« first day (1747 days earlier)      last day (3425 days later) » 

13:04
Help I tried using PHP but my HTML keeps getting in the way?
a wild krakjoe appears
@Matthcw Eh?
@Duikboot +1
user924016
Hmm.. how would I guesstimate what the cost of generating a password hash should be? One thing is my dev/stage site, but the production site will be more busy/etc .. do I have to test the time of computation on the live site to set a proper cost?
mo info ?
13:10
I'm no expert, but you're meant to leave the cost alone, right ?
someone will join in, watch ...
user924016
=] thx
afaik the cost should not be touched unless you are running on a very slow or very fast machine
even then, doesn't adjusting cost equate to adjusting security ?
@RonniSkansing Assuming you're talking about password_hash, Example #4 on php.net/password_hash shows how to find a good value. And yes, you should get the cost for the production server, rather than dev.
even on a very slow machine, I wouldn't touch it, and on a fast one, you'd have to have a better reason than "it's a fast machine"
13:15
I'd assume that if that script returns a value significantly different from the default (10), you should probably change it, otherwise you can leave it alone.
@JoeWatkins Well yeh but there's an element of UX concern about it. I seem to recall someone saying that you should aim for it taking roughly 500ms to compute
Like, on a really slow server you don't want it to take 10secs to authenticate a user, and on a fast machine you don't want it to take 5ms
But for 99% of people this is not a problem, the default cost should be fine
@DaveRandom Actually, 5ms is already pretty decent
iirc, ymmv etc etc
@MadaraUchiha No because if it takes to little time it potentially makes brute-force attacks more practical
Normal hashing functions' run times are measured in nanoseconds to microseconds
I think that's the main point of the cost
but I could be wrong
13:17
5ms is 6-3 orders of magnitude above that already
is it practical to talk about using such a machine for anything in the real world, how long would it take such a machine to connect to a db server or secure api of any kind ?
But yeah, I generally aim for around .1s for my costs
@DaveRandom You should better throttle requests than increasing the cost IMO, there's no reason to put more load on your server just because it's faster.
@JoeWatkins Indeed. Probably the best advice is just "don't touch it unless you are one of the 3 people on earth who actually understand the implications"
yeah, that ...
13:20
@DaveRandom touch it! what could ever go wrong!!
Maybe something truly horrible will happen, like it will open a portal to the underworld or I suddenly end up working for Apple or something
@DaveRandom dont be so chicken. you got version control!
@JoeWatkins So, I woke up with little more than a headache.
:thumbsup:
@Gordon Not sure git is sufficient to revert Cthulu, but I suppose it's worth a try
I really don't understand the documentation of password_hash()
13:26
@chozilla What do you not understand?
The documentation.
:X
how does it generate a salt for me if it only returns the hash and not the salt? I need the salt to check the password a second time...
@chozilla The returned string contains the salt
@DaveRandom so i have to split it?
It also contains information about the algorithm and cost that was used
@chozilla no
You just store the returned string and pass it straight back into password_verify()/password_needs_rehash()
13:28
so there is no secret there... it is just depending on calculation time to be secure.
ok... interesting i did not get that.
the password is the secret
@JoeriSebrechts yes, but it is the secret and the message.
what you get out of password_hash is basically a token that matches up only with the password that was given, so that password_verify can compare the password against the token
what is in the token is of no importance except to password_hash and password_verify
if (!password_verify($userSuppliedPW, $storedString)) {
    // bail out, user supplied wrong pass
}
if (password_needs_rehash($storedString, PASSWORD_DEFAULT)) {
    $newHash = password_hash($storedString, PASSWORD_DEFAULT);
    // update stored string to $newHash
}
That's the basic flow of how it's supposed to be used
@DaveRandom TIL password_needs_rehash()
13:32
@MadaraUchiha So if you change your algo/cost settings etc you can gracefully update the DB next time the user logs in instead of forcing them to do a reset or whatever
@DaveRandom Yup
Oh fuck, that's supposed to read $newHash = password_hash($userSuppliedPW, PASSWORD_DEFAULT);
(obviously, I hope)
So I guess I don't gain additional security if i add an manual salt inside the functions, e.g. password_hash($userPW . $secretSalt, PASSWORD_DEFAULT);
No, in fact there's a reasonable chance you lose some
the cool thing about those hash strings is that they contain everything you need to know to hash a password for comparing (password_verify), algorithm, parameters of the algorithm including salt, and resulting hash. in our codebase we ended up migrating from an old broken hashing strategy to bcrypt by making the old algorithm just another variant, and implementing an extended password_verify that also implements the old hash algo
13:36
because you can somehow reproduce the matching parts?
so we only have one column of hashes and one code path, for both new and old hashes
@chozilla No, because the salt generation algorithm is likely smarter than you are.
@JoeriSebrechts yes but you depend on the algorithm having no shortcuts.
@chozilla A hash string looks something like this:
ALGO:BLOWFISH---ITERATE:2048_TIMES---SALT:ABCDEF---RESULT:rg2387cyfb2387ry3w7
(Only less human readable)
user924016
@AllenJB thanks.. it is not password_hash but I guess the concept is the same. Thans for the ref and I will do it on production... laters guys.. going home from work now
13:38
password_verify reads that string, parses it, and so knows what algorithm, how many iterations and what salt to use.
are we talking about peppering?
bcrypt truncates at 72 characters, so appending a pepper might not actually help any depending on your password
bcrypt(HMAC($password, $pepper)) might be even worse blog.ircmaxell.com/2015/03/…
@DaveRandom In your example you password_hash the $storedString and not the $userSupplyedPW, is that right?
password_hash() is good enough, the biggest problem in modern web applications is storing plaintext passwords
@ScottArciszewski Am I the only one bothered by that?
@MadaraUchiha there is no magic going on there. so the string is meta + hash
13:41
nope
it bothers me too
@chozilla Exactly
that removes the old salt that was added.
This makes your password store future proof
bcrypt(base64_encode(sha256($password))) -> authenticated encryption library -> final output
13:42
yes i know the pain... had to rehash 5.2 mio passwords once...
Because you can switch your hashing algo or increase the salt arbitrarily midway, and the old passwords still work.
no fun.
if (!password_verify($userSuppliedPW, $storedString)) {
    // bail out, user supplied wrong pass
}
if (password_needs_rehash($storedString, PASSWORD_DEFAULT)) {
    $newHash = password_hash($userSuppliedPW, PASSWORD_DEFAULT);
    // update stored string to $newHash
}
@DanLugg good, good ...
Now how verify doesn't accept the algo, the salt, or the number of iterations
You don't have to provide them.
13:43
@ircmaxell by the way, how do you feel about Argon 2 for password_hash() in PHP 7.2? :)
And if the currently stored hash doesn't meet the current security expectations, you just rehash the user's supplied password, and store that in place of the old hash.
@MadaraUchiha you loose the ability to change the additional hash. yes that i know.
@MadaraUchiha like it is in this systems. you always have users that will not log in again
11 mins ago, by DaveRandom
Oh fuck, that's supposed to read $newHash = password_hash($userSuppliedPW, PASSWORD_DEFAULT);
@chozilla That's true, and there's nothing you can do about that.
@DaveRandom don't worry, I got it before it went to production ;)
13:46
It's not a problem with bcrypt, it's a byproduct of hashing. You don't know the user's password
@ScottArciszewski I sit with Alexander (Solar Designer). Unless some of the GPU hardening features make it in, not really worth while (and infact could weaken things)
@JoeWatkins sometimes it's just easier not to ask
I've realized I don't have a problem with new management, new superiors replacing old; it's when new superiors are put between you and your old superiors that I don't like. When the chain gets longer.
@MadaraUchiha i dont suggest to know the users password. I suggest to have additional rules to remove or disable Accounts after a short transition time between security increase.
@DanLugg I don't mind as long as that makes things better. Which it rarely does
@chozilla You can do that, that's what password_needs_rehash is for.
13:49
also for the old game i worked on i would never use PASSWORD_DEFAULT in case the security level changes.
Force the user to reset their password upon entry, if they haven't logged in in a long time since a security update.
what's even the point of the PHC then?
@chozilla But the entire point being that stuff won't break even if PASSWORD_DEFAULT changes...
@chozilla instead, why not run a migration over the DB to wrap the existing password with password_hash (including a flag that it's legacy).
@ScottArciszewski they focused on the KDF use-case, as well as large-scale password storage systems (where you can have dedicated password servers). They didn't focus on the interactive small use-cases
which is partially why I pay little attention to them
13:51
@ircmaxell hash the password hash? and flag it? so how do I recover from that?
@ircmaxell You can't run a migration, you don't know the password to rehash
Or am I missing something?
@MadaraUchiha compute password_hash($stored_hash, PASSWORD_DEFAULT)
okay, let's start a second PHC for small interactive use-cases then :P
13:52
Oh
Yeah, that's a good idea.
Same algo, so no entropy loss
@MadaraUchiha I think it is ment to run twice.
@chozilla on login, check to see if the flag is set (indicating legacy) and if so pre-hash with the original hash function prior to passing to password_hash. If that matches, re-hash with native password_hash() and store it
@ScottArciszewski if Alexander's changes make it in, it'll be good. If not, we'll likely go with yescrypt
@ircmaxell if you have a system where you have users online 25/7 and you take down the servers to upgrade your security it is possible to kill your system if everyone tryes to rehash there passwords at once.
13:54
I can't wait for this to be a thing
@ScottArciszewski however, it really comes down to what crypt(3) binds to. Because I'm not going to invent a crypt format for PHP, no matter which algorithm.
@chozilla yes, it is possible.
@ScottArciszewski there are some wired timezones involved in 25/7 ;)
@chozilla If you have a system where you have users online 25/7, frankly, you don't want PHP behind the scenes :|
who manages crypt(3) anyway?
13:56
If you're afraid of overloading your server over rehashes, that is.
@MadaraUchiha what do you want then? >_<
@MadaraUchiha the password_hash() function is designed to be slow.
@ScottArciszewski BSD team (the one that ships with BSD, the original) and Solar Designer (libcrypt)
@chozilla It's also blocking which is a different problem.
13:57
ok that sounds sane and reasonable
just need to bug the BSD team then :P
and see which one they're going with
is the random entropy in password_hash() blocking other processes?
it uses urandom
so it doesn't block
@ScottArciszewski Alexander has good ties with them
but if your kernel is stupid and decides to go on strike because urandom is being used, I don't know what to tell you
maybe spin up a VM on your laptop and offload the hashing to it?
13:59
oh pw_hash we will have a lot of fun together.
Neither, I go with the { on the next line
That is for the class methods.
@ScottArciszewski +1
He's talking about the classical functions.
14:01
the fourth option is totally retarded
@HassanAlthaf a) not necessarily and b) why would you write one different from the other?
the only time I leave the { inline is for closures
Personal preferences.
I leave { on the same line for flow control structures though, @Jimbo's way looks really weird to me
14:02
the only reason I leave the { inline for closures is a JS habit, not sure if I'm violating a PSR rule there :P
I really hate the 3 line } else { as well
}
else
{
New line for classes. Same line for procedural.
I think the {-discussion is quite more fun than talking about security. and you all agree right?
so, I recently had to clean up a project from an outsourcing agency (which oursources to India, of course)
every line in a 5000 line god class
was indented 1 tab in
regardless of how deeply nested it was
and they did 3-line } else { too
And it ended with ?>
14:04
Ugh, tabs as well, just to add insult to injury
ended with ?> and two newlines
y'know, to break header()
@DaveRandom I love Tabs dont hate on tabs only because you program in vi >_<
Nothing annoys me more than` if ($condition) {} else { /* actual code here */ }` instead of using a !
expand -t 4 file.php
solves your tab problem
@Sajad No... <?= ?> is a shortcut way to echo something out without having to open the php tags and write the echo keyword, etc. So yes, you can do it with pure php. However, it is not recommended.
if (!!$condition) {} else { /* code */ } perhaps :P
@iroegbu i disagree on line 1 and 2
github.com/paragonie/halite_cookie <- this is basically my code style
(probably the smallest feature-complete example I have)
@Fabor Come on man. At least get the absolute truth in value. if (!!!!$condition) {} else { /* code */ }
2
14:07
What is a Closure? Anonymous function?
lol, you know someone has.
@chozilla you put the curly brace in the same line?
@ircmaxell Precisely.
yes, but not if your inside of a class then it is a new line.
14:08
@DanLugg to be fair, that's precisely the role I'm walking into on Monday
@HassanAlthaf only in php, yes, it's an anonymous function
@chozilla public function foo() ... is in a class
@ircmaxell good luck :)
a function is a function doesn't matter if it's in a class or not
thanks
14:09
posted on July 29, 2015 by kbironneau

/* by JoLabrycol */

NSFW Maybe ^
@iroegbu no, in a class it's a method
I had developers being unable to program because of wrong indents or linebreaks
decent timing @ coding love
14:10
Does anyone know
any good post/video to understand interlaced videos
@FlorianMargaine wait... you are serious?
@ircmaxell Well, my only advice goes without saying: DBAD.
Does anyone know how big files on the client side should be and when it is better to split things like Images up in different files?
I have no advice to offer because nobody in their right mind would put me in charge of anything :P
@DanLugg of course
how implement this: if session defined. I want something like this (but this is won't work): if(!$_SESSION['test']){ // do stuff}
if (!isset())?
Gals,
otherwise you get E_NOTICE for an undefined index
14:17
I think my atlas files are getting to big for the client to have fun with them: s1.darkaura.de/resources/img/map/Entity.png
Anyone of you got a nice portfolio?
I do, it's the accordian kind.
Which I can view for inspiration?
Portfolio around here is usually github
I have a list of CVEs?
I want to do a web based. :P
another one which I will be dropping publicly soon :P
@ScottArciszewski still does not work !
@ScottArciszewski nice site you have man. ;P
14:19
@samaYo No problem.. was wondering why that one got picked ... it's the worst answer there
I want to check that $_session['test'] is defined or not ?
lol thanks, I assume you mean paragon not my ugly personal site ;)
... i will go to JavaScript and ask there... >_<
isset($_SESSION['test']) returns true if it's defined and doesn't have a falsy value
array_key_exists('test', $_SESSION); is another option
@ScottArciszewski s/defined and doesn't have a falsy value/not null
14:22
@ScottArciszewski good !! second way is good !
Bit coin is awesome. :P
Anyone who wants to throw in some bitcoins for me: 1cUJ77U9sPqE6EqFAdkJEEtzfttT4CvZL :)
good morning
Sup Orangepill.
Oh yea, I've been just dying to throw away some of that pesky bitcoin I didn't need. Let me get right on that.
14:27
Just two games more,
And I will have 1 billion winnings on 8 Ball Pool.
@Sherif You being serious? Lol
@HassanAlthaf Oh yea, I was just waiting for somewhere to throw away all this bitcoin. Finally, now I have somewhere!
i lost my wallet key some years ago.
Lol, so you gonna give me em? lol
Yes, I've already picked out the ones that have gone bad or expired. I'm sending them over right now.
What do you mean bad or expired?
lol
14:32
Well, these ones smell kind of funny. I just had nowhere to throw them away.
Thanks to you, though...
lol
I dont have any bitcoins xD
I am new to this stuff
Really? You mean you didn't get your free bitcoins when you joined the Internet?
3
0.00001 something
They hand them to you at the door.
@HassanAlthaf Well, you could always buy a $5K ASICS miner, foot a $10K electric bill, and manage to mine yourself one bit coin in about 7-9 years.
It should be worth at least $50 by then.
I didn't get into bit coins to mine them. lol
Just for online transactions xD
They are like so exp ryt nw lol
14:37
I still have some AOL CDs with bitcoint codes printed on them...
using of 15 if statement is natural in the one page ?
@chozilla lol
@Sajad Depends on what you are doing
@Orangepill then that is not natural !
@Sajad If you can show us some code, we can help you optimize. :)
14:39
Yes, 7.1 is much more natural than 15.
I need 1 if for checking login, 1 if for checking cookie, 1 if for size of a variable (strln()) and ...
@Sherif then 7 is ok ? :)
@Sajad When did 7 become 7.1?
@Sherif no, using of 7 if statement is optimized ?
@Sajad Of course not.
It's not 7.1
@Sajad some people think 1 if is too many
14:41
@ircmaxell ... so complicated for you ...
@Orangepill OMG ! then how can I check stuff ??
@sajad polymorphism and composition
@Orangepill what ? I just use of PHP !
oh wow, the Intel guys are offering patches to PHP now.
lol
and Google allocated a security guy to PHP too
14:43
@Orangepill wtf how do you do it without if? Can you show me some example code converted from if to what you are saying
You know somebody must have done something right if they're interested enough to contribute upstream.
Btw guys,
that's pretty cool ...
Is ther any programmer way to say "I love you"
I've never dated a programmer
or anyone, really
@Orangepill Thanks.
@HassanAlthaf Don't know, but there are quite a few ways to say "I hate you" to a programmer. Give them a book about Java, for instance.
Good morning folks.
Yesterday I asked a question (https://stackoverflow.com/questions/31681597/mockery-doesnt-seem-to-recognize-nested-method-call) regarding Mockery not seeming to recognize my method calls during a test.

I have a method, which is supposed to be called exactly 256 times. Yet Mockery is telling me it's called exactly 0 times. Could anyone explain to me why this is and maybe how to fix it?
14:46
blinks 18 cores
Those things cost $4K a pop. I'm working for the wrong people.
Ahhh. They have finally figured out how Windows can afford to release version 10 for free to so many people. There newest money making strategy
They really should just fire Ballmer
who has 18 cores ?
@TheSerenin Either your naming is bad or your code structure is weird, specifically the method called create(). What is the purpose of the IIPRepository class?
only 8 here
14:51
oh wait, he's not the CEO anymore? Holy crap, how'd I miss this.
He now owns the LA Clippers though
This may seem unrelated but I'm wondering if mockery is getting confused by a weird hierarchy
@tereško +HT ? or 4+HT ?
Then who on earth is releasing all this crappy software now?
@JoeWatkins you should have .. IIRC, you bought a Xeon
I have an AMD chip with 8 cores
14:52
I got 5960X in the end
What will they ever do without the Ballmer Peak?
I want to give to the users that are logged in mywebsite several feature (commenting, voting and ...). now I need to a appropriate algorithm. anybody can give me a reference ?
hm, given struct foo {int something; char bar[1]; }; if I have variable of type struct foo called foo, will foo.bar be the same as &foo.bar[0]? (yeah I'm that stupid)
I wanna,
Make a new fresh StackOverflow account. :)
@DaveRandom IIPRepository is the interface for my EloquentIPRepository (repository design for Laravel) The create() method simply inserts into the database. Mockery however doesn't recognize the function call when it's called through createRange() which calls it 256 times.
14:54
@nikita2206 normally, yes
@JoeWatkins The Intel guy that just sent a PR for opcache
@JoeWatkins how great is your need? I could conjure up someone with that type of specs it it is something implrtant
*if it
@Orangepill I don't get their point?
@JoeWatkins I mean, both of these expressions will have the result of type char * right?
I compile php 40 times a day ...
14:55
@Sherif who are 'Intel guy' ?
@nikita2206 yeah
ok great
I just got kicked out of a clan :/
you will have to qualify that statement, context is missing
@HassanAlthaf the Scottish can be grumpy ...
What Scottish? lol
where does it say he got 18 cores ? @Sherif
I am talking about Clah of Clans.
*Clash
@JoeWatkins in #teksyndicate IRC room .. maybe
@Sherif aha, your mean of 'Intel' is really 'Intel company'
14:57
> Same result using a full load test with http_load on a Haswell EP 18 cores.
He is talking some greek man.
@Sajad I have no idea what that means.
@Sherif nothing !
wow, that's 18 cores +HT (so 36 to most of us)
@JoeWatkins Same for the benachmark results:
> Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz 2x18 cores, stepping 2, LLC 45 MB
14:58
@JoeWatkins Yea, those suckers cost $4K+
mine cost $2k
I remember buying one of thos octocore Xeons about a year back for $2K
Would it not be practical to get a mobo that supports two CPUs and have 2*8?
+HT
So 16 logical cores... I thought that was badass :/
pffft
14:59
that's what I got ... it is badass ...
Clearly I need to go work for Intel to get the real toys
I wanna...
work for..
more would be nice though ...
I'm okay with my Core i7 i7-4790K
that's just too much money ...
14:59
FUCK MAN
that is sick

« first day (1747 days earlier)      last day (3425 days later) »