« first day (1252 days earlier)      last day (3921 days later) » 

13:00
Because the other content is static, and there is no need for it.
OK, so then buy a cert for one domain... ?
one particular subdomain is for API
I want that domain to be over SSL
user895378
You should SSL everything. Doing otherwise is unsafe.
so buy the SSL cert for that domain. I don't see what your question is.
Actually, I'm purchasing SSL certis from godday. It's giving me two options : SSL for a domain, SSL for all your sub-domains.
@rdlowrey SSL for everything is costly :(
it's like 4 times more
user895378
13:03
It's certainly less costly than exposing sensitive data.
@rdlowrey but there is no sensitive data on other subdomains or the main domains.
user895378
Then why do you need SSL?
It's just static text explaining the API.
only one particular sub-domain has the actual API
user895378
I'm not going to argue the efficacy of encryption. If the data is important then encrypt it. All of it. It's a serious security risk to encrypt only part of a domain's content. Doing so makes it trivial to use tools like SSLstrip to compromise the encrypted portions as part of a Man-in-the-Middle attack.
I've www.xyz.com , which is the marketing page for the API ... abc.xyz.com which contains the documentation , api.xyz.com which is the actualy API.
So wouldn't it make sense to just have ssl on api.xyz.com ?
user895378
13:06
Only if you share no links or sessions of any kind between api.xyz.com and *.xyz.com
Yes. There are no links !
So I need to purchase ssl for a single domain ?
user895378
I don't trust you. I don't trust anyone who's trying to avoid the cost of proper encryption.
haha !
@rdlowrey Definitely don't want to have my Doge2048 game compromised =S
@Shivam I lost my house keys, so should I only change the lock to the front door, because nobody can get to the back door?
user895378
13:07
You have my advice on the topic. You should encrypt all of it, but you're certainly free to not do that. Good luck.
@Greg haha.. that was nice !
@rdlowrey thanks for your advice. I would surely reconsider my opinion :)
The question is, why would you not encrypt everything? If it's a matter of a few more dollars per month, you have to question the value of the data you're not encrypting (including any attacks that could be made on your encrypted data).
github is unavailable?!??!
@Greg the answer is, there is no sensitive data on the other sub-domains. They are just static HTML, containing on documentation, nothing else.
@DaveRandom there are cases where the users would prefer it, this is one of them (they are asking for it). But anyways, thanks for the help. I was hoping to find services that did this.
13:10
@CSᵠ yeah, down from here also :(
only*
Morning
monring/.
Well, evening !
@David I disagree with him. Also writing code is pretty different from typing in general. :) We have intellisense, code snippets, etc. It's not 90s anymore, is it?
@ircmaxell morning
13:12
@Leri Yeah I disagree also but I still want to learn. I'll tell you when I can do 120WPM
@Daи Just recommend that they use tor, it's far too much hassle. And no, you probably won't find someone who'll provide commercial support for something like this because of its borderline-legality and tendency to attract people who are up to no good...
@Leri disagree there. I think before I type, so to me things like intellisense just slow me down...
eeeew "intelli"sense
@DaveRandom presume all of my customers are not breaking any laws, and are tech-stupid ;)
If they are tech stupid the won't ask for what you are trying to do
13:15
@Daи Your customers are the NSA? :-P
@DaveRandom haha
they'd probably set up their own
we're too small for that, I'd rather just pay someone
@ircmaxell Depends how you use it. For me it usually reduces keystrokes and time I'd need to open docs or method declaration to see what class/method/property I am going to use does.
@Leri Well, for me, the time it takes for me to cognitively identify which selection is appropriate is less time than it would take me to hit those remaining keystrokes...
@ircmaxell Would you recommend learning to type correctly? I can do 76 WPM right now without looking at the keyboard but I don't do it the "correct" way
Also I don't need to memorize all the names and focus my brain on something more important than method name I'll never use after that project.
13:17
@David I never formally learned. But I can type pretty well now. and at a good pace when I think about what I want to say first...
Hey mate
@ircmaxell The problem is that you try to cognitively identify if selection is appropriate. :)
I'm just going to do 15 - 30 mins a day in 5 or 10 min sections and see what happens after 6 months. I used to work for this guy a C++ programmer and he learned to type since he was was young and he was able to code at the speed of lightning @ircmaxell
We use intellisense differently, imo.
good friday morning!
and WTF
13:20
@Leri no, I try to cognitively identify if the selection is what I'm looking for or not
@David how fast you type is about the most insignificant thing that matters in your programming ability
@ircmaxell I know but it is certainly handy. Being able to type correctly would certainly help with the documentation side of things I would imagine
no argument. But there are far more important things to work on for coding ability
@reikyoushin good morning !
and seriously WTF !!
@ircmaxell I'm not doing the typing to improve my programming but just as an extra skill to have that will aid in programming
13:24
@ircmaxell I hit ctrl + space only when I am sure, word will be automatically written (or I'll just need to hit enter) so I can move to the next statement. I can say I do it almost blindly and I have that in habit now.
@ircmaxell If you have 60 seconds have a go at this 10fastfingers.com/typing-test/english
I got 76WPM with two words spelled incorrectly
For typing I prefer play.typeracer.com
What are some simple approaches to anti-CSRF attacks, using plain old PHP?
@Greg using tokens..
13:28
Damn doss monkeys are at it again at github :(
@David also, that tests the ability to read as much as type. Good tests give you plain text that you can read in one blob, and type from memory
@ircmaxell how about seclab.cs.sunysb.edu/seclab/pubs/acsac11.pdf‎
@ircmaxell What do you mean? Loads of random letters stuck together?
@SecondRikudo No ^^
@LeviMorrison Why allow null then?
13:31
@JoeWatkins We'll see. I'd like to try to do the patch but I'll have to see with time constraints if I am able to.
Off to real world problems. Later
@David no, phrases. that you can read and comprehend (so it's not just type what you see)
That would be tough
@Wes Easy: it wouldn't make it past internals. People like using grep -r 'function x' ./ to find function definitions.
@Shivam yeah, that's another way of doing the exact same thing as my recommendation (just using a proxy instead of in application code)
13:34
@SecondRikudo Empty string, empty array... people use null for empty object. Should they? I don't know but it's incredibly pervasive.
user652649
@LeviMorrison how about then function getDate : DateTime ($strDate){} ?
@ircmaxell Excellent article, as ever.
lol I just found this in a source file with space indents:
> # pep-0008 - Is stupid. TABS FO'EVER!
Looks like to good guys won the fight
13:50
does it make sense to have a settings class?
If you want to do freaky stuff like merging configs in a specific way it can make sense otherwise no imo
what would be a good way to set things needed?
ini?
php
array
included required ?
user895378
PHP arrays! All of the configs!
13:52
Please no ini
@CSᵠ for example
whatever you do, keep the config as php
pls don't start throwing yaml at me
Word
@PeeHaa YAML!
or wait a second, I take everything back
write your config in XML
nooooooooo
13:54
and use XSLT to process it
return [
 4 => 'life'
];
@NikiC gtfo :))))))
@NikiC into PHP, to then include()
@CSᵠ :P
json?
trendy today...
13:54
@PeeHaa well fuck =o(
@salathe GTFO
user895378
Of all the stupid things perpetrated on the PHP community by Symfony zealots ... YAML has to be the worst.
@crypticツ My tab instanlty crashed
i am waiting for somebody to say global vars on bootstrap.. >:)
@rdlowrey Damn, you really hate YAML don't you lol.
13:56
$GLOBALS ALL TEH THINGS!
@PeeHaa *deletes repo and starts all over again* =o(
@PeeHaa you drunk already?
@crypticツ :D
@CSᵠ ;-)
user895378
@Jimbo Yes ... the stupidity of requiring a non-standard extension just to bootstrap an application's config settings is astonishing ;)
I like my YAML configs :( I have noticed little to no slowdown in my applications. I guess if I were writing something enterprise, I would not consider YAML, yeah. PHP array because it's all native. But for my own projects - I like the structure and ease of editing of YAML
13:58
@rdlowrey If using YAML is the worst of all the stupid things that @rdlowrey can think of... that's not so bad.
What about if someone were to write a yaml.so PHP extension? I can think of nobody better @rdlowrey ;)
@Jimbo If you were writing something enterprise you definitely wouldn't be writing config files in PHP.
@salathe What would you do?
^ Genuinely interested
user895378
@Jimbo In the grand Symfony tradition of compiling stupid practices to make them seem less stupid?
13:59
@Jimbo if I were writing something enterprise?
user895378
@salathe Yeah, I mean it's not like Symfony is single-handedly accelerating global warming or anything. Oh, wait.
@salathe I don't mean you personally only, but yeah sure. What'd be the best way forward?
If you want to own in one 2048, you must own in all 2048's http://doge2048.com via @laferrera
@Jimbo all config lives in <insert name of enterprise configuration management tool> and you'll need to use <insert name of enterprise configuration management tool access interface> to get the details.
@salathe Okay, but how would the application retrieve the data created and managed by this tool? It'd have to be an agreed messaging standard, like JSON, XML, YAML... right?
14:04
Mar 14 at 13:43, by Dan Lugg
Mar 7 at 14:15, by Dan Lugg
Feb 28 at 15:17, by Dan Lugg
Feb 21 at 14:01, by Dan Lugg
Feb 14 at 3:32, by Dan Lugg
Feb 7 at 5:00, by Dan Lugg
Jan 31 at 12:54, by Dan Lugg
2
ok.. here's my view, Setting class -> private properties initially set inside the class, -> public getters that return it's property only if conditions met...
Yay! \o/ It works!
@DanLugg That would've taken you way too long. LOL.
> It'd have to be an agreed messaging standard, like JSON, XML, YAML... right?
Heh, no.
@Jimbo It's taken about 3 derp 2 months ;-)
14:05
@Jimbo Haha, good joke. It would be a proprietary message format without specification that was implemented in four subtly different ways in different parts of the system ;)
Haha, legacy ftw then
Ha! @DanLugg, clever :)
That's not legacy, that's enterprise
However, it might be that both terms are synonymous...
Hello, my brain is kinda fried thinking of a solution to this. I am trying to work out the amount of days hours and minutes in a "quotation" calculator I am building. The only Input is the amount of minutes lets say 1000 and the amount of hours in a day which is 9.
Sorry for the math on a Friday :D
@salathe I give you JSONYXAXML
14:09
@Jack JSONYXAXML64
@CSᵠ @PeeHaa @NikiC .. thougths
@StephenWolfe Really? You are trying to calculated the number of days hours and minutes based on minutes?
@StephenWolfe 1000 minutes / 60 = 50/3 hours. 50/3 / 9 = 50/(27) total days if I'm not mistaken.
@Greg :-)
not always... thank daylight savings time and leap seconds...
@ComFreek But when you divide by 60 you are left with a .point
14:11
oh no :(
Rounding?
@CSᵠ I'm having difficulty seeing the use case
@PeeHaa It's probably Friday ...
I want to have an output like " 1day 3hrs 10mins"
So that would be "12hrs and 10 mins
or 730 mins
@StephenWolfe 730 is your input, right?
I don't want to see the quotations coming out of that system ;-)
14:16
@ComFreek In the example above
@PeeHaa well its an efficient way to quote on a job.
@StephenWolfe I could reproduce your output values with these formulas:
@ComFreek the formula above?
wait please :)
sorry :(
var hours = inputMins / 60
var days = hours / HOURS_PER_DAYS
var totalWorkDays = floor(days)
var daysLeft = days - totalWorkDays
var hoursLeft = floor(daysLeft * HOURS_PER_DAY)
var minutesLeft = (hoursLeft - (daysLeft * HOURS_PER_DAY)) * 60
Those do not take any daylight saving times into account.
14:22
@Wes After the parameter list is a pretty common convention in functional languages. If you have a lot of parameters in your functions I don't feel sorry for you anyway ^^
Btw, any thoughts on hacklang.org ? (Sorry if it has already been discussed)
@ComFreek As you can imagine there has been a lot of discussion ^^
@ComFreek what does floor() do ? but that does look like the logical solutions
@StephenWolfe php.net/floor
user652649
@LeviMorrison i don't usually have lot of parameters, but variable names and class names may be lengthy
14:24
3.4 --> 3; 3.8 --> 3 "it cuts the part after the integer"
@LeviMorrison I always come late to the party -.-
@Wes Maybe you are confused; class names won't influence the position at all?
@ComFreek thank you
@rdlowrey Start a blog you noob
user652649
@LeviMorrison type hinting
+1 @Jimbo
14:26
@Wes Oh, I see what you mean. The type hint name could be long.
Hilo. Anyone here going to use Facebook's hack language?
or will it go the way of Dart?
lol
user652649
@LeviMorrison protected function getData(MyVeryLongClassName $param, MyVeryLongClassName $param, MyVeryLongClassName $param, MyVeryLongClassName $param) : MyData{}
Yeah, I can understand that. But it's a common notation to put it after the parameters.
@LeviMorrison And if you're in functional land, there's currying anyway.
user652649
i know, but it's possible also before the parameters, like in java :P
user652649
14:28
not that java is religion xD
haha sorry for bringing up what was already brought up
@Wes There are two conventions I know of: before the function name (not an option here; it's been proposed in the past and shot down) and after the parameter list.
So I'm going with the latter.
user652649
have you thought of future improvements? like
private $myvar : integer;
private MyClass $myvar;
private $myvar = 10 : integer; // ?
user652649
@LeviMorrison no probs, still better than writing it in the phpdoc xD
Yeah, I want to extend optional static typing to more things as well.
14:35
Who is actually making this Hacklang and HHVM? I'm guessing no one from PHP team?
Webarto, have you been kidnapped?
Seriously? Are you that out of the loop?
user652649
who's the traitor? :P
@webarto Facebook
Yes, seriously, I get distracted on daily level by unimportant things so I just "turned off".
Someone got to pay for the Porsche :P
Yes, facebook, of course, but they don't consult or anything with PHP people except through Sara (if)?
What I wanted to say, they don't give a funk about PHP people?
user652649
14:41
i wonder how they did with scalar type hinting... what happens if function doSmt(float $floatVal){} and doSmt(10) ? someone tried?
fatal error
@ComFreek Hi I am trying to work out why a "-" sign is coming up in the fomula. Can you see why.pastie.org/8956606
@Wes They do no implicit conversions.
@ComFreek this is the result Days:1 Hours:7 Mins:-40
user652649
@LeviMorrison what you guys think about this? maybe that's what people want most of time
14:47
I like no implicit conversions. It would be a hard migration path for many users to do so though.
One test case, 95% coverage .. I like :)
@StephenWolfe here's a better way, using modulo: 3v4l.org/fphd8
@ircmaxell Thanks, Woo I haven't spoke to you on this forums for a few years
user652649
@LeviMorrison it looks to be the most sensible way to do this btw. the only exception is that float / int ... in that case i would prefer an implicit "juggling"
user652649
or doSmt(number $number) ?
14:56
I am definitely not proposing stricter type rules or juggling at this time.
user652649
so what? nothing? xD autoboxing? magic methods?
@Wes well, for int->float, yes. for float->int, no unless no loss of precision occurs. At which point why not have "1"->int. And then all of your runtime optimization posibilities about generated code disappear
since a float is a float, and an int is an int, and no juggling happens, code can be simply generated at the machine level that doesn't need to worry about type, it knows it will always be an integer
user652649
@ircmaxell yes i meant just int -> float
hey @ircmaxell I've been reading over your CSRF article and I'm confused on one thing. Why would you create a new token for every form & request? If a user then visits 1000 pages without submitting any forms, they will have 1000 valid tokens which is 1000 times less secure than using a single token for the whole session?
@Greg it's not 1000 times less secure.
15:08
@ircmaxell good, but my tiny brain can't work out how :)
namely, because an attacker can't guess one of the 1000, due to them being strong random numbers
if an attacker can't guess one of the 1000, due to them being strong random numbers, surely the attacker can't guess the one-per-session either?
(I think I'm missing something fundamental)
and since you invalidate the token on submission, replay attacks (where the attacker replays an old submission) are not possible
with a "one-per-session" token, there is no defense against replay attacks
Do you invalidate all of the non-used tokens for a particular form when a valid token is received? If not, we stop that 1 replay, but we still have 999 valid tokens out there for that form.
You don't need to. You can...
15:14
So if I don't, a direct replay is protected against, but the hacker still has access to 999 valid tokens, surely?
if the hacker knows them, yes.
So my question is, how is using a new token per form/request any stronger than just using 1 token for the whole session?
If the hacker can't access the 999 tokens (because they are strongrandom numbers), then he surely can't access the 1 token, etiher?
And surely he wouldn't be able to execute a replay attack in the first place?
This discussion is going in circles :) he just mentioned something about replay attacks.
compromising the current token only effects a single request in the nonce pattern. In the once-per-session pattern, it will effect all requests
@ircmaxell understood, but if hacker compromised any of the other 999 tokens that haven't been submitted, they would still be able to submit the form.
15:20
@Greg yes, but only exactly once
it limits the attack surface
and in practice you shouldn't have 999 tokens.
why are we talking about csrf tokens as being a defence against hackers btw? seems a bit stretched.
@Jack because, internet.
@ircmaxell Brilliant, I understand the benefit here now.
Thanks for your help in understanding this.
hi
@LeviMorrison anywhere I could be useful for mothership?
@webarto Think of some useful examples; I don't like foo when possible.
15:46
@ircmaxell Second one, maybe only because it's a change.
thanks
@LeviMorrison Noted. I see Hacklang copied the PHP docs, hah :)
You look like a Russian mobster.
I know you're of Italian ancestry.
@igorw where art thou?
16:03
My mate had an elephpant as the php logo in the top left of php.net
I refreshed his cache, now it's gone
:(
Only in firefox, no chrome
@JoeWatkins this is what I was talking about, almost identically: youtube.com/watch?v=f6kdp27TYZs
hi guys :)
quick question: select nodes with XPath that have node_name_1 or node_name_2
SELECT SUM(`SI_Paid_Amount`) != `RG_Total_Paid`,`SI_Reg_No` FROM `student_installments` LEFT JOIN `registrations` ON `registrations`.`RG_Reg_No` = `student_installments`.`SI_Reg_No`  GROUP BY `SI_Reg_No`
can i use SUM(SI_Paid_Amount`) != `RG_Total_Paid`` in the where clause ?
@samitha Nope
any alternative ?
16:15
SELECT SUM(`SI_Paid_Amount`) paid_amount, ... HAVING paid_amount != `RG_Total_Paid`
@samitha
RFC Draft: Return Type-hinting. Please provide feedback.
9
@LeviMorrison not nearly long enough
and that's serious feedback
Sure, I agree. It's still a draft ^^
it's been tried enough times, that it really needs to cover all of the discussions from prior iterations
The fatal strokes of previous RFCs (in my mind, anyway) are that they tried to change type rules at the same time and screwed up the really easy "function foo" search idiom for function definitions.
16:19
perhaps
I mention these in the RFC, but it's fairly short as is a non-discussion ^^
I know I need some more examples.
and copying Hack syntax isn't the worst idea ;-)
Well, it's a common syntax for return types.
Was about to say that... what happened to previous drafts/RFCs?
The fact that hack has it isn't bad, I agree ^^
16:20
Well, but there are a lot of them, but the fact that Hack has it is actually a good thing
if it wasn't for that, I'd say "get rid of the :"
Yeah, that's syntax from functional languages that follow mathematical notations.
Not sure why it is necessary, but several languages have kept it.
No need to be needlessly different.
function YOLO() :
endfunction;
Good thing this doesn't work.
@LeviMorrison I know, but it's a superfluous token. You can do without it...
Jay
Jay
Can do you make it so it you swiped a table TR on an iphone a js alert popups?
@Jay Totally not appropriate room for you to be asking this.
16:24
@ircmaxell Sure.
Why would I be getting a "PHP Fatal error: Class 'finfo' not found in ..." error?
I thought this was a standard class.
does anybody certified in MYSQL ?
@samitha Certified or just plain knowledgeable?
Certified From Oracle
16:27
I haven't met anyone to date.
@Hamster no, it's available as an extension
@salathe Hah!
@ircmaxell Besides examples and links to previous discussions, what other content would be good to add?
@LeviMorrison Some use case justifications, some pros-and-cons. Some of the issues raised by prior discussions, and your take/resolution on them
16:40
@ircmaxell I'll take a look at that later on ...
Btw, Joe, I updated the return type-hinting quite a bit. I'd love your feedback.
I'll read that too ...
LEAVE JOE ALOOOOONEEEEEE
Joe, you've got to supply me man, I'm losing it.
> PHP Fatal error: Uncaught exception 'Exception' with message 'DateTime::__const
ruct(): It is not safe to rely on the system's timezone settings. You are *requi
red* to use the date.timezone setting or the date_default_timezone_set() functio
n. In case you used any of those methods and you are still getting this warning,
you most likely misspelled the timezone identifier. We selected the timezone 'U
Fuck you seriously
16:46
it's a fatal?
Derick::FUCKS_GIVEN++
Ahhh, error exceptions
> Parse error: syntax error, unexpected '++' (T_INC) in Command line code on line 1
(you just tried to increment a constant! :-( )
Sad part is that I actually doubted would that work and tried it out.
Incrementing a constant… that's retarded :-P
16:51
Potato!
@salathe Ahhhhh
I need to add Reflection information as well
@LeviMorrison Regarding those "nullable" type hints, many built-in PHP functions (strpos, substr) return FALSE instead of null in case of errors. Just wondering whether you should also take them into account...
Nope, not going there.
I'm not proposing that we go through the php core and add this return type info to the functions.
I don't want to support multiple return types.
If you have multiple return types then simply leave off the type-hint and get the current, dynamic behavior.
That is worth noting in the RFC though; thank you for bringing it up.
Hey everyone. I was just updating everything with composer and when it started installing JMS/SerializerBundle it asked for my github credentials, is this normal?
I was installing 0.12.0 build
16:59
No problem :)

« first day (1252 days earlier)      last day (3921 days later) »