« first day (1015 days earlier)      last day (4157 days later) » 

15:00
Do you have to worry about session hijacking and more when using SSL?
Question is basically "Someone rejected my suggested edit as plagiarism (even though it was approved eventually!) I want a confirm box to prevent it from happening accidentally!" rant.
@JunatanmDegraded You don't have to worry about people stealing the session cookie through simple MITM attacks, but that's about all you can say for sure. It's still possible to brute-force the session ID and it's still possible to conduct more elaborate MITM attacks (although the former is usually impractical given the entropy of a PHP session ID and latter is highly unlikely as it usually requires that the attacker already have control over some elements of the victim's network)
And it would also require that the attacker have the private key
But the main thing to remember is this: nothing is secure if the attacker wants it badly enough.
@DaveRandom You make some good points. I need to let it sink in for a bit, but thanks so far. As for "forget the word files" I don't know what you mean and I suspect there may be a miscommunication as to what I was referring to. The files the system reads are written by the user of the library, so you would need to refer to them in the documentation, and it's probably best to give them a (non-forced) extension as well. Those two things are what I was referring to.
@Jasper Yeh but it's just a data storage layer. You may conceivably at some point expand it so that the data can be stored in the database. You may have something like class FileStorage extends DataStorage somewhere - but in your code they (the files) are just StorageRecords, which are built and parsed by a standard routine in DataStorage
15:15
@DaveRandom Got it now. It's not the storage engine, it's the definition of the data types. To put it in OOP terms, the files represent the class definition, not the objects.
u need mind to understand it.. — Himanshu Goyal 6 mins ago
Or did that come across previously?
@Jasper Ahh, well they are SchemaDefinitions then
@MadaraUchiha do you have a link to a webshop where I can buy mind?
15:20
@HimanshuGoyal: Really, well I have one thing to sayMadara Uchiha 53 secs ago
@DaveRandom schema is one of the few English words I've always had some problems with. Perhaps it's because we have the same word in Dutch, but the two aren't quite the same (yet similar enough that a definition doesn't generally describe the difference)
but it might indeed be the correct word to use here
@PeeHaa did you already notice that more services from developer.apple.com are back?
@bwoebi Yes I got the mail last night I think. I think I can deliver monday :)
yay!
And it only took 8 days!
:P
15:27
what do you want to deliver?
@bwoebi An app so that it can be tested
@PeeHaa I thought you could just install the certificate on the iDevice and then install the app there?
Late message joke fail
or did this change?
@bwoebi I need to add some people to the cert and create a new one
Otherwise people cannot install through testflight
15:31
oh oops… forgot that you have to add them in the iOS dev center… (I just thought about itunes connect to bring the app to the app store)
@bwoebi Can't blame you for forgetting 1 of the 100 steps you have to take to install the damn thing without the app store
Damn that shit is painful
I hate wireless mice
@PeeHaa I just had tried that once… but what sucked the most is that there has to be exact signatures, no private APIs etc :@
@PeeHaa why? disconnects?
I hate wireless mice with crappy battery life and less-than-desirable range (so all of them) but I like the concept.
@bwoebi battery dead :(
@DaveRandom Yeah that was what I meant :)
@PeeHaa me too. Their weight is all wrong, and it's absolute pain when the batteries go dead when you're in the middle of doing something.
15:35
@Jasper the batteries weigh the most I think…
@Jasper Playing a FPS
And about to win, too :D
@PeeHaa once a month (or less)… is that too often?
I once broke a mouse over that. Threw it against a wall. I'm still looking for some of the pieces.
@bwoebi yes it is.
@PeeHaa it costs 2 minutes to change the batteries… really… :o
15:37
@MadaraUchiha I only had it once, while playing a turn-based cardgame online. It was easier to overcome than while playing an FPS, but it was enough to make me stay away from wireless mice from that point on
@bwoebi Yeh, plus the 40 minutes to find the replacement batteries.
2
@bwoebi Yeah. Unless you are out of batteries and you have to get them
@DaveRandom Haha, that
@bwoebi I know. And I don't want my mouse's weight determined by the batteries, I just want a lighter wired mouse :P
@DaveRandom haha… You don't place your batteries in a central place? :-D
15:38
And to make matters worse somebody decided it was a good idea to put the old used and drained batteries back in the drawer...
WHY WOULD YOU DO THAT!?!?!?!?!?
@Jasper If the mouse would be so light it wouldn't have enough inertia to be held under control.
@bwoebi Yes I do. Unfortunately that central place is usually buried beneath a huge pile of junk, and usually when I have re-balanced the pile I find that the box is not where it should be and my gf has taken it to work or something.
@PeeHaa For some reason, EVERYONE does that
I HATE everyone!
3
We have a huge box of dead batteries destined for the recycling thingy at the supermarket. It has way more batteries in than the box with fresh ones in.
15:41
@PeeHaa here old batteries just lie in some random places … which I will throw away correctly when I clean up here… (but the new batteries are in a central place)
It also has really odd formats of dead batteries in, formats that I'm certain I've never owned a device that takes them.
@DaveRandom My guess is they are hers. Are they sticky?
@bwoebi it may be the fact that it was several years ago or the fact that it was a cheap wireless mouse (it was one I got for free because the owner had no use for it) but the mouse was significantly heavier than most wired mice I've come across.
:P
Also I seem to have a sheet of 64 CR2032s (one missing), as if CMOS batteries die on a daily basis.
lol
15:43
@PeeHaa No, those are all just double As she doesn't need any of those.
I come back!
Anyone here uses Blender?
@PeeHaa I expected that out of @tereško or something :P
@MadaraUchiha I have a handful of times in the past, but I've used 3ds max way more
@PeeHaa You're the cat? :D
@DaveRandom :D
More like Blender
@LeviMorrison this is still disturbing me:
Jul 20 at 16:59, by bwoebi
@LeviMorrison If you look at the description here: http://leviathon.homenet.org/manual/en/function.assert.php I think the parameters names are emphasized too much.
15:50
@bwoebi You mean too skewed?
@MadaraUchiha On a related (completely unrelated :-P) note, how is anime.SE going?
@MadaraUchiha I'd just prefer the same font-size than the other text and not bold
@DaveRandom Doing really well, actually.
We've surpassed 1.5k views/day
Currently, we're looking for some avid users and question askers :)
How long before beta -> live?
@bwoebi +1
@DaveRandom Not sure, that's up to Stack Exchange team
user895378
15:53
@DaveRandom I have good news and bad news. The good news is I've finally found a way to retain header field casing in aerys in a performant way. The bad news is PHP's date() function is so slow that using it to auto-add a Date header on every response drops the number of responses per second by 1,000! From one freaking date() call per request! Unbelievable, PHP. Unbelievable.
Which one is better: a is actual and b is how I'd prefer it.
@bwoebi Yeah, I think b.
@rdlowrey Isn't Date: completely superfluous anyway?
Anonymous
@bwoebi 'a' isn't bold enough for me
@Simon_eQ Needs more bold :D
15:55
a vs b
2
Except that looks like you're trying to promote a over b
@rdlowrey then cache it for a second?
@bwoebi That'd be silly :-P
user895378
@bwoebi Obviously I tried that too -- the additional userland work negates any advantage.
Anonymous
I am deadly hungry. Exceptions for mistakes should be made ...
user895378
The fastest way to work around it was to set a recurring event to update a cached date property once per second and always read from the cache.
15:57
but according to rfc 2616 the Date header is not needed?
user895378
But even that only cut the performance degradation in half.
user895378
@bwoebi You should probably re-read RFC 2616.
@rdlowrey Isn't there a more direct way to get the system's time?
I doubt date() to be the fastest function.
user895378
> Origin servers MUST include a Date header field in all responses, except in these cases:
user895378
(insert edge cases that aren't applicable here)
15:59
@MadaraUchiha It's not just about obtaining the current time, it's about formatting it into the needlessly complex format mandated by the date() header
What's wrong with a unix timestamp I have no idea
user895378
> Date: Tue, 15 Nov 1994 08:12:31 GMT
That Berners-Lee character had no idea what he was doing, honestly.
@rdlowrey According to 14.18.1 you don't have to. You are allowed to operate clockless (if you don't send expires header etc.)
Anonymous
I just discovered, every php dev was scammed, into learning php thinking it was a very easy language.
16:00
@rdlowrey Perhaps a compiled little C(or something) executable to return the current date in the correct form?
Surely that would be faster?
@Simon_eQ PHP is a very easy language.
user895378
@bwoebi Sure, so go ahead and negate the massive caching advantages of the Expires header? That's idiotic.
Anonymous
@MadaraUchiha easy to learn. Impossible to master ...
user895378
That creates far worse performance implications than not sending a Date header.
@Simon_eQ Like everything else, basically?
16:01
@rdlowrey If you want to cache, yes. But not for dynamic content
user895378
@bwoebi You can't just assume people don't want to cache things. Not in a real server.
@tereško when you use your mapper's save() function, does that just modify it within something like a "unit of work"?
but, when you browse, static content won't be requested every time, so this is negligible
Anonymous
@MadaraUchiha Not sure! I just know that I miss HTML so much :p
@rdlowrey that's why one could set itself the header… instead of assuming that the webserver does
user895378
16:04
For one, you aren't "allowed to operate clockless." So none of your statements are making any sense.
user895378
If you have a clock, you send Date headers.
@rdlowrey no?
user895378
Second, there's a reason why people use php: because it abstracts these terrible HTTP specs. A server that doesn't handle things like this for you has no real widespread usability.
user895378
Technically according to the spec you're required to add it to all responses but in light of these findings I'm very likely to add an option so that it's not auto-added by default. It's only necessary in certain cases where caches want to compare it to Last-Modified dates and what not.
that's what I wanted to say…
user895378
16:06
:)
@rdlowrey presumably you're not passing a second arg to date() ?
user895378
@DaveRandom date(self::HTTP_DATE)
@DaveRandom the second arg would be time()… what is the default arg…
@rdlowrey self::HTTP_DATE === 'r' ?
@bwoebi Yeh but if you were doing date($format, time()) it would be way less efficient. I know @rdlowrey already knows that sort of thing but sometimes I find it useful to use other people as a stupidity filter ;-)
user895378
16:09
I definitely require stupidity filters from time to time.
user895378
const HTTP_DATE = 'D, d M Y H:i:s T';
user895378
It's the difference between:
user895378
Sat, 27 Jul 2013 16:08:56 UTC
user895378
and
user895378
Sat, 27 Jul 2013 16:08:30 +0000
16:12
@DaveRandom this is really a minor microoptimization… ;-)
yey received gold badge for PHP tag :D
user895378
Anyway, I think @bwoebi has the right of it -- I'll add an option to have the server always set it if you want (disabled by default) and have the static file handler always set it.
lol... I was looking up the difference between the Dutch "schema" and the English "schema", and here's just some translation of the dutch word to English: plan, scheme, pattern, schedule, timetable, schematic, schema, system, diagram, programme
user895378
I wonder if there's any possibility that PHP date() could cache results in which the unix timestamp and output format were the same ... obviously that introduces the issue of invalidating any cache entries older than one second but it would make a big difference in this particular case.
user895378
^^ Anybody know anything about whether that would be a viable option?
16:20
what's the usecase?
user895378
27 mins ago, by rdlowrey
@DaveRandom I have good news and bad news. The good news is I've finally found a way to retain header field casing in aerys in a performant way. The bad news is PHP's date() function is so slow that using it to auto-add a Date header on every response drops the number of responses per second by 1,000! From one freaking date() call per request! Unbelievable, PHP. Unbelievable.
@rdlowrey some simple tests I've just done indicate that $result = substr(gmdate('r'), 0, -5) . 'GMT'; is around 4 times faster than $var = date('D, d M Y H:i:s T');
@rdlowrey If I'm not wrong the status line HTTP/1.1 200 OK is basically enough for a valid response. But what else is needed is only the Content-Length header to not have to close the connection so that it's faster to make the following requests.
Not least because gmdate() doesn't have to do all the extra legwork to adjust for the system timezone
user895378
Now comes the stupidity check -- it hadn't even occurred to me to use gmdate()
user895378
16:23
@bwoebi well yes, but I'm going for robustness here :)
user895378
When I'm serving static files I don't want to have to handle things like this manually, I want my server to do it for me.
@rdlowrey I mean: only implement the headers which are necessary to have some speed advantage
@rdlowrey Actually just using gmdate() with your format string seems to be the solution that performs best
user895378
Hmm ... even using gmdate() over date() my results look like this:
user895378
w/  gmdate call: Requests per second:    6633.25 [#/sec] (mean)
w/o any    call: Requests per second:    7602.86 [#/sec] (mean)
w/  date cal:    Requests per second:    6538.07 [#/sec] (mean)
16:27
rly?
That doesn't stack up with the results I just got on my system for the difference between date() and gmdate()
one sec
$ time php -r 'for($i = 0; $i < 5e6; $i++) $var = substr(gmdate("r"), 0, -5) . "GMT";'

real	0m5.928s
user	0m5.877s
sys	0m0.049s

$ time php -r 'for($i = 0; $i < 5e6; $i++) $var = gmdate("D, d M Y H:i:s T");'

real	0m5.492s
user	0m5.453s
sys	0m0.037s
@bwoebi Compare against date() though?
user895378
Apparently either calculation is slow enough that it becomes a bottleneck, even if gmdate is faster than date
$ time php -r 'for($i = 0; $i < 5e6; $i++) $var = date("D, d M Y H:i:s T");'

real	0m13.252s
user	0m13.200s
sys	0m0.049s
@rdlowrey how about using apc(u)?
16:29
@DaveRandom why did you say around 4 times faster?
wohoo, finally figured out this whole fpm nginx setup. Have two versions of PHP running now. Now onwards to setting up MySQL =o(
@Jasper no… that would be even slower I think.
@bwoebi Because over 100000 I got about 3s vs 0.7s
user895378
@Jasper I've tried keeping it in memory (no need for apc, this all happens in one process). The additional userland work negates the benefits from not calling date/gmdate.
ah, I see
MGE
MGE
16:31
Hello, how can be the problem here
@DaveRandom your system is slow…
@MGE The problem is often here.
user895378
Final conclusion:
MGE
MGE
setcookie('CookieSecure', md5($userid.$secureid.strrev($mail).serialize($_SERVER['HTTP_USER_AGENT'])), time()+60*60*24*30, "/", "domain.com");
setcookie('CookieUser', $userid, time()+60*60*24*30, "/", "domain.com");
error_log($_COOKIE['CookieSecure'].' - '.$_COOKIE['CookieUser'],0);
user895378
if ($this->alwaysAddDateHeader && (stripos($headers, "\r\nDate:") === FALSE)) {
    $headers .= "\r\nDate: " . gmdate(self::HTTP_DATE);
}
16:31
@MGE @problem can be here, because this is a public chat
MGE
MGE
PHP Notice: Undefined index: CookieUser ...
@rdlowrey +1. exactly this :-)
@bwoebi I didn't say it wasn't :-P - but I got those results consistently over 5 runs and it's the ratio that matters
@DaveRandom I ran this also a few times… only variations ±20 ms
user895378
Thanks for participating in my tiny micro-optimizations @bwoebi and @DaveRandom :)
user895378
16:33
It's nice to have other OCD people I can come to with my problems!
> Once the cookies have been set, they can be accessed on the next page load with the $_COOKIE or $HTTP_COOKIE_VARS arrays.
@rdlowrey another micro-optimization would be to write: $var = gmdate("D, d M Y H:i:s")." GMT"; instead of using the T option.
@bwoebi In C, true. In PHP - probably not.
it saves 100 ms over 5e6 runs
MGE
MGE
okey, it cant be accesed by the same page
16:35
@DaveRandom I just tried five times with time...
MGE
MGE
I think that the problem is with my Chrome browser
@bwoebi (ridiculously) micro-optimising, what about gmdate('D, d M Y H:i:s \G\M\T') ?
less opcodes ftw!
Get the quotes right you stupid boy
What about caching "D, d M Y H:i" and expire it every minute
@DaveRandom didn't help :o
Actually that's a fair point, do seconds really matter here?
16:39
@Orangepill and who maintains the counter? there's no millisecond precise setinterval in php
I mean it's not like people have cacheable resources that only last for a few seconds. If something is that time-sensitive you just don't cache it
user895378
@Orangepill Hmmm ... interesting point.
diff of cached time call
user895378
It's a good idea, though I'm a tiny bit hesitant to add recurring events that happen even if there are no clients connected. It's probably an irrational thing to avoid but right now the process never wakes up to do anything if there aren't any clients connected.
@Orangepill then you have to check every time time(), fetch the variable with the last update, fetch the cached variable and use date() to get the seconds…
16:42
@rdlowrey That can't last forever. What about log rotation?
@DaveRandom that are cronjobs… and cronjobs are only checked every minute once
user895378
@DaveRandom Well something like that isn't hardcoded into the server though. Logging is an add-on.
a call to time should be pretty low hanging fruit though....
@rdlowrey OK... but said logging add-on is going to want to rotate its logs. And it may want to do it at a fixed time, because the guy who runs the server - let's call Adam Inistrator - is a bell end, and plugs his removable hard drive in for precisely 18 minutes at 1.43 am every day.
I may have carried away there
But srsly, I think a potentially infinite hang on network input may bite you eventually
user895378
@DaveRandom No I agree with you that it's bound to happen, but I'd prefer to avoid waking up unnecessarily in the core server. In the logging mod? Sure.
user895378
16:46
@DaveRandom Not possible in the server.
user895378
Non-blocking IO. Something only happens if the socket is readable. When that happens there's either data or it's EOF.
user895378
And if a socket is idle for more than the prescribed amount of time the server kills it subject to its option settings.
@rdlowrey are you regularly sending ping frames?
user895378
@bwoebi Each websocket endpoint can optionally specify a heartbeat period in seconds. When present that option causes the websocket handler to automatically send a heartbeat ping frame at the specified interval.
user895378
If more than 3 ping frames pile up without being answered by a pong the handler will initiate a close handshake.
16:50
@rdlowrey Oh yeh duh, for some reason I had select(r, w, e, null) in my head but obviously you pass a timeout.
user895378
And of course if the client doesn't fulfill its end of the close handshake within a certain amount of time then the handler will terminate the connection
On that note, I'm going to get drunk
catch y'all later/tomorrow
user895378
@DaveRandom later
@rdlowrey what do you use as heartbeat period?
user895378
@bwoebi I default to ten seconds, but it's configurable and only takes place if there hasn't been any activity for that amount of time.
16:52
@rdlowrey yep :-)
17:06
Hi there, I got a problem can you help me out?
> Discussion for all things PHP - Don't ask whether someone is here to help you. If someone is around and wants to help they will.
hello. anybody here familiar with asterisk?
or PBX
@UchihaObito @DaveRandom probably, but he's out getting drunk
@PeeHaa ok, thx. i'll try to catch him when his online
he's*
17:22
@UchihaObito Quite the feat you've done there.
But you won't stop me from using my last trump card :)
@MadaraUchiha just handle Hashirama, I'll do the rest :P
lolz
Asking for my email to talk about a job opportunity, and then adding me to a spam newsletter is NOT cool. Way to never hear from me again...
@ircmaxell you got it all wrong. That's really how most recruiters work ;)
Anonymous
@MadaraUchiha I just realized why, I didn't implement die() because, it would break off my page.
@Simon_eQ Obviously, that's what die() does :D
Anonymous
17:37
Yea, I knew it wasn't there for a reason :p
How do bounties on meta work? I mean, what does placing a bounty on a feature request mean, for example.
@Jasper That the person who offered the bounty want it to get more attention, because he thinks it's a higher priority
It usually doesn't work though :P
Ah, I see. It would feel rather sour to me if you set a bounty on a feature request, get a response stating "SO owners don't like this for x" and then have the bounty awarded to that...
18:03
hi to all
I asked an question in stackoverflow but no one answered me
can I ask my question here?
Hi all.
@Madara are you online?
Hi @Peeha!
please some one help me here:
Anonymous
18:06
ok
@MaciejCzyżewski heya
I saw it
I lolled at the comment
2
Q: how controll other scripts by a main script and pass to them parameters when they are running

saeidI have a main.php and test.php. test.php should be executed by main.php both scripts must be run infinite. main.php must checks in periods of time that test.php is running or not and if it isnt running (in case of occuring errors) execute it again. I must have error logs too. if main.php reciev...

I want to write the longest answer to stackoveflow
in *
Anonymous
18:08
@MaciejCzyżewski I'll surely down-vote it:)
@MaciejCzyżewski It's less funny when you know it is limited :)
@PeeHaa :-X
@saeid I know how to do this in linux
18:09
oh please say
@Maciej say please
@saeid wait if i done this and it will works i answer your question.
@PeeHaa I know its limited but read this line "at 39220 characters (I'm not sure how it's so long; possibly the post length checker ignores some data, or the rendered HTML takes up a lot of space)" -- Michael Mrozek
Hey I have a problem in war deployment, I am using xampp and ubuntu. I have one war file which i paste it to htdocs. When I run server it is not extracted
@MaciejCzyżewski Yeh I know. Not sure how. Didn't feel like investigating any more :)
@PeeHaa I have a dream, I want to get more upvote then 10... Because I always get 1-3 :-X
It will happen eventually
18:19
@Maciej when do I come and ask you about my question and your tests again?
@DaveRandom I came up with a new names for my classes based on our conversation. I'd appreciate it if you could take a look and say if it makes sense (other people are of course welcome as well, context: chat.stackoverflow.com/transcript/message/10884178#10884178)
I'll put this in UML because it is clearer than trying to use words to say the same.
@saeid :-( you are using windows I have linux :-(
18:20
it's not problem
@Maciej it's not problem
Notes:
1. I went with Schema over SchemaDefinition because while the files might be the schema definition, this is the in-memory representation, so it's the schema itself.
2. Terminology: on the filesystem, you have your schema (definition) which consists of datatype files
@Maciej I want to use my code in linux finally
3. The real change comes from folding the Member class into the the Type classes. This is something that did come out of our conversation even if I don't think it was a conscious suggestion. It will require some refactoring (because the change will be reflected in the Visitor-ish system, which is used in a number of places)
@saeid aaa ok
@saeid wait i am testing
@Maciej thanks thanks
18:26
@saeid ok i am writinga code. In this time you can read something about proc_close
*writing
@MaciejCzyżewski Am now
@Maciej I studied about proc_open very much
@DaveRandom either way, thanks for your suggestions, I do feel I have better class names now
@PeeHaa Noooo... stackoverflow.com/questions/17900004/… If it will be 'put on hold as off-topic' I lose my points?!
@MaciejCzyżewski Only if it is deleted
18:36
@PeeHaa Will be able to upvote my answer or no?
@MaciejCzyżewski yes
@PeeHaa uff thx
18:48
@MaciejCzyżewski I wouldn't be surprised if get deleted eventually. While the in-depth answer is nice, that question just doesn't merit such an answer
@Jasper I know. But in comment he want to explain this (regex)
19:00
I am going to ask a question that says something like "What do you think about the magical yellow unicorn who dances on the rainbow with a spoonful of blue cheese dressing?" just so I can reference it as a dupe for questions that appear to be random words like that one
lol
yeah we need the canonical random words blob dupe :)
@peehaa ... I like that as the official description ... or they need a "Huh?" option as a reason for the close vote
@Maciej Where do you get?
please some one help me here:
3
Q: how to control other scripts by a main script and pass to them parameters when they are running

saeidI have a main.php and test.php. test.php should be executed by main.php both scripts must be run infinite. main.php must checks in periods of time that test.php is running or not and if it isnt running (in case of occuring errors) execute it again. I must have error logs too. if main.php reciev...

@saeid You may want to have a look at @rdlowrey 's projects, one of them is exactly about a scheduler task with asynchronous IO. You should ping him about it. I warn you though, it's pretty high-level stuff.
@Madara please give me a link
@Madara a url
@saeid Ping @rdlowrey about it (I just did), but there's probably a URL on his profile page. It's under his GitHub account.
@Madara I'm a beginner. what does mean this (Ping @rdlowrey) ?
what I must do exactly?
19:33
@saeid Call him here in chat. (Which you just did, by prefixing his nickname with a @ sign)
Not sure he's here right now though.
ok
@rdlowrey my friend. are you here now?
@MadaraUchiha Troll-lolololol?
@saeid I think Madara is referring to this https://github.com/rdlowrey/Amp but Mr Lowrey is pretty busy - I doubt you will get help just pinging him randomly.

« first day (1015 days earlier)      last day (4157 days later) »