« first day (3816 days earlier)      last day (1115 days later) » 
05:00 - 23:0023:00 - 00:00

5:40 AM
posted on March 27, 2021

Today's comic is dedicated to my wife. Who uses the word "what" in the most creative of ways. She can somehow combine all of the following simultaneously into a singly syllable: I'm completely innocent and have no idea why you're looking at me like that Up yours I know I'm lying and you know I'm lying. What are you going to do about it?!? It's not like her to lie, so the word "what" is

 
 
2 hours later…
7:29 AM
wrong range() result ・ Math related ・ #80912
 
 
2 hours later…
huh?
rasmus git account got hacked i suppose
 
That would be my assumption as well
 
what to do besides reverting? escalate to security@php.net + systems@php.net to revoke the account?
account needs to be revoked, evaluating if other commits were made to other repos
better write directly to internals@ to avoid this getting a primary news source outside of php orga
@NikiC do you revert? otherwise i will
not sure people deploy master, but still :D
 
yeah I've revoked karma and reverted the commit
 
could also be the git server being hacked itself
the part "Signed-off-by: Rasmus Lerdorf <rasmus@lerdorf.com>" is just fake part of the commit message or not?
 
9:21 AM
It's just part of the commit message
As far as I can tell only the commit to master was pushed -- otherwise git fetch would also show updates to other refs, right?
 
We are Zerodium

The world's leading exploit acquisition platform for premium zero-days and advanced cybersecurity capabilities.
honestly thining about it, i believe that probably git.php.net was hacked, not rasmus himself.
 
 
2 hours later…
11:21 AM
Out of curiousity, what does that code do? As I read it, it would wait for a HTTP Header called "HTTP_AGENTT" (with double T) and execute whatever PHP was send along and the placement of that code fragment in zlib.c is not relevant.
 
 
1 hour later…
12:43 PM
@beberlei Yeah, signed commits show the "verified" badge. E.g. github.com/php/php-src/commit/…
 
1:07 PM
What about master.php.net? It's on an older version of Cent OS
 
What about the github clone exploit
 
If I need to send a mac for repair, other than deleting private keys from it, are there any other things I should do?
 
Perhaps rasmus cloned an untrustd repository and thats how they got his credentiqls @makadev
 
1:30 PM
@Danack delete browser profiles/passwords?
 
good point.
 
steam profile maybe or other apps that are logged in
 
Shred
 
"delete" is also such a thing, zero over :)
 
Then delete
 
1:32 PM
although its tricky anyways, with the log into mac don't you have access to the backups via isomething?
 
If you want to be extra paranoid
 
1:52 PM
@Danack if you are using TimeMachine, you might need to delete local shnapshots too after removing keys and other data
 
Full disk encrypt from the start is the only way to go imho
 
Thanks, but not using it.
Jan 26 at 0:11, by Mark R
I woke up today and couldn't remember my laptop bitlocker password, my NAS encryption password... I could remember parts of them, but not others, or order. I just had to spend 6 hours brute forcing my NAS with a dictionary attack to get it back and the laptop TPM won't let me try anything other than a recovery key, which I always destroy :S
tradeoffs, all the way down.
 
Yep. Losing access is better than someone else getting access.
 
you should comfort that guy who forgot their password for 30 mio in bitcoins
 
The annoying thing about the laptop is I remembered the password the day after, after i'd formatted it.
 
2:06 PM
@ln-s is that even possible? Afaik both git+https and git+ssh do not send plain text credentials but either a hash or some sort of challenge that doesn't leak the credentials (except maybe for ssh crypto mode none).
pubkey ftw
 
2:24 PM
Last year I had to do similar (battery + cleaning). I bought 200 GB package of Google One (drive.google.com) because i was missing 5-10 GBs on free google drive space to store all things I wanted from docs I wanted. I saved there also priv-pub keys. And changed root and my user passwords to be something very much intuitive.
P.s. Part with Google One above can be replaced with some other cloud or as much with external drive.
 
\o
 
2:35 PM
Morning o/
 
\o
 
 
2 hours later…
4:19 PM
@NikiC What happened here? github.com/php/php-src/commit/…
I was going to push my changes, but now I don't know whether I should rebase or wait for the situation to clarify
 
need to figure out what credentials are actually being used to push those commits
the e-mail addresses aren't related to the account, so blocking Rasmus's access was probably irrelevant
not sure what logs will exist for that, but someone needs to get onto the actual git.php.net server and find them
 
It looks like it was pushed by Nikita
 
nope, that's just the address in the commit
 
How can you do it without having control of someone's account?
 
nothing verifies against that e-mail address
pull this commit, and you'll see it committed by "dharman@php.net", but it was actually me: github.com/IMSoP/php-src/commit/…
someone needs to take that server offline, audit it, and figure out how far back the history might be compromised
 
4:42 PM
Dafuq?
 
No idea how to wake someone up to deal with it, but right now, consider git.php.net and any automatic mirrors of it (e.g. github) to be compromised and not trustworthy.
 
Hmmm we should probably consider the attackers are watching this room
 
👀
 
Yeah, this is not the forum for this discussion.
 
What if it is one of us?
 
4:48 PM
Although this is a strong vote in favor of requiring signed git commits.
3
 
Someone should still probably pull the plug on the master git repository all the same
 
What if it is me, but I don't know about it?
 
@MarkR That's in process.
 
good to hear; I'll stop speculating about details, which you're right don't belong here
 
All R11 communications must now begin with the secret handshake followed by the counter-sign twerk.
 
4:53 PM
user image
7
 
This is why commits should be signed.
 
(sorry, couldn't resist)
 
@Trowski I've been soft-pushing for signed commits for awhile. I'm going to start hard-pushing for at least the limited access repos like web-*
 
@IMSoP I'm the guy you're going to have to explain the joke to. :-P
Obviously I get the Rasmus part, but what's that from?
 
4:56 PM
@Trowski You definitely need to be pulled int the next R11 among us game xD
 
@Trowski omg you need to join our matches of Among Us
 
The screenshot is from "Among Us", a game where you 1 (or 2) of your fellow players are secret imposters bent on killing everyone else. You have to guess who and vote them off.
Rasmus was attributed to the original commit, so he was "voted off" (frozen access), but then the un-revert from NikiC indicates that he was not, in fact, the imposter (compromised account).
@Tiffany I hope to get to today's game. I've been busy the last several weeks.
 
@Sara My opinion doesn't mean much here, but to me there's little reason to not be signing commits.
 
@Sara wait, there's weekly games?!
 
But oh... wait... is there ANOTHER "Among PHP" group?
I think there's two different groups playing this.
 
4:58 PM
yes :P usually coordinated with @PeeHaa and @Ekin
 
We should merge groups.
 
yes we should!
 
Aww, no mac version. Looks like a game my Windows VM could handle though.
 
there's a mobile and Switch version, but harder to communicate, though they're trying to simplify it
 
@Tiffany Just DM'd you a discord link on Masto
 
5:01 PM
0
Q: Exclude product from woocommerce booking google calendar sync in unpaid status

Lubo MasuraI have an issue with excluding 1 product from woocommerce bookings Google calendar sync in unpaid status. I have a clients which are booking individual classes where they pay at. These classes I need to sync with my google calendar in unpaid status. 1 product is for more people and each of them h...

 
I think you need a few more messaging protocols in there :P
 
@Sara can I invite other r11ers to the server?
 
Among Us is basically Werewolf or Secret Hitler or Mafia with better graphics, AIUI.
 
I hadn't thought of that comparison, but basically, yes
 
yeah, that's what I compare it to when people ask what the game is like, but most people haven't heard of Werewolf or Mafia either
the minigames in the form of tasks makes it more fun for the non-impostors
 
5:14 PM
@NikiC Did you revert the revert?
 
@Tiffany Sure. I just prefer to avoid putting the discord link anywhere fully public.
Don't want the riff-raff getting in, after all.
 
/me waves.
 
@Sara Agreed, sorry, did not see this before.
 
Wait there is a R11 Discord? :o
 
@Girgias There's an "Among PHP" discord, which happens to contain some R11ers
 
5:26 PM
Huh, haven't played Among us ever but that's neat
 
@SebastianBergmann No worries
 
@Girgias there was at one point, but I left it a while ago. There's also @StatikStasis's server that some of us congregate on. And the one Sara mentioned.
 
It's fun to find out who's suspiciously good at lying to so-called "friends"
 
so many
 
Hi
How can visitor of a website make sql injection with query since the input field accepts string
 
5:31 PM
@Sara There is a video on YouTube where I play the "Battlestar Galactica" boardgame with a group of people. Spoiler: I was the Cylon ...
 
Nov 21 '20 at 22:08, by Tiffany
Nov 14 at 19:59, by Danack
1 min ago, by Tiffany
use prepared statements
@PHPFan We've told you this several times, perhaps... I dunno... listen?
 
@PHPFan have a look at bobby-tables.com
 
yeah I undderstand @Tiffany
but I suppose I didn't use them
 
well, you should hope none of your students has the name Robert'); DROP TABLE Students;-- then
 
@PHPFan figure out what is preventing you from using them, then solve that
@PHPFan anything else is a waste of time that could simply be solved by using prepared statements
 
5:35 PM
minor nitpick: what you need is parameterized statements
there is a large but not complete overlap between that and prepared statements
but most people use the terms interchangeably
 
It's curious only how hackers attacks works with sql injection
 
@PHPFan because it's an easy vulnerability
it's #1 on the list
@IMSoP yeah, @DaveRandom has drilled it into my head :P easier to call it prepared statements from a PHP standpoint because it's the closest we have to parameterized statements
 
super-simple example:
- you write `$searchResults = execute_query("Select * From comments Where content like '%{$_GET['search']}%');`
- I search for `'; DELETE FROM comments; --`
- you no longer have any comments
so instead:
- you write `$query = prepare_query("Select * From comments Where content like '%' + :searchterm + '%'); execute_prepared_query($query, ['searchterm' => $_GET['search']);`
- I search for `'; DELETE FROM comments; --`
- nothing happens, I just get no results
 
@PHPFan worth noting that it's not the only vulnerability that hackers exploit, but if it's a vulnerability, why bother with any other vulnerability when injection does a significant amount of damage alone?
 
@IMSoP Sorry I don't understand you well
 
5:48 PM
just an example of how easy SQL injection is for the attacker
 
you no longer have any comments why?
 
because the DELETE FROM comments; gets executed
 
I wrote this in search or text field
true?
 
"you" in the example is the owner of the website; "I" am the attacker typing things into the text field
 
@Sara Well...
 
5:50 PM
So this variable $searchResults is to delete comments
how it processed ?
 
the SQL that gets run is this:
Select * From comments Where content like '%'; DELETE FROM comments; --%'
 
At least it was noticed quickly and removed quickly.
... wait, except it was pushed again?
> Revert "Revert "[skip-ci] Fix typo""
 
@Sara I think this is a priceless opportunity to shut down git.php.net and declare the github repos canonical. Thoughts?
5
 
@IMSoP consider this example
$sql = "SELECT id, firstname, lastname FROM MyGuests";
$result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
  // output data of each row
  while($row = mysqli_fetch_assoc($result)) {
    echo "id: " . $row["id"]. " - Name: " . $row["firstname"]. " " . $row["lastname"]. "<br>";
  }
 
@NikiC what has actually happened ?
 
5:55 PM
Can it be injected by this way?
 
@JoeWatkins Looks like git.php.net was compromised -- in some way
 
1 hour ago, by Sara
Yeah, this is not the forum for this discussion.
 
I just reverted the revert of the revert of the... wait I lost track. But I signed the commit: github.com/php/php-src/commit/….
 
that feels a bit "locking the door after the horse has bolted"; the history needs to be audited
 
it's probably a waste of time, expect your reverted revert to be reverted
 
5:57 PM
@JoeWatkins It only took a second -- may provide more for audit trails to look at.
 
@IMSoP History did not change
 
@NikiC I thought it best not to assume that, until the situation is definitely contained
@PHPFan no, because in that example, your whole query is hard-coded; but most of the time, you wouldn't actually fetch all the records from the MyGuests table, you'd have a where clause, with a variable... and that variable is where the injection comes in
 
@IMSoP Fortunately, history changes would be difficult because so many of us have copies of the repository checked out -- when we'd push we'd find out about divergent history.
 
indeed; I just think paranoia is the best course of action until facts are established
 
git.php.net is probably riddled with security holes; it doesn't accept my ed25519 ssh key, for instance.
 
6:00 PM
the facts are, we fucking suck at keeping things safe, and should hand over to the professionals ...
7
 
Someone should be paid $$$ for this kind of thing, IMO. This is why we need a foundation.
 
I have ssh for the git server, but wouldn't really know what to do with it. The only thing I was able to easily check is that the commits were not pushed via gitolite. Anything more will probably need someone who actually has some linux-fu.
@JoeWatkins Thus my suggestion to capitalize on this and shut the server down
 
Let github handle it. They have millions to spend on keeping their infra safe. It provides multi factor authentication and a strong audit trail.
 
yeah, burn it with fire, having our own git servers complicates everything, it's a time sink in every way ...
2
 
We don't use "karma" for subfolders or anything, so we don't need special rejection hooks anymore.
 
6:04 PM
master meanwhile, appears to be protected by MD5 hashed passwords.
 
@NikiC I haven't heard of gitolite before. As far as I can tell, this means an actual user was compromised?
 
kinda funny that git is prompting me to install an update now...
 
@LeviMorrison No, that means the server was compromised
 
not likely, it's likely the machine was compromised ...
 
It's not just some rogue user pushing using other people's names, that would end up in the log
 
6:07 PM
Is git running on physical or a VM? If a VM it may be advantageous to snapshot the memory if available for forensic analysis.
 
@NikiC What about our ACL controls? I guess we can repro that on github...
 
@Sara yeah, we just need to add people to the org on github
We already do that anyway so people can use the interface
 
@IMSoP So I should prepared statement not parameterized queries in my website
true?
 
I can't get a shell and don't have jump setup anymore
 
@PHPFan no... but don't worry too much about the terminology, just look up some examples of how to do it right, like the site I linked earlier, or the one Tiffany linked
 
6:11 PM
@PHPFan PHP's implementation of parameterized queries are prepared statements
 
@PHPFan imo, just defaulting to use prepared statements everywhere is good.
 
the key thing to remember is that the SQL and the data should be separate
 
alright
 
what does phpstorm call those things....so I can find the setting to turn it off.
 
parameter name hints?
 
6:13 PM
"inline hints" I think
 
@Tiffany ty.
 
@NikiC got root/sudo on git ?
 
@JoeWatkins yeah
 
if you get me in I'll have a poke around ...
 
heh, I wouldn't know how to get you in ^^
Rasmus said that he's looking around right now
 
6:20 PM
@NikiC me neither, it's all very mysterious ... afaik, I've logged into the machine before ...
 
@makadev the git clone vulnerability is recent and not related to credentials
You just git clone an evil crafted repo and then it executes commands in your computer
Such as commanfs which involve credential theft
This issue was aready lallegedly patched by github
I dont know the internal git php infrastructure regarding git, but if git.php.net is not just a dumb mirrornfor github
 
git.php.net is the source, github is a mirror
 
I would vote no, github is now under microsoft management im sure the git clone problem is just one security issue of more to come
 
That makes literally no sense ^.^
 
At least not for something as massively distributed as php
I just put my tin foil hat on what do you want 😅
 
6:33 PM
Microsoft has an entire team of engineers working on security hardening, PHP has.... has.... ummm...
 
volunteers
 
Anyways compare md5 hashes in both servers perhaps it will tell you something
 
and the git clone was an issue with git itself, not github.
 
Both repos i meant
Gogs is an open source git solution which is super easy to manage
Made by google
 
Easier to let someone else handle it :-)
 
6:40 PM
That matter depends if you need to have full control or you dont
 
Which we (PHP) doesn't.
 
Also depends on TOS from the provider
 
is there going to be a public announcement?
 
Running your own is all well and good when you have the resources to maintain it, people on the payrole who's responsibility is to keep them running and secure.
I use self hosted for some things, provider hosted for others
 
If electricity is a problem I could talk to rasterman from the enlightenment project he hostes into a university which provides him of free internet and electricity
For any other kind of administrative tasks its just using a gui to grant or deny access plus gogs tells you if there are new updates if I remember correctly
Additionally the biggest feature of github is github actions, which is a paid feature
 
6:59 PM
@ln-s CVE-2021-21300? Hrmm.. I understand the gist of the RCE part but not if that is actually possible by cloning a random github repository. Kind of disturbing..
 
@ln-s Only paid for private repos, right?
 
Afaik you dont need to pay for private repos github actions is a paid feature regardless of repo visibility please correct me if im wrong
They have to make a buck its totally fine
 
guys which one is correct?
 
Im assuming git.php.net has several deploy steps ?
 
- Every day about 4k new rows get added to it.
- Every day about 4k new rows adds to it.
 
7:09 PM
Hey Im not trying to be a dick here but this is not the english support channel @Shafizadeh. I suppose you are talking about records from a table. Every day about 4k rows get added.
Thats it
 
thanks
 
@Shafizadeh ell.stackexchange.com would be the better place if you have other questions like this :)
 
you are right .. thanks
 
@ln-s off-topic conversations are allowed, as long as they are not disrupting more on-topic conversations. I suggest using the ignore button sometimes.
 
@ln-s not sure I agree that github actions is "the biggest feature"; the main relevance right now is that literally anybody managing the server infrastructure is better than it going unmaintained for lack of volunteers
there are other hosting providers, certainly, but the point is to make it someone else's problem
 
7:16 PM
> Place your Linux files in your Linux root file system Make sure to put the files that you will be accessing frequently with Linux applications inside of your Linux root file system to enjoy the file performance benefits.
if I'm using docker on windows with WSL2, and I haven't (afaik) installed a 'Linux root file system', but docker is working - how can I find where that directory is on Windows?
 
WSL has its own virtual file system
 
@Danack \\wsl$
 
^ what Mark said
 
aka I'm seeing problems in file changes not being picked up automatically inside the container, and apparently there is a place I should put file for it to work.....how can I reach it from explorer/phpstorm on the host system?
 
WSL and Windows basically see each other like network locations; Windows drives end up in /mnt on one end; WSL filesystems end up in \\wsl$ on the other
 
7:19 PM
@Danack File change notifications can be a bit of a hassle, a known issue. If you're running a process on change, run it from inside a docker container mounted on the linux partition
 
"mounted on the linux partition" - how would I get to that partition? I'm fine with git cloning my stuff into a new dir, but I don't know how to get to that place to check it out, or how to open the project in phpstorm to edit the files also.
 
If you open up powershell and type "wsl" you'll be in your linux shell, where you can do whatever you normally would.
When you want to open that area in phpstorm, open a project in \\wsl$\YourDistroName\home\etc etc
 
or install Windows Terminal, for nice tabbed shells
 
DesktopDanack:/tmp/docker-desktop-root/mnt/host/d/projects/PHPOpenDocs# apt
bash: apt: command not found
 
@NikiC I'd vote in favor going github as source of truth. Having our own git instance means maintaining it, and that means having someone who will pay that level of attention, and I get the feeling that systems@ is becoming smaller over time, not larger.
4
 
7:26 PM
I haven't consciously installed a linux system. any idea what the package manager is for whatever the default one is, so I can install docker to run stuff?
 
* github, or bitucket, or something else.... so long as it's not sourceforge.
 
@Danack Which distro did you install? microsoft.com/en-us/p/ubuntu/9nblggh4msv6
 
@Danack run cat /etc/lsb-release
 
@IMSoP cat: can't open '/etc/lsb-release': No such file or directory
I didn't consciously install a distro. afaik, I just enabled wsl2
 
7:28 PM
I'd recommend installing ubuntu then
 
well, you've got bash, so you've installed something
oh, unless you've just opened up "git bash" or similar
which is completely different
launching PowerShell and typing wsl --list will also tell you something, maybe
 
I need to setup a swear jar first don't I?
 
lol wtf; doesn't like the capital letter maybe!?
 
yep.
 
I signed my commit. Did I do it right?
 
7:39 PM
So I have ubuntu installed, and touched a file called danack.txt. How can I reach that file from Windows? Do I need to map \\wsl$ ? I can't seem to see it in file explorer.
 
Facepalm, I forgot to add "closes GH-XXXX"
 
@Dharman It says "Verified" in the github UI, so I'd say "yep!"
 
@Sara How large is the distributions repo?
I believe github limit is 100 GB
 
@Danack if you just type \\wsl$ into the Explorer address bar, it should show the Linux distro like a network share inside it
the full path will be something like "\\wsl$\Ubuntu-20.04\home\danack"
 
```
$ du -sh distributions/
11G distributions/
```

Not nearly as big as I'd thought.
It's easy to forget that each release is only about 40MB total (about 13MB per compressed tarball)
 
7:46 PM
Yeah, that should be fine then. I have an active github repo that's larger than 11g
 
Fuck it then. Burn it with fire.
And let's move bugs onto GH issues.
And pretend qa.php.net doesn't exist.
((we already do that))
 
What is qa.php.net?
 
@Dharman What's that? You must have imagined it. It doesn't exist.
 
@Dharman EXACTLY
Gonna assume this isn't related as we're almost certainly not on a case-insensitive filesystem: github.blog/2021-03-09-git-clone-vulnerability-announced
 
there must be a bug tracker out there that sucks less than bugs.php.net, but github issues isn't it IMO
not for a project the scale of PHP, anyway
 
7:53 PM
I'm just channelling koala-destruction.gif
 
@Sara So ... can I interpret this as permission to burn it with fire right now?
 
@NikiC Allow me to hand you a match, good sir.
Rasmus gave his blessing, that's probably as much as you need.
 
I imagine a certain Gnome mage channeling a fireball right now.
 
I roll Arcane, but I do keep Fireblast on my hotkeys
It's a nice instant cast and in torghast it can turn into a stun.
 
I put on my robe and my wizard hat
 
8:01 PM
Is github becoming the source of truth for everything, or just php-src for now?
 
github.com/php/php-src-security Can someone on the php org but not an owner confirm that they don't see this repo?
 
If the point is to delegate then it must be the source of truth for everything
 
@Sara Just pulling Denathrius, and pulling Denathrius, and pulling Denathrius ;)
 
Else you still maintain
 
@NikiC Not on the org, but I do not see that repo, if that is any help.
 
8:05 PM
Spank me harder, Sire daddy.
 
Neither do I
Lol
 
@SebastianBergmann 404 to me
 
@Sara Wipe 74 right now.
 
@SebastianBergmann Heroic?
 
8:06 PM
@Sara Yes. Flawless Phase 1 and Phase 2, and then somehow chaotic in Phase 3.
 
@NikiC Sorry, replied to wrong message. I'm in the PHP org and I can't see that repo.
 
@Sara Okay great, that should address stas concern
 
My guild is still only 8/10H we're casual nubs
That said, NOW I WANNA KNOW WHAT'S IN THAT REPO!!!!!!
:p
I often struggle between "I should have ALL THE PRIVILEGES!" and "It's best to stick with principle of least privileges and not have any permissions I don't actually need"
 
@NikiC Just to confirm what Sara said, but yeah can't see it either
 
@NikiC I also had the same first idea after noticing the incident. So +1 from me :)
 
8:23 PM
Oh hey, @MarkR were you the one asking about PHP documentation rendering the other day? Phd was the name of the package I couldn't remember, and it's on git.php.net (if you can trust it now)
 
@NikiC if you say kill it with fire, you don't mean destroy that server or? because it would probably make sense to have someone with the chops evaluate what was all compromised and such :)
 
@Sara Thank you. I think that's what is part of the normal build process, but couldn't see anything about single docs
 
@beberlei Yes. Keep it for analysis. Also, not all PECL repos exist on github (yet), so there'd be an additional migration (or filtration) stage for those.
@MarkR /shrug Sorry, I'm at the limit of my knowledge of our documentation.
 
What's the process to be added to the GitHub Org?
 
8:33 PM
@Sara I suppose one should asses what was compromised before doing anything else?
 
8:44 PM
Does anybody know how many of the 1800 people on people.php.net have php-src karma? The higher the number, the higher the likelihood something like this can still happen on GitHub. But of course moving to GitHub will be a win in any case.
 
@IluTov Permission management on github would be completely independent from both php.net accounts and karma
Of course individual keys can still be compromised, but there's nothing you can really do about that (apart from revoking permissions after the fact)
 
@IluTov I'd say we can also start cleaning up some of the permissions for people who haven't contributed in ages, which if they request access again they'll get it
 
@Girgias +1
 
9:00 PM
@JoeWatkins Does the php-azure-devops user belong to you?
 
9:44 PM
@Sara I created github.com/php/web-php-distributions -- can you push your hopefully known good copy there?
 
Sure thing. Let's exercise this gigibit fiber :)
Pushin'....
I'm going to run a validation of the signatures for all the tarballs we have. Will let you know if any fail.
@NikiC `remote: fatal: pack exceeds maximum allowed size`
`
 
So, looks like you can't do a single push of that size, have to split it up ... manually?
 
I'm literally reading the same post
Yeah, I can script this, it'll just take a little longer...
 
So now to push to php-src we'll need to be part of the github org?
 
Is there a specific advantage of hosting the binaries on git, vs something like a cloud bucket with a write-once retention policy?
I'm unsure about AWS, but Google has a retention policy you can permanently lock in place. Uploaded files cannot be deleted or altered in any way, even by someone with admin credentials.
 
10:02 PM
Yeah, this iterative approach is working (so far)
 
0
Q: why update_post_meta saves NaN as Value?

hosseind600I have a problem saving data using update_post_meta in wordpress . the code is like bellow: $price = get_post_meta(get_post_meta($orderid,"service",true),"package".get_post_meta($orderid,"package",true)."price",true); $mainPrice = get_post_meta(get_post_meta($orderid,"service",true),"package"...

hi gys
guys
 
Let me rephrase. We're not here to solve your problem. We have enough of our own.
 
literally pastes question then leaves, heh
 
I'm done with people's idiocy
 
is bugs.php.net safe?
also the issues with bugs.php.net from a few days ago with it sending 500 errors, could there be any relation?
 
10:20 PM
I dunno what the max pack size is, but it is NOT big...
But getting there, slowly but surely
 
Blocked pushes for large files
GitHub blocks pushes that exceed 100 MB.

https://docs.github.com/en/github/managing-large-files/conditions-for-large-files
 
Alright then. That's like.... 3 or 4 releases at a time then. Fun.
Also, I think it must be more than 100MB per push, I'm doing way more than that right now.
 
perhaps that doc is referring to individual files.
 
It blocks single files above 100MB afaik
 
Ah, then that's not applicable to the woes I'm having.
 
It's pushi', pushin' real good
I mean, I'm into the 7.x branch already
 
That... is odd.
/me continues pushing like it's Dec 2018
 
That is a very different "push it"
 
10:35 PM
@Sara any feedback on the mail?
 
Right. This should be the last push.
looking
@NikiC Replied. Also, the upload of web-php-distributions is complete. I imagine something in web-php's update flow needs to be updates to pull from github now.
 
> We're reviewing the repositories for any corruption beyond the two referenced commits. Please contact security@php.net if you notice anything.
@Sara Something like that at the end?
 
Sounds perfect.
 
@Sara Yeah, a bunch of stuff will need to be updated. Going to look into things tomorrow.
 
You da man!
 
10:53 PM
@JoeWatkins If you have access to the php-azure-devops user, can you please accept the invite? I've added it as a collaborator directly on php-src, hopefully that will be enough to make CI work again
Otherwise it's going to need 2FA so it can be added back to the org
Though I have no idea why azure needs a user with write permissions on the repo
 
@NikiC thanks for all you do :)
And Sara
 
05:00 - 23:0023:00 - 00:00

« first day (3816 days earlier)      last day (1115 days later) »