 
thx
 
10:45 AM
@cmb bukka approved the 7.3 backport :)
 
cmb
11:00 AM
@RemiCollet yes, just seen that. I'll wait a while with merging; still unsure whether to release 7.3.32 this week.
 
What's the weighing factors?
 
Does "stub" means "small"? (in the context of "gRPC stub")
 
No, it means a minimal function implementation, sometimes even just the declaration and return type
 
ah ok
is that function defined on the server or client?
 
@Shafizadeh that is irrelevant. Any function can be stubbed
 
11:15 AM
e.g. function toe(): Pain {}
 
Or:
function isThisReallyComplexRuleTrue() : bool { return true; }
@MarkR What did you do to your toe?
 
I stubbed it...
 
grown
 
^.^
 
11:56 AM
o/
 
\o
 
12:13 PM
@ramsey I'll do the tagging now, ok for you?
 
well, determining a specific data type (for returning) will be named as "stubbed"? like : bool
 
that's just typed... I wouldn't call that stubbed.
 
is there any doc for "stub" concept?
 
12:28 PM
@Shafizadeh en.wikipedia.org/wiki/Method_stub is pretty good
 
thx
So, the stub is a function which returns something as expected for now, but not real value, and it needs to be implemented/finalized in future to do the right process
 
It can be quite varied in what said functionality is, PHP src for example uses stub files which don't return anything, but they provide the functionality of defining names, args and return types:

https://github.com/php/php-src/blob/master/Zend/zend_builtin_functions.stub.php
 
I see .. interesting
 
Morning
 
12:39 PM
\o
 
 
2 hours later…
2:21 PM
@cmb " 28 Okt 2021, PHP 7.3.32" ;)
 
cmb
oh, should be Oct – or is something else wrong, too?
 
yes Okt => oct
 
cmb
ta (guess I was thinking about Oktoberfest ;)
 
2:44 PM
Isn't that in September?
 
cmb
Bavarians ;)
 
3:31 PM
@RemiCollet I've finally gotten around to moving phpimagick.com to ImageMagick 7..... do you know anyone who might be an expert in ImageMagick, and has some free time to answer questions, as this stuff seems confusing to me.
 
@Danack sorry no real contact with such expert...
and looking at IM is always a real pain ;)
(the library, not the ext)
 
@RemiCollet cool.....btw I have regrets about the whole deprecation strategy used in Imagick. I don't think it fits well as some stuff that was deprecated has been deprecated for years, but only is unavaiable when using ImageMagick 7. Also, some of the stuff that was removed, was just pointless to remove as it's trivial to keep working: github.com/Imagick/imagick/blob/…
aka it was easier to undeprecate and shim it to work on IM7, than it was to fix the examples on phpimagick.com, and then write migration guide.
 
3:56 PM
@Danack indeed, if you find a way for a deprecated function to be undeprecated with IM7, this is great
 
- Imagick::flattenImages - MagickFlattenImages was removed, so internally this now calls MagickMergeImageLayers(intern->magick_wand, FlattenLayer);
- Imagick::getImageIndex and Imagick::setImageIndex are undeprecated and work on ImageMagick 7. They call MagickGetIteratorIndex and MagickSetIteratorIndex internally.
- Imagick::getImageSize is undeprecated and works on ImageMagick 7. It calls MagickGetImageLength internally.
 
I'll try and polish the migration guide......the reason I was hoping for someone who knows what changed is that I don't fully understand what happend to Matte/Alpha and the documentation is ............................."unintuitive".
 
is that slang for "missing" or "shite" ?
 
MagickSetImageMatteColor() sets the image alpha color.
 
4:00 PM
Not matte or glossy?
 
but matte values are opposite to alpha......mostly.
 
cmb
@Danack is this for GIF (a color that signals transparency)?
 
@cmb It appears to be a general method for any image that has a transparency channel. I don't know when it's appropriate to use it or not.
 
 
2 hours later…
6:11 PM
Someone sent me a Slack message with a photo of Hulk Hogan and asked me "Do you know who this is?" I feel old...er.
 
6:34 PM
@PatrickAllaert Just now seeing this message. Sorry. Feel free to tag away. :-)
 
Guys the dsmap library it's ready for production?
 
@ramsey @PatrickAllaert - how about setting a schedule of who is going to do each release, rather than leaving it to the last minute? Probably reduces the chances of ...problems.
 
@Danack 👍
 
@ramsey @PatrickAllaert Yes, please just alternate :-) Like Sara and Gabriel do, and Peter and I were supposed to.
 
Does anyone know when the last time PHP src had any kind of external security audit performed, if ever?
and if so, by whom
 
6:55 PM
I don't know that it's ever had one. And I'd be kind of scared of the results. :-)
 
As would I, but I'm going to need to write up some internal docs on our upstream security considerations, hence the Q
 
nowadays this would mean compliance, and I'd say luckily no such framework exists for the PHP group.
what I know about is that (some years ago) the hardened PHP project and suhosin, today Snuffleupagus and shuosin-ng. And PHP has some CVE process I think, the bugtracker has support to hide reports from public.
And the documentation gives more notes on certain functions, e.g. warning about the openbasedir feature, what common problems with searilzation are etc.
but this is all more about using PHP code to attack the system running it then issues with the C code itself. I think this is handled on a report-by-report basis and maintenance. E.g. security fixes there are with every release.
 
7:26 PM
@MarkR If your company has any money to pay for it, you'd get a better report from Scott Arciszewski aka twitter.com/ciphpercoder aka paragonie.com than you'd get from yourself.
 
@Danack Yeah I wasn't considering doing one myself, I'm not remotely qualified, it's for internal reports as PHP is part of our tech stack
Filezilla for example was included in EU-FOSSA
 
 
3 hours later…
10:34 PM
I encountered an oddity with my client recently, and I'm unsure how to process it.

Long story short, I'm asked to use a form to create a file in the server of a website... using purely Javascript.

Javascript is client side and can do no such thing, so I talked about PHP. I'm not quoting him, but paraphrasing, it was like... "Let go of your bias towards PHP. It's old and unreliable. We use a different server". Then proceeds to never mention what the server's system is, despite my asking. Answers usually describe "MYSQL", rather than what language I need to access MYSQL
 
The correct reply is "You're an idiot, and clearly not qualified to be making decisions as you obviously lack any knowledge of the web development ecosystem"
Also paraphrasing :P
However, just an FYI, javascript can also run server side via node
 
11:10 PM
Fire the client. Now. Before he metastisizes.
 
11:33 PM
I <3 me some client side JS (TS), but other than the official static analysis (which is TS, not JS) I don't know why anyone would choose it over PHP... maybe it's async capabilities, or maybe their devs have only ever done JS
TS however utterly blows PHP out the water when it comes to typing.... except for runtime
 

« first day (4028 days earlier)      last day (911 days later) »