« first day (1910 days earlier)      last day (3264 days later) » 

11:03
@Gordon I love how the protocol on Friday is to not trust any link not suffixed by not rb
Until it goes full circle and people break that trust
@bwoebi Yes I know. But some vendor told me to set it to 10000 so I told him to piss off
On what is the magic default number 1000 based?
Because 10000 sounds like collisions are going to happen
yea. I don't come here often, but after the first link this morning, i've been very suspect of other links posted
@PeeHaa collisions are also going to happen with 1000 probably.
Tnx
the issue is really only in case where many collisions happen at the same hash.
and this is only the case when the passed array is specially crafted.
@PeeHaa well, you can set it to 10000, if you really need it, as long as your server is able to handle 10000 collisions in a marginally small time.
11:10
> your server is able to handle 10000 collisions in a marginally small time
To the DOS mobile!
:-D
Ah the power of CSS I honestly don't know why I do this, it just happens. I think I have a problem.
7
11:26
Weekend plans, anyone?
@Sean It's this channel. It's messing with your mind.
12:00
@Sean Is … that masochism?
... people get aroused by the strangest things
I will brew some tea now
do you know the favorite tea of any Sith lord? It's Darth Jeeling!
@Gordon Do it slowly.
I need to buy a different tea
@Danack my wife keeps telling me that
when we have dinner I mean
12:05
I accidentally bought black tea and, since its -20*C outside, I really dont want to go shopping
@tereško order online. get it delivered
shipping in Latvia cost 5euro or more
dont you have amazon prime?
Anonymous
13:04
meh
Anonymous
@tereško you obviously know the power of 5 euros.
Can someone point me when strings become refcounted?
in PHP 7.0.1 Z_REFCOUNTED_P on strings gives false, in master it is true
13:19
@zaq178miami before PHP 7.0
(see zend_string)
Any good examples on interfaces for displaying multiple nested tables?
Found one thank you very much!
Wes
Wes
13:35
you are welcome. :B
@TiagoMatos Just out of interest, link?
Wes
Wes
@Jimbo \o
@TiagoMatos awww. come on. that would have been a perfect opportunity to rebecca him
:D
@Wes o/
MOT passed with flying colours, just brake pads are a tiny bit worn, nothing else :-)
13:37
Well @Gordon you still have it i don't know what rebecca me is :\
you … you don… now witness the awkward silence
words are violence, break the silence...
Break the Internet? What?
@salathe You know, I knew what was coming but I clicked it anyway.
13:46
@PeeHaa Not utter bullshit, just a factor 100 worse (I don't know whether that's utter bullshit already)
@zaq178miami Is one of them a zts build perchance?
Morning guys
Wes
Wes
@PeeHaa i would say it's a pointless setting. just as max_input_nesting_level. why care? i don't care of other settings than post_max_size, and max_input_time
Suppose I add a text on an image via PHP
now in order to do that I have to declare the header("Content-Type: image/png")
But If I do that then I won't be able to add any HTML content
How can I add both things together ?
@Wes Because possible dos?
Wes
Wes
but how is that different from setting post_max_size?
13:57
It attacks the hash table collisions iirc
Wes
Wes
also max_file_uploads and upload_max_filesize. why would i allow to upload max 4mb divided in two files of 2mb, but not 1 file of 4mb? maybe i'm missing something...
@ZahidSaeed i guess, if you really wanted, you could base64 encode it? though i'd just separate the process and embed the php for the image in the img tag like src="example.com/image.php"
Wes
Wes
files that not necessarily i want to process
I'm talking about max input vars and friends
Wes
Wes
13:58
@PeeHaa was related but unrelated
@BobNocraz I found a same question on stackoverflow too
Wes
Wes
is it actually possible to create such collisions with 8mb of post data? @PeeHaa
@BobNocraz I have a question. Is there any way to send post data to other pages without having query strings in the URL ?
Without form
@Wes yes totally
At least I think :P
Without AJAX even
14:01
@ZahidSaeed do you mean like an XHR post?
ah, hmm. from a browser?
Also 8MB. I shit more than that :P
@BobNocraz XHR will only work when JS is enabled, right ?
So what's an alternative way to do it ?
lol @PeeHaa
you could use GET instead of POST
i think that's what is expected of you when requesting an image anyway.
14:02
@BobNocraz That's the point. GET is insecure
no more insecure than post...
no more insecure than xhr...
How can a post be insecure ?
:P
@ZahidSaeed how can it not be?
14:03
introverted and shy requests are insecure
@Gordon :D
@PeeHaa Most of the sites says that
Link one
W3schools is an example
14:04
...
A real one
in their article, GET VS POST
The point is, (if it's form data or something similar) the browser will always see the post data at some point.
Yes but the user couldn't see it, right ?
yes they can
Wes
Wes
14:05
the only difference is the referrer. if you use get the referrer to third party will include the querystring, if you use post the data will be hidden
Any major browser, yes they can
From developer tools ?
under the network tab ?
In chrome, aye
14:07
So what is the best way to do it ?
The top request is usually the page request. Click it, click headers, at the bottom "Form Data"
The most glaring difference is caching
what is it that needs to be secure?
It can be any data
The question I want to know
14:08
@BobNocraz @DaveRandom's momma against me
I just want to know and adopt the best practices
is if it's for privacy or security
I guess that POST is somewhat more secure than GET if you're thinking access logs, etc. but it sounds like you're attempting to hide the information from the client, not potential hackers
i would add a third option to @Sean's question of vanity as well.
@BobNocraz I want to secure it from everyone
That's what I'm trying to say
A regular client/user wouldn't know what to do to inject something
14:11
but someone who wanted to inject something wouldn't be a regular
Did you install you ssl certificate yet?
I know bob
But what about alice?
most secure place, offline ??
So, what should I do ?
14:11
Ha.
@ZahidSaeed we went from post and get to injection pretty fast?
@Andrew in your head
@BobNocraz your head is not the safest place to be :P
@Andrew Spend one weekend with me drinking and you would retract that statement I am sure :)
Better devs feel free to jump in here, but GET should (pretty much) only be used for navigational purposes and/or JS components.
Any other form data should just be posted
14:13
JS components?
but either way the browser knows about the data.
I was just joking :((
@Sean, @ZahidSaeed was talking about dynamic image creation. incase I missed something and we diverted away from dynamic image creation and are now just on best practice for security
@FlorianMargaine Unless JS can pull from POST?
@Sean GET is for getting a resource and POST is for posting ;-)
14:14
But you still haven't told, what should be done to prevent injection ? @BobNocraz
@Sean I was just wondering what you meant by "JS components"
@NikiC yes, that one that reports strings are collected are zts, is this a reason?
@Sean generally speaking, this is a fairly good explanation: en.wikipedia.org/wiki/Representational_state_transfer#Example
@ZahidSaeed validation on your back end server? I'm still not sure what you're attempting to prevent being injected
@ZahidSaeed look up idempotent on the web
14:15
@zaq178miami zts doesn't support interned (non-refcounted) string (apart from the empty string)
I see in sources now, thanks for pointing me
@PeeHaa Indeed, but the lines can be blurred sometimes in websites
Suppose there a lots of images on the page. A user clicks on one of the images and the that page opens for that image
what is there to inject about that?
How will I know, which image has the user clicked ?
14:17
@Naruto steroids ?
Should I use the Query String in the URL for that image containing the ID of that image so that I could fetch info about that image ?
I'm trying to rewrite nonexistent PHP files to my index.php (pastebin.com/bDkKJeMy) but my rule is not kicking in. I'm just getting a 404 - File not found for PHP files, other extensions like JPEG and PNG are working. So I'm guessing this is an apache configuration?
@DarkBee you should rewrite all the requests to you index.php
@BobNocraz heroin?
@DarkBee Unless it is a typo your config is broken
14:19
=)
@BobNocraz What should I use in such case, POST or GET ?
Broken? It's working for images etc only not for PHP files
@ZahidSaeed is the link to just simply open a new page? or are you sending data along with the link to help create the page?
4 mins ago, by PeeHaa
@ZahidSaeed look up idempotent on the web
14:20
It's working on our other server though
@BobNocraz Yes the link opens a new page
I just need the data on the page so that I know, which image was clicked by the user
It seems our htaccess is fully ignored for PHP extension. Is this possible?
Right now, I'm adding an 'id' query string in the URL
then fetching it using $_GET
But I was guessing, what If the user changes the ID in the query string ?
Wouldn't my page simply crash ?
depends how your error handling is on the other end..
validate the id ??
Wes
Wes
14:24
@PeeHaa stackoverflow.com/questions/34679301 feel free to improve it like you prefer
@Naruto But that page only contains the info about that image with some ID
If the ID is not correct then there will be NO IMAGE WITH SUCH ID
What will I show ?
Wes
Wes
or even delete it, if it's shit :B
404 page?
14:25
then you go back to the previous page or show some random crap file not found
Wes
Wes
@NikiC #fail :D
funny one :P
@Andrew Validate the ID but how ?
alright, I'm out of this discussion :D
@NikiC also NAN.0 I guess?
14:26
@bwoebi Likely
yep…
just checking for the dot…
but not for an N in the string
@Wes Well I already gave you the answer :P
You are vulnerable to hashdos attacks
if image not found, should be 404 page or blank or redirect ??
@bwoebi you mean zend_isfinite
Wes
Wes
asked about other settings too
also … why are the NAN and INF constants case sensitive? :-( I'm always typing NAN as NaN first…
er, cc @PeeHaa
Wes
Wes
@PeeHaa max_file_uploads limits for the same reason. if you have too many files uploaded you can get collisions, right?
@BobNocraz I recognize that youtube id from a mile away ;)
@Wes Don't think that is related to collisions no
14:32
meh, could have at least pretended =)
Wes
Wes
@PeeHaa well if you upload a million files 1 byte each you get collisions, no? :B
anyway that's why i asked.. feel free to improve and/or answer if you want :B
@Wes Where? In the HT?
Wes
Wes
yes
You do, that's why the max vars workaround is invented :)
14:40
@PeeHaa but you clicked it anyway, right? that's what I usually do. cant get enough rebecca
if listening to rebecca is wrong, I dont wanna be right
@NikiC that naming though… there is zend_finite, zend_isinf, but no zend_isfinite … but yes.
what data type stackoverflow uses for answers column? (TEXT? MEDIUMTEXT? LONGTEXT?)
Wes
Wes
@PeeHaa so what i was saying is correct max_file_uploads is not crucial
14:42
@Shafizadeh I just know that they don't use mysql…
@Wes It is, but it prevents something else
Well, I'm creating something like SO, What data type you recommend for answers columns?
Wes
Wes
what does it prevent? :P
@Shafizadeh nvarchar (max)
14:43
@Wes A lot of files! :P
Dunno :)
@FlorianMargaine tnx, but do you know nvarchar (max) is equivalent with what data type in mysql?
@Shafizadeh you can google that, can't you?
Wes
Wes
perhaps yeah having the temp dir full of shit files that slow down everything might be the reason
14:44
@FlorianMargaine ok :-)
@Shafizadeh there are SO dumps, maybe there are some info about that
Someone needs to spread the word that type declarations are slow and in production you'll see a speedup when compiling them out...
I want to see if people really will compile them out then…
are you talking about langs with optional type declaration?
About PHP
(in function decls)
14:48
I guess it is expected overhead
but are there any benchmarks about that?
we need to execute all the ZEND_RECV opcodes in case a type hint exists
is the define() violate the MVC pattern and also SoC ??
@Andrew not sure why it should…
im confused :S
@Andrew Neither of those but it is a code smell imo
14:51
say, defining Document Root as constant, then it is hard to trace where it has used ??
Do you really need to access that path that often?
Wes
Wes
document root is not as constant as π
I only need it in my bootstrap file which is already in the root
currently trying to eliminate the use of define :S not sure am i going the right direction :S
@Andrew In general, define() is fine for system dependent global values
Wes
Wes
14:55
@Andrew constants are global state, which you should avoid
so, docroot as a constant is probably fine, just that making the paths dependent on a docroot is probably not fine.
@Wes you should only avoid global state for things which aren't truly global.
> Mae gwall wedi digwydd. Dewiswch "Continue" i roi cynnig arall.
Wes
Wes
which the document root isn't :B at least imho
likewise, it's fine to put your configuration (like database access) in a constant … or whether your underlying system supports a certain feature…
Also a bad example
*imo
14:59
I feel like my bootstrap file is so messy, with the ini_set, define(), spl_autoload, and the "wiring", imo
If you need to reach inside the global scope from within the stack you might be doing it wrong imo
@Andrew Linky?
@PeeHaa sorry not a native english speaker, what linky means??
Wes
Wes
@Andrew avoid ini_set(), just use php.ini. if you want to check the configuration use assert()
posted on January 08, 2016 by nlecointre

/* by r940 */

@Andrew Do you have a link of an example of your bootstrap file :)
That's not even trying :P
@PeeHaa was trying to put it on git, but still learning the command -_-""
@PeeHaa why would I need to when you click it anyway
@Gordon Oh man, thats the second time I clicked the link -_-""
Wes
Wes
use gist.github.com
15:06
Yeah a gist or pastie/bin is fine
@Gordon :'-( 3rd time...
hehehe
Wes
Wes
ahahahaha
15:07
WIN!
im still learning MVC pattern :S
damnnn, people says globals are evil, but I say @Gordon is evil :'-(
just kidding @Gordon
lols - imgur.com/gallery/zcEeZ nsfw text, motions with hands.
3
oh well, its the 3rd time already, might as well just click the 4th time haha
I feel like everyone can be a pop star -_-"
Wes
Wes
@Danack ahahahaha is this even allowed on tv
@Andrew Well my bootstrap file is a lot messier
15:13
@Gordon I think I must click this, correct?
@Wes past 9pm....British TV gets a bit darker.
@PeeHaa haha I still in the stage of learning, but already feel code smell, how do you format your bootstrap ? :S
@Andrew use some febreze
@Naruto I thought another Rebecca ... sorry :(
Wes
Wes
@Andrew it's okay, but i don't think you should have that constant, either pass it as variable or use relative paths when group of files are bound together. this is what i'd do at least
15:18
@Andrew u mean good old rebecca?
@Wes I set up the $root variable, so currently trying to clean up the old ROOT constant :S
@Naruto the damage is done XDD, I checked the link this time, hehe
@LeviMorrison yes
youtube.com/watch?v=jofNR_WkoCE, how is this even a song .... :S
@salathe good trick!
@PeeHaa sorry just notice the bootstrap you posted :(, but it looks neated with comments surrounding on details :D
@salathe definitly saving that one xD
anyone with too much time on their hand willing to use annasagrera.com/on-ascii-youtube-and-letting-go on rebecca. I cannot believe there is no ascii version of friday
@FlorianMargaine Because I don't need e.g. a http request object on cli
I only generate keys on cli
15:46
I feel like it's impossible to meaningfully contribute to the Code for Conduct discussion because of sheer volume.
@LeviMorrison the discussion? No
the actual RFC/process? yes
@LeviMorrison if you have feedback, I'd like to hear it to improve the proposal
is there a way to create a mailto in html with an attachment already attached?
@Naruto Doubful. The mailto link passes prefab data to your local MTA. I would assume forcing a file in there would be a massive security risk
yeah seems this is not possible, from what I've found so far
Wes
Wes
@Naruto why you need to do that?
15:55
Yay! Just crossed 99k rep!
@Wes because client wants something like that, but the best thing I can do is let him fill in a form with an auto added attachment us phpmailer or something else
@ircmaxell You really want to get that stackoverflow swag, am I right? :-P
E_SWAGOVERFLOW
@ircmaxell For me it's not so much that I don't like anything specific.
@bwoebi I have already :-)
15:59
I just don't think it will solve many of the issues that internals has.
@ircmaxell yeah, but for a different reason?
@LeviMorrison I don't either, but I think it will solve one category of issues and act as a first step towards some of the others
@bwoebi true.
@Wes this is one of those clients, where you tell them, it's prob not possible, but this way is faster / shorteer, costs you less money to make it, and he still goes, no I want it like this, where in the end you have to say sorry ,but...
@ircmaxell I think moving to something like a Discourse forum may work better for all of our issues.
As well as more granular moderation tools.
Wes
Wes
just link the file in the message? @Naruto
16:01
@LeviMorrison I totally don't disagree…
We definitely need a code of conduct.
@Wes nope, because these files are generated and deleted after the mailing.. as I said it's one of those I want everything but I don't wanne pay for it clients :P
I think maybe I would just drop the enforcement stuff for now.
Enforcement also seems to be a sticky point with others on the list.
Wes
Wes
@Naruto the worst kind
Today I got to see the records for our DNS
I wish I could unsee today.
16:03
last changes he wanted, I worked on i for a week, and my boss sent him the bill, and he's like, no way it took that long for that... because yeah, everything we do and you ask is 5 min of work :P
@Sean in what way are these that bad?
Not too keen on disclosing it in a public chat, but it isn't great.
@Sean damn the litte bugger is bigger than expected #leon
@Naruto Oh yeah, he got big quick! Wonder if he's ever going to stop
@Sean don't leopards get way bigger? ;)
anyhos, time for a well earned weekend, later all!
16:10
@Naruto See you on Monday! :p
Jen
Jen
May i know how autoload works ?
Overall, I'm +1 on this. It could help to catch a number of mistakes in code. Just two quick notes/thoughts about the RFC:

1. XOR'ing strings is perfectly valid (used for string comparison, see http://stackoverflow.com/a/7475502/4530326), so not sure if this is worth consideration

2. Using undefined constants in arithmetic now outputs a notice and a warning:
sapi/cli/php -r 'undef_const + 1;'
Notice: Use of undefined constant undef_const - assumed 'undef_const' in Command line code on line 1
Warning: A non-numeric value encountered in Command line code on line 1
@Jen Autoloading classes, you mean?
Jen
Jen
yeah @Sean
\o/ beertime
16:17
Autoloading callbacks are registered using something like [`spl_autoload_register()`](http://stackoverflow.com/questions/7651509/someone-explain-spl-autoload-autoload-and-spl-autoload-register)

In runtime, when a class is referenced that has not been found, PHP will fire the SPL callbacks in order, providing the callback with the name of the class attempting to be accessed.
The responsibility of the callback(s) is to find the class. For example, the typical operation a callback does is to find the file which contains the class and include it into the script.
Wes
Wes
someone knows if there is a formal name for the single piece in a domain name? like "co" in "baz.co.uk"?
@tpunt One non-fatal error often cascades into another. I don't think this requires special casing.
Jen
Jen
thanks @sean
If none of the autoloaded callbacks can find the class, PHP kills the script, but if an autoloader does find and include the class, the script continues on as normal.
Jen
Jen
If autoloads fails to get the class would this callback in terms of fatel error ?
16:20
@Jen if the autoloading functions can't produce the class, the script execution will halt with a fatal error, yes
E.g. Fatal error: Class 'Foo' not found in /script.php on line 6
Jen
Jen
Thanks a lot @sean, it clears all my doubuts :)
Cheers
@Jen Happy to help. I suggest you take a look at the official docs on autoloading, they help a lot ^^
@Sean Read the manual, what are you, some kind of commie?
4
@Sean Hmm, we should probably more strongly encourage spl_autoload_register() on that page...
@NikiC Yeah true. Thinking about it, I've seen it quite a lot (E_WARNING emitted from one place causing another E_WARNING (like headers already sent) being emitted from another place)...
16:28
@tpunt which is why the only sane thing to do is convert any unsuppressed warning/error into an exception.
@tpunt the best obviously is errors causing a loop yielding an infinite amount of errors :-D
@Danack Agreed on that :)
Newbie by BDD and Behat, I'd like to know how to start my first feature for a traditional blog project
Wouldn't we all?
I don't know if I should name my feature "post" or break it "read-post" and "create-post"
The user stories are different in the case of read a post and in the case of "create/editing/deleting a post"
16:34
@bwoebi Can't say I've ever encountered that before ^^
so therefore I thought it should be separated in distinct ".feature" files / features
@tpunt I did ;-)
what do you think about it?
@IamZesh Choose one at random. Write some code. See how you feel about it.
Unless you're making a choice that would take ages to change, just DO ONE.
@Danack ok. But shouldn't each feature have a single user story associated with it?
I'm asking because I'm new to bdd and I've always seen examples / tutorials / manuals like this:
Feature: My Feature
In order to bla bla
As a bla bla
16:40
Short version probably not (users with different permissions might interact with single feature differently, e.g. people on a free plan would see a limited version of a feature), but also, I don't care.
and then the Scenarios
It's your code - it's there to satisfy your needs.....
@Andrea Looks like your 7.0.2 fixes introduced a bug: 3v4l.org/mGrv5 (report: bugs.php.net/bug.php?id=71314)
Also:
var_export(NAN); // NAN.0
does it makes sense for you though, to have features like that "read-post.feature", "manage-post.feature"?

« first day (1910 days earlier)      last day (3264 days later) »