« first day (2470 days earlier)      last day (2704 days later) » 

17:00
what the shit is going on here
@DaveRandom r11's lit yo
@tereško Oh shit. I missed that part, glad for you
I assume it was @PeeHaa's fault
@DaveRandom say anything and it'll likely get starred
A fair assumption usually
17:00
@DaveRandom "can I have feedback and votes?".... "I HATE YOUR FEEDBACK AND VOTES"
3
@DaveRandom yep. he does too
it was all @PeeHaa's fault, I saw it
user4244405
@Dereleased, noted, I would've appreciate intellectual feedback earlier but was welcomed with a bad vibe; but I've spent enough time on the net to know not everyone deserves the same treatment. I appreciate your concern though. .. not sarcasm, I mean honestly.
@FélixGagnon-Grenier They probably do. You all suck.
Sorted
17:01
lol
Anonymous
Calm down earthlings ... you comment too much
@DaveRandom as far as I can gather, the room encountered an expert ... I wasn't around at that time, so I'm just enjoying the show
lol, did you reban the guy for good this time?
:p
@DaveRandom I love that, pronounced correctly, that 't' is pretty much just a glottal stop
17:02
Duuuuuuuude
You'll be allowed to talk again in 57 seconds.
:D
57
ahhahahahahahahaa
Avenged!
well I guess I deserved that
@argon Link?
17:02
top level avenging, someone get that ex-moderator a hero suit ...
@littlepootis says the js programmer ;)
let me play my part also
!!dad
I have a polish friend who is a roadie for a band I have a Czech one two, Czech one too, one too
17:04
@Gordon lol
I hadn't seen this ASCII owl before: {o,o}
on a more serious note, @kelunik these are the only todos left now:
user4244405
Levi, sorry, it's rather busy, multitasking; okay so, have a look at the growth of PHP, it was intended for personal use but because popular very quickly by demand of the hosting providers. Make no mistake, I think PHP7 is really good; but it took a lot of time getting there .. As with many things, some become pupular out of luck - right time and place I guess.
static DWORD WINAPI copy_file_to_socket(LPVOID param)
{
    file_socket_pair_t *pair = (file_socket_pair_t*)param;

    // todo
}

static DWORD WINAPI copy_socket_to_file(LPVOID param)
{
    file_socket_pair_t *pair = (file_socket_pair_t*)param;

    // todo
}
user4244405
java?
17:04
C
everything else is done, once I have written those routines it will be 100% working and we can test it in production
@argon I asked for a link to your programming language you claim to have written?
@DaveRandom hahahahahahahahahahha
actually it will probably explode, I haven't tested any of the child process creation stuff yet
I will even put it on github now so you can all laugh at me
Out of the box, PHP is more than fast enough for most apps. But you can benefit even more by the huge speed gains in PHP 7, or an opcode cache like APC.
17:06
What was that before? room-owner-kick-time?
I don't understand why that exists ...
ok, fuck this, I am going home
user4244405
ya I donno, some folks like to blow off steam like that I guess, still I hold no grudges, it's just irritating.
Anonymous
@bwoebi ?
17:07
@Jeeves what should I do for lunch?
@Tiffany What do you like doing?
lata tereško
@JayIsTooCommon meh, Chris kicking Pieter and Gordon kicking Chris
@Jeeves during lunch? watching Doctor Who or going home and playing PoE.
@Tiffany You're wasting my time.
3
17:08
hahahaha
@bwoebi escalating settling revenges
really the only place left was for @MadaraUchiha to ban @Gordon, than @JoelSpolsky to ban @Madara, then @NickCraver manually altering the db and banning Joel.
@bwoebi I had expected to get kicked next… because… you know… the combo must go on
... maybe that could be escalated further by Jon banning SO from the interwebs
Anonymous
17:09
@argon keep your head up. You'll be fine
user4244405
oh sorry Levi, sure, i've written the first documentation about it, but it's really only in draft still, and needs updating, but, i would appreciate any feedback: github.com/xacra/vamp/blob/master/docs/VampDocs.pdf
user4244405
samayo ... gotcha ;)
@argon for documentation, use markdown files
github trying to load pdf files is a joke
user4244405
indeed Tiffany, that link above is the result of mark-down converted to PDF
... aaand you missed the point (of git, as whole)
17:12
then commit the markdown file instead of the pdf
Anonymous
Weather's nice today.
github handles markdown files wonderfully, PDF is laggy as shit
is there a way to conditionally skip an entire phpunit testcase?
user4244405
@Tiffany, agreed, well, there is some of the new revised introduction in markdown here:
https://github.com/xacra/vamp/blob/master/docs/md/01.introduction.md
17:14
@salathe @argon much better
user4244405
:)
@argon
VAMP does NOT just "throw away" the unnecessary digits; rather : it gets handled internally by looking at the expression input & output accordingly, so you don' tneed to bend your brain trying to figure out what the hell is wrong with your own logic -when it is perfectly fine.
Hi guys
How does it do this? What are the rules for keeping digits?
user4244405
17:15
haha :D
user4244405
oh
Is it possible for soap service to return applicatin/json output?
@PeeHaa in setup() call skip() based on the condition
@Gordon <3
awesome
Here, feel free to point and laugh everyone: github.com/DaveRandom/amphpProcessWrapper/tree/master/…
17:17
I have used $this->markTestSkipped() but mainly for trivial checks
@Gordon method skip() not found in Testcase
@Vamsi yes but that doesn't prevent the tests from running
user4244405
well, as the JIT (just-in-time-compiler) interpreter reads the expression, it takes the length of the input string on left and right of the operator; calculates the expression and verify that it's the correct length.
user4244405
@Levi
@PeeHaa markTestSkipped. I assumed you know the right name. sorry. :)
17:18
43 secs ago, by PeeHaa
@Vamsi yes but that doesn't prevent the tests from running
it marks as skipped but just runs all the tests anyway right?
Anonymous
@DaveRandom haha
Anonymous
@DaveRandom ha..ha
@argon ... this sounds off. How does the JIT interpreter know the correct length? You just deferred from A to B.
Anonymous
Fuck off you shitty mobile
3 messages moved to Trash
17:19
@PeeHaa yes. another option would be to use @require but I think that is less flexible: phpunit.de/manual/current/en/…
I will just add my conditional in all tests in the testcase
what condition is it?
user4244405
@Levi, as you know, any interpreted code is plain text; so the parser simply counts the number of characters after the . say in 0.002 (if any)
is this just theory ? I see no compiler, or transpilers, or any code I can read to get an idea of what the hell this thing is ?
What happens when you use floating point for financial calculations? You get NaN-cents
Anonymous
17:22
@argon if you're trying to bullshit you're way through this, you've come to the wrong place :p
@Jeeves please add that to your dad jokes repertoire
@Gordon Very well.
@Gordon @Linus this one is for you, I think ...
user4244405
@JoeWatkins, not just theory, I have a working draft, but it's not published on Git yet as I run my own local repository on internal network.
Can anyone point me to some pages/articles regarding preventing brute force attacks on login pages, specifically about identifying an attack? Right now I lockout users after 5 failed login attempts within 1 hour, but I think that could be troublesome to a user who just forgot their password.
17:23
@PeeHaa if it's the same conditional, there is no use to add it to all the tests. it's just duplication. put it in setup()
@JoeWatkins :D lol
I am thinking I should show a CAPTCHA after 5 failed login attempts within 1 hour, and then lockout the account after 20
@Gordon huh?
But my entire point is that I still need the conditional anyway to stop the test from actually running
Am I missing information here?
Anonymous
@Alesana that's the standard way afaik
6 mins ago, by PeeHaa
I will just add my conditional in all tests in the testcase
17:26
yes
how is that stopping the test from running?
@JayIsTooCommon The first or second one?
Because I can return; in the conditional
in the tests
I cannot do that from setUp()
Right?
but then you get no feedback
Anonymous
@Alesana second, Captcha
17:26
Sure I will also add markasskipped
giggity ass
@JayIsTooCommon Okay thanks, I'll implement that then
Or are you suggesting to only add the markasskipped into the setup
@PeeHaa yes
I'm leaving computerland to do real life stuff, lata all
17:28
Not sure I like
@JoeWatkins later
@argon
(`abcdef` + 9) .: abcdef9 :: added 9 at the end of the text
(9 + `abcdef`) .: 9abcdef :: added text after the 9
(`abcdef` - 3) .: abc :: it subtracted 3 characters from the end
Have you watched the wat video?
Will see what it looks like
@PeeHaa sorry @PeeHaa, I have too
@Alesana what web server do you use ?
17:29
Gonna miss you Joe sir
@Vamsi apache
back in the days, I was just using ModSecurity to block brute force attacks
@argon if not, I highly suggest it. destroyallsoftware.com/talks/wat
user4244405
Thanks @Tiffany, yes, it is rather simple as it calculates what is implied .. and dare I say .. division by zero is not an issue.
17:30
it just blocks the IP who tries to brute force and it's quite configurable
I mean the handling of addition and subtraction with strings.
@PeeHaa basically in setup(): if (yourCondition) { markasskipped() }. that will not prevent all the tests from running, but it will fail them immediately, so they'll never get to their assertions.
user4244405
@Tiffany .. checking the vid
@Gordon huh?
waaaait
wat
waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaat
Also I'm thinking of how to identify an attacker, I think that it's pretty safe to say that if a certain IP does more than 5 failed attempts within an hour they should have to complete a captcha too (regardless of attempted username), but I am having a hard time finding other information online on what else I can do. Maybe ban an ip if they have over 100 failed login attempts in 5 minutes or something?
17:31
Lemme test
you test. I go for dinner. can thank me later ;)
holy shit
Thanks
I thought it would just continue executing the tests
@Alesana Don't assume IP has anything to do with it. I mean, don't ignore IP, for sure, but track on username as well
TIL @Gordon is actually useful sometimes <3
@Alesana and track globally for all requests
@Alesana here's some basic config. snippets.aktagon.com/snippets/…
17:33
@PeeHaa So if it gets outside of a certain rate you CAPTCHA everyone?
Yes
Dynamic range is prefered
Anonymous
@argon hahahahhaa
Anonymous
Ok, that creased me up
It's all a trade-off though
Annoyance for users vs the thing you are trying to protect
@Dereleased Right, I already am implementing username based protection but wanted to also implement attacker based protection
@PeeHaa This is what I have been hearing but I am having a hard time imagining what else I can track for other than IP. The only other thing I can think of is user agents, but that seems like a bad idea.
@Vamsi Thanks, I will check it out!
17:37
@Alesana Just invalid credentials in general
user4244405
lol this video is amazing! haha thanks @Tiffany .. yeah exactly too much weirdness .. I've spent countless hours trying to fix weirdness in languages, hence why I opted to create a new one that does away with all things long-winded and "WAT" lol
Anonymous
!!xkcd standards
If that is a lot higher than usual at the very least send a mail to the admins @Alesana
17:38
would just use TS
@argon languages that allow arithmetic with strings and numbers are generally laughed at. There is no reasonable expected behavior because they are not the same type.
@PeeHaa Ah yeah that's a good idea, I was thinking more along the lines of blocking out a specific attacker but I would think that the only way to do that would be to block IPs
@Alesana how do you define "a specific attacker"?
@PeeHaa @DaveRandom @Gordon Please don't play with kicks
@MadaraUchiha I wasn't
All my kick has been valid
17:41
@PaulCrovella Right now by IP :P
and why would you allow division by zero?
what good reason could become of that?
@Alesana blocking IP. it's not an unheard practice.
user4244405
Tiffany, I got the sarcasm when I saw the vid :P .. anyway, have a look at languages such as Lisp - many people don't understand it, but it's actually a very powerful programming language used in image processing (facial recognition, etc) .. well, the point is to calculate a result by what is "implied".
- for not using "reason about " when mentioning the word Lisp
aaaand I am sfinaly home
eventin' everyones
17:44
@tereško it's my lunch time
@tereško Let the imbibing commence!
actually well past my lunch time, but fuck it, late lunch
I have only two beers
user4244405
of course there is much more to be disclosed about this language, but the bootconf gives you the option to turn on and off many things, including "implicit" expressions; which when off the library does not even get loaded; which frees up some resources. @Tiffany
@PaulCrovella In all seriousness, what I'm looking to prevent is someone who brute forcing using multiple IPs. If someone has a huge botnet they could have 10,000 ips, that specific attacker could make a lot of login requests
17:44
We've got a teambuilding event today. About 75 minutes left of work.
@Dereleased So plop open beer?
@Dereleased as in "social drinking" ?
@tereško Yeah, our teambuilding event is essentially getting drunk at a local brewery -- on the company dime!
@tereško beer pong and keg stands
I work at a dry institution. No booze for any events. :(
17:46
@Tiffany dry gin?
martini? wine?
We don't have team building activities because they are just a waste of money. We send people to conferences instead.
@LeviMorrison I hate you
!!urban dry campus
[ dry campus ] when the use or distribution of alcohol is forbidden on a college campus.
Anonymous
17:47
Nerds
user4244405
lol
Anonymous
@MadaraUchiha ban them please
@LeviMorrison Both are good. Depending on the actual team
@LeviMorrison we don't not do that. Our company decided to offer an "employee of the month" program, but that doesn't make sense for an engineering department, so we pool the money we'd get for it as a department and just go out together once every three months
@Dereleased do you have a swear jar?
17:48
@Tiffany just paypal me the money
@tereško BTW I did try going through a VN proxy myself and same issue, so must be more than just IP.
Anonymous
@Dereleased lol
I mean in your department, but lol
No, because every one of us would be bankrupt
anyway, lunchtime.
17:49
@Alesana my point is you can't define "an attacker" - hell, the internet still hasn't figured out what a "user" is, let alone a malicious one. don't bother worrying about an attacker, just consider the attack
@Fabor I'll give it a try in couple hours. Maybe they banned "russian hackers" but were not entirely sure, here "russianistan" is .. or how to find it
@MadaraUchiha my kicking of Dave was justified
@Alesana have you considered a DNS based firewall to mitigate DDoS/Distributed Attack/Bot Attack? Full disclosure, my company sells one, so I am not going to publicly recommend any.
Anonymous
@PaulCrovella this @Alesana
No worries, I will be in bed in about 4 so no rush.
Oh actually just tried a different VN proxy and it worked. Anyone got a proxy switching extension and 1 minute free? :P
17:51
@PaulCrovella Okay, I guess that was my question. I will focus on usernames and IPs in that case, in addition to requiring all users type in a CAPTCHA when trying to login if there is a huge spike in global failed attempts
@Dereleased I was thinking about that solution, if it becomes an actual problem I would definitely do it
@Alesana I swear to god I'm not trying to be a salesman, dick, or salesdick, but, do you usually wait to buy emergency supplies until after the emergency has taken place?
Which is to say, not necessarily buy one THIS INSTANT, but do it when you start getting popular, not when you start noticing attacks
@samayo eh, no lol. it's quite pricey
@WesStark How much was the fine. And how much too fast was the fine for? :-)
@PeeHaa winter has come for you my friend
@Dereleased I wait until the likelihood and possible impact of the emergency warrants it
17:55
@PeeHaa i don't know yet. can get the envelope only tomorrow
@WesStark You have to pick it up? That can only be bad
indeed
@Dereleased Yeah that's a good point, I guess I will do that once my app starts paying enough for a DNS based firewall I will buy one
@Alesana =)
@rlemon AHAHAHAHA
ok that was good
18:00
@PeeHaa your requestable page support a proxy option?
@Fabor nope
-_-
Sorry :)
got a browser addon for proxy switching? :P for your nefarious habits.
I don't. I have an openvpn client though
18:03
I knew it pervert!
Would you try xuanvinh.vn with 118.70.109.221:53281 if you get a minute please?
you guys started to speak strange again though. i caught up at some point and i felt i could understand you but now... you are all docker container openvpn nefarious nosferatu requestable mvc pvc microservices wysiwyg
boob.
@Fabor it works
user4244405
yup
Ah sweet, thanks. I was trying to save you some time there @tereško :P
@PeeHaa Abort!
@FélixGagnon-Grenier hi. i havent' read you in a few days. remember that you are here forever [evil laughter.mp3]
Anonymous
18:11
@WesStark Boss's wife needs that software, she has mac ... do you know where I can get one for mac?
@Fabor first impression - at least they have some additional PSU options
@samayo rhino?
Anonymous
Yeah
on their site?
Anonymous
It's not free.
18:12
sketch up?
Anonymous
i started with the educational one though...
eh. don't tell me that :P
that was the biggest expense i had in months
@tereško Some corsair cases too.
@tereško If we can remove lazada stuff that's ideal as that's all shipped. Hopefully these guys have it in stock at their stores.
though, it was 1k euros for me
the mac version was half that or something
@Fabor I might need to re-visit the entire thing, since lazada pars were is discounts
18:14
Rhino 5 for Windows
Rhino 5 for Mac
€ 995
€ 695
Full - single-user 1 1 educational
Rhino 5 for Windows
Rhino 5 for Mac
€ 195
€ 195
@tereško Ah well at least the new site is easier to navigate and more choice
ah well .. not really, since it leads about 10 second :D
lol
anyway, I will get back to you tomorrow with a revised build
:thumbs_up:
18:22
@Fabor btw, it seems that their sit is having some issues: xuanvinh.vn/vga-card-man-hinh?dong-gpu=rx-570-rx-580
lol
"1 billion" does not look like the correct price
or you have serious issues with bitcoin mining
:D 1 billion it about £30,000
you can get an apartment for that here
You can here too.
Average salary LV?
18:24
not sure
@bwoebi can I somehow tell travis to run two jobs. one with php and on with the phpdbg binary?
@Fabor average developer salary is ~1200€/mo
@PeeHaa sure, just set an env var in the matrix
(saw some stats around newyears)
Cool. You have an example in a repo by any chance?
18:25
@tereško Rich compared to the guys here. Get a remote job and move to VN. You'll probably hate it :P
Bring your PC though
@Fabor I probably gave you that advice a year ago
heh Should definitely follow your own advice then
@WesStark hey o/. yeah, I've had some days out, of basically everything...
\o :D
18:41
43 mins ago, by Wes Stark
@rlemon AHAHAHAHA
gn all have great Saturday
@MadaraUchiha sorry
Anonymous
19:18
@MadaraUchiha ban him
@tereško is that before or after tax?
If I want to have a user type in their username and password and click login, then be directed to a page with a captcha on it, then after captcha completion be directed to a page that attempts to login with their username and password, would it be secure to store the password in the session?
Don't store the password anywhere
Also why not just put the captcha on the login form like everyone else
Because I only require captcha completion on a username basis
If I don't know their username I won't know if they need to complete the captcha
I guess I can have them type in their username, then on the next step do the captcha and the password together
What does a username have to do with a captcha?
19:32
But that seems unnecessary
If the username had more than 5 failed login attempts within the past hour
Doesn't really matter does it? Check captcha before checking username and password anyway.
Well if the username hasn't had more than 5 failed login attempts within the past hour I don't want to require a CAPTCHA completion. I guess I will use ajax to check the username without doing anything with the password
I saw this solution here but it seems overkill
Encrypt the password (using e.g. AES) with a random key of sufficient length
Store the encrypted password and username in the session
Store the encryption key in a cookie
don't encrypt passwords
!!docs password_hash
[ password_hash() ] Creates a password hash
I know about password_hash but that wouldn't work in my situation
19:39
Honestly, I would just put a captcha on the login regardless of failed attempts. There's those "Click" ones that are simple enough
sessions aren't really what I would call secure. I certainly wouldn't be putting anything related to passwords in there.
why is password hash not an option?
Store the encryption key in a cookie
jesus, no
password_hash isn't an option because I can't check a password_hash()ed password against a password_hash()ed password
!!docs password_verify
[ password_verify() ] Verifies that a password matches a hash
@littlepootis maybe you want to downvote this answer :P
19:41
Done
Either you don't understand what I'm trying to do, or you don't understand how password_hash/password_verify works
tbf I am also having troubles seeing what you are trying to do :) Care to explain what the use case is?
Haha fair enough
A normal login is two pages, login > logged in, the password is sent through $_POST and then no longer on the server. It's not 100% secure but it's as secure as it can be
agreed
But I want to add a middle step
Login > Complete Captcha > Logged In
And I don't know what to do with the password on the middle step
19:45
No need to store the password
Set a flag in the session that user is logged in, but needs to confirm the captcha
And redirect all pages to the captcha if that flag is set
Ha I feel pretty stupid for not having thought of that
Just don't leak the fact whether it was a valid login or not
@Fabor have you tried a rambutan?
Not sure whether it's actually the correct solution, but it's the first thing I can think of
@Alesana So which part of that means you can't use password_hash?
19:47
@PeeHaa Yeah that makes sense. I guess also I have to remove that flag before trying to log them in, in case they successfully log in, don't complete the captcha, then unsuccesfully log in
@Fabor You mean use password_hash in general for password verification or use it as a solution to my problem?
@Alesana Yes it should reset each time
As said not sure whether it's the best solution. I am currently busy trying to set something up so maybe @Fabor has a smarter idea
yes @Tiffany Big nut in the middle but nice.
@Fabor coworker from Vietnam brought some in for us to try. It was interesting.
@Alesana tbh I wouldn't remove the flag until fully logged in. It just helps prevent any potential attackers actually learning more about your app.
@Tiffany Pretty popular in Asia. Tons of weird fruits here. Big difference is usually smaller and not ripe here. Often inconvenient to eat.
Rambutan is basically a lychee
@Alesana re password_hash I just want to be sure you're using it and not encrypting any passwords anywhere.
it looked like a hairy or spiny strawberry. I thought I was supposed to eat it with the skin at first, but he told me to peel it
19:53
!!? Rambutan
Search for "Rambutan" (https://www.google.com/search?q=Rambutan&lr=lang_en)
• Rambutan - Wikipedia - The rambutan is a medium-sized tropical tree in the family Sapindaceae. The name also refers to the… (https://en.wikipedia.org/wiki/Rambutan)
• What is Rambutan Good For? – Mercola.com - Learn more about rambutan nutrition facts, health benefits, healthy recipes, and other fun facts to… (http://foodfacts.mercola.com/rambutan.html)
• What Is the Difference Between the Lychee, Rambut… - 30 jan. 2014 - The white tropical fruit on its own is juicy and sweet and its two lesser known cous… (http:/
(see full text)
you looked at that and said "yes, I should eat that whole"?
That's one weird looking lychee
That stuff is scary
@PaulCrovella I probably misheard him as I often do, but I thought he said it was like a strawberry, so I assumed I was supposed to eat it like a strawberry
And the tentacles didn't give it away? :P
19:54
it's nothing like a strawberry
@PeeHaa fruits are weird
:-)
@Tiffany heh
@PaulCrovella the one I had looked like a hairy/spiny strawberry, with a paler hue
Reminds of my friend Viet gf here who opened a babybel and took a bite straight through the wax.
19:56
@Fabor Yes I use password_hash/password_verify when creating/verifying a password but it's not relevant to what I was asking about.
creating, verifying & storing.
Nope I use password_hash to create it and verify it but not to store
I just store in plain text
Perfect

« first day (2470 days earlier)      last day (2704 days later) »