« first day (3350 days earlier)      last day (1822 days later) » 

Wes
Wes
04:28
@NikiC it's not gonna work, because we don't have a equals() that allows me to create distinct objects that the weak map considers equal keys
meaning i can only use identity
04:42
\o
Wes
Wes
05:05
hey joe, mornin. pls have a look at the gist i linked above when you have some time
 
1 hour later…
06:07
Good morning
 
1 hour later…
07:31
@Wes I resisted the idea of adding "handlers" of any kind ... I'm still resisting it ...
Wes
Wes
stop fighting, and let's get them :B
it's not a good idea, the nature of weakrefs means an application that uses them is going to have a lot of them most likely ... think about what that means ... from a distance you can alter the performance characteristics of any object you can access, you must be careful with that ... that means not inserting function calls for every object ...
at the moment, you can't notice any degredation because everything is done at the lowest level in the best possible way ... if we start handing over to userland, we ruin everything ... people won't want anyone to use them ...
try convincing nikita, it's not going to work on me ...
Wes
Wes
08:06
@JoeWatkins 3v4l.org/gApOY did you check this?
Wes
Wes
08:29
i don't understand what you are referring to though
the handlers must be called only on destruction
like destructors
08:44
!!rfcs
Is it dead again?
@AsyncBot Bad Jeeves
08:57
No plugin yet
Async is partially complete
09:09
How to capture only 2 characters word only?
$txt = '7     LBU 20/2045 2125  MH3232 JC DC IC YC BC LC QC GC    AT7C*';
preg_match_all('/^([A-Z]{2})$/', $txt, $matches, PREG_OFFSET_CAPTURE);
Though this doesn't work
@Cleancode /\b[A-Z]{2}\b/ maybe?
@NikiC Thank you man :)
09:23
sure but dtor was written by the author of the class, they know about the perf characteristics of their class, but it's impossible for anyone to know exactly how an the performance of any object will be impacted if we allow you to insert your own user code ...
Anyone know what produces %s(%d) : Warning - %s style messages?
@JoeWatkins i didn't mean to write another post, that would be more work. I just think people will not connect the dots from the archived repo, the place where they probably end up, and your blog and the new parallels extension. If you link them from pthreads repo then this is probably reducing the amount of messages
@beberlei I've implemented ObjectStore API in Z-Engine, it provides an access to all objects in the engine by object_id (spl_object_id) github.com/lisachenko/z-engine#objectstore-api
@NikiC why is the "Differences to spl_object_id() and WeakReference" section tacked on to the end of the document?
09:39
@beberlei so, you can return an object by ID without having a reference to it anywhere except global zend_objects_store. It's kind of WeakMap implementation...
@lisachenko we cant make FFI a requirement for doctrine though :)
Unless we want to reduce our userbase to near zero ;)
10:08
@salathe Supposed to be an appendix, as it's not really part of the proposal, just some additional explanation
10:56
@NikiC Oh, I think that's a mistake and should be in the body of the document, but at least put an "Appendix" heading.
Also, I apologise again for mentioning crap like this after the vote opens. :P
If I have a table in mysql as select columns from many tables using inner join, how to add a new column to it
@beberlei Good plan! Follow it )))
FFI is enabled by default, thus, starting with PHP7.4 any library that depends on FFI should work without issues. But still, FFI is too dangerous
@lisachenko You still need to install and enable the extension
11:04
@NikiC I was sure that it is bundled...
Ah, indeed... To enable the FFI extension, PHP has to be configured with --with-ffi .
Was it changed?
No, nothing changed
@PeeHaa How realistic is it to implement user accounts for bugs.php.net?
11:20
Writing a PHP test for my wrapper over EG(current_execute_data)
$thisValue = Core::$executor->getExecutionState()->getThis();
$thisValue->getNativeValue($instance);
$this->assertSame($this, $instance);

// We can do crazy things like changing $this in current stack frame
$self = $this; // Save current $this to call method on it later
$thisValue->setNativeValue(new \stdClass);
$self->assertInstanceOf(\stdClass::class, $this);
Crap ) where are the rules for formatting?
11:43
@lisachenko default enabled yes but only during preload afaik? So significant usage hurdle. Also its not installed by default in ondrej ppa for example
Also really not a friend of FFI for 99% of all use cases
Z-Engine supports preloading. It would be nice to have support from the Composer too, but they decided not to worry about preloading
@beberlei Yes, I can understand your position
@Derick Is it possible to do an IP based ban of rhsoft?
for which service?
bugs.php.net
IP address?
11:49
I don't know ^^
Do we store IPs for comments?
http log will have it
For example, next to last comment on bugs.php.net/bug.php?id=78963&edit=1
but he'll just jump IPs
I don't have root
Not sure what else we can do
Get me root, and I can sort that
12:00
I was thinking to work on optional github based login for bugs. We could extend that to other services. This would allow some reputation based system where we could restrict commenting on issues of other authors for non verified users. Or we add a karma system
what we really need is to work on punch over tcp/ip ... maybe we can crowd fund it, or piggyback from someone like deliveroo
hehe
What we really need is to switch to github issues :O
no.
I only wrote that once...
12:05
well I think whatever the arguments against it are, they are trumped by the main argument for it ... moving to github would have a positive effect on the language like no other change we could make to our own bug tracker ...
github issues is actually not a great issue tracker. unfortunately that's still like 5x better than bugs.php.net is
it has the people
It's really shite actually. And the reason, I use self-hosted Mantis for Xdebug
regardless of it's features, we want all it's users to easily access this stuff, and so maybe help with it ...
@beberlei That sounds like a good idea
12:07
but do you want to require people to have GitHub? It's a big ass vendor lock-in thingy. And you can't set the bug numbers the same as we already have
(disclaimer: I know nothing about bugs codebase)
it can be used to some degree of effect but it's hard to use it consistently across a bunch of users and it doesn't have much in the way of configuration so you can force some sort of workflow ...
It has no workflow at all? Not really has the categories, or our canned responses, or anything.
I believe it has canned responses
Categories are multiple repos and tags
Could bug reports simply require an auth system and it use a variety of identity systems?
GitHub, Google, Facebook, Twitter, so on and so on
@Tiffany I can tolerate GH, but there should not be any trackers for Google, Facebook, and Twitter to push more shit ads on us :-)
That's true...
Ideally bugs site should have some kind of accountability to a person to limit trolling, some form of auth system with restricted anonymity helps
We could take inspiration from edit.php.net, which lets you log in as a PHP.net account, various third-party accounts, or as an anonymous user.
Ideally without the anonymous user part, for the bug tracker.
And SSO is nice
12:15
Maybe doing our current VCS account, and add GitHub, and then other comments as anonymous moderated?
@salathe yeah, that sounds nice :)
We haven't done too well historically when it comes to moderated systems :P
sure, I really meant with that "ignore them"
hehe :)
So this is likely a controversial question, but what would it take to switch the docs from SVN to git? I was looking up how to do it yesterday and found a decent article, but the very first thing it listed was acquiring a list of all SVN users...
I stumble about with git, but at least I can cover and reset my mistakes and hide my shame. SVN, at least in my experience, doesn't grant that privilege...
12:23
@Derick did you have any luck with the breakpoints?
@NikiC Hadn't had a lot of time yet - but making progress.
@Tiffany Andreas is/was working on that.
heh docs and git
@NikiC Lots of taxes/accountancy stuff to sort out before the new year, and then there is this pesky contract ;-)
I'm contemplating volunteering to assist with it, if I'm able to assist, simply so that I can formally contribute to docs without having to touch SVN again
And it would be good for the resume...
i've poked him on text
12:28
@Tiffany the conversion is simple - git svn clone with an authorlist is all you need. The issue is usually all the tooling that has been built around svn
what kind of tooling?
I assume edit.php.net integrates with svn for its history?
github.com/php/web-doc-editor is this the docbook editor?
@Tiffany There is a lot of tooling at for example: doc.php.net and doc.php.net/revcheck.php?p=translators&lang=fr
@Tiffany For a background of the process: phpinternals.news/28
I need to actually read through that today, rofl
the guides for contributors
@Derick cool, I'll listen to it
> "Why is that so hard? It's just moving stuff from SVN to git..."
> "And do you still have that same opinion?"
> "Nope." *laugh*
oh boo, it doesn't italicize in blockquotes
12:46
Hi. Can I ask here why my symfony questions are almost always being downvoted and not answered?
@Clarity going based on your last question - stackoverflow.com/questions/59390279/… - you state that you have a problem with your code, and you paste the error message, but you do not include what you've tried already, or show that you've made any attempt on your behalf to solve the issue
or if it's something you're confused on where to begin, explain why you're not sure where to begin
@Clarity here's an example, I had a question regarding conflicting htaccess files because of my setup with dev and prod, I had tried googling for suggestions, but the info I was finding generally wasn't relevant to my situation. I explained in my question what I had tried already, specified my question clearly, and explained my setup as additional info for the reasons why I had this question.
I also presented possible ideas I had to solve my question, but I wasn't sure which was preferable (I was also worried that my question was opinion-based because of the nature of it, but I figured there would be a correct way of doing it, which is what I was hoping for in an answer)
basically, be honest and clear as possible, and show that you've made an attempt to solve the problem yourself
13:04
@Tiffany sorry, but it was hard even to suppose where the problem is... because during execution the command, my computer is sort of lying about that array_json is an invalid type. It even showing that it is in list of valid types.
@Clarity then explain that in your question 😀 I'm not the one that needs to be told, it needs to be explained in your question. have you read How to Ask a Good Question?
@Tiffany now yes, by the way, there was a guided mode for questions. Can I use it, or it is only for pure newcomers?
I dunno, I'm guessing that's a recent addition, it wasn't around when I started, so I don't what it is or how it works
Anyways, thanks for responding, I'll try to improve my answer. ♥
question*
@Clarity codeblog.jonskeet.uk/2012/11/24/… may also be helpful
(just noticed Jon Skeet's blog is wordpress... lol, the master of C# still uses PHP...)
13:17
I use PHP in Symfony at work.
13:56
hi guys
any wordpress expert here
yes,raise your query if any know then they can help you
14:07
@Derick downside: I'm not skilled in git, upside: I have a lot of free time ... downside: I probably will have questions that would require someone else to bring me up to speed, which may suffer from the man-month myth. I probably wouldn't be an effective contributor :/
@Tiffany That's OK. But now I've prodded Andreas, he seems to be (slowly) making progress. He has spare time in the holiday season
@Shadow yes please
14:47
@Tiffany I've kinda done a rewrite of doc.php.net which doesn't care that much about it being SVN or GIT
The current problem with moving to git is the EN-Revision comments which exist in all the translations to know if it is up to date or not
15:08
hey @Girgias can you take a look at why the build process creates 150,000 atom files?
@MarkR Just got back home in France and because my laptop died I'm repurpossing my mum's one so I need it to setup stuff
By I don't know that much oh how the doc is build but can have I look
As you know im experimenting with the web stuff, and would like to see if we couldn't replace all those files with a single PHP array and a script.
What do these atom files do?
@Girgias yeah, that's what Andreas talks about in the episode Derick linked
They're all identical except for the title and the date the docs were built.
15:12
because SVN is sequential with revisions, it's easy to see "oh, this one is out of date because the number is lower" and he had to change it to something else
@MarkR you should listen to the episode
it explains a lot of the struggles of switching from SVN to git
@Tiffany I not 100% sure but I think it's already the case that if the revisions don't match exactly then it's considered out of date
So a change to the git commit hash shouldn't be that problematic
At leasts that's how I'm currently building the translation status
@Girgias yeah, exactly, and the dude focused on switching it from SVN to git wrote something to make it easier to track, I guess, for translators
I didn't quite understand what it was he did, but he did do something :D
Well I did send Andreas an email but haven't followed up with the finished project as I still need to do translators
But that's relativeley easy, will do that over the break (hopefully)
I did @Tiffany. I had already proposed a solution but it wasn't well recieved :P
what was it?
15:19
To require that the XML itself contained metadata about updates by embedding a revision history directly in it.
words are hard... trying to think of a word and my brain is going HURDURHUR
@MarkR what were the opposing viewpoints to it?
That getting humans to change is hard :P
would the metadata have to be manually added every time?
cause I can see where that would be a problem... if there was a build tool (I dunno if that's the right term) that did it automagically then I can see it better received
@MarkR you wanted the whole strucutre to be changed to JSON at one point too >_>
That was the multi language thing, that would also solve it.
15:26
XML is easy enough
typing JSON by hand is blah
Well the idea was to avoid typing anything by hand entirely :-)
Because each language is, in effect, completely disconnected, there's massive amounts of overlap in both structure and data. My other suggestion was to change that, to have one working 'template' which defined the structure and then inline translations of each section, allowing full visibility of what has / hasn't been translated, and if it has, when and how.
I think the problem with that is there may be nuances in other languages that translators may have to take into account, and it's not apparent for native English speakers... granted I haven't really looked at the documentation in other languages, so I can't say for sure that it's not 1:1 for code snippets
Some examples have comments in them that need to be translated
yeah
Some of the code snippets are translated, but a code example is just another block.
In terms of databases, the problem is that the data has not been normalised.
15:39
Morning!
Evening!
@salathe what kind of commit message is that? 😃 github.com/php/doc-en/commit/…
I had a good laugh. I suppose I should subscribe to that mailing list as well, to at least lurk.
15:55
ISOC wanted that dolla dolla
probably a matter of time that the .edu domain goes the same way, heh
that'll be a shitshow
granted, there are probably enough big universities that have the money to throw to keep it from happening
@Tiffany Oh great... more tuition increases.
yarp
at least community colleges are regulated in how much they can increase tuition and how frequently, and transfer to a big university and get a bachelor's, no one knows the difference that the first two years were at a community college
$20 increase in domain registration rates... College: We need to up tuition by 25%!
controversial opinion: something something pensions
actually, not really even an opinion I guess
but I'm willing to bet that employee salaries and pensions play heavily into it, and possibly a question of greed :/
Greed is always a factor.
Many here expect the next bubble to burst to be student loan debt.
(I'm still slightly biased having worked for higher ed for so frigging long)
yeah, I wouldn't be surprised
16:22
As a new employee I take my work pretty serious. Then I realize my coworker are not really programmers. (All they do is joke on my serious face when reading codes, youtube, online gaming, gossip). How do you think guys?
Nothing wrong with the comp. , it's the people I think I don't fit with, I've regreted my decision to reject the extension from my previous comp. already
: )
i'm so desperated that I even posted this in this room, lol
@Plain_Dude_Sleeping_Alone what is comp an abbreviation for?
16:42
thats company
17:07
hmmm... should we be keeping a list of the versions with dates in the tag wiki? stackoverflow.com/review/suggested-edits/24889639 seems like work to maintain for... I don't know what exactly?
17:41
I don't see any reason to maintain x.y.z, but x.y can be helpful, I suppose.
17:57
there's a broken link in the post... I was going to remove it but doesn't seem like I can while the edit is pending :|
... yeah I guess we should approve that one, the wiki is still somewhat better after, but it just feels... useless, I agree with Levi
yeah
18:32
Robocall conspiracy theory: owners of sites where robocalling numbers can be reported are now robocalling people so that people will google the number and access their site for ad revenue ...
Received three calls from one number, in quick succession, I googled the number, accessed two of the top sites from results, both covered in ads... (though one site is at least semi-reputable)
 
2 hours later…
user12382982
20:07
Hello anybodies there ?
hello
20:22
@rlemon ever update SO Dark Chat so that it doesn't click and drag people's avatars by accident? :D
 
1 hour later…
21:24
would it be wrong to hold a users username and password in session while waiting for a 2FA input form the user
on user login, i confirm the user email and password, if valid i check if user enabled 2FA, if enabled i don't complete the login.

instead i serve the user with a 2FA input page and if the users 2FA input is correct i then complete user login with the saved in session user email and password
is there a better approach ?
21:50
most things PHP and security, paragonie has something paragonie.com
thanks @Tiffany
just had a quick browse through
but would like to know how would you go about implementing such? (a google 2FA)
It's been quiet in here this eve
@BobbyAxe not sure, personally.
I'm reading through the multi-factor project code to get an idea
22:05
I've done a couple of MFA implementations, ideally handle it via javascript so there's no need to save the user / pass. I just re-post it.
If you do need to do it on different pages, store a token in your session to say they're authorised for <x> period of time.
@MarkR what gets passed through JS? just the MFA code?
User + Pass + MFA.
No need to store it anywhere other than the browser (which already has it) that way
okay, likely due to my ignorance, but when I hear passing username/password via JS, I cringe
Why?
@Tiffany thanks for point me there, i am reading through also. seems so far to based more on the security aspect rather than the login process
22:08
@MarkR client-side, readable by anyone
You're typing in your password to log in anyway, it's already right there in the input box
ThW
ThW
@Tiffany It is a client/user input anyway, and you will have to trust the current page (including its JS)
would it depend on whether or not the site is encrypted and how it handles username/password with JS?
That's no different than logging in via a form
@MarkR i see your point
22:10
MITM?
but would encrypting it make it any safer?
ThW
ThW
@BobbyAxe HTTPS - yes
Not hugely. I mean you can send a code to XOR the next request with, and ive done that so the actual valid password can't get logged unless you know the outbound traffic too
But it's overkill really
I should have specified, that's what I meant by site encryption - HTTPS
no mean like if i where to still hold on to it in session
22:13
If you don't consider your page itself, and the channel between page and server secure, you've already failed.
You should never, ever have a readable password stored anywhere server side, ever
With the exception of the 5 nanoseconds between changing it, and encrypting it
I trust SSL Labs' test when I check my site's security :P
if it gives me an A or A+, I'm happy
okay i see
granted, SSL Labs only checks for common vulnerabilities, it doesn't pentest a site
cause i was trying to implement this in an existing project with out having to change the flow much
a flow that goes
log in, encrypt details, check user, if user valid, if 2FA enable save encrypted details to session and serve 2FA page, else complete login
and the when a response from the 2FA page is sent back, then the 2FA is validated and the session encrypted details is decrypted and used to completed login process
@MarkR @Tiffany would i be shooting my self in the leg with this flow?
Don't save the details, even encrypted
22:25
Are you using password_hash?
If nessary just save a token to say how long they have to log in for
@Tiffany yes always
@MarkR of course that would work
didn't even think that far
Today is Wednesday, yes?
Yes, it is
Why is my sister impossible to get a hold of today...
I heard it's because she's left her phone behind as she eloped with a married man to a far off country... or so I heard
do humans still elope ?
22:36
I assume it happens every now and then. Still lots of intollerant places
@Tiffany The only vulnerability that JS adds in contrast to simply submitting a form, is if you create your login form using malicious / contaminated libraries. The recommended fix is to handle login with bare static html files or use oauth with identity providers.
I would argue if you've got contaminated libraries on your page it's game over in the first place.
As you've lost all suggestion that the login button they clicked was even the right one
oh yeah. but if there are on your page and you have a login in a static html / no-js page, at least they can't steal the credentials
that would be quite far-fetched to implement, on an attackers pov, but possibly not that much more so than simply reading post requests
Basically if you can't trust your own page, the rest is meaningless
@MarkR you may not be far from the truth, but that's neither here nor there
22:49
I'm not sure what you mean, it's the foundation upon what the login process is built on, which bits do you trust
I may be unintentionally picking up British colloquialisms from my best friend, I think he's used that phrase before
@MarkR check the message I replied to :P
oh :P chat isn't very good at showing that xD
sorry
Mouseover or click on arrow :P
teh effort :|
Less effort than rewriting php.net XD
Lol
22:54
But php.net annoys me at how bad it is, that's the key factor
literally that
:)
but wont mind seeing php.net get a little styling
The greatest motivation you can ever give an engineer is showing him something and him going "ffs"
I wonder... 🐈
php-web.markrandall.uk I'm even wanting to put videos on the front page! O_O
@MarkR that's how I was with accessibility in my last job. Any time I saw an image with text
aha, Chrome does recognize the emoji, yesss
the sheer amount of people that didn't care about Americans with Disabilities Act and website compliance was baffling
23:03
We just had to add a metric ton of captioning to all our videos due to it
public relations was a frequent offender... uploading images with text and no alt text
before I added a description field to the CMS, it's excusable because they had no real way of doing it... but after I added it and they were still doing it... -_-
well, they're adding them in now, but they're not very descriptive, if someone accessed the page with a screenreader, they'd go "wat"
@NikiC you were looking for "small features"? ;) : twitter.com/mjackson/status/1207108228921741313?s=19
(also, I know that's not small, but could be insanely useful)
@ircmaxell I've asked for that one already loooong ago :-D
23:21
@ircmaxell man that function name confuse me a lot. I was like why do you need the square of x when your are doing log^2(x) ...
23:47
jellow
cant sign in to gitlab !! anyone else facing this issue?
can pull and push code tho
saying incorrect password :(
working for me
using 2fa
@samayo nope just plain email and pass
so strange
yeah, but issue seems from your side.
check status.github.com
changing password now will mean am gonna be changing it every time i want to login :( cause i will always forget once i alter my password pattern
23:56
Why not use ssh?
That'll solve your problem plus many more
hmmm
couldn't find a support line on the home page
do they have one?
Yeah, they respond pretty quickly btw
it could be an ip thing
had same issue with another site sometime back
What error do you get?
incorrect password or email
23:59
oh shit! I thought you said github ...
all this time I was talking about github not gitlab

« first day (3350 days earlier)      last day (1822 days later) »