« first day (1224 days earlier)      last day (3949 days later) » 

12:02
nevermind..i figured it out
get_headers
It was terrible!
I couldn't connect to SO this morning. :(
Stupid exchange.
Another DDos?
if only to his ISP
OK @rdlowrey in the interests of simplicity I've created a new branch based on he current upstream/PHP-5.6: github.com/DaveRandom/php-src/compare/windowsPeerVerification, if you're doing anything on this can you push to that branch so we can keep everything in sync and mergable?
Jes
Jes
hi
$roles = $this->Metadata->query("SELECT value from metadata WHERE owner_guid =" .$user_guid."AND key = role");
whats wrong with this query statement
12:12
@Jes You use reserved words without escaping.
Also you are missing a space before the AND
Oh, and it's pretty likely that $user_guid should be escaped
And unless you are trying to compare the two columns key and role, role should probably be in quotes
Jes
Jes
@Leri $roles = $this->Metadata->query("SELECT value from metadata WHERE owner_guid =" .$user_guid."AND key = role");
i have escaped key with backticks
And just generally don't name objects the same as keywords, it makes life a lot harder than it needs to be
Jes
Jes
QLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'role\'' at line 1
SELECT value from metadata WHERE owner_guid =" .448024."AND key = \'role\'
key has backticks
@Jes What is &quot doing in query? oO
`WHERE owner_guid =' .448024.'`` is the valid for
user924016
12:20
injection
user895378
12:34
@DaveRandom Sorry, I generally rebase whatever I want on my in-progress branches. I don't expect people to be doing in-progress things based on my in-progress things :)
user895378
But I'll try to avoid that on my php-src branches going forward
@rdlowrey I know, I like to make things more interesting
can we get local IP address like 192.168.100.1
I don't want wan address we get from the `$_SERVER['HTTP_CLIENT_IP'];`
user895378
@DaveRandom But your windows branch looks like it's progressing nicely. I should be able to play with it tonight. Thanks for working on this ... adding the improved windows support should go a long way to making the peer verification changes more successful overall.
user895378
Because, lets be honest: windows users are more likely to not know what to do if peer verification fails by default.
12:41
@rdlowrey That's more or less the thinking behind all the effort. And if we can get to a point where everything that would work in a browser without complaining also works in PHP then a) that's probably 99.9% of cases "fixed" b) the 0.1% people won't be surprised about, because they won't be able to visit it in a browser either
Plus obviously we get the benefit of Microsoft's root CA list rolled out via updates
user895378
^^ That.
user895378
I'm thoroughly convinced that cert management is something PHP should never handle itself.
Indeed. Either the OS CA list is good enough, or the programmer needs to do something, but the language shouldn't ever need to care
I am feeling so ignored
user895378
I'm readying some massive NEWS and UPGRADING file updates ... I had forgotten how many new openssl features there are.
12:44
has anyone ever encountered this problem? :o

$parameter;
if($parameter == 0) {
  //works
} else if($parameter == 'hello') {
  //doesn't ?
}
user924016
?
user895378
@LiamMartens What is the expected $parameter value?
user924016
probably null
user924016
hehe
user924016
right, and what's var_dump(null == 0); give you?
actually to be fair, this is one of those principle of least surprise violations that PHP is good at
bool(true)
Since 0 == 'hello' but null != 'hello'
I already solved it though
but I was suerprised it didn't work
user895378
@DaveRandom do you want me to give you a heads-up in a little while after I merge the reneg limiting code to 5.6 (so you can pull that into your branch)
user895378
12:47
?
( oh and it is also when I give a value to $parameter
user924016
Then you should read the link i gave you.. =]
user924016
there is a difference to == and ===
I opened it @RonniSkansing
@DaveRandom Aha, but null == (unset)'hello' :D
You just have to use the right cast, that's all.
heehee
user895378
12:49
I always forget about the (unset) cast
MGE
MGE
Hello, I have a problem with PLACEHOLDERS: pastebin.com/T6kfFRyi
user924016
.. the unset cast
MGE
MGE
Invalid parameter number: number of bound variables does not match number of tokens
user924016
=]
@rdlowrey (unset) completes me ;-)
12:50
@rdlowrey Please, yes. Although I don't think there are any conflicts there, I've refactored some of your stuff a little (although I'm still not totally happy): github.com/DaveRandom/php-src/blob/windowsPeerVerification/ext/…
@Jack PHP really needs a (wtf) cast
$var2 = (surpriseme) $var1;
(unset), the cast that all the other casts make fun of. #php
related ^^
MGE
MGE
sorry, error of mine
@Jack it's an ancient feature, isn't it?
@Jack wait... unset is actually a cast? O_O
holy mother of all things, it is :O 3v4l.org/2qF5h
@Ocramius waked? :D
12:56
Yeah, I didn't read backlog :)
it's since PHP4, I believe ..
@Ocramius wondering why it isn't called (null)
Btw
Woohoo! @naderman fixed https://github.com/composer/composer/issues/2690 ! #composer #security /cc @padraicb
not happy with what happened (and publicly), but at least the hole is covered now
@rdlowrey Have you got a *nix build of improved-tls-defaults readily accessible? If so, can you tell me the exact error output you get when you try and fgc a URL with an untrusted cert?
user895378
fgc?
13:08
file_get_contents, whatever, just a stream
user895378
oh, sorry :)
user895378
sure.
user895378
I think it's just the internal openssl error message
user895378
one sec
@Petah I've been around. And will be. Just haven't been much during the day
13:10
I know, I'm just trying to work out which message it should be (and which error code I should set on win)
user895378
Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in php shell code on line 1
user895378
@DaveRandom So you probably want to spit out whatever error message you get back from windows if possible
Oh, right. Well fuck knows what code produces that.
user895378
Well TBH an error message of your own construction might be more intelligible anyway
@rdlowrey Maybe, but I get Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: error:14092105:SSL routines:SSL3_GET_SERVER_HELLO:wrong cipher returned in Command line code on line 1 spit out anyway
So I figure I just need to set the last error to the right code and output will be consistent.
13:15
@bwoebi because
@ircmaxell it's always because pre-php-5.3 -.-
not always, some stupid stuff still gets proposed...
Yay! finally some sanity in that post: news.php.net/php.internals/72730
@ircmaxell proposed, yes… but does it make it in? not really…
/me is off to work, laterz
user895378
13:33
@ircmaxell later
user895378
@DaveRandom can you see this bug report when logged in with your php.net username?
user895378
I'm trying to ascertain if "private" bug reports are private to the user that created them or to anyone with a php.net login
@rdlowrey No
user895378
Ah okay. I won't be creating bug reports that way anymore :)
@rdlowrey No it's definitely more complicated than that, there's a security team or something who can see them
user895378
13:35
Do you know if they become public once closed?
user895378
i.e. when I submit a PR and reference the bug ID will people be able to see it once I close the bug after the merge?
@rdlowrey Someone has to make them public I know this because of the recent thread on internals started by @Jack (like last 3 days?)
Ugh, I think I'm going to have to get the name from the cert and then get windows to verify that the name on the cert matches the name on the cert in order to get CN_match to work in a sane way :-(
ThW
ThW
Good Morning
Guten Morgen
Is the CN field mandatory or is it possible that you'd get a valid cert with just SAN populated @rdlowrey @Jack ?
user895378
13:41
@DaveRandom You have to have a CN
user895378
But since you have to check both either way it doesn't much matter
OK, at least that makes it not completely impossibru
user895378
And you have to check SAN first
user895378
we have two functions for that (which you probably know)
@rdlowrey Doesn't really matter, php_openssl_apply_verification_policy() handles that
Bare in mind that what I'm doing doesn't replace that routine
(I don't want it to anyway, otherwise I'll have to re-implement the whole thing)
13:44
@Touki I had to use doctrine.orm.default_entity_manager
But because of the way the cert purpose verification works in Win I have to supply the name to validate against, even though we validate that manually with the wildcard pattern. So I'm just going to pull the name out of the X509 and pass that to Win
@Gordon That's odd. Doctrine creates an alias for this service. I don't know why it didn't work!
But fine if it solved your problem!
@Touki yeah
user895378
@DaveRandom I haven't tested yet but I assume err = SSL_get_verify_result(ssl); will be X509_V_OK if you SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); in windows and then you can launch into your win-specific verification routine inside the switch
user895378
it needs a little refactoring to work with win but shouldn't be too bad
13:51
@rdlowrey No we don't need to call the verify routine, we're replacing OpenSSL's native routine. In terms of flow and how it relates to that line, this code is the routine that generates the value of err
user895378
@DaveRandom yeah I get that, but we still have to use the verify callback in conjunction with telling openssl not to verify the certificate itself because we're handling that manually
user895378
Anyway, not important. Easier to just do the code instead of trying to relay what we mean in chat :)
@rdlowrey No, we still tell OpenSSL to verify the cert. The difference is that this routine gets invoked when it performs the verification
I just worked it out; I drink 7.1 liters of Red Bull a week.
@DanLugg Sounds healthy
13:55
I actually feel pretty good most of the time.
@DanLugg Man, I'd be wired through the friggin' roof. I would literally be bouncing off the walls
Mostly because of my full-body rubber suit, but still.
^^ @cspray on a Wednesday afternoon.
I try to avoid energy drinks. I personally find I become dependant because when I stop drinking them there's a big come-down. After a few days of avoiding it I go back to normal.
@Fabien I'm dependent because of routine, but on the weekends or other time where I'm out of my usual schedule, I don't often drink them.
Energy drink > coffee, for me, these days.
13:58
You know what's a good alternative to energy drinks? Exercise... seriously.
user895378
@DaveRandom I'm pretty sure that if you tell openssl to verify the cert it will fail. The CA stuff is done internally by openssl based on the cafile and capath (which can't use the windows cert store)
user895378
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback); <-- non-win
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_callback); <-- win
@Fabien I know, I remember those days :P
@Fabien Oh, I agree, but it's harder to get a treadmill in my office than a case of Red Bull.
Don't say it like it's the past :P
user895378
13:59
^ That way you still have the verify callback invoked and you take a different path inside of it to do the manual verification if you're in a windows environment
good friday morning!
They are tasty though. I used to really enjoy an ice-cold energy drink when i first got in to work on a hot day.
@rdlowrey You're still thinking in terms of how the default verification routine works. This is replacing all of that. See github.com/DaveRandom/php-src/blob/windowsPeerVerification/ext/…
@reikyoushin You just reminded me:
Feb 14 at 3:32, by Dan Lugg
Feb 7 at 5:00, by Dan Lugg
Jan 31 at 12:54, by Dan Lugg
14:01
All that CA file/path stuff is dealt with in the routine that this is replacing, hence we only replace it when those options are not specified
user895378
@DaveRandom ah, okay, I see what you're saying now :)
@DanLugg =p
Hard to believe it's been a month already.
Since?
My Friday quotery. ^^
14:06
@DanLugg that would be funny if it was different people quoting one another. Now, it's sort of sad, actually.
Get in on it then! ...but you have to wait for next Friday now.
user924016
I like it
@rdlowrey Yeh it's quite hard to wrap your head around, I only this morning managed to properly understand that it didn't also need the verify_callback
user895378
@DaveRandom I'm looking forward to playing with your windows branch now!
user895378
That sounded vaguely sexual.
14:07
hehe
@rdlowrey You dendrophile.
user895378
lol
damn it I just actually lol'd and now everyone's looking at me
user895378

Dendrophiliacs Anonymous

4 mins ago, 1 minute total – 7 messages, 4 users, 0 stars

Bookmarked 9 secs ago by rdlowrey

3
oh good lord
14:12
lol
user895378
@ircmaxell Do you work in the google building down by the high line? Or somewhere else?
@rdlowrey Yup, 16th and 18th
user895378
Cool :) that's a nice area
yup :-), and it's an awesome office
Dependency Inversion Principle - can it be said that this can be achieved simply through using polymorphism, so with PHP - interfaces as method parameters?
14:18
Yup :-)
Awesomeness, just doing some slides for my first talk and making sure they're not completely bullsh*t
user1607528
I know it is not a super user chatroom, i open a file in a editor from FileZilla, and everytime I save the file I also have to save in Filezilla, is there any easier way to do it ?
This winter storm is bs.
@Muhammet use Total Commander and F4
good morning room 11
14:24
good morning orange pill user
morning @Orangepill
user1607528
@CSᵠ i didn't know that total commander can be userd as FTP
@Muhammet it's actually very good at it (Ctrl+F / Ctrl+N)
user1607528
So it won't ask me for saving while i save it in editor ?
Even notepad++ has an FTP client
14:28
@Muhammet you can edit remotely, yes
user1607528
@CSᵠ i am installing it now, i will see
user924016
MMmm toast
@webarto why no link to PHP ?
wat.
14:32
dat.
@rdlowrey Why does the verify_host ctx option exist? (why isn't it part of verify_peer?)
@webarto "let's build a robot to fetch me beer" ftfy
user895378
@DaveRandom Because bug 47030. It's useful to allow separate peer and host name verification (as allowed by curl).
user895378
By default both are verified.
user895378
But you can disable either/or/both.
14:36
@rdlowrey Ahh OK, so it used to be part of it?
user895378
Yes. Previously you had to do both or neither. Now you can do only one or the other if you like.
OK good, I though I was going crazy
@rdlowrey Have you got the address of a public server with an untrusted cert?
user895378
@DaveRandom let me fire up an aerys one that you can test against. One second.
user1607528
@CSᵠ how to change the default editor notepad, when you press F4
@rdlowrey Could do with a self-signed, if you have one
(yes I could do this myself but I am lazy :-P)
user895378
14:44
user895378
That one's not self-signed
user895378
The host name matches but obviously the CA I created to sign it won't be recognized by your client.
Firewalled? Getting RST
user895378
woops. I killed it with ctrl+c
user895378
Try again.
user895378
14:45
I can setup a self-signed cert later if you like
Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in Command line code on line 1
Warning: file_get_contents(): Failed to enable crypto in Command line code on line 1
Warning: file_get_contents(leviathon.homenet.org): failed to open stream: operation failed in Command line code on line 1
leviathon.homenet.org => Fail
We have a winner
user895378
Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown in /home/rdlowrey/dev/php/Aerys/src/Aerys/Server.php on line 417
user895378
Two-factor verification!
user924016
Ding ding ding
@rdlowrey Is that my client telling your server why it's binning the connection?
user895378
14:48
Yes.
winner
user895378
That cert required a CA to sign because I was using it to test ECDHE ciphers (which can't use self-signed certs because DH is not a signing algo). That cert should allow you to test your support for "verify_host" => true with "verify_peer" => false because its CN matches the host name but the signing CA isn't trusted.
Mornin'!
@rdlowrey Yep, works :-)
user895378
sweet
user895378
14:53
@Sean morning
(although I would expect it to, I haven't technically touched any of that, it's just SSL_VERIFY_NONE)
user1607528
I started not liking sublime text
user1607528
maybe go back to npp
@rdlowrey it is reasonable to assume that the text extracted by cert_name = X509_get_subject_name(x509_store_ctx->cert); cert_name_len = X509_NAME_get_text_by_NID(cert_name, NID_commonName, buf, sizeof(buf)); will be UTF-8?
Presumably it should just be ASCII, I guess names on certs are Punycode encoded?
user895378
IIRC there are openssl functions that will return an ASN1 string from the cert and then you can ask that structure specifically for something in UTF-8
user895378
14:57
Let me check
Because windows is windows it wants the name as WCHARs (i.e. UTF-16)
Still, at least it's UTF-16 and not fucking ANSI
If I ever meet Lester I'm going to confiscate his question mark key
> That PHP supports the range of platforms that it does with the flexibility that it does creates it's own problems?
That is not a fucking question!
> that it does
^^ Stahp.
user895378
@DaveRandom I just got a SSL3_GET_CLIENT_HELLO:wrong version number ... did you try with one of the specific protocol methods? or is that someone else?
@ircmaxell Thanks for yesterday, by the way. I assigned the properties to a variable and performed validation on that instead; worked like charm!
@rdlowrey That's someone else
user895378
15:03
:)
user1607528
Notepad++ FTP is awesome
@Muhammet Eek. It has... uh, problems sometimes.
@Sean :-D
Let's just say it borked a bunch of work on me in the past; can't recall the exact circumstances, but I've since stopped using it.
user895378
@DaveRandom I think you want to use X509_NAME_get_index_by_NID (check examples section) then you can use the X509_NAME_ENTRY utility functions on what you get back
user1607528
15:06
@DanLugg i used filezilla+ suublime text since today, and working on NPP right now
user1607528
Filezilla's asking for saving permission was annoying
What should be on this canonical list by the way? Staple PHP questions that the young'uns ask?
@Muhammet Integrated FTP is a nice idea, but I've seen it fuck too much stuff up in practice. The explicitness needed in using separate applications is much "safer" I've found.
@Sean s/young'uns/everybody
@DanLugg Fair enough! Thanks
user1607528
@DanLugg as they say use it until it screws it
15:10
@rdlowrey Ahh OK I think I got you, may need to address matches_common_name() as well in that case, I borrowed my routine from that (although maybe not, I guess it's reasonable to put that in the hands of the user)
user895378
Yeah I'm not totally sure if we need to change the way the CN is retrieved from the cert or not. That's how it was when I started working with it so I left it that way. But it may make sense to go ahead and update that to be consistent and to avoid any possibility of getting some sort of wank string.
@rdlowrey Heh, I was 100% joking.
user895378
:)
15:28
@rdlowrey Are you aware of/use this - autobahn.ws/testsuite ?
USA. USA. USA. USA. USA. USA.
user895378
@Danack I am, but I haven't used it myself. Was planning on doing so on my websocket implementation in the next couple of weeks. I spent a lot of time making sure I adhered to the protocol so I would be very surprised if I had issues, but I still plan to do so.
user895378
@Lusitanian No spoilers!
user895378
ass. so much for my DVR.
15:30
:D
user895378
It's okay, I'll be able to watch the gold medal game live, at least.
@rdlowrey Apparently it can be used for testing load performance as well as just checking comformance.
@rdlowrey Why can't you watch it live? Starts in 90 minutes and NBC streams it I think :)
user895378
@Lusitanian Oh, I didn't know the start time. Just set it to record. I didn't know if it had started yet or not
Ahh. Yeah it's noon eastern
user895378
15:32
@Danack Cool. Will see how it goes.
I'm primarily pumped because the entire US is going to be united against Sidney Crosby :)
user895378
I'm not particularly optimistic. Canada is beast.
Yeah I think we're gonna get destroyed
I expect Canada to win gold
Hi
in PHP, is there an in-memory server storage mechanism?
user895378
@Lusitanian As long as we don't do what the women's team did yesterday things will be okay. I'd rather lose 15-0 than the way that game yesterday shook out.
15:35
@Purify yes APCU - you have to install it as an extension pecl.php.net/package/APCu
@rdlowrey That was brutal and really depressing.
user895378
:(
Us canadian's are lucky that post saved the goal
yup. oh well.
however, that linesman(woman) should not have been in the way... I really though our ladies had lost, looked like they got out played. their goalie was the saving grace
but if our men play like they did last game, they will lose. they are just all over the place and not an actual team
15:38
That's why it was so disappointing IMHO -- the US outplayed Canada for probably 95% of the game
and lost
and eh the US men aren't all that fantastic
sometimes it all comes down to the goalie's and that is what it came down too yesterday
Yup. But, UNC beat Duke so at least that happened :D
user895378
If we can get to a shootout we'll have those crazy bearded Canadians right where we want them.
user895378
/cc @DanLugg
15:47
changed the time on my clock and saw that =))
hi
has somebody more experience with chef? maybe just a few is enough ...
I'm trying to execute a series of mysql queries, one after one, but it seems the results are unreliable
set the clock back to the past ;-)
16:04
omg omg omg omg omg
15 minutes and counting!
alright, one of my bosses is buying us pizza and drinks for the hockey game... meeting booked so I am not going anywhere :)
Is it just me, or are all the reflection classes named backward? ClassReflection -- "I'm a reflection, of a class.", vs. ReflectionClass -- "I'm a class, of a reflection."
15 mins till what?
Beer ofcourse!
16:15
@PeeHaa :D
@TutelageSystems jealous.
nice :-)
I'm just going to clarify: I'm an terrible atypical Canadian; I don't care for hockey unless I'm drunk and playing it.
(just realized that I musn't be terrible since I drink beer and play) ;-)
This is a drive by chat post: does anyone have a drink right now?! I'm looking at you PeeHaa! I just solved my most complicated PHP problem so far and I'm sitting alone in a shed at the end of the garden, and literally no-one will care, so please raise me a brief toast or hi-five/fist-bump your monitor. I will appreciate it! Normal service resumes in 3.... 2.... 1....
lolwut?
16:20
wollut
@CarrieKendall I just fucking lol'd so hard.
2 hours ago, by DaveRandom
damn it I just actually lol'd and now everyone's looking at me
7 hours ago, by PeeHaa
Note to self: don't drink on thursdays, you're not 20 anymore
^^ But... but... it's Friday now!
It is!
16:24
It's clocking off time on Friday where I am (in my shed), so a drink is fine. Feel free to use the hi-five/fist-bump option if alcohol is inappropriate...Thanks!
NOTE: referring to Friday without the necessary link will likely result in permanent ban/flag/report/death threats
@PeeHaa Drink! Drink like it's going out of style! Drink like the apocalypse! Drink like the bananas are turning brown! Drink like you forgot your shoes in the grocery store! Drink like your kitchen flooded and you're all out of fabric softener!
morning
good morning @NikiC :]
mornin @NikiC
user895378
16:30
@NikiC morning. Question: how much duplication should there be between NEWS and UPGRADING? I have a lot of news items. Should I just go ahead and put them in both places?
@SamCampsall Alcohol is totally appropriate
@NikiC monring
@rdlowrey UPGRADING is for a more general overview
Like, what you think is most relevant to end users
user895378
Okay, so put everything in NEWS. Do high-level stuff in UPGRADING. Thanks.
@PeeHaa Why didn't someone tell me this six years ago?
It makes total sense!
Hi all
16:34
@R.MartinhoFernandes C'mon you're sooooo young. We are all oldfucks in here
Hi Someone can guide me for SSL Certificates
do you need buy different ssl Ftp Server and Mail Server
I have four different sections in my WHM
@gowri certificates are based on domain not protocol
@PeeHaa How old is the oldest regular in this room?
I think it's @Danack
@PeeHaa: Thanks, I was confused, do i need to buy it from the same hosting provider or I can choose some one else
16:40
@gowri You can choose to buy from however you like
SHopping for certificates really pays out
@PeeHaa Woah, 38?
oh thank!
I was honestly expecting more.
user895378
<--- bringing 31 years of unbridled awesomeness to the table.
38 that's practically dead man
16:42
We have some four 40+ in the lounge, the oldest of all being 57.
user895378
For those who care:
user895378
Client-initiated TLS renegotiation DoS mitigation coming to an encrypted PHP 5.6 server near you: https://github.com/php/php-src/pull/600
@rdlowrey noice one
yay, just found an SQL Injection vulnerability in a book :-P
Has my avatar updated?
16:50
@rdlowrey Now supports CN_match, verify_depth and allow_self_signed. I'm going to go ahead and say that it should now support all the required functionality, I haven't addressed the charset issue yet but that should be pretty trivial.
In other words, pending any new pertinent info appearing here, I'm going to call that basically "done"
It may be worth bringing it up on the list to see if anyone else has anything useful to bring to the table
user895378
@DaveRandom Awesome! I'll try to play with it today/tomorrow. Can you plan to PR after that? Once the PR is there we can consult the list for input (I don't want to steal your thunder). If all goes well we should have no problem merging in time for 5.6
@ircmaxell Is that unusual?
Well, perhaps not, but it's my first time ;-)
@rdlowrey OK no worries :-)
SQLi should be the next most common vulnerability after XSS
16:57
Oh @rdlowrey I haven't done anything regarding the whole thumbprint cache thing yet, I figure that needs more planning and general thinking about first though
user895378
@DaveRandom I agree.
let's go Canada!
What hosting do people use in here? I run my own server, but looking for something down the road where I don't have to do anything
17:34
@NikiC I always though SQLi was more common than XSS.
Due to the amount of code I see that still uses ext/mysql
let's.go.USA.
17:48
@TutelageSystems I use a VPS running cPanel, but I'm heading toward using AWS most likely.
@Gordon Thanks! I also feel more and more like "Chef smells under the hood".. However, to much work has been done now with chef ( for this stage ) , I can't turn back and use something other.. Chef was given to me when I started the job
@Gordon Maybe just that database cookbook which introduces the mysql_database resource providers needs to be patched (or not used) .. But I'm unhappy with that.. It should "just work" because I'm doing nothing special...

« first day (1224 days earlier)      last day (3949 days later) »