« first day (1766 days earlier)      last day (3408 days later) » 

15:00
btw, I talked to Taylor Otwell about using Laravel with DDD (and not using the ORM)
@DanLugg I like the proposal. I'd like to know why @ircmaxell withdrew it.
he said that was perfectly fine, and we even discussed that it's okay to mix it up. Use ORM in Laravel situations (like the new upcoming SAAS Laraval Sparks)
Jeffrey Way's presentation mentioned favoring Api over Purity
@Trowski Because internals, IIRC.
any recomendations on hosted e-commerce system to sell physical products?
15:02
@Trowski because no-one wants function autoloading :P
I would think the existing spl_autoload_register function could be changed, with an added type parameter that defaults to AUTOLOAD_CLASS.
@Ocramius I hadn't really heard of coderabbi until this conference
I'm currently looking at his github.io pages, and I'm liking his directory structure recommendations for Laravel
@NikiC thinking more about it, it's, I think (apart from using opcache…) the best one we have.
@salathe Keep those filthy comments to yourself!
I thought he may be "more theory, less action" but he's quite the php developer
15:04
@salathe Yeah, actually we just need composer to include all functions.php files automagically.
@kelunik Which is fine just as long as you're not using the PHP web sapi...
The thing is, class autoloading made sense because there has "always" been a strong tradition of a very simple and clear mapping of class name to filesystem path and one class per file. The same has never been true of functions.
functions have always been a bunch of "helpers" in a file somewhere
@prograhammer I usually code with Laravel in /tmp
:)
@Danack Well, as long as they're generated with composer dump-autoload it shouldn't be worse than the current situation.
15:06
You could technically do without functions and use a static helper class
however, you can namespace a function. why not autoload those? :p
@Ocramius what are the main things you don't like about it?
or are you someone who dislikes frameworks in general?
@salathe A function autoloader could simply include functions.php from the function's namespace. Though that would be up to the implementation, it could easily be a file-per-function organization too.
@prograhammer you should follow twitter, there were riots a day or two ago
Followed by ircmaxell and taylor becoming bffs
I would say there's a strong trend toward this sort of organization, just as much as the file-per-class style.
15:08
@Amelia But you always need a prefix:: then. But right, just put everything in Utils.php as static helper class. ^^
@kelunik I have an idea for standardising php's function orders: use stdlib; to import a standard set of functions into the current scope. backwards compatible. Never getting through internals :p
@Amelia Sarcasm? From what I saw I don't see how that would be possible.
@Trowski they made up, but sarcasm entirely intended
Is it possible to break this up? `<li>a</li><li>b</li><li>c</li>` so that it's echoed from my DB as:
`<li>a</li>
<li>b</li>
<li>c</li>`
?
@Amelia You don't even need use stdlib;, all standard functions are already available. :P
15:11
@Amelia I came into the Twitter world late. Like 2 weeks ago, late.
@Amelia where do I see these "riots"? Ircmaxell?
Or even:
<input value="a">

<input value="b">

<input value="c">
@Amelia They should really discuss somewhere, where you have threaded conversations...
@kelunik the idea was standardising the bizarre function names/orders currently in php that's been a tech debt from the beginning. a completely separate namespace for a new set of functions
@Trowski of course it could. I'm not saying that there's zero demand for autoloading functions.
btw, this was me:
"I have a small team….. actually it's just me" - Question asking guy #Laracon
15:12
@kelunik only problem is suggesting anything like that to internals without being killed in retaliation :p
@Amelia Just do it and unsubscribe for a week. :P
Lol
@prograhammer no, I'm actually one of the maintainers of ZF2 and Doctrine2
I just don't like Laravel's approach, as (to me) it looks like ZF1 + namespaces
and well... we moved away from ZF1 due to numerous reasons
so @ircmaxell and Taylor Otwell are friends now? What happened? That's good
@Ocramius who made the decision to over-use arrays, by the way? :p
15:19
@Amelia tbh, the entire array stuff is no different from XML/YML in other FWs
@prograhammer I was being (slightly) sarcastic, but it was around 200 tweets back-and-forth
it's just more efficient than those other approaches, as we can code some minimal switches directly in the config
@Ocramius Most of those reasons being expressible entirely in 4-letter words, presumably
So yeah, the only thing that was annoying was the 5.3 array syntax in the examples
@DaveRandom well, yeah, ZF1 was a thing of 2006~2007. When Symfony2/ZF2 came out, ZF1 automatically became swearing
@kelunik Yeah it can be. For largish projects having for example ten megabytes of data copied per request from opcache to the process handling the request caps the number of requests that can be handled at around 600 requests per second per memory channel. (Obviously 600rps wouldn't be bad, but that's before any actual work is done.)
@Danack it's not that bad
actually, it's only the op_array struct which is copied
@Ocramius zf2 has arrays nested so deep it's easier to do lisp-style indentation to keep track of stuff
@Ocramius That's awesome.
@Amelia true, and sf2 has the same with YAML :P
@Ocramius yup :<
15:23
What's the point in having more configuration that code at all?
Configuration seems destined to be ugly. So many different solutions, all of them ugly.
This is why I like configs working by default out of the box, or dot notation everywhere :p
DNC
DNC
I am recruiting 1 PHP web developer, you should be able to work with MySQL. Who is interested?
@DNC no
@DNC no
15:27
@Amelia this is what you were talking about: twitter.com/…
Sometimes I wish SO chat was also connected to SE chat. Then again, I think that the extra 200+ mods flooding SO would strangle Lounge<C++>
@prograhammer that's a decent query for it
DNC
DNC
No one here knows how to work with MySQL?
@Amelia Hm, currently I have my config as nested JSON and join it to dot notation at runtime.
@bwoebi Looking in zend_accel_load_script there appears to be more stuff than just opcode copying. e.g. zend_class_copy_ctor
@kelunik the neat thing about flattening an array to dot notation is that you can do it before runtime
15:28
@Danack we were talking about functions
@Amelia Before runtime doesn't matter. :P
you can literally do router.foo.bar.abc.baz in the source array as a key, and it will be identical
@bwoebi No, we were talking about people using the files entry in composer.
@kelunik me staring at 8 levels of nested arrays is annoying
Which doesn't have a restriction on what it contains.
15:29
@Danack then I must have missed context
@Amelia Well, the reason is that it's easier to have a JSON schema for validating the config then.
Any opinions on squareup as an ecommerce platform?
user924016
TW9ybmluZ3M=
@kelunik the idea is that you usually end up with this at some point
The fact that Firefox marks a non-EV SSL cert with a exclamation as though it's a potential security risk angers me. It's odd for a OSS project to be pushing me so hard to spend more money.
15:39
@Trowski letsencrypt is out soon, remember?
in roughly 4 weeks
@Amelia That's all well and good. But requiring an EV cert is beyond just requiring encryption.
@Amelia It's delayed.
@Trowski which site is this?
@Trowski they push their camp which whenever ready will be there.
sadly I hate these mozilla politics
@Trowski Are you sure it's because of non-EV and not because of SHA1?
15:40
An exclamation mark is sha1/obsolete ciphers
aka block mode ciphers
they're vulnerable to padding/oracle attacks, or a potential attack on sha1.
@kelunik Hmm... you might be right. I jump to that conclusion because I was actually on an Amazon vendor site when I noticed the exclamation.
It's interesting that Chrome mobile alerts on sha1, but Chromium doesn't.
EV is entirely different, @Trowski. All EV certs must be using certificate transparency + sha256 or higher anyway quite soon
And when I click on it simply said "This website does not provide identity information"
@Trowski that would be certificate transparency, iirc
I wish the browser makers would actually agree on what to call it in UI, geez
15:43
@Amelia Unusual to see such a thing on an amazon.com subdomain.
@Trowski link?
@Orangepill what is squareup ?
@Trowski obsolete cipher suite
Your connection to vendorexpress.amazon.com is encrypted using an obsolete cipher suite.

The connection uses TLS 1.0.

The connection is encrypted using 3DES_EDE_CBC, with HMAC-SHA1 for message authentication and RSA as the key exchange mechanism.

The server does not support the TLS renegotiation extension.
Anonymous
@tereško ping
15:44
tls 1.0 + 3des sets off alarm bells
@hakre POS with ecommerce option - squareup.com/…
Chromium shows a green https anyway...
@kelunik click on it
it's not phasing out obsolete just yet
@Amelia Yeah, but I feel that it should at least be orange in that case.
@Amelia Ah, ok. The first error I saw was about not suppling identity information, so I jumped to conclusions.
15:45
@kelunik same
green green green here, too.
currently doing an ssllab test to see how bad it actually is
@Trowski That was true for GitHub and Twitter not too long ago as well.
@Amelia Are you seeing that error in Chrome or Firefox?
@Trowski not an error, more information
Now check this: ssllabs.com/ssltest/…
15:46
@Trowski It's just he information box when you click on the info button in Chrome.
@Amelia Whatever, you know what I meant.
is it possible to have a foreach loop run then break for some html then continue running
@kelunik Right, but my initial complaint was about Firefox and it showing an exclamation instead of the lock.
If it's due to using TLS1.0 instead of a lack of identity information, then I have no complaint.
@Tsea What do you mean by "break"? Something like "?><div...><?php //continue loop"?
@Trowski it's due to 3des, HMAC-SHA1 and cipher block chaining mode
15:48
yeah @kelunik
ssllabs.com/ssltest/… < Cert name mismatch.
@Amelia Ok, then that's fine, that should be marked insecure. I'll get off my soapbox now.
@Tsea Sure.
My only complaint then is that Firefox should actually say that.
@Trowski I think the plan is to add warnings for SHA1 at the end of the year or so...
user924016
16:03
date_default_timezone_get(): It is not safe to rely on the system's timezone settings
user924016
this got removed in php7 right?
@RonniSkansing yes!
user924016
\o/ yay
(the most important feature of PHP 7!)
16:19
@prograhammer see? BFFs.
LOL, yeah I see
FTR...Anthony didn't produce any real laravel code specific examples
to support his side of the argument of "dangerous"
or "horrible idea"
so biases aside, the win at this point probably goes to Taylor. Code is king in this industry.
lol
uhm...
you don't discuss architectural issues with code snippets
^ i disagree
16:23
It's "the design of this thing is shit" not "you forgot to pass an arg to this method"
and no frameworks breaks down on simple use cases that are expressible as snippets
@prograhammer how about NO
here, have a huge architectural issue as a snippet
yes, but to call out a framework and have no specific snippet to talk about is....pretty weak
(since it seems like we need to discuss in code snippets)
code snippets compliment and support the theory
so it's not all theory, and no action
16:25
well, good luck building software with that
this is the kind of thinking that usually produces more work hours for a consultant like me, so thanks for that :)
Take design patterns for example. We can talk about them more clearly with some code snippets, can we not? But the bigger point is, how can someone say something is bad "theory" without directly looking at or talking about code?
@Ocramius you seem to think I think theory and code snippets are one and the same
No, but they go hand in hand
@prograhammer because you have empirical experience on such a topic, besides the theorical concepts of coupling, CCLOC, NPaths, etc
@Ocramius isn't that the sped-up call_user_func_array?
16:26
@Amelia I care only about the first line of that method
the rest is a known performance hack
Theory can be played out in different ways in code. But it is the code that ultimately represents theory in action.
@Ocramius aren't all those cases handled in the default case?
The two go together. Anthony failed to call out any code. That's what I'm pointing out.
@prograhammer code is crap. Anything you write down becomes automatically an imperfect concretion of what you initially thought as a perfect model in your brain
@prograhammer because application code is NDA'd?
@Ocramius we're talking about Laravel, not some NDA'd application code
16:28
I can barely mention any ZF2 open source applications that represent a good coding example, because nobody pays for open source applications
Time for me to vanish in a poof of smoke
"Anthony failed to call out any code" yeah, because it wasn't a bug/vuln
they both got over emotional and no conversation could have had been constructed.
@Ocramius I can show you two very, very disgusting paid zf2 applications, and then point you in the direction of the people who wrote them
the issue is more abstract than that
16:29
hint hint
@prograhammer Laravel itself is a quite bad example, and I just linked 2 code snippets that show how bad it is. What else do you want? This stuff was discussed ad-nauseam anyway, we know which code Anthony refers to even before we start discussing it
@Ocramius or if he wants to talk about how Laravel is used with some application code, then a fictitious example is fine
@Amelia do that, I can usually fix that on the long term :P
@Ocramius you linked 2 code snippets?
when / where?
Anyways, bai
I think Laravel's use of unserialize() in the session driver is enough to keep far, far away
@Amelia bye
@ScottArciszewski oh, and the message queue that serializes closures
oh gotcha, missed that...checking now....
RCE as a service
16:31
/me shudders
(or as a component \o/ )
because eff good security practices.
unserialize() isn't just PHP object injection btw
recent history has shown it to be a reliable source for mem corruption bugs
word is, that's how Agora got popped
@Ocramius Link #1: fascades were criticized in earlier Laravel versions (ie. 4.1). Anthony failed to keep up. Laravel 5+ moves away from use of fascades and offers them as an option.
@Ocramius Link #2: Seriously? The invoice print out? That's so weak and you surely have to agree with that
@Ocramius I can give you a bigger issue I have with Laravel Cashier....
and that is that it forces you to use the Eloquent ORM and Users table.
as well as probably some other ORM calls
I should probably look for more laravel vulns
so they can merge my fix, then revert them because of bikeshedding
I should probably work instead of discussing this stuff. Evidently, the fact that an invoice prints itself via global state is not a problem nowadays
16:35
That's coupling that I don't like. I can give code snippets on that. So I don't use Laravel Cashier, I actually use Lumen (microframework from Taylor) which I can remove the ORM
as well as facades taught in the manual as a quick start
So, you see how I say the win (as of now) goes to Taylor. @ircmaxell needed to break open some code into the convo.
It's not a question of winning
Again, I say "win" in quotes. I'm not trying to make it a contest here. Just a way of saying the other side of the argument needs something.
winning? lulz
16:37
it's a question of not teaching crap
this isn't a war
:P
who cares who wins?
what matters is the consequences: are people shooting themselves in the foot?
it is about the thousands of developers out there that know no better and therefore build steaming dumps of shit that we'll have to deal with in 2+ years
^ Scott, read my comment
I said "win" in quotes.
that's the issue. I give 0 damns about Taylor's ego here, I'm honestly concerned about the community damage being done
And further explained that. I agree with you, no war
16:38
> So, you see how I say the win (as of now) goes to Taylor. @ircmaxell needed to break open some code into the convo.

Nope
@Ocramius Serializing closures, really?! In production!
@Trowski and pushing them through a network connection to a separate machine
wait, I've got it!
I actually reported a security issue on that last year, it got "fixed" by encrypting them
Line right after: "Again, I say "win" in quotes. I'm not trying to make it a contest here. Just a way of saying the other side of the argument needs something."
16:39
I'll find another unserialize() mem corruption then brand the bug as UNSERIAL KILLER
a'la heartbleed
@Ocramius But but... that wasn't the problem... lol
@Ocramius No one talking about ego. I'm with Taylor at the moment because I see more rant than code. IMHO
user895378
@ScottArciszewski marketing FTW
meh
Taylor's a cock
16:40
I shouldn't knock serialization too much, since I will pretty much have to use it in Icicle's concurrency package. But I wasn't planning on serializing closures!
@prograhammer so if I produced 10k LOC a week you'd follow me just because I'm faster at producing crap?
I talked to Taylor personally and gave him examples of the issue I had with Eloquent (in a respectful manner, and thankful for the work he has done).
(9k of those LOC would be crap by axiom)
I report a security bug, he dismisses it, I post it to FD, he sends me an angry flame email
@Ocramius Some of them might be good by random chance though!?
16:41
@Ocramius I happen to follow you and taylor, LOL
on twitter
I started disliking him after that
@Danack 10% has a chance of being useful code
a chance.
@Ocramius you spent 30 min of your life talking to me about DDD. You "win" them all in my book.
... this is starting to look like ad hominem attacks...
> Scott,
>
> Who receives these emails and why would you send it out before I have had time to consider the JSON change? You are truly one of the most unprofessional security researchers I have ever worked with and I have worked with several!
etc
16:42
@prograhammer this doesn't change the fact that you prefer code amount over code quality, and that is worrysome
Coderabbi put you up on the big screen, and I immediately related that tweet to my experience with you @Ocramius
@ScottArciszewski FD?
is that a website?
mailing list
16:43
@Ocramius I prefer code quality. But both code amount and quality require something....oh what is it....uhmm...hmm.. oh yeah, code!
^ being smug
:-p
"it's not a security issue" "okay, sending it to FD then" "wtf why would you do that before we have a chance to look at it?!"
No, clean code actually requires thinking, not code
14
@rdlowrey Have you written anything for concurrency with Amp? I was curious if you had any solution for sharing data other than serialization.
code is just a by-product. It's the waste of the concretion of the thinking.
@Ocramius there was no code.
I think we philosophically disagree here. I believe code is king.
Take "faith" for example. You can talk about your faith all you want, but you can demonstrate your faith by your works.
Code is just waste that we produce. We should write as little as possible at any possible time
I'm a long-time reader of PoC||GTFO
but focusing too much on code is like staring a tree and judging the forest based on it
16:45
@ScottArciszewski what about focusing on....zero code?
there was zero code.
@prograhammer I do demonstrate clean code through my work, and Anthony has plenty of good code in his repos, so I don't see what the problem is
That was Taylor's beef
I linked 2 examples by not even looking at them, I already knew where to look, eh
Anthony called out Taylor (after looking at his code). But gave no code to discuss.
I don't want to hear about Taylor's beef or taco
16:46
ah whatever, ignored
@Ocramius we talked effectively once you gave those 2 examples.
user895378
@Trowski I have, but it didn't cross process boundaries (used pthreads). When I've done concurrent task dispatch where the transport mechanism used unix sockets (or local tcp looopback in the case of stupid windows) I used serialization in those cases because there was no other choice. If someone has compromised your local machine then you have bigger problems than injection into the local socket transport layer. I also didn't allow the serialization of objects -- scalars only.
if you have a problem with Anthony
Note: I simply got work to do and I was wasting my time: nothing personal.
I suggest bringing it up with him
16:46
You did good. We had fruitful discussion. Can't say Anthony accomplished that yet.
user895378
IMO there's no reason to allow serialization of non-scalar data for concurrent task type processing
user895378
If you can't represent the computation inputs using scalar values you're probably doing it wrong (just my opinion).
Anthony is way more knowledgeable than me. I will always defer to him on advice. IMHO I'm just pointing out that I didn't get substance from his public rant on twitter on Laravel.
@rdlowrey This is the approach I took, though I haven't put an limitations on what can be serialized.
@ircmaxell isn't here, continuing to talk about him instead of talking TO him will only be taken as an act of cowardice
16:48
Since I'm the layman php programmer, I look at both Taylor and Anthony for advice.
protip: no gods, no masters
@ScottArciszewski I agree. Good point. But the twitter discussion was pointed out to me, so I read it and gave my comments here at the same place it was pointed out.
@rdlowrey I'd have to think about this... not sure there would be a reason to limit it. As you said, if someone has compromised the machine to be able to inject into the local socket transport layer you have much bigger problems.
user895378
@ScottArciszewski it seems like you're talking to someone who has already received the official @rdlowrey Mute of Great Justice. From your monologue I can only assume I made the right decision.
I see, that's reasonable
hahaha XD
16:50
@rdlowrey not necessarily
this discussion feels more like "taylor bad anthony good let's ignore any argument"
the theme of today for me is the number 1000
One thing I have learned in life is to know how to lose. No ego. I've mastered good skills on taking in a loss.
awesome-appsec hit 1000 github stars, my HN account hit 1000 karma
Not that I go looking for it, but I find joy in it actually, when it happens.
the thing is, @ircmaxell doesn't see it as a battle
16:52
@ScottArciszewski max I got is 15 github stars
Kind of like the movie Fight Club (I saw long ago, can't say I would recommend watching it, it's too vulgar for me to watch nowadays)
no wait, 25
until a few months ago, the most I had was like 4
the whole drama started because he expressed an opinion on twitter
@ScottArciszewski my fault. I should have never said "win" (even in quotes). But to someone who is seriously listening (ie. me), I'm going to give a serious response as to what I got or didn't get from that public twitter encounter.
Morming
user895378
16:54
@PeeHaa o/
I got @ircmaxell making a single bold statement about Laravel (just before or after Laracon)
@PeeHaa it's already another day since last time we talked?
so I listened. And I was not fed.
Taylor, IMHO, was ready to defend the bold statement.
@FlorianMargaine It sure feels like it :P
16:58
Taylor needs to shove a tampon in it and accept that some people will dislike what he created
user895378
Jan 19 at 15:30, by rdlowrey
The only thing worse than no one using your libs is people using your libs.
lol
yes
I have no users, so I can afford to break BC
user895378
There is a lot to be said for that freedom

« first day (1766 days earlier)      last day (3408 days later) »