« first day (1271 days earlier)      last day (3899 days later) » 

18:00
^^ "If you crash a truck, I will thank you for doing it. Because it was you, not me"
;-)
user895378
Yeah. Just by way of example ... one of the first SAN name matching commits I did for 5.6 had a null-byte poisoning vulnerability. If you constructed your malicious certificate correctly you could have convinced my code (PHP) that the cert was valid for any domain of your choice.
user895378
Now, I caught and fixed it within a week or two (and this was obviously months before the 5.6 release), but still ...
user895378
Things happen.
No one would thank you, you would be denounced.
none of this tells me what distro is not a waste of time to install tho does it ?
18:03
anyway, I hope you found the lecture to be useful, @crypticツ
.. if a bit frightening
user895378
> Red Hat and Ubuntu already have issued patches for the vulnerability.
user895378
@JoeWatkins Supposedly if you do a clean install with latest RHEL you'll be fine.
but they totally haven't ... or it's not obvious anyway
but i installed 3 weeks ago
and just requested an update and get a buggy version number back
user895378
google is failing me ... I'd expect "rhel heartbleed" to actually show something useful
user895378
@JoeWatkins If you can expose a port through your router you can run an openssl test server and toss the IP address into one of those "checker" sites.
user895378
18:05
I can post instructions for the openssl server (just a command) if you like.
do it, please
user895378
@JoeWatkins Do you know how to quickly generate a cert to use for your server or should I post a file in a gist you can download?
make it easy, assume I'm just a fancy monkey ... because I am :D
user895378
k
user895378
18:13
@JoeWatkins Okay, you'll need two ssh tabs open
user895378
That downloads a cert
user895378
Second line starts a server
user895378
It'll ask you for a passphrase for the cert
user895378
Type:
user895378
18:13
"42 is not a legitimate passphrase"
user895378
(remove quotes)
user895378
You'll now have an encrypted socket server running on 127.0.0.1:4433
user895378
Actually, use this server command:
user895378
openssl s_server -tlsextdebug
user895378
Then in the other tab:
user895378
18:15
openssl s_client -tlsextdebug -connect 127.0.0.1:4433
okay, the monkey did it ...
user895378
As long as you don't see the following text in the debug output of either of those windows you're safe:
user895378
TLS server extension "heartbeat" (id=15), len=1
:(
[joe@localhost tmp]$ openssl s_client -tlsextdebug -connect 127.0.0.1:4433
CONNECTED(00000003)
TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "heartbeat" (id=15), len=1
0000 - 01                                                .
depth=0 C = US, ST = XX, L = Anytown, O = N/A, OU = N/A, CN = localhost, emailAddress = [email protected]
user895378
Actually, that may not be the best way to test.
user895378
18:17
Because I assume they just patched it so the heartbeat extension is safe now.
user895378
Do this instead:
user895378
openssl s_server -www
user895378
And open port 4433 in your router and point it at your box
do what ?
user895378
openssl s_server -www <-- fires up an https webserver on port 4433
18:18
forward port 4433 to my box from router ?
user895378
Yes.
user895378
Because then you should be able to put your {$ip}:4433 into a tester form to tell you if your server is vulnerable.
user895378
You know what, I'm sorry. That's probably way more complicated than necessary.
user895378
Just follow the instructions here: blog.matthewdfuller.com/2014/04/…
this is a shit router
user895378
18:21
openssl version -b
user895378
If the date isn't older than "Mon Apr 7 20:33:29 UTC 2014" you're fine.
so build date is enough, got it ...
user895378
Yeah ... this is why I said "distros patching existing versions" is kind of a confusing solution.
well that only tells me what is the openssl version in use, not what everything else that relies on openssl is using ..
But pre 1.0 versions are safe
(from that bug, at least)
18:22
if it's static then it doesn't matter what version I'm using ...
built on: Tue Apr 8 00:32:22 UTC 2014
so looks like I am safe then ...
but only the openssl package ..
I should search for static linkage shouldn't I ?
user895378
Probably.
user895378
It would be nice if distros would publish resources to tell people exactly how to deal with the issue.
okay, so can you give me the name of a function that is only in affected versions ??
So I've been playing with Hack today.
A few things worth sharing:
user895378
@JoeWatkins You mean an OpenSSL function?
18:25
because I have no idea how to search for static linkage without the name of a function that is only in affected versions ...
yes
@LeviMorrison None? :)
$v = new Vector<float>(); //doesn't work
or is there a version struct to be found in openssl ?
For whatever reason you don't say the type on instantiation.
@Levi Why, that's seems extremely backward ?
18:27
I am not sure.
when do you declare the type ?
On definition only.
Damn G500 mouse has a downside when the drivers suddenly stop working. Mouse flying about all over the place.
This makes it (mostly) useless outside of class internals.
that's surely just an oversight ...
18:28
Hopefully just an initial launch limitation, yeah.
> 7ft5 Tacko ‘Taco’ Fall Might Be The Tallest High School Player In The World
WTF were they feeding that kid
Guy doesn't even jump more than 3"
user895378
@JoeWatkins Here is the relevant commit fixing the problem: github.com/openssl/openssl/commit/…
user895378
Probably best to use that as a basis if you're looking for affected static linkage
user895378
> It's the biggest security vulnerability in the modern crypto age. Sysadmins everywhere are scrambling to renew keys and certs.
user895378
18:33
@JoeWatkins Another thing to look for:
compiler constants
user895378
Though that will trigger in newer "fixed" versions
user895378
OPENSSL_NO_HEARTBEATS
well nothing can be linked to the new version I installed it a few minutes ago
user895378
18:34
^ Though that won't help you if using a patched version
but they are compiler constants ...
I need a version struct or function name that will be present in the binary
I guess then any ssl function would do
since they would have linked to a known vulnerable version it doesn't need to be a struct any function name that is always present will do
user895378
Basically if it was built before April 7 2014 and it doesn't use the OPENSSL_NO_HEARTBEATS flag it's vulnerable.
user895378
You might be better served to just do a yum update on everything.
user895378
Unless you've built a lot of things manually that use openssl ...
user895378
This is stressing me out.
18:39
@JoeWatkins That's maybe just in partial mode, now that I look more. In strict it seems to be required. Kinda goofy. I'm just confused. I'm not sure of anything anymore.
lol, "Preparable, has 10's of 1,000's of subtypes" <- anyone else catch that?
Hello guys, how I can get the class name that called the static method? for example if I write User::getByID() I want to get "User" in the getByID method.
__CLASS__ ?
@rdlowrey this is quite new buid but I do build everything that trends on github that looks semi interesting, so there's gonna be some of that but yum update should fix the rh stuff anyway and I'l just have to delete everything else ..
18:41
or perhaps self::
The function getByID is inside Queries class and user extends Queries so if I write __CLASS__ it will return Queries
user895378
@JoeWatkins Yeah, this is definitely going to instigate a more organized approach for me in terms of how I structure/organize things I build myself.
User::getByID() | The function getByID is inside Queries class
Wut?
@Fabien User extends Queries so I can call getByID() from User
Sounds smelly.
My vote goes to "Take a step back and look at the whole picture".
18:45
What wrong with that?
Your current predicament is an indication.
I can't make Hack happy in strict mode.
@Loclip Plenty, but get_class($this) will probably get you what you want.
@DanLugg this will not work because method is static, you cant use $this in static method
@Loclip Then you certainly have problems, if that's a static method.
18:52
@DanLugg if you talk about security issues then yes I know I took some measures
You should definitely take a step back and re-evaluate your approach.
No, not security; code maintenance. You are going to send yourself to hell if you keep down the path it sounds like you're taking.
Have we lost @PeeHaa to beer time for tonight?
@DanLugg I think I understood what your talking about but I will not have, all my tables have column id and I will not change this
get_called_class()
You suck at explaining.
@Loclip Yes, you will. You are in for a world of pain. Unless you never intend on changing, touching, or even looking at that code again (or anyone else, ever) then you are "doing it wrong".
18:55
@DanLugg Not late static binding safe me thinks.
@webarto Not static scope friendly, me thinks. But that's a ^^ different problem.
@DanLugg What he's doing generally sucks, so... he hasn't got a problem, he's got f* problems, plural.
^^ All your base.
@webarto you have communication problems, anyway I will do more research about this.But @webarto please go outside talk with people, be polite, too much programming is bad
19:00
I pity thine research!
/me crawls back to basement
In Hack writing $v = new Vector(); reports an error during type checking, you have to do $v = new Vector(null);
Thanks Hack.
@LeviMorrison wait, is the Vector constructor defined with an optional null?
Let's not do that in PHP, please.
It's ?Traversable so I would think omitting the parameter would work.
@LeviMorrison Try Vector {}
19:03
@LeviMorrison ?Traversalbe $foo = null?
? just makes it nullable, it doesn't give it a default value (or shouldn't IMHO)
@DanLugg That's what I was just told.
@DanLugg wait, really? That's horrible
*shrug* I agree, shouldn't need to default to the collection initializer syntax, but w/e
Thank you Facebook.
19:05
I cannot wait to hear people defend that if it ever comes time to do something similar in php ..
@JoeWatkins What, force empty collection initializers?
user895378
So ... who's going to implement immutable tuples for PHP 7 PHP 6? :)
Lucky for @ircmaxell he's a Googler and not Facebooker, otherwise he would have to cope with all the bashing here :D
@rdlowrey Wasn't it 8? :P
So, Vector {} works. It is likely a definition bug in the .hhi file though. Talking with people from Facebook about it.
@webarto cope? that was one reason I didn't
user895378
19:06
Since we have to skip 13 anyway we might as well get all the skipping out of the way now and just jump straight to PHP 14.
user895378
Makes sense because development started in 2014.
@LeviMorrison Maybe not; if the argument to Vector::__construct has no default then you'd have to either Vector(null) or Vector {} predictably.
It might be a bug in the constructor definition (eg: someone forgot the = null).
user895378
And 14 = 7 (the next PHP version) x 2
@DanLugg The former is a recent build fail, is the preliminary conclusion.
we should just jump around random numbers like xbox, have one, then 360, then one again ... then I dunno eleventeen ...
19:07
@rdlowrey To catch up with browsers.
@ircmaxell Sorry, can you rephrase, I'm dumb :)
@JoeWatkins Thirtytwelve!
@webarto I won't go any further in public ;-)
user895378
PHP 98 -> PHP 2000 -> PHP NT -> PHP XP -> PHP 7
9
@ircmaxell :)
@rdlowrey HAHA
Aww, small comic is small.
19:09
@rdlowrey you forgot about PHP ME
user895378
lol
Okay, I now have a fully compliant Hack demo project.
I dunno if there really is any validity to the idea that we should skip any version numbers ...
@rdlowrey PHP CE for hardware limited platforms
@LeviMorrison compliant :P
19:10
^^
Actually, I'm not quite compliant. Need to figure out how to make a fully compliant 'main'.
Fastest way to generate a random string of any given length using ASCII chars?
@Fabien Fastest as in shortest or performance wise?
performance
@Fabien for what purpose
Not sure, "random" is a tricky for what @ircmaxell will say to you.
user895378
19:15
Not the fastest way in the world but you could always do something like this (not safe for cryptographic purposes, obviously):
Security
@rdlowrey #fail :P
user895378
Nevermind.
this isn't for practical use, just me wondering.
user895378
I should've known you were going to say "Security"
19:16
:D
;D
/dev/urandom tr -dc _A-Z-a-z-0-9
also, what level of security, and what level of performance do you need?
Unsure, the question spawned in my head when looking at PitchBlade
Unless it's a batch operation or you have a gigantic service, just use safer.
/dev/urandom can give about 12mb/s of random data. If you need more than that from a single machine, I really want to see your problem case
19:19
heh
I dare to say even what @rdlowrey wrote is better than nothing, I'm guessing Pieter WhoreDick is using it for CSRF token.
Oh man, I hope he shakes that nickname :P
user895378
FWIW I didn't realize the use-case was for cryptographic purposes when I typed that out :)
We know you didn't honey :P
Speaking non cryptographically then. Can I see the code again? :P
19:23
Main page is showing only WP questions for me, I have no luck.
$str = '';
for ($i=0; $i<$desiredLength; $i++) {
    $ord = rand(0, 255);
    $str .= chr($ord);
}
So pretty much the same.
Yup.
Printed out all the characters and it winked at me. ^_`
@Fabien that should be fixed at some point, that's not good
19:27
tag @PeeHaa ^
It doesn't hurt to use RandomLib.
So... I really dislike switch sometimes...
    switch( $type ) {
      case Class::DEPOSIT:
        $class = 'Deposit';
        break;

      case Class::AFFILIATE:
        $class = 'Affiliate';
        break;
Speed I would imagine.
Why not do this with array ($key, $value)?
19:33
@DanLugg if (ord($rand[$i]) > $mask) {
So if you're trying to generate 8 bytes, it may only "generate" 6 valid bytes. So then it needs to generate more. For the sake of efficiency, it just generates 8 more bytes and tries again. So it may over-generate
Yep, gotcha. :-)
I was thinking to thwart some sort of attack on sizing, but *shrug*.
nope...
I ain't no dang-fangled cryptogralizer.
neither am I ;-)
Yea, suuure
19:38
can someone please help with this :stackoverflow.com/questions/22972240/…
It'd be nice to see a version of PHP, let's call it PHP "11", where every feature ever discussed in this chat is implemented, regardless of gross potential for abuse.
@DanLugg CISSP :P
@Fabien Ooh, do I get a sticker when I'm done? I like stickers. Especially ones with kitties. Or dogs. Or hearts. Or stars. I like stars. Did I tell you I like stickers? And sparkles. Ooh, sparkly stickers. Now that would be a treat.
If you're lucky maybe an emailed certificate
Is the certificate a sticker?
19:42
Could've swore they used to have a course on just cryptography.
@DanLugg In case suggestions were contradictory, there's a large bitflags based setting you can choose which ones to activate :D
@DanLugg Bumper sticker
@hakre Yea, finally a use for declare... which may itself be subject to conflict based on other features.
declare double-declare redeclare cestclaire monkeypatch southbox mixin hack-neutral spl-types;
use ticks strict;
has ticks dog;
19:45
apply frontline;
E_FATAL `frontline` not defined
@AnkitLadhania Don't spam.
@DanLugg Be nice, answer their question... dammit!
@dan-lugg i have been struglling with this problem for 2 days.. os please if you can help
I am being nice; "GET THE FUCK OUT WITH THAT HIPHOP SHIT" would've been less helpful.
1 message moved to bin
^ And I didn't even say anything bad :)
19:49
Why can't we get good tv like this
Also, shoes are not furniture.
@DanLugg I think of this whenever someone mentions hhvm... youtube.com/watch?v=N_uhrxJmxwU&feature=youtu.be&t=34s
@Fabien Awesome.
I'm going to make funk for hack for hhvm so I can play this.
Funk > HipHop
Trend of VMs by music genre
Apparently parents are beginning to name their daughters Khaleesi
20:07
Fugesi, fugasi, it's a woozy it's wazzy
fairy dust
20:24
<?ihdmf // instrumental house + death metal fusion
<?idgaf // actually compiles Cobol
@Fabien where have I heard that name?
ghostbusters? some manga? vampire chronicles?
Game of Thrones
ThW
ThW
morning
... oh
Surely you're watching it?
20:28
yeah, now I know
well the actress is quite impressive ... with and without clothing
Emilia Clarke
user895378
@Fabien don't talk about my future wife like I'm not here.
lol
user895378
But seriously, I would shove every one of you bastards into a meat-grinder for a date with her ;)
heh. Khaleesi wouldn't approve.
20:37
@rdlowrey You could shove every one of us bastards into a meat-grinder while on a date with her too.
anyway ... rest of my body is telling me to get a fucking nap
bye
Later
in Teenage Programmers Chatroom, 10 hours ago, by CoffeeandCode
Holy shit, my teacher in computer class today referred to HTML as an advanced form of programming.
@HamZa yeah... no...
Why #heartbleed doesn't leak the private key http://blog.erratasec.com/2014/04/why-heartbleed-doesnt-leak-private-key.html#.U0Wq8uZdUa6
Were we familiar with Heartbleed prior to the announcement this week? Officially, we had no knowledge of any vulnerability by that name.
user895378
@ircmaxell Terrific. Just ... terrific!
20:50
"Officially"
forum.kohanaframework.org/discussion/12509/… <-- made me happy right until the last paragraph... yay
> This package contains a collection of helper components. These helpers are static classes that are completely stateless and have no dependencies.
I think the far more interesting headline is this rant by Theo de Raadt, in which he lambasts OpenSSL for reinventing the wheel ...
@Charles yeah, it's a valid counter-point...
@ircmaxell \o/ static framework
I'm trying to unit test a method that uses a closure to perform a transaction using Doctrine DBAL. Anybody have any idea how I can get code coverage inside the closure? 3v4l.org/NSiPp
20:56
@ircmaxell dude, static is the future!
Don't you know that instantiating objects is slow?
@vascowhite mock the connection object, and then grab the closure from it...
@ircmaxell I am already mocking the object, can you expand a bit?
mock "transactional" to actually execute the closure
ah, OK, I'll give it a go. I could also pass the closure in as a dependency I suppose.
yeah, depends on what you want to do
actually, make it a stub
21:02
@ircmaxell Yes, I was considering that. Thanks for the help.
21:15
> When applications are architected properly, what web framework you use becomes a detail, not a fundamental requirement.
^^ If that's true, you're not using a framework, but libraries. The very fact that it is a framework binds you to their architecture and restricts you from making it a detail
I still prefer frameworks where I can easily take the code out, write a little code and it works again.
I hate frameworks which force a too tight coupling in your code.
@bwoebi then that's not really a framework.
frameworks impart architecture
Hmm… What would you call rdlowrey/Arya? It's a framework, no?
I still find I could easily take out everything (except the router from Nikita), modify code with a bit find&replace and it works again…
it's a router
or a micro-framework at best. Doesn't really instill any architecture at all. More just handles common tasks
the router is NikiC/FastRoute. Then call it micro-framework…
21:28
you can still structure your application however you want, so it's not a framework
@ircmaxell Imposing architecture is what I hate about frameworks… so, okay ;-)
that's why you use it though
so you don't have to think about the architecture
that's the exact benefit of using one
@ircmaxell nah, the framework is just that, a frame. it doesnt say anything about how to architect the application itself.
sure there is some opinions and conventions but its not the full architecture
user895378
So ... if anyone wants to make my life better it would be great if we had a function you could call to disable automatic file stat caching as mentioned in here in #28790 ...
and you can still pretty much f*ck up your archiecture even when using a full stack
21:34
@Gordon sure it is. It inverts the relationship. Your code plugs into the framework. Whereas other way around is your code pulling in libraries
@ircmaxell not really imo - you code your core domain and then the glue between it and the "technical" part that the FW deals with
@ircmaxell i dont think so. Like with Sf2, you can use the DIC and the routing and the controllers and twig and stuff but thats mostly the HTTP abstraction only. I wouldnt say its plugging your code into the framework. the framework just handles one delivery mechanism
@Gordon I'd argue symfony 2 is not a framework
so you have the FW, the core logic where you code without the FW and then some glue
@ircmaxell the symfony standard edition is a framework
it gives you standard locations where to put stuff and places where stuff will be looked up
pretty much a "structure"
@Ocramius structure != architecture
21:37
@Ocramius a frame :)
@ircmaxell architecture is the science of structures?
@ircmaxell architecture is the sum of constraints
it doesn't give you ALL the architecture
it deals with the "usual stuff"
not all of the problems, and it can't do that either (unless you're building a business rule engine :D )

« first day (1271 days earlier)      last day (3899 days later) »