« first day (3769 days earlier)      last day (1176 days later) » 

6:15 AM
Good morning.
 
7:10 AM
Bloody hell, finally getting something somewhat useful to suppress Exceptions using @
Now onto figuring out how I can pass class information in a way that doesn't require me to rethink everything
 
@Girgias Finally for yourself or finally after catch block? :D
 
@Tpojka Eh I suppose both in that case :p
 
7:29 AM
morns
 
user15029185
Does anyone know how to setup ci/cd using gitlab for opencart
 
user14716889
Hi guys I have a question, What is the meaning of ? and : in a boolean statement? I really don't understand it because the explanation I've searched is difficult to grasp. Thanks
 
It's a ternary
 
7:50 AM
@any_something Check here.
 
user14716889
okay copy :) thanks will read it now
 
@any_something Before ? is some boolean condition that resolves either true either false. After ? is code being executed if resolution is true and after : is case if resolution is false. Docs.
 
8:29 AM
I'm confused in a ZEND_VM_HANDLER what do corespond the 5/6 arg (so after the 2 input opcodes) and how do you access them? As ideally I'd need to access a CACHE_SLOT in an opcode which already uses 2 ops and returns something.
I could also split it into two opcodes but that seems rather... dumb
 
8:45 AM
@Girgias The third argument is extended_value metadata
 
Which is used for specialization?
 
Which is used for all kinds of stuff ^^
 
9:03 AM
Right >_> I'm just very lost on how I'm meant to proceed currently. I've got github.com/php/php-src/compare/… which works for the basic @expr to silence all Throwables (although I think I've got some things I need to iron out but) so working on @<class union list>expr, and I just don't know how to propagate the class union list, I saw that catch does it with a cache slot, but I have no clue how to reuse that apparently.
As I'm trying to fetch it using a live range info currently
 
@Girgias I'd expect you to generate an appropriate CATCH sequence
 
not at all what I'm currently doing
So like just insert a CATCH opcode?
 
yes
Hrm, wiki.php.net is super slow
@kelunik Can you restart the wiki.php.net server? iirc you had access to that one
 
9:40 AM
Hey everyone I got a problem with explode and strpos but I dont get it why
Please see my gist here: https://gist.github.com/marinarioagalliu/6c4932f231c6109a5a670208c6326791
 
@MarinarioAgalliu strpos does not return a boolean
It returns an index or false
You need to use !== false to check if the string is contained
or === 0 to check for starts with
If you're on PHP 8, you can use str_contains or str_starts_with instead, depending on which one you actually want here
2
 
You are right. Thank you @nikiC
 
10:40 AM
@NikiC I can, but seems to run fine for me?
 
@kelunik yeah, it recovered in the meantime
 
So I am learning a bit of PHP and this snippet is just blowing my mind...
```
<?php
$array1 = array(1, 2);
$x = &$array1[1];
$array2 = $array1;
// unset($x); # Fixes the problem
$array2[1] = 22;
print_r($array1);
```
I have 4 separate issues with this code.
1. On line 2, the assignment changes the right hand side. That is... um... very unexpected, to say the least.
2. The docs about references seem to imply that a reference is simply a regular variable whose contents are the same as the contents of another variable. The docs compare it to a Linux hardlink. But this code proves that refere
 
@yossizahn I see you have discovered the joy that is references
 
@yossizahn first of all, references are (with some very specific exceptions) not a thing you should regularly use, or encounter in other peoples code
 
10:55 AM
So... that is the answer? Great :D
 
@yossizahn It's a bit like the answer to "how do you avoid being eaten by a shark?" Step 1) don't go swimming where there are sharks.
 
@NikiC I've been there already... I will give it another look because I am not sure I am totally clear on the internal representation. But I think we can still agree to the points I raise - namely;
- The language semantics should not be affected by the internal representations
- Hence the fact that references are internally different should be totally transparent (point 1 2 & 4 above)
- Also the copy-on-write implementation should be transparent and the language should act in agreement to it's copy-on-assign language semantics. (point 3 above)
 
Rather than changing subtle beaviours, which would break existing code, we could focus on slowly removing all need for references, and at some point get rid of them...
 
11:15 AM
@yossizahn The main problem is … you do a CoW copy - meaning, we just assign the array and increase refcount on the array. But any reference within does not know what the source it belongs to was. So there's basically two choices, killing the reference or not killing it. Killing the reference means though, if the array we did the CoW copy from (i.e. the original array) is modified first, loses his reference. Which presumably is worse than just retaining the reference on both arrays.
to properly fix that we'd essentially have to do proper copying at all times.
(or walk the whole possibly nested array recursively checking for references, and then copying immediately, which is … expensive)
 
11:31 AM
@Derick Does it make sense to make the DateTime::__construct argument nullable?
 
You can just not supply it?
 
@Derick new DateTime(null, $timezone)
Asking because of null -> string deprecation
It already seems to treat new Datetime("") the same as new DateTime("now")
And I suspect that's primarily to allow the null version
 
Yeah, it should. I'd use $d = new \DateTime(); $d->setTimeZone($timezone);
I don't think a "null" was considered, but an empty string was.
 
nikic@neptune:~/popular-package-analysis$ rg -i "new DateTime\(null" sources/
sources/phpseclib/phpseclib/phpseclib/File/X509.php
1060:            $date = new DateTime(null, new DateTimeZone(@date_default_timezone_get()));

sources/alibabacloud/client/src/Log/LogFormatter.php
46:            self::$ts = new DateTime(null, $timezone);

sources/craftcms/cms/src/helpers/DateTimeHelper.php
254:        return new DateTime(null, new DateTimeZone('UTC'));

sources/zendframework/zend-http/src/Header/AbstractDate.php
 
I guess we can't deprecated it then :D
 
cmb
11:38 AM
@Derick, what to do about github.com/php/php-src/pull/6525 ?
 
@cmb I don't care enough. As I've had in my replies, gmmktime/mktime should IMO be deprecated and removed ASAP.
 
12:08 PM
@Derick Any reasons why we can't just directly access the specific information as properties on DateTime as integers, but need to go through format (of which most are not obvious) - like $date->seconds, $date->weekdayNumber etc. would be great. Similarly for date interval format with the PXF notation - is there any ideological reason, or were there rather practical concerns in the past?
(and a cherry on top would be being able to do $date->minutes += 10 directly - on the mutable instance)
(and with strict types format('H') usually needs an int cast ...)
 
 
1 hour later…
1:33 PM
Yo!
 
ho ho and a bottle of rum.
 
2:06 PM
FilesystemIterator::FOLLOW_SYMLINKS remove KEY_AS_FILE from bitmask ・ SPL related ・ #80724
 
@Danack =D
 
2:31 PM
@Girgias The type docs like php.net/manual/en/language.types.boolean.php have a sentence like "However, in most cases the cast is unnecessary, since a value will be automatically converted if an operator, function or control structure requires a bool argument." which is kinda misleading...
The part about "function" in particular
Hm, maybe only present for bools and ints
 
@NikiC Do you know of an extension that runs in non-ZTS mode and starts a thread?
 
2:50 PM
Hi, would anyone have a few minutes to explain how PHP and the AST works in relation the is_literal() implementation @Danack has started (and I really appreciate). I'm not a C programmer, but would like to see how feasible a solution would be (I'm confident this is a simple way to prevent common injection vulnerability mistakes).
 
@CraigFrancis btw that code sefaults against php master.....so it's even less working now.
 
@Danack np, while I shouldn't be writing any C (I'd probably introduce more issues), I'd like to understand if this is an approach that could work.
 
I find it useful to think of `=&` as a single operator, meaning something like "add to reference set", and _not_ as an assignment. That makes both sides being affected less surprising. It also explains why direction doesn't matter: `$x=2; $array1=[1,&$x];` has the same result.
The reverse operation, "remove from reference set", is achieved via the `unset` function.
In this case, the members of the reference set are `$x` and one of the elements of the array. I guess what goes a bit funky is that `$array[1]` can be thought of as both a name and a value: as a name, it's definitely now part of
The solution, as others have said, is to avoid references wherever possible. And when you do use them, to make sure you "unreference" afterwards (e.g. I occasionally use foreach($foo as &$bar){....} unset($bar);
 
@Danack I believe the taint extension uses a slightly different approach, which uses flags on the ZVAL? but that that might be pushing the limit on how many flags there are, and a possible performance issue.
 
@Derick nope
(as in, I don't know about any specifically, but doing that should be fine generally)
 
2:59 PM
@Derick datadog_trace does.
We don't run PHP in that thread; strictly background work.
 
cheers
yeah, that's what I'll be doing too
 
@CraigFrancis same idea.....storing flags against the zval. The only reason the AST stuff is touched compared to that version is that i) the ast exists now and didn't when the taint code was written. ii) that seems like the sensible place to store a flag of "this variable comes from source code".
 
@Danack ok... but if memory serves, I think @Derick
...sorry, I think @Derick said we are at a limit for the number of flags that can be put on a ZVAL?
 
I need explanation the line with ->
<?php
$mysqli = new mysqli("localhost","my_user","my_password","my_db");

// Check connection
if ($mysqli -> connect_errno) {
echo "Failed to connect to MySQL: " . $mysqli -> connect_error;
exit();
}
?>
 
@SmilingMouse do you mean what is ->?
 
3:07 PM
//->, is used when you want to call a method on an instance or access an instance property
//what does it mean on an instance
 
oh - there is a better answer:
4662
Q: Reference — What does this symbol mean in PHP?

GordonWhat is this? This is a collection of questions that come up every now and then about syntax in PHP. This is also a Community Wiki, so everyone is invited to participate in maintaining this list. Why is this? It used to be hard to find questions about operators and other syntax tokens.¹ The main ...

 
@Danack Thx all knowledge on one site perfect!
 
Regarding the is_literal idea.....I think the question is "are there any bits left to use as a flag on a zval"?
@SmilingMouse btw, rather than asking for an explanation, it may be more likely to get you an answer if you ask "what is X called", as asking for explananations sometimes gets a philosophical answer...
 
@Gordon ey, do you know how much instana costs per k8s cluster? I got a few clusters to monitor, and I'm wondering if it's gonna end in a financial disaster, if each pod is priced individually @_@
 
@Ocramius I don't know. I can connect you to someone from Sales though.
 
3:13 PM
that's alright, pinging them straight away from my end :D
 
ld: fatal: file processing errors. No output written to .libs/libphp7.so ・ *Compile Issues ・ #80725
 
@CraigFrancis I didn't understand the question
 
@Danack yep, I think so... but I must confess I really don't know enough about zval to know if this is the right direction, I think it is, because I suspect it's the right place to say if a variable comes from source code, but I also know it would be tricky to get a change to zval without everyone agreeing it would make a massive security improvement, and little (ideally no) effect on performance.
@Derick Sorry, yes, it's been over a year since we talked about it (after PHP-SW meetup in Bristol)... but this relates to adding a flag on zval to say that a variable has been defined in the PHP script (i.e. safe, and not affected by an external source, I was thinking of having a function called is_literal).
 
draft RFC words is_literal. I tried and failed. I think the question is "are there any bits left to use as a flag on a zval"? aka will that approach work.
 
For Everyone: I need to know on which exe/exes runs php script: php.exe or something else?
 
3:34 PM
@SmilingMouse which country are you from btw?
Asking as a room moderator, not a weirdo.
 
@Danack Yes this is perfect: "What is X called?" It's my secret
For AI it's the shortest way to ask
Few days ago had a problem in C++ #define xyz
usually #define xyz abc //but this time was only with xyz
after few days found out the purpose - didn't know the right words to describe: #define identifier token //instead used "first word" and "second word". But @Danack thanx this simple "What is X called?" is the best way to ask saving resources
Ok let me put it like this: I need to list all undocumented PHP functions - I know there are a lot of them in PHP
 
Define undocumented
 
You mean in source code?
 
wat
Even Jeeves is better at conversations :P
 
what do you mean by "undocumented PHP functions"?
 
3:44 PM
What "Define undocumented " is called?
 
@SmilingMouse PeeHaa was asking you to clarify your comment
 
PHP functions that can be called and are not in the manual
 
there should not be any
 
There are none.
 
^ that
 
cmb
3:45 PM
lol
 
What you are asking makes no sense
Hence asking for clarification of "undocumented"
I would personally call the reflection api undocumented, but it is there in some form
 
@NikiC I didn't touch that section but I can review it, but yeah seems a bit odd
 
I believe the manual is generated from the source code, so even if nobody writes a description, a stub page appears on php.net with the function signature
 
For example undocumented SessionIdInterface in PHP 5.5
 
@Derick Pedantically, there are a couple of recent functions which aren't yet in the docs... but there shouldn't be any really
 
3:47 PM
doesn't look very undocumented to me
 
in which .exe or .dll is located SessionIdInterface?
@IMSoP thx btw - just func name to URL it will be helpful for me
 
Are you looking for the source?
 
15 mins ago, by Danack
@SmilingMouse which country are you from btw?
 
Your question is really hard to make sense of :)
 
yeah, looking up manual pages like that is super-useful
 
3:50 PM
15 mins ago, by Danack
Asking as a room moderator, not a weirdo.
 
cmb
@IMSoP that is no longer done for many years; there is now docgen (which retrieves a basic page via reflection), but that has to be called manually, and the pages have manually to be added to the manual.
 
Because some room moderation is likely to happen, and it's probably better I base it off facts rather than instinct...
 
@cmb ah, OK, I stand corrected
 
@Danack Trust your guts :)
 
@Danack
 
3:53 PM
Even I am on the edge now Dan :P
 
@SmilingMouse That means nothing to me. Please answer the question, where are you from?
 
@Danack I don't know who else is in this room don't ask me like that
 
@SmilingMouse Hello
 
Hi @mega6382
 
@SmilingMouse Hi, I think Dan is trying to decide if you're a bot, please don't take offence, just that some of your questions seem a bit random, and it's difficult to make sense of them (maybe English isn't your first language?)
 
4:00 PM
1 message moved to Trash can
@MarkR please don't try to pick fights when room moderation is happening. Or at all.
 
@Danack to be fair, I had no idea where you were going with the question, and Mark's comment made me chuckle as an obviously absurd interpretation
I read it as a humourous way of saying "I have no idea what's going on here"
 
@SmilingMouse Which region of the world are you from? you don't have to specify the country just the general region like the continent should be enough.
 
If I'm talking with you it means am friend
 
@SmilingMouse Hello
 
You're going about it all wrong. If you think it's a bot, you should try confusing it with paradoxes. Gawd, have none of you ever played portal?
 
4:03 PM
Freedom means noone can force anybody to reveal info about himself under any pressure
 
@MarkR lol, I was trying to see if there is any repeating pattern.
 
@SmilingMouse Your phrasing is weird, to the point of being rude.
39 mins ago, by SmilingMouse
For Everyone: I need to know on which exe/exes runs php script: php.exe or something else?
 
@PeeHaa to the rescue <3 :p
 
He had ample opportunity. Let's not waste time with it anymore
 
What rude? Normal kind question
 
4:06 PM
Well with asking about EXE one assumes windows, in which case it would probably be php-cgi not php.exe
 
You might have a need to know something, but phrasing it like that sounds like an asshole boss, who tells you "I need this", rather than asking for help. You should take the time to phrase stuff as a question, rather than just say your needs. And yes, I know this is acceptable phrasing in other countries, which is why I asked where you're from.
@PeeHaa chill out a tiny bit...possible it's not deliberate.
 
@DaveRandom ping
 
Don't come back telling us we are rude
@Danack Either way. It's not constructive
 
@PeeHaa I think they were asking for clarification on what I considered rude....
 
oh shrug
 
4:10 PM
Is there an option for php, php-config, phpize, any PHP binary really, that specifically says whether it is ZTS or not without having to parse something like: PHP 7.1.33 (cli) (built: Nov 22 2019 18:22:12) ( NTS )?
Not a big deal, but would be happier if there was something.
I think I'm going to try my hand at a Rust extension for PHP soonish and am trying to figure out all the needed Rust cfg things I may need like ZTS.
 
Oooo that would be cool to hear about how you go with it. Have any been done in Rust yet?
 
I've only written a small amount of Rust, but I like learning programming languages so I'm not afraid of it.
There are two Rust crates I've found that already do this sort of thing: php-rs and solder. As far as I can tell, neither has tackled ZTS related things.
 
@Danack seems deliberate, or it's definitely a bot, their phrasing in the comments and Q&As seems pretty normal.
 
@mega6382 or maybe it's just beer o'clock where they are....
 
Speaking of
/me checks fridge
 
4:19 PM
lol, yeah that too :D
 
Incident on 2021-02-09 16:19 UTC ・ GitHub Pages has Partial Outage
 
@LeviMorrison Coincidentally, I've just stumbled upon this like a few hours ago. Not sure how usable it is. github.com/rethinkphp/php-rs
 
Yeah, I've looked at it. Surprising how little is needed to make a minimal extension.
 
Incident on 2021-02-09 16:19 UTC ・ Issues, PRs, Dashboard, Projects has Partial Outage ・ GitHub Pages has Partial Outage
 
@Danack Regarding the zval flags, and the ability to add one more, am I in the right area with _zval_struct in zend_types.h (says he having never written any proper C in his life, but I can also see a reference to "interned", which Mark mentioned, erm, last year).
 
4:23 PM
Jeeves reminds me of the butter robot out of Rick and Morty..... "What is my purpose?" ... "You tell us Github ops suck" ... "Oh My God"
 
no, you could use an elf/obj parser to look for a unique symbol maybe @Levi
one of the module global identifiers that are exported as global might do it ... (eg, compiler_globals_id)
 
4:40 PM
@MarkR Tells us about PHP bug reports too!
 
True that.
 
Incident on 2021-02-09 16:19 UTC ・ GitHub Pages has Partial Outage
 
@CraigFrancis yeah, it's that, then also figuring out where the elements of that struct are used.... and I think there is spare space in type_flags.
 
@Danack Ok, so that's a zend_uchar, which looks like a unsigned char (8 bits)?
 
yeah, and the only 2 bits I can see being used are: github.com/php/php-src/blob/master/Zend/zend_types.h#L674-L675
Though as that code segfaults now, maybe not.
 
4:57 PM
Minor Service Outage ・ GitHub Pages has Partial Outage
All issues have been resolved!
Minor Service Outage ・ GitHub Pages has Partial Outage
All issues have been resolved!
Minor Service Outage ・ GitHub Pages has Partial Outage
All issues have been resolved!
 
@CraigFrancis Are you interested in string literals only?
 
@NikiC I think so... there might be a case for integers defined within the php script itself, but tbh it's not the end of the world if they need to be quoted so they are strings.
@Danack Yep, I'm struggling to understand how all the flags work, they seem to be dependent on the variable type, but that's purely a guess.
 
5:12 PM
@CraigFrancis In that case, you don't want to mess with zval flags
Use the GC flags on the string
 
With any PHP 8 version I get crash running more than one CLI ・ Unknown/Other Function ・ #80726
 
@NikiC Ok, is that the bit under the "string flags (zval.value->gc.u.flags)" comment?
 
@CraigFrancis yes
@CraigFrancis The flags are all already used, but you should be able to reuse GC_PROTECTED for strings
 
@CraigFrancis there's probably very little value in tracking ints and bools as the checking code can do:
if (is_literal($foo) || is_int($foo) || is_bool($foo)) {
  // ok
}
else {
 // not ok
}
 
@NikiC Thanks, tbh I'm a little out of my depth here (@Danack knows a lot more about this than I do)... is GC_PROTECTED, which is "used for recursion detection" not needed for strings created in the PHP script? Previously @MarkR suggested that IS_STR_INTERNED might be useful (but also warned that it might not be reliable).
@Danack Yep, you're right.
 
5:24 PM
@CraigFrancis interned is to do with whether the memory underneath is 'owned' by that variable or whether it is stored internally to PHP (and so can be shared amongst many variables). I'm reasonably sure.
I'll have a go at following Nikic's advice after food....
 
@Danack Ah, yes, that makes sense.
@Danack Thanks, I really appreciate this.
 
@NikiC Is there a github repo for the examples in the Internals Book?
I mean, not the website, but the actual extension.
 
@LeviMorrison nope
I did have some for php 5 I believe
but well ... those examples are a tad bit outdated
 
@Girgias you pang?
 
@DaveRandom Indeed, my friend was wondering if you were still passing along this week or scheduled got reshuffled due to snow?
 
5:37 PM
@DaveRandom Is "pang" the past tense of "ping"?
 
I mean I don't think it's codified, based on "ring/you rang" :-P
 
Not like English is codified as its descriptive :p
 
in my head I said it with the voice of lurch from the addams family
snow has actually not been mentioned as a factor so far
I hadn't thought about that tbh
 
I'm used to pinged
 
I think the M62 is OK atm
I am, however, still waiting for approval to actually go and do the bloody job
there is some squabbling amongst management I am leaving them to it
if it happens it should be thurs afternoon
 
5:41 PM
@DaveRandom Well when you have confirmation just remember to send him an email :')
 
I will do and yes sorry
I am shit at communication
ironically for a network engineer
 
No worries :p
He just asked me today so double checking
 
yeh I will let him know and if it ends up not happening it will happen in the next week or two (which is why I am staying out of it)
 
Right, okay :)
 
3 different project managers from 3 different contractors, yay.
and the only one who is competent is a bit timid, the other two are just shouting their shit opinions at each other
 
5:44 PM
ouch
 
Great, just spent an afternoon migrating from artax to http-client, and now my tests fail because HttpClient is a final class that can't be mocked.
 
Client?
oh huh what no interface
 
Nope, just DelegateHttpClient, which notes that it shouldn't be used as a dependency lol
 
6:00 PM
@Girgias youtube.com/watch?v=OKmH_7Sm004 - Oh is that what you look like! You totally don't look like I expected.
 
Haha yeah, most of my photos are pretty old on social media
 
I don't think I'd seen any pictures of you at all...
 
Well I don't take many, and when I do people tell me it looks weird, like twitter.com/Girgias/status/1337713657871011841/photo/1
 
6:19 PM
You're not following the rules of social media posts.... remember to pull a duck face, and have a messy bedroom in the back
 
I had ElePHPants in the background. Is that good enough?
 
It has a cool nerd factor
 
 
2 hours later…
8:07 PM
@Derick doesn't sound like Derick in that video somehow
just your voice I mean
 
It doesn't sound like a British Dutchman who used to live in Norway?
 
it definitely sounds like that :-P idk there's some quality about it I can't quite put my finger on that different from what I'm used to hearing in podcasts
lol @Girgias I was deffo expecting a much more noticeable french accent :-P
 
@DaveRandom Well I'm not French that's why :P
 
why do I think you are did I just imagine that?
 
8:25 PM
I've been told my French accent is completely unnoticable.
 
I think you as long as you either sound like you can't really be bothered talking, or spit the words out like the words themselves have offended you, you will carry french pretty well
german is the best language, I like how utilitarian it is
 
8:50 PM
obv not a new idea
 
But integrating the whole chain of software dev from writing, to using dependencies (through npm), to deploying to azure is kind of novel.
Dmitry sounds a lot more American than I expected....
 
@Danack Pretty sure that one was read by one of the staff members
 
Hello Team, I have a general question: How do Facebook/Google/App and other software companies protect their source code on employee laptops?
I have a team of 5 developers now and I'm about to add 10 new developers within 2 months. Currently, all developers have all project source codes in their local database, including the application database, but I doubt if this is the best option for all developers to have a copy of full application in their local machines. Any assistance, I will appreciate
 
9:08 PM
5 hours ago, by SmilingMouse
If I'm talking with you it means am friend
@PeeHaa Hi friend!
 
youtu.be/OKmH_7Sm004?t=246 Dmitry's view on PHP 8 is kind of sad
As in, he's the only person left who has contributed pretty much for decades and he doesn't like where the project is going.
 
9:23 PM
@IluTov It was before my time, but you can look back at the battle it took to get in things like typing, things which no serious PHP developer would work without nowadays. Now the battle is over standards like namespaces.
 
@Girgias That is the joke.
 
@IluTov I didn't hear it as being sad.
 
wiki.php.net/rfc/scalar_type_hints_v5 would pass by the skin of its teeth under current rules
 
@Ephra What problem do you have that you think you need to protect yourself against.
 
Wasn't happy with the 8 release specifically. Did say some positives about jit but mentioned that it was a first step towards many other optimizations that are still needed.
 
9:29 PM
@IluTov He's spent many years working with Zeev, and neither of them seem to understand what modern PHP code bases look like. And (imo) the reason he sounds unhappy is that some things many PHP slightly slower, and he doesn't care about whether they make PHP easier/safer to use.
 
PHP being fast is important, but actually being useful matters more.
 
@Danack I'm tired sorry :(
 
If you ever talk to him, asking him to maybe discuss more on internals, rather than never taking part in discussions, might be an idea....
 
CPU time is cheaper than dev time and downtime.
 
@Ephra When you say local database, you don't mean code in SQL, do you? Everyone having a local checkout of the Git repo with the source code is bog standard.
 
9:35 PM
@Danack Yeah that's my impression. I understand that he worked incredibly hard to make PHP faster with opcache and now JIT and that's fantastic. But people who use PHP probably did not pick it for speed but ease of use. We need more than a faster PHP 5.3.
 
Whether or not everyone having a local copy of the SQL database is a good idea depends on your data size and security profile.
 
IMO only your senior devs / operations should have access to production databases, either online or backups.
 
@Ephra to tag onto what Crell said: also limiting what your devs have access to on a need-to-know basis. Principle of least privilege
 
@Danack My source code lately will be exposed to anyone in the world even without my permission
 
@Ephra No, it be exposed to developers you hire. Also......source code by itself is way less valuable than you might think.
 
9:38 PM
@Crell meaning all customer data are also available in all developers local machines
 
Bitbucket + separate repos + permissioning, could possibly be done similarly in GitHub and private repos but not sure
 
@Danack I have to disagree, in a lot of enterprise cases the IP contained within source code can be incredibly valuable. Although the "code" itself is perhaps less so.
 
@Ephra You probably want to have some kind of cleaning script that randomizes the sensitive parts. Usernames, emails, etc.
 
Or even better, have a the databases for local dev filled with placeholder data, when the local environment gets initialised...
 
Yeah, why do devs need access to customer data on local machines?
Other than to view it
 
9:41 PM
@MarkR yes, for my case, as we have a valuable competitive code base and features
 
@Ephra Then the answer isn't technical, it's contractual. NDAs, penalty clauses, non-competes.
I'd say patents but they're barely usable in software for most the world (thankfully)
 
@Tiffany because they have access to source codes hence access to live database so they can connect at anytime
 
Oh fucckkkk no
 
Yeah, if your developers don't have access to the source, they can't do their job. If you don't trust them enough to have complete access to the code they're working on, don't hire them.
 
@MarkR oooooh, okay I got an idea now
 
9:43 PM
@MarkR Danger Will Robinson! The code in your repo includes credentials for your production site?
 
If your source code contains your access credentials you're doing it horribly, horribly, horribly wrong.
 
@MarkR I was going to make a joke about maybe true for enterprises, but I doubt that's the case here. But I won't.
 
@Crell at the end of the year, we expect to add at least 86 developers, and to my thought, you cannot trust all of them that are trustworthy, will you ?
 
Well, yes
That's what the hiring process is for
 
Any credentials MUST be kept separate from the source code. They should be stored as environmental variables or within a PHP file that is only present on the server
 
9:44 PM
@Crell yes
 
Why would you hire someone you don't trust?
 
@MarkR any idea to fix this ?
 
@Ephra How exactly can a developer do his job if he doesn't have access to the source code he's supposed to edit?
@Ephra OK, then you need to stop and fix that, immediately, before you hire anyone, period. Not because you don't trust them, but because that's a horrible horrible security practice.
 
@MarkR yaeh sure, thanks for the inputs, I will do it
 
And rebase it out of your git history.
That's like, "my CSO won't let me do business with your company now, knowing that" levels of bad.
 
9:45 PM
@Ephra Fire whoever allowed it to happen in the first place. Then you must write code that allows reading a configuration database (even if that DB is just an array), and then replace every. single. credential. They're effectively compromised. Go through and change them all, replacing the code that accesses them with code to read your new database
 
Once you solve that, your "trusting developers" problem 80% goes away.
 
oooh, I understand now
 
If credentials are needed for testing, they must be different from your production credentials, and it should be possible to disable t hem without effecting production.
 
In the ideal scenario, no human being ever knows the credentials for anything. They're managed by the deployment system and injected via environment variables, and can be rotated automatically if needed.
 
@Crell the project is big with more than 30 separate modules (ERP) so other modules are very sensitive and we wish only senior developers to work on the
 
9:48 PM
(Disclosure: I work for a continuous deployment hosting company. We have specific tools for our customers to use on this.)
 
and no individual developer (except your highest tier when out of necessity) should ever be in a position to deploy code to production without review, otherwise they can just upload code to dump your super secret credentials store.
 
@Crell great input, any reference on the deployment system, I wish to implement this as well
 
@MarkR little Bobby tables
 
Now someone break out the vodka so R11 can drink away the panic attack half it's members just had :P
 
You can have your code in separate repositories, and give different people access to different repos. That's fine. They would all need read access to install stuff, but you don't have to give them write access.

This actually seems like really good use case for private packagist.
 
9:50 PM
@MarkR I guess there might be some tools to enable this, can you recommend please?
 
@Ephra It's a fully hosted setup. Platform.sh.
 
@Ephra This will be part of your repo management / deployment.
 
Hang on, I have a recent blog post on this.
 
@Crell great idea, thanks, we will see how to implement this
 
Those should start you in the right direction. (And of course the really right direction is hiring us as your deployment and hosting company, but then it's my job to say that. :-) )
 
9:51 PM
@Crell great
 
> Static config files for environment-specific information (like database credentials) are a terrible idea and will come back to haunt you.

Wai?
 
@Crell great, this is great start, thanks
 
@MarkR How do you inject DB credentials from an env var into a YAML file?
Or an ini file?
 
Not sure I follow the use case, why would they be there?
 
@Ephra In my entirely biased opinion, from what you've said so far your best bet is a combination of Private Packagist and Platform.sh. (I'm assuming from context that your app is in PHP.)
 
9:54 PM
@MarkR but if we use Laravel, they recommend us to remove .env files in live environment , what is the best approach then
 
@MarkR A ton of applications want you to put your DB config etc. into an ini file or a YAML file or something like that. Which doesn't work so well when your production file system is read-only (for security) and the DB credentials are in an env var.
Correct. .env files are for local development.
 
@Crell Yes, I'm using PHP laravel, I will have to try these approaches
 
See previous blog posts. I am actually working on turning about a dozen of my old blog posts into another book. :-)
 
Personally, for PHP apps, I roll credentials up into single encrypted config file that gets injected into the container before it loads.
 
@Ephra This is what we do for Laravel: github.com/platformsh/laravel-bridge
Works quite well. We have a similar one for Symfony, too.
 
9:56 PM
I'm not even sure how my employer does it, principle of least privilege in action :D
 
@Tiffany Maybe they just hide all the privileges from you so you can't tell them to russian spies :P
 
@MarkR 🙄
 
I have learned something useful, and I see implementing these 3 options will lower the risks (1. use packagist and platform.sh, 2. Implement privileges option for developers, 3. Implement good legal measures including non-compete, non-disclose, etc)
 
we've just been moving all our environment-specific configuration into Consul and Vault
 
Getting credentials out of your codebase and into a proper deployment system is step 0. That will make almost everything after that both easier and less stress-worthy.
 
10:01 PM
you can use that as the source for the environment variables that get injected in the build/deploy process, or (as we're doing) directly access them via a locked-down local API
 
I could do with looking at Hashicorp Vault. Not sure it's worth throwing an entire separate cluster at though.
 
yeah, it made sense to us to have it sitting alongside (and storing its data in) Consul
it's Yet Another Service to maintain, but it beats rolling our own encrypted store
 
How do you handle service separation? That's the bit I haven't figured out short of microservices for every damn thing. The codebase has access to everything.
 
@Ephra If you want to talk more about Platform.sh, you can find me on Twitter DM (same name) or chat.platform.sh I don't want to take over the chat here.
 
@Crell Thanks @Crell, I'm checking your articles, I will connect
 
10:07 PM
we do have separate applications deployed to their own servers, so can theoretically lock things down that way
the only hard separation we have right now is a separate environment handling payments (mostly because we have to deal with direct card details for irritating reasons)
 
Makes sense, yay PCI DSS
 
indeed :/
Consul and Vault both grant access based on ACLs, so if you can make different parts of the system access with different auth tokens, they can be restricted that way
 
But presumably any part of the system can access any other part of the system, to access those tokens? Unless they're completely separate services.
 
indeed; they need to at least be running as separate processes
 
10:16 PM
if you've just got "class A should have access, but class B in the same process shouldn't", I don't know of any magic that would enforce that
if you've got, say, a cron job that needs extra stuff, it could run as a different user, or SELinux context, or something, and pull a token that nothing else can see
 
I can identify with this guy... this is not a skit... this is my life. youtube.com/watch?v=oDGTCULn6P0 //cc @Tiffany
 
11:00 PM
before I spend ages experimenting with it, does anyone happen to know whether Filezilla server needs to be restarted to pick up a replacement of it's SSL cert?
we'll gloss over the whole filezilla thing, it's for a customer and it's non-negotiable at the moment (legacy)
 

« first day (3769 days earlier)      last day (1176 days later) »