« first day (2636 days earlier)      last day (2538 days later) » 
01:00 - 16:0016:00 - 00:00

01:10
posted on January 02, 2018

New Cyanide and Happiness Comic

01:22
/crickets
01:46
{% if fruit %}
{% for item in fruit %}
<p>{{item.name}}</p>
{% set itemsx = 'pieces' ~ item.id %}
{% for itemx in itemsx %}
<p>{{itemx.number}}</p>
{% endfor %}
{% endfor %}
{% endif %}
What's the correct way for {% set itemsx = 'pieces' ~ item.id %}
{% for itemx in itemsx %} ?
@Arthur write a php function and call that function from twig.
/tumbleweed
trying to do complicated stuff like that in twig syntax is too difficult.
@Danack ah ok thnx
Yes heavy wind here too
02:14
I've been working out my roadmap for contributing to PHP this year. My two main goals are improved variance and parameterized types (aka generics). It's definitely ambitious but I am hoping to get the latter approved as a special project by my university. That would allow me to get credit for doing it.
I suggested something like that in the past but this year I'm really pushing for it. I have reason to believe it will get approved this time around.
hope it does
that would be sweet
\o
g'devening
03:12
can i know where can i read on how to change a db value after a certain period of time like about 5 minutes? using Laravel php.. for example the value is '0' at first then after 5minutes it changes to "1". The reason is because each employee is having a different id.. so first employee is 0, second is 1, third is 2 and so on.. so a query will be passed to the first employee and after 5 minute if he didnt do anything with it then it will pass on to second employee.
 
2 hours later…
04:49
Morrrrning
o/
05:10
\o
Wes
Wes
05:23
o/
Wes
Wes
05:45
how are you feeling today joe?
hey guys?
morning room
and morning Joe,Wes.
Morning evrbdy!!..
So, hats are gone. SAD!!
Wes
Wes
06:08
😁😂
lol
user8046090
Good Morning guys
user8046090
Is any laravel expert available here ?
06:27
@ChiragDaxini Ask what you want.
user8046090
Actually i am facing some issues in laravel due to cache ...so how can i disable it completely ?
07:12
I want my glasses back
I want my unicorn horn back. :(
user924016
07:49
mornings
I want my hat back
!!comic angry I want my hat Back
08:19
morning!
since I didn't have the chance yet: happy new year, wish you all the best for 2018!
08:47
@ChiragDaxini rm -rf vendor/laravel will disable it completely
3
whoever is flagging as rude/abusive and summoning everyone with enough privileges to this room to tell you to behave, perhaps just point out why you think the rm -rf "advice" is unhelpful and keep it in this room
thank you
Wes
Wes
laravellian-butthurtage
rm -rf stupid/flags
@tripleee Is someone really calling people from other rooms?
08:59
I got flagged for a sexy Hitler image once. Still pretty salty about that :(
the little arrow on the left of each post has a "flag as spam/offensive" option -- this is what it does. I'm not sure if this is documented properly but the chat moderation, like the Stack Overflow moderation in general, is partially delegated to users with enough privileges; so the first layer of how that gets processed is that I and a few hundred others see a blue balloon in my chat window
Wait, so what level are you? Or why aren't you blue?
you can see my profile for that, it's public information
/me off to ansible -a rm -rf /usr/bin/php
o/
09:02
@tripleee Thanks. Didn't know that.
@mega6382 Once Joe put his phone number on chat and it can't be removed unless your a mod. I wasn't sure what flagging did, I thought that it only called like a handful of people. I told Joe i'd grab a mod to remove and flagged it. Counter-intuitive to the idea of removing the message, it disseminated it to all the mods on SO -_-
\o
Jul 22 '16 at 13:30, by Fabor
Flagging should cost 10 rep. If the flag is invalid the rep goes to the person they flagged. If it's fine you keep your rep.
Here's the transcript from when I wrongly flagged it :P
09:09
Right, nobody move, I have an exact 1:1 twitter following/followers ratio, the internet is now finished, you can all go home
it's not the worst thing I posted to chat ...
my password has been posted a fair few times ...
and then there was penisgate ...
which was all @DaveRandom's fault
I type terminal commands into chat on an almost weekly basis
Damn I am already following Chris and I am too nice to unfollow.
Wes
Wes
284
09:12
@JoeWatkins Every now and then I worry when I paste and hit enter and nothing shows in my terminal. Gotta quick panic as to where my cursor is focused :p
@JoeWatkins I have drawn a lot of penises on a lot of things
@Fabor I use superputty (multi-window tabbed terminal emulator/ssh/telnet/etc client), which is a great application but the focus logic is a bit screwed up and I frequently type terminal commands into chat windows and code editors, compounded by the fact that PHP Storm's focus goes a bit weird when you have a lot of windows open
@DaveRandom huh?
Apparently someone has grown tired of my quality content
Just unfollow @James and you'll be even again
I got unfollowed the other day, when I suggested that people should fuck off or die in a ditch ...
2
09:17
FOODIAD
yes, I was upset that I was not allowed to fuck off and die in a ditch
you were, I gave the option "all of the above" ...
Oh, my bad
@DaveRandom Allow me to disrupt that.
can't wait to see the falcon heavy explode, it's going to be epic
09:27
@DaveRandom You ca follow me back and it will be 1:1 again.
Wes
Wes
@JoeWatkins how many lol
09:47
just 1
@JoeWatkins Was it the guy who told you to remove that you are BI from your profile?
dunno who it was, you don't get told
also you said a stupid thing ...
that it belonged on tinder ...
That was a joke.
:(
jokes are funny
I am sorry, btw.
09:52
accepted
10:14
nightly broken on travis?
composer self-update seems to fail every time
Anonymous
10:31
naming help. There's this shitty VO named SessionWithAvailabilityPresentation - Naming for a class that sets some properties of that VO (conditional and elongated)? config just doesn't fit with a presentation VO..
Wes
Wes
you don't set properties on VO, VOs are immutable :B
Anonymous
ughhhhhhhhhhhhhhhhhhhhh
Anonymous
I'm so bored of shit code.
Wes
Wes
:B
@Wes eh, maybe
Is a state bucket not a form of VO?
@JayIsTooCommon hows the whole alternative career thing going?
Wes
Wes
10:35
macho macho man i want to be a macho man
@samayo Yeah, hit me up when you're around for stuff like. Do you use the discord server?
I'll settle for "man". Even just "human".
Wes
Wes
@DaveRandom canonically speaking
mutable value objects make sense to me, but they say they must be immutable
who is "they"?
Wes
Wes
who coined the term :B
the ddd guys
10:39
The thing about listening to people who coined terms is that they usually do it early on in the lifecycle of a concept, when it hasn't been applied to the real world much, and they frequently turn out to be wrong a decade down the line
immutable value objects are a good idea. see datetime...
Wes
Wes
immutability is a good idea in general
@JayIsTooCommon do you fancy moving to Bristol?
I have rarely found a moderately complex abstraction which does not leak when you try to use immutable everything everywhere, you either end up with unresolvable cyclical conflicts or ctors with 20+ args
DDD doesn't say everything has to be immutable, only value objects
10:41
@Patrick immutable value objects are a often good idea
if it's mutable, it's not really a value object anymore
that's fine, just don't call it VO :)
Sometimes immutability is directly at odds with avoiding global state (and sometimes global state is an actual thing which makes sense, as well...)
Anonymous
@DaveRandom Yeah I got in but got about half a year before any movement.
@DaveRandom are we still talking about value objects?
Anonymous
@Danack I've always fancied Bristol but looking at Cheshire atm. If that falls through, most certainly :)
10:47
@DaveRandom I am finding myself having less and less worry about having ridiculous argument lengths for functions when converting from one type to another....if the objects are that complicated, then it's kind of natural for their functions to be appropriately complicated.
Anonymous
@Sean I don't use that server. Give me your battle tag
@Patrick possibly slightly different definitions thereof. To me there is an object that "is stuff" and one that "does stuff", I don't mix the two, but sometimes what a thing "is" can change. For example, a properties of a user context may change (e.g. "last seen time") without the entire object being re-created.
A datetime is immutable, an IP address is immutable, anything that I would define as a struct in C# is immutable, but it's not a hard-and-fast rule.
@samayo b..but you were there in the server tho...
Anonymous
@SaitamaSama Yeah, but I only logged in once. I don't even have the link for it now
10:59
shared.php.net not available – #75753
Anonymous
@SaitamaSama Why do we need discord again? Are you always online there?
It's kinda more convenient for games
Anonymous
It's much easier to add someone as friend on OW and see when they log in though...
like you can do ingame chat with discord
Anonymous
you can link dicord to the game?
11:01
yeah
like when I play Overwatch or smth, Discord shows under my username playing Overwatch
@DaveRandom DDD doesn't separate doing and being. An object that is identified/compared through it's values is a VO. If it has a separate identity then it's an entity.
a user would be an entity btw
facing problem while setting virtual hosts on mac. "quitch.local" takes to google search
my vhosts file code

<VirtualHost *:80>
DocumentRoot "/Applications/XAMPP/xamppfiles/htdocs/project/public_html"
ServerName project.local
ServerAlias *.project.local
<Directory "/Applications/XAMPP/xamppfiles/htdocs/project/public_html">
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Anonymous
try: http://quitch.local
shows blank screen
:(
internal server error
Which means its working
11:16
@masud_moni type in quitch.local
and then swear at google.
why it is giving error 500? is the code of vhosts wrong?
4 messages moved to Trash
455
Q: How to get useful error messages in PHP?

CandidasaI find programming in PHP quite frustrating. Quite often I will try and run the script and just get a blank screen back. No error message, just empty screen. The cause might have been a simple syntax error (wrong bracket, missing semicolon), or a failed function call, or something else entirely. ...

Anonymous
@masud_moni check your logs
now my apache is not starting :'(
[Wed Jan 03 17:21:34.659676 2018] [mpm_prefork:notice] [pid 59136] AH00169: caught SIGTERM, shutting down
11:28
Feb 20 '17 at 9:19, by Sean
Sean#2321 If anyone wants to beat up some nerds virtually sometime.
Oh boy, fun times. Should a native mobile app have to go through a browser to login with oauth? You can't exactly store a client secret on the app
You could have an end point which accepts the un/pw and submits it to the oauth server with your id/secret wrapped, but then that's open to abuse
@Sean wanna play rn :B
@SaitamaSama At work ^^;
meh... :B
Anonymous
@SaitamaSama rn?
right now
Anonymous
11:34
I'm trying to buy one of these, but still can't decide: digitec.ch/en/s1/producttype/…
Anonymous
chip in if anyone know the good ones
coooool
Anonymous
@SaitamaSama nice
Anonymous
You wouldn't pull that shit on me though. I'm now on level 28 :p
11:40
@samayo I enjoy my Chroma DeathAdder immensely
Not too expensive either
@samayo I am on 15. I rarely get a chance to play. Work sucks. :(
:P It was one of the non dragon blade ones... I got some pretty dope soldier PoTGs today as well
amazon.com/Razer-DeathAdder-Chroma-Overwatch-Comfortable/dp/… there's even a Overwatch version for it :B
Anonymous
@MadaraUchiha costs 111.- here digitec.ch/en/s1/product/… it's pretty expensive. I would've bought it if it was wireless though
@samayo If you want anything to game with, don't go with wireless
^ that
11:45
Why tho?
btw, senpai, please teach me how to widow
@mega6382 the input lag
Anonymous
But it's only about meticulous details isn't it? I don't need a mouse that calculates something a millionth of a second. But my biggest problem is wired mouse is inconvenience. I need something as portable as possible
12:14
mornin
Anonymous
\o
Wes
Wes
12:26
\o
@Leigh I don't have a favorite sport.
Error parsing dates with "BRST" – #75754
fuck, I still can't remember the argument order for array_key_exists()
I would guess ($key, $array), but I don't know either
12:43
@tereško Then use an IDE that does.
@JoeWatkins why do you hate all people? (not judging, just want to compare notes)
4
@mega6382 Or... and this is a revolutionary concept, use a language with sane parameter names and order :D
@MadaraUchiha Now that's just crazy talk. :D
@MadaraUchiha actually, the best option would be for php to start introducing object-oriented interface for utilities on arrays and strings
12:54
@MadaraUchiha someone will have to create one first.
@tereško and objects, and numbers, ... and kittens, right?
@DaveRandom Puh-leeze, even JS is more sane than PHP in that regard...
@tereško Is there an RFC for that?
Don't answer that, I already know the answer. Are you guys close to having an RFC for that?
@salathe naah, the rest as at least slightly reasonable, but the array and string utilities are a complete clusterfuck
@DaveRandom The reference flew over my head
12:56
@DaveRandom is that some new white-powers sign? I think we need to report him to SPLC.
I'm down with the kids
.. you might have a doctor look at it then
@tereško *deletes RFC draft for introducing the kitten type to PHP*
pffft, they're always talking about "facts" and "evidence". I'll stick with my shamen, thank you very much.
I don't want to even ask
13:11
Angular is a bitch.
Anonymous
word!
Wes
Wes
@Jeeves bring me a tea
@Wes How about Earl Grey tea?
Wes
Wes
@Jeeves i prefer english breakfast tea
@Wes Huh... I didn't know that was a song!
Wes
Wes
13:14
ur drunk again
Gal
Gal
is zf2 still alive?
kinda
Gal
Gal
why just kinda?
Was zf3 ever released?
Anonymous
hmm
13:23
Any good PHP router suggestions?
that's why kids, use ryzen
@JayIsTooCommon Intel CEO sold ~$40M of Intel holdings last month
Hmmm
Anonymous
!!package nikic/FastRoute
@JayIsTooCommon No matching packages found
Anonymous
@JayIsTooCommon
@JayIsTooCommon Thank you!
At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers.
:D
Anonymous
:B
@JayIsTooCommon How is handler used in nikic/FastRoute?
Gal
Gal
13:28
@MadaraUchiha really? holy shit..
Wes
Wes
@JayIsTooCommon i read intel's ceo sold a lot of his shares lol
Anonymous
@MadaraUchiha ^ look at this guy
Anonymous
who does he think he is.
Wes
Wes
yeah i read. damnit guys relax
4 mins ago, by Madara Uchiha
@JayIsTooCommon Intel CEO sold ~$40M of Intel holdings last month
Anonymous
13:29
C:
nevermind
thanks
Anonymous
@AbrarAhmed not sure, sorry
... and billions and billions and billions and billions and billions ...
billi-janson bill-janson
Wes
Wes
contemporary [Intel] CPU architectures
is there a list of the actual cpus?
i want the pipe operator so much
13:57
Is it ott to store pkce hashes using password_hash?
I mean it's already hashed..
@Sean The question is whether you can use the pkce hash itself for something
Consider the following scenario: I bcrypt on the client, and send the hash to the server
Down to the dev who generates & sends it to you
In this case the hash becomes the password itself
If I can find the hash, I can log in to your account
Which beats the purpose of the hash
The idea is what you have a bunch of hashes in the database, that on their own mean nothing
So the question you should ask yourself is "If an attacker got hold of the pkce hashes, what can they do?"
Has everyone seen this? laraelite.com
7
14:06
In theory if the person generating the hash has done it manually then it could be rainbow tabled if the attacker compromises the DB. It's incredibly unlikely, but possible, since the standard is to use sha256. if the hash is then hashed on our end then I'd like to think the chance of the original hash being brute forced is reduced, but I don't entirely know.
The bad stuff would be if an attacker was able to get hold of the hash and managed to derive the original value within the 5 min expire window, they would be able to claim the access token (providing it hasn't been claimed) and use it.
@Sean The idea isn't whether the hash can be broken
The question is whether the hash itself carries significance?
@Ocramius Literally 6 messages up
dang
I'm just enjoying it so much, sorry
Can an attacker do anything if they have the hash?
@Ocramius See my response :D
14:09
@MadaraUchiha Not by itself I think. It has to be compared with the original unhashed value, and it's used for nothing else except that
@Sean Then there's no point in hashing it again
As long as the hash by itself has no significance, you don't need to do anything further to it.
@MadaraUchiha did you watch Overlord's Second Season?
The first ep
@SaitamaSama Of course :D
14:29
Just observed the IT intern ignoring a person wanting some assistance and pretending to be absorbed in what he was doing for a full minute. There's hope for him yet.
@DaveRandom :D
Sounds like the kid has a future
@Ocramius who put catch (new …) there :o
Anonymous
Is it not wrong to rely on type hinting to protect us against sqli? I.e. I wouldn't expect that by removing a typeHint, I could be adding a sqli exploit.
@ircmaxell Was already posted twice :D
Anonymous
Actually having to have this conversation with a senior... who told me I don't need to escape x value because the VO origin is type hinted to :int.
hehehe
@JayIsTooCommon How does a typehint help you mitigate SQLi?
Anonymous
14:57
^
What happens when an arbitrary string gets cast into an int?
Anonymous
Like a genuine comment on my PR.. "This escape isn't necessary because the VO can only return :int"
@Sean the effectiveness of a rainbow table has nothing to do with the underlying hash function (provided it's a fast cryptographic hash, which sha256 is)
@JayIsTooCommon If you're escaping instead of using prepared statements you're doing it wrong regardless, yeah?
Anonymous
Yes :)
Anonymous
14:59
23 hours ago, by JayIsTooCommon
This system uses Laravel as their API, PHPMaker for their CMS and Angular 1 for their POS. Questioning the context just results in people suck.
Fair enough
@Sean just use sha256 (or sha3 if you can). If it's high-entropy data (>=128 bits of random input), then rainbow tables are going to be useless anyway
@Sean password_hash (and all pbkdf style functions) are designed to "stretch" low entropy input (like user-generated passwords, etc) into something suitable for a key. But keys aren't low-entropy. And the security model of OAuth2 requires the PKCE be random, you can safely assume it's high entropy
@ircmaxell Aye, brain fuzzled but of course the algorithm doesn't matter when using a rainbow table.
Speculation over. Intel bug has been reproduced with a PoC. https://twitter.com/brainsmoke/status/948561799875502080
I'll be forcing sha256 (minimum), won't allow plain
15:05
@JayIsTooCommon sounds like "avoid at any cost" system
Anonymous
!!wotd
patrician a person of noble or high rank; aristocrat.
@ircmaxell "PoC" is an acronym with too many decryptions
@ircmaxell I read about that last night. Very troubling
@tereško Proof-of-Concept
15:07
tnx, I already deduced it from the context
or .. well ... more by method of elimination
Anonymous
What is it that he's managed to do there?
@JayIsTooCommon read kernel memory from a user-land process (specifically the kernel's symbol table (functions it has)
Anonymous
dear me..
Wes
Wes
isn't selling shares like the intel ceo did considered illegal trading?
10+ years of processors lol
Anonymous
15:13
@Machavity I know I posted it >>>>> But only understood layman terms
Intel has this dynamic "guessing" system designed to lower processing times. But you can make it guess wrong and return information from unrelated processes
@JayIsTooCommon it's one of those cases of "as an AMD user ..."
Ryzen ftw
So OSes have to essentially "wrap" processor calls to get around it. So now you wait two cycles to get data. Gonna slow down users of those processors significantly
Threadripper ftw
15:16
This couldn't have happened at a better/worse time, depends on whether you're AMD or Intel respectively 😃
Anonymous
we're so not ready to use computers..
cant they (intel) fix it in microcode?
@JayIsTooCommon Ah, missed the star. Sorry
Anonymous
@Machavity your explanation helped :)
@tereško no
15:18
@tereško Built into how the chips work apparently
So, this has to do with branch prediction
basically, if statements are expensive, because a modern processor is "pipelined". Meaning if it does 12 operations to complete an instruction, modern processors parallelize that so that it's doing each operation on a different instruction.
So in practice, if there's 12 operations, the CPU is executing 12 instructions at a time
reminds me of the Pentium's FDIV bug ... but I guess this is actually a lot worse (since that one was fixable in microcode) (and that time they did a per-request recall)
the problem comes when there's a branch (if statement). The CPU doesn't know which "branhc" is correct
if it doesn't "guess" and waits to know, it needs to wait for the if statement instruction to complete before starting the next instruction. This results in a massive penalty
@MadaraUchiha I'm curious if the speed difference between the i9 and the Ryzen wasn't based entirely on branch prediction
Anonymous
Is this going to be a domino realisation for other processors or certainly intel-specific?
15:21
so modern processors use "branch prediction" which tries to guess which way a branch will go (based on a lot of factors) and then start down that path. This means that if it guesses right, there's no cost to the branch. And if it guesses wrong, it flushes the pipeline and starts over again (a branch prediction miss, quite expensive)
I believe the most upvoted answer on Stack Overflow explains branch prediction :D
this particular case is not branch prediction, but speculative execution (a related concept, but slightly different). It starts executing code it think may be executed. The problem is that security checks in the CPU are only done once the execution actually happens (it's not done before in the speculative executor, where it is in AMDs designs)
Speculative execution is an optimization technique where a computer system performs some task that may not be actually needed. The main idea is to do work before it is known whether that work will be needed at all, so as to prevent a delay that would have to be incurred by doing the work after it is known whether it is needed. If it turns out the work was not needed after all, any changes made by the work are reverted and the results are ignored. The objective is to provide more concurrency if extra resources are available. This approach is employed in a variety of areas, including branch prediction...
the reason Intel designed it this way is that the operation isn't complete before the security checks happen, therefore they didn't think they needed the speculative portion to check it ahead of time. But it turns out there are side effects (my guess is related to cache usage)
(and only now I remembered, that @ircmaxell has actually built a CPU .. or few)
hehehe
Anonymous
@ircmaxell You have a good talent of explaining things. Takes me back to timing attacks where your post was the only one I could understand without self inflicted head trauma. Now write a book god damn you.
15:29
@ircmaxell Maybe you should post a PwA about this
With some visuals
@tereško Isn't it basically taking a flattened rock and tricking it into thinking?
Oh, and you also need to put lightning in it.
I've thought about doing a few more PwA's... I may, need to think on scripts
👍 I've missed your explanations, they're always well made :)
thank you :)
@ircmaxell This article gets into Intel's speculative execution side-effects: cyber.wtf/2017/07/28/…
So yea, seems to revolve around "tricking" the OS into speculatively loading some kernel memory into a cache line and then reading that
Probability looks the same in 64 byte blocks, implying cache lines. Theory: permission check happens when the memory isn't in some cache. If the permission check passes, it's brought into L1 (so user memory always works), otherwise the caches stay the same and it uses zero.
o_O
At this rate we're going to have a reconstructed PoC before the end of the embargo, and before the patches are ready
15:52
yup
But yeah, this is receiving quite a bit of attention
@MadaraUchiha we (as in - humans) have become like the gods of old.
01:00 - 16:0016:00 - 00:00

« first day (2636 days earlier)      last day (2538 days later) »