« first day (3347 days earlier)      last day (1583 days later) » 

12:06 AM
why is phpstorm putting a red squiggly under public function adopt ... "Cannot make static method AnimalShelter::adopt(name: string) non-static" when there is no static at all
even tried creating a new file and pasting the code in that, maybe it still had the previous code indexed, but even in the new file, it complained
 
I forgot something
interface AnimalShelter
{
public static function adopt(string $name): Animal;
}

needs to lose the 'static'
 
interface function didn't have static though... but after creating a new file and dumping the covariance code into that, it shut up
I'm going to type it up tomorrow, my brain's melted
even after all of this, I still have trouble keeping covariance/contravariance straight in my head
 
Yeah they're arkward
 
but bloody useful
 
Covariance = Making a return type more specific
Contravariance = Making a function parameter less specific...

Or is it the other way
 
12:18 AM
yeah, I had to write out on paper
covariance - return type, more specific
contravariance - parameter type, less specific
not sure why I preformatted that
 
 
2 hours later…
2:07 AM
Any idea what the best compile-from-source guide is that I can copy from?
 
For PHP ?
Pretty sure the doc of PHP-src is the best around with phpinternalsbook
 
2:27 AM
php-web.markrandall.uk/versions/7.4/install 2 install methods down, 4 to go.
 
 
7 hours later…
9:28 AM
o\
 
 
1 hour later…
10:50 AM
@MarkR i believe the PPA also works on debian, might be wrong
Awrsome work
 
That would make sense. Thanks @beberlei I'll give it a try and update the description.
 
 
1 hour later…
12:06 PM
@MarkR I can't remember what versions of PHP web platform installer has, but MS has their own instructions for installing PHP with Windows/IIS, which uses web platform installer, their package manager for web servers
It's been almost a year since I used it
 
I'll have to check but I think it was old
 
There was only one time I manually installed PHP on a Windows/IIS server
 
Lemme install WPI and take a look
 
Hopefully they've updated the versions of PHP it ships with
 
7.2.19
 
12:09 PM
I cringed every time I installed 5.3 because that's what the legacy code I worked on supported
Bollocks
 
Although I see you can actually install 5.3.28 with it
 
Yeah >.<
Well, time for tea...
 
You're going to have to be more specific. I'm English. It's always time for tea.
 
@DaveRandom got me hooked on English breakfast tea a while back, so it's what I use for caffeine now
 
Yorkshire Gold. The best tea.
 
12:22 PM
How's it compare to English breakfast?
 
Fair bit stronger. You have to go really quick on the brew or it goes overpowering
 
I have to be careful with how much caffeine I have
 
It's not the caffeine content that's strong, it's the tannins in it
 
Ah. Shows you how much I know about tea.
 
tried running composer install in linux as root and it warns me of not to run as super user/root. I checked the link also. Says some third-party plugin will have access to the whole system as the root user. Do the same thing should happen in windows also ? When Its run as administrator.
 
12:36 PM
Normal users don't have the same 'root' abilities on Windows as they do on linux
So while it's still dangerous, there's still some level of protection unless you decide to run it as SYSTEM
although not much
 
I ran into a problem on a server one time, it wouldn't let me install a package through composer unless I ran command prompt as administrator. I couldn't find a better solution.
It's even something I asked on SO main
 
Even administrator isn't really root on windows
Root on Unix is the equivalent of NT_SYSTEM on windows
 
Actually I have already run it as root user in linux , so I would like to get some advice on it.
 
Is every file in your PHP directory owned by root?
 
@MarkR people are always baffled in France when you tell them you can share one tea bag of Yorkshire gold with like 6 people and still have it strong enough to add milk in it :')
 
12:49 PM
@MarkR I suppose so
 
Well are they or not? Because if not, then any file potentially becomes a promote-to-root vuln
The thing about composer is, even though composer itself is trustworthy, can you say the same about anything else it runs, like setup scripts?
 
How can I check that whether PHP directory is owned by root or not?
composer install --no-plugins --no-scripts
composer update --no-plugins --no-scripts
i have run these commands afterwards. Is it fine?
 
ls -lta and see what ownership the files have in your PHP directory
 
AFAIK that's the recommended method of disabling third party code running. Wouldn't bet my server on it though.
 
Yes every file is owned by root...
 
1:01 PM
Are you running this in docker by any chance?
 
Might one ask therefore why you're running it under root in the first place
 
I am using nginx for running php. And it is working only as root user
 
Yes but the bit running PHP itself will be FPM, which starts as root but then changes its u user down to www-data for the r unning php bit
 
Oh I see. So is there anything I can do there to secure system?
 
1:11 PM
Don't run it as root.
Composer that is
Not that it'll make a huge difference if you're disabling plugins and scripts
 
chown the php files? I dunno
 
I wont again! Thanks bro ..some simple mistakes could cost a lot
 
It's not the biggest danger in the world, but why have that risk if it's not going to benefit you anyway?
 
I have done it as we do normally
frankly say I did it as i use to do npm install and update as root , but i didn't get a warning like these
 
1:38 PM
So now npm can't be ran as root
Thanks again
 
2:23 PM
There is no string concat in the Zend API right? >_>
 
2:37 PM
I think you need to ask Levi, I think he and nikic were discussing adding one, maybe they already did
 
I found concat_function
Which seems to do what I want
 
cmb
3:06 PM
@Girgias, if you have to concat several/lots of strings, consider using phpinternalsbook.com/php7/internal_types/strings/smart_str.html
 
@cmb I'm trying to do the thing where you can assign empty or multiple bytes to a string index
And I'm trying to figure out how to split the zend_string at the given offset
I suppose I need to fallback to C strings
But if there is a better way that would be great
 
@cmb Can I borrow your knowledge a sec? I'm trying to find something resembling a list of conferences in the web source, but all I'm able to find is news items with tags. Does that sound about right?
 
cmb
@Girgias, ZSTR_VAL(zend_string*) is the char* of the zend_string. concat_function() appears to be overhead.
 
@cmb I think I have one case for the concat_function wich makes "more" sense is with the case when the Zval is getting concatenated at the end of string when the offset has been extended.
 
cmb
@MarkR, maybe you're looking for include/pregen-news.inc ?
 
3:14 PM
Aye that's what I'm using so far to populate a conference feed but I'm unable to find any source data, unless that is the source data
 
Pretty sure it's edit that file to add some news/confs
 
cmb
@MarkR, sources are in archive/ (these are mixed entries though); I think pregen-news.inc is generated by a script, but didn't find where that script would be.
see e.g. github.com/php/web-php/pull/307 on what is modified in repo to add a conference.
@Girgias, if you have zvals, concat_function is likely the way to go. If you already have zend_strings, zend_string_extend() is likely more efficient. See also phpinternalsbook.com/php7/internal_types/strings/…
 
Ah okay, so just generic feed items rather than a discrete conference
Thanks @cmb
 
@cmb Yeah I'm looking at that but I realized I've already converted the zval to zend_string so ...
 
 
1 hour later…
Looks decent thus far
 
4:39 PM
Requesting reviews on a page I would like to add to the PHP site explaining covariance and contravariance: gist.github.com/tiffany-taylor/2656a8011794e367530c33c0a689e0d0
2
 
4:56 PM
For some reason I hate these oversimplified illustrations with animals or simple objects for the class model...
 
because it defies SOLID code
but, it's easy to understand for newbies
personal preference, I'd rather have example code with a tangible object than foobarbaz
foobarbaz just breaks my brain
 
Foobarbaz is almost as bad as class A, B, C
 
> zend_mm_heap corrupted
Woops
 
you done broke it
 
I did indeed :(
 
5:03 PM
Hi, I have been attacked by sn1per ransomeware. Which encrypted my entire hosting account files and folders and demands bitcoin to unlock.
 
Do you have a backup?
 
restore a backup
otherwise, depending on how important/costly the data that was encrypted, either pay the fee, or count it as a lesson learned and start over
 
@Tiffany, no backup available... Is it so easy to encrypt and demand money ?
 
Yes
They wouldn't do it if it wasn't
 
Then where is the security?
 
5:07 PM
In what?
 
keep your software updated, your OS, your application, keep up-to-date on secure coding practice (Top 10 OWASP)
 
Lemme guess, they're using an old version of PHP that wasn't updated to handle the FastCGI vuln
Contact your ISP, it may not only be you.
 
:S
 
It's a GoDaddy web hosting account.
If someone encrypt entire files on hosting. Can't understand how can they enter into the system.
 
they found a vulnerability and exploited it
 
5:10 PM
It's what happens. Someone finds a hole and then someone exploits it.
 
@MarkR I'm using PHP 7.
 
PHP 7.what?
 
@ARJUN which complete version
So 7..y.z
 
all it takes is getting access, then finding vulnerabilities to elevate their permission level until they can do damage
read up on pentesting some time
 
I prefer parker jotters myself.
 
5:13 PM
what about pen island?
lol
 
I did use to be a big fan of the vector
 
@Girgias I don't understand. I know it's PHP 7.2 is the current version of PHP
 
7.4 is latest nevermind
 
What is your patch version
So 7.2.x
 
Yes, 7.2
 
5:16 PM
7.2.25?
 
I can provide my website link here :)
 
Because the vuln @MarkR is talking about got patched in 7.2.24
 
what is the number that comes after 7.2?
 
That's not helpful at all
You are not giving the info we are asking you currently
There are 25 versions of PHP 7.2
And most of them are vulnerable
 
voqeoit.com
 
5:17 PM
Not helpful
 
twiddles thumbs
 
Just run metasploit against it, will quickly find out :p
 
Ok, @Girgias let me check in my cpanel
 
I'm trying to stop making PHP die on my strings
So :')
 
@Girgias your heap still corrupted?
 
5:18 PM
@Tiffany yes
 
I've just included symfony/console into my phpweb composer file, now it's on :p
 
@Tiffany I corrupted it trying something else
 
~~~favourtism~~~
 
Currently I'm getting a mungle of bytes in a wrong encoding lol
 
if an RO is about, can I request this be sticky-starred for 48 hours? chat.stackoverflow.com/transcript/message/48118085#48118085
 
5:19 PM
Gosh do I suck at C
 
better than me :D
 
C++ all the way
 
thanks
 
Any blog or posts available on "SN1PER RANSOMWARE" ? Google is not helpful on this :(
 
if you don't have a backup, you're basically shit-outta-luck
 
5:22 PM
@Tiffany oops :(
 
make a cost assessment, if the data is worth the cost of the ransom, pay it; otherwise, start over
and keep regular backups next time ;)
(and test those backups monthly to make sure they're actually backing up and useful, cause otherwise a backup don't mean shit if it doesn't work when you need it)
 
I can rewrite but it consume lot of time as it will be by scratch again... Well by this I assume there is no way to come out of it.
 
You could try paying the ransom, but there's no certainty.
 
sometimes contacting the person who did the attack on you can help... explain your situation and why you can't pay... sometimes they have pity on people
 
Or if you're desperate, sometimes they'll up the price. Take your risks.
 
5:28 PM
yarp
makes me think of ganking in vanilla WoW on a pvp server...those were the times...
or having my ship blown up in Eve in low sec/null sec
though, usually I was the one doing the blowing up when I was in a pirate corp... >:D
 
My ships blew up many a time. Less so after the reds knew I triple boxed T2 siege revelations on the other monitor.
 
oh dear lord
 
I've not played in years
 
same
 
It's really gone to shit =\
 
5:32 PM
@Tiffany ha ha... @MarkR yes they can demand more
 
That's what happens when CCP wants zomg big 5000 man fight to get them press
and forgets that 5000 man fleets are oppressive to everything else
 
or some senior officer stealing thousands worth of shit from a corp bank then jumping ship
 
We had a hostile supercapital umbrella move within range of us, then some of their pets attacked us. We could have killed the attackers but had zero hope against the super fleet their allies had dropping revenants and avatars.
I think about 90% of our alliance stopped playing
 
ouch
 
Yup
but that's EVE for you
 
5:39 PM
indeed
 
 
1 hour later…
6:52 PM
@NikiC Throwing exceptions in destructors sucks, but do you think converting any exceptions thrown in destructors into fatal errors would be any better in the long term?
"Hey, don't do that."
 
7:14 PM
@LeviMorrison no. e.g. running tests: do you want to abort immediately or just fail that test?
 
I feel I'm doing something dumb by brute force writing it like that ... oh well code review will tell me if there is a smarter way
 
@bwoebi Doesn't really matter in that case.
 
7:39 PM
@LeviMorrison Having places that convert exceptions to fatal errors tends to be a pita
See __toString
And in my experience the big problem with destructors is destructors, not exceptions in destructors ;)
 
Is this supposed to work as of 7.4
class Model {}
class User extends Model {}


abstract class AbstractSchedule {
    public ?Model $job = null;
}

class ScheduleClassExample extends AbstractSchedule {
    public ?User $job = null;
}
 
@Ghostff no, this is unsound
 
Deleted. Missing the class which would prove the point
 
@NikiC what is unsound, the code pattern?
 
Imagine you had multiple kinds of Models.... .UserModel, AddressModel
and you had a function which accepted an argument of type Model
You'd think... well I can assign anything that is a Model to it.... but that wouldn't be the case, because you've tightened the type requirement on your child class.
 
7:46 PM
@NikiC while you're there care to have a look at github.com/php/php-src/pull/4940? It's a new take on adding ZPP and type errors to count()
 
Child classes have to allow whatever is required by their parent, or wider (in 7.4 with conrtavariance)
 
@NikiC Do we want to sometime introduce something like public ?(extends Model) $job;? so that such hierarchies may be described?
and this extends then means that it is defined by the implementing class
but that field has at least the properties of Model
 
Would break the contract either way wouldn't it?
 
@MarkR no, because now the contract is: you must not assign unless you know the implementing class type
instead of: you may assign any Model
 
@bwoebi aka generics
 
7:54 PM
yes
@NikiC do you intend on making generics happen in PHP 8.1? (i.e. sometime in not too far future)
 
@MarkR maybe I dont get it quit right, doesn't contravariance work on properties types?
class Model {}
class User extends Model {}


abstract class AbstractSchedule {
    abstract protected function job(): ?Model;
}

class ScheduleClassExample extends AbstractSchedule {
    protected function job(): ?User {}
}
works fine.
 
@Ghostff no
Because it's read and write
 
@Ghostff You have to think of it the other way, it's not a matter of reading, it's a matter of writing
 
@NikiC or other question: what are your "big changes" you want to start working on in the next 2 years?
 
Read-only can be covariant, write only can be contravariant
 
7:57 PM
Generics and I will buy you wine and or alcohol of your choice :P
 
But because of both it needs to be invariant
 
8:25 PM
Need someone to check my thinking on this please, ideally someone with RM experience... right now the release history is split between two huge arrays, and each one then has a completely separate release announcement file.

I'm thinking that if I keep each release self-contained in a single XML file, I can then generate the PHP array from that, or eventually, shove it all in a DB
 
 
1 hour later…
9:39 PM
@Ghostff does my write up on contravariance help at all?
I should've put review/feedback in my original message
 
@Tiffany which Appendices?
 
yeah, just confused of the core implementation.
 
I keep thinking of adding something at the end like "if you have trouble remembering what covariance and contravariance do, just remember covariance : more specific : return, contravariance : less specific : parameter," but it feels out of place for PHP documentation.
@Ghostff I'm looking for feedback on it before I submit it to PHP docs. If I should change anything.
I'll need to credit @MarkR somewhere, maybe in the commit message, for help with the example
 

« first day (3347 days earlier)      last day (1583 days later) »