« first day (3817 days earlier)      last day (1114 days later) » 

12:13 AM
People are coming after me first now
 
lol
I am bad at being impostor and lying... I'm at the point that I'm apathetic if people blame me or if I lose... next game starts fast enough lol
 
@NikiC don't.
 
thats a pitty, also to secure the project itself.
 
hmmm, why is it a pitty?
 
12:22 AM
the only part not owned by microsoft from the LAMP stack they always wanted is the A then for Apache.
 
PHP can always jump to another platform
php-src contributors have the repo cloned, can push elsewhere
 
The best alternative being owned by MS is a pretty odd reason to stick with something that's unmaintained and vulnerable :|
 
well speaking of securities, right.
 
1/ MS doesn't own us. Don't be hystrionic.
 
anyway I might be wrong, Mysql still looks more like a mirror, too.
 
12:26 AM
2/ The shame is that our infra was compromised, not that we've moved to more secure systems
 
@hakre mysql is owned by Oracle...
 
Dumb question, but does the master system allow updating your email without verification?
 
@Tiffany ... and Github by Microsoft. I was writing about Mysql being developed there, but it looks more like a mirror.
@Sara had to look up that word ... I didn't say they own us, just that the SRC is in their hands. Everything else really would be offending.
 
No, you DID say that.
"""the only part not owned by microsoft from the LAMP stack they always wanted is the A then for Apache."""
You literally said that only 'M' is not owned by MS which QED means that P is.
 
@Sara and PHP-SRC is not on Github?
 
12:30 AM
Of course it's on github AND ON EVERY CLONE AROUND THE WORLD
 
Maybe my english is too bad.
 
it's hosted on github, not owned by github
 
nm on previous question, I missed the userid=$userid in can_modify
 
@Tiffany would it be correct to say they have it then, like a host has their guests?
 
@hakre They're a business providing a service. Part of which is having a secure platform.
 
12:32 AM
@hakre no, because it can be pushed to a different platform if MS does something the PHP project disagrees with
@hakre "host has its guests" if the party is a barbecue at a public park, and guests are free to leave at any time :P
 
@hakre No, it would NOT be correct to say they "have" it.
They don't have it any more than anyone who runs git clone "has" it.
They have a copy, that is all.
 
@Sara maybe I misunderstood the canonical part.
 
There's no such thing as "canonical" in a dVCS
GitHub is the default upstream, that's all.
And guess what, they've BEEN the default upstream for years.
Since that's where the vast majority choose to clone from.
 
perhaps like sort of quite half of the world if not even more.
 
If MS chooses to maliciously modify PHP's source tree, then EVERYONE with a checkout finds out immediately.
 
12:36 AM
I was more concerned about a different form of security, but it's late and my english is not the best one.
 
Unless you can define what form that is, your concern is meaningless.
 
I'm sorry if my comments did upset anyone
 
We're already upset about the breech.
You making a boogeyman out of MS over something they can't do is just an annoyance on top of that.
 
@Sara Followed immediately by github's market value dropping to about negative 10 billion dollars.
 
was git lfs activated by any chance? but likely you've checked that.
 
12:39 AM
@MarkR Fer srs
@hakre Aware of the Mar 9 vulnerability and it's unlikely to be causal.
 
It's an odd one, because it's so.... freaking obvious.
It's the "REMOVETHIS: sold to zerodium, mid 2017" which has me confused / concerned. What was sold in 2017
 
Right, I think it might have been a poorly delivered whitehat, tbqh
Or an utterly inept skript-kiddie
Hard to tell sometimes.
 
To be quite frank
It does feel awkward
 
Is there a way to assign a different GPG key to different git repos? I'm just looking into commit signing now
 
A company that has demonized open source for so many years
 
12:44 AM
Different CEO
 
Microsoft jumped on the OS bandwagon years and years ago.
 
@MarkR you mean that you have different keys, yes that is possible.
 
Saying it was cancer
Etc
 
@hakre Could you point me somewhere that runs though it? I'd like to use a different key for my work stuff than my php stuff
 
Anyway ... dont want to go edgy as stallman
But yeah it feels bad
 
12:45 AM
Again MS is a very different company under the leadership from Nadella compared to Ballmer
 
@MarkR do you have a key already? do you have a non-work key already? do you know what a subkey is?
 
Like that highschool sweetheart which cheqted omnyou with brett the jock
 
Then she wants to come back and you say sure
Lol
Didnt ms also drop the support for php?
She cheats again! 😂
 
@MarkR all you need is a gpg key to sign. you can create yourself multiple keys, e.g. one key you use to sign for git. this has the benefit you can revoke it individually (and extend it individually). I normally refer to here: wiki.debian.org/Subkeys
 
12:48 AM
Anyway dont think its a bad idea, but it feels awkward
 
It's besides the point really. The PHP project is notoriously bad with infrastructure, it just doesn't have the funds to dedicate someone to it at the level necessary. Github is offering its services for free to us, just as it does to everyone else. We'd be silly to pass up the opportunity, if anything it's just a shame it took an attack to incentivise the move
 
I thought the amount of volunteers was huge
Or so I read the other day
 
that may have been sarcasm
 
PHP's core development team is tiny, it's operations team is even smaller, 1 or 2 people at most
 
Again it feels awkward, same feeling as forgiving a cold blooded murderer who killed your siblings something like that
I personally think ms is following a tactic called embrace extend and extinguish but time will tell
 
12:53 AM
Right. There's a decided non-zero chance that MS will fuck the github platform, but when and if that happens, we move.
 
^
 
Will be costly to translate all the actions created
 
@Sara until then we can hit on their CI servers.
 
It wouldn't be the worst idea to just push a mirror to bitbucket just because
 
the actions are already there
 
12:54 AM
Yeah all the actions already run on github
 
@Sara there must be a tool that mirros between the big three: bb, gl and gh.
would also reserve the project names like on twitter.
 
@ln-s What? You just change the git repo, the CI is not using GitHub actions at all currently
 
Is that one in our control tho?
 
@Girgias the plan is to go 100% to gh? Or not?
 
12:56 AM
@ln-s ???? No
 
No idea but in light of a complete absence of activity, an polite email from security@php.net would likely be able to claim ownership of it.
 
@Sara what is the plan then im lost
 
Guys you need to learn how to read properly, the main place were the source code lives will now be GitHub instead of our own unmaintained git repo
And GitHub was already a mirror where most people forked the project so they can propose PRs
Making another git repo the "main" one is super easy
 
@ln-s sorry for the confusion, this is about the git repo only. the current one was compromised so a new one right now is needed for which the previous mirror on github has been chosen.
 
And we are sure that the trojaned code has not also been pushed to gh?
 
1:00 AM
We're not super sure of anything right now, and the list of people in a position to find out is small.
 
I mentioned something early about comparing file hashes between the two repos
Find with xargs md5sum in one repo and do it with the other repo then you diff the result
On my phone now but it should be:
 
@ln-s the repositories on a server are normally bare, that means they don't have a working tree checked out.
 
cd repo; find./ -type f | xargs md5sum > repo1.hash
Clone repo from php.net then clone repo from github
Then compare master branches
 
@ln-s both trees and objects are already hashed by git itself. they can be compared w/o cloning / checkout.
 
The git server seems to be the entry point I would not trust it
 
1:07 AM
You don't have to.
 
@Sara :D
 
That's not how git works.
 
I'm terrible
 
Shhhh
I need to do a git deep-dive video, because clearly people DO NOT GET GIT
 
I think git has enough documentation already.
 
1:10 AM
Clearly not
Because you (among others) don't understand how any dVCS works, let alone git.
 
I was really annoyed when I finished uni and realised we'd never been taught how to use any source code manager
That was about 14 years ago, maybe things changed since
 
@Sara Clearly that would be great. Let alone git, if you could to a video how the packing works on the protocol level and the recent changes there would be great.
 
@MarkR I see it as one of the most suggested things to students when they ask for stuff to learn to become a better developer and most students are like "I've never heard of that, I need to check it out"
 
God, I hope so. VCSs should be year 1 coursework these days
I can confirm that few interns have a particularly good grasp of git, but they've at least heard of it and know the basic commands.
But then the old farts start arguing merging and branching strategies and the poor dears' eyes gloss over.
 
I'm a college dropout, and mostly self-taught. What I learned in highschool/college was basically taught in week 0, maybe week 1 of CS50x
 
1:17 AM
I think most folks learn how to use git nowadays
 
I've actually learned more from CS50x than highschool/college
 
I never went to college, but my courses at the autodidact university of meesville were pretty good.
 
I even know people in design which are taught how to use it
 
@Sara :D
 
I'm old though, I'm not even sure CVS existed when I woulda been in college
 
1:18 AM
@Sara but not that old.
 
Oh, initial release 1990... Okay, it existed. Barely.
 
@Sara rcs from 1982
 
Yeah, rcs was a thing for sure
 
I think when I started it was TortoiseSVN as the tool of choice on windows
 
@MarkR loved it those days.
 
1:22 AM
When I started, TrumpetWinsock was the IP stack of choice on windows.
 
what is the preferred GPG signing key?
 
but when I discovered git never went back to svn.
 
git is life
 
So you're saying that if people name themselves as GIT in Among Us you won't immediately kill them?
 
@Sara the day you apply the shell scripts in the commit messages via cherry picks.
 
1:25 AM
I only kill paul in AmongUs
I even TOLD YOU PEOPLE. "If paul dies first, it was me." And then you let me win AGAIN
 
in among-us does everybody show-off at the end of the round or are still some things kept secret?
@Tiffany between which do you choose?
 
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(14) Existing key from card
Your selection? 1
shrug
trying ot figure out how to sign with gpg next
argh, figured it out, but it's annoying... I guess it's one way to make me take a step back to make sure my commits are correct before pushing
 
1:44 AM
yes 1, and this should not prevent you from amending commits. there is no signing with blood in git and its all software, so easy to change and correct.
signing a commit will allow others to check that the commit is by you if they have the your public key.
 
yeah
 
Looks like github has an option to mark a branch as protected, requiring commit signing
Seems like a reasonable idea
 
Rasmus commented it should probably be done for php-src, but documentation and stuff can wait
I'm prepared at least :D
 
How did you verify it was including your signature?
 
made a throwaway repo to try it out
 
1:58 AM
ah good shout
 
2:15 AM
Annoying: GitHub on mobile doesn't say if it's verified :|
 
Github, like many sites, offers a shit experience on mobile, even when their normal site would work just fine.
However, unlike many sites, GitHub will allow you to permanently use "desktop view" if you click the right incantation.
 
That incantation is gone, I think
I tried doing it a couple weeks ago and realized "wait... IT'S GONE?!" unless it was moved and I just haven't found the new location
 
Got my key signing sorted too.
although I changed my account name in the process sooo probably broke plenty of other stuff
 
2:32 AM
@MarkR gg :P
 
 
3 hours later…
5:28 AM
@Sara I still have some RCS repositories with ARexx/C/Assembly code from my Amiga days around here somewhere.
 
@NikiC I do have access, but can't figure out where to login, do you have the full email for that user ?
when I login to azure as me (krakjoe) it shows me the phpdevops user, but I dunno if it's an actual account or an alias, or something else ...
 
 
1 hour later…
7:01 AM
o/
when creating a Symfony 5 api, how can I sent up the Symfony router to accept a route like "/products/{id}". I'm using Vue on the frontend, so for example #[Route('/{entry}', name: 'app.entry')] I'm using a wildcard to accept all requests and returning the base.html.twig page. So how can I configure it to accept a deeper url, I tried /{entry}/{id} which threw an error.
 
@KerrialBeckettNewham "which threw an error" is a bit generic, not sure we can help unless you give us the exact error. What you are looking ofr is a fallback route I assume?
 
7:17 AM
@beberlei it's just a generic message stating that the router isn't configured to accept this route.
 
you used to do have to make a change to change the {entry} regex to allow a slash in it, because by default the validation of every parameter in symfony is defined as ^/
google for symfony fallback route to find the relevant infos I believe
 
@beberlei yes, I recall looking at this, it gives a terrible example in the documentation, * @Route("/share/{token}", name="share", requirements={"token"=".+"})
 
i find it confusing symfony does not provide a fallback route yet, specificiallly with SPAs this is a common problem
 
@beberlei ikr
 
7:33 AM
@KerrialBeckettNewham I think not accepting / in a parameter is a much more common case, so instead of guarding against it in every single route Symfony does it automatically. I think that makes sense.
 
@IluTov yes, but there should be a config to tell the router you are using Symfony router as an entry point only, as Symfony encore forces you into this setup.
 
DateTime(Immutable)::sub around DST yield incorrect time ・ Date/time related ・ #80913
 
7:53 AM
The media is reporting the incident.
 
@JoeWatkins Just to be clear, that one is a user on github not on azure
 
I can't remember the pass or email for it ... did I send it to you at any point ?
 
@JoeWatkins I don't think so
 
crap
 
I think the problem is that this user is associated with the org on azure and thus needs to be the one with access to the repo
 
8:09 AM
I found the associated email address
searching disks
I'm sure I wrote it down in a document and thought I sent it over to you ... but maybe not ...
 
8:23 AM
@beberlei by the way, this: #[Route('/{entry}', name: 'app.entry', requirements:['entry' => '.+'] )] doesn't throw any errors, but prevents pages from loading correctly, get an error in the console: "Error: Redirected when going from "/login" to "/dashboard" via a navigation guard." if I remove the requirements from the route it functions correctly.
 
@JoeWatkins oooh I did it
 
what and how ?
I can't find the login, I think it doesn't exist and never did ...
gmail says it's not an email address
 
I switched azure from the oauth integration to the app integration
A button for that appeared after I installed the azure pipelines app again
Integration looks different now, but works: github.com/php/php-src/pull/6816
It shows the individual jobs as well now
 
that we don't know how we won is not important, every win counts :)
 
that looks like gthub actions and not azure pipelines :)
(its the same underlying technology)
ah no, it does link to azure, its just the checks are inside actions
 
8:52 AM
Incident on 2021-03-29 08:52 UTC
Incident on 2021-03-29 08:52 UTC ・ GitHub Pages has Partial Outage
 
9:09 AM
moin
@NikiC You've developed a new "stop" word: "like" (just edited the latest podcast episode)
 
9:26 AM
@Derick oops
 
Added that to the list of "uhm", and "so" ;-)
 
All issues have been resolved!
 
"In the malicious commits [1, 2] seen by BleepingComputer" as if to see those commits they had to attend a clandestine meeting in the shadows of an underground car park or something ... it's public, anyone can see it, you provided a link ...
 
10:03 AM
We should setup branch protection rules on php/php-src and require that all commits to master and/or PHP-* to be reviewed/signed/linear history, etc..
 
10:13 AM
Morning, all.
 
10:35 AM
 
@pmmaga Indeed, we should. I suggested something similar in the mailing list :)
 
Anyone used the Ratchet SessionProvider with a RedisCluster?
 
11:13 AM
@ln-s honestly, I'd trust Microsoft more than Google these days
and had no particular reason to trust github as an independent company in the first place
 
Sure! you can trust the guy who dropped support for php builds
xD
Anyway ¯\_(ツ)_/¯
 
yeah, I think you made your point about 10 hours ago; and Sara's answer is pretty much all there is to say chat.stackoverflow.com/transcript/message/51877828#51877828
 
You brought it up again, I didn't
:P
 
Exercise self control :P
Morning all
 
Morning Mark
 
11:43 AM
Morning, quite a start of a new week I see
 
Aye
 
11:58 AM
@Derick Wait I thought that was my issue
 
@GabrielCaruso Isn't commit signing pretty universally considered as useless?
I've not seen enforced commit signing used in any high profile project
 
Nikita: I mailed you to nikita.ppv@gmail.com
I still own the github php org
can't twitter DM you since you don't follow me, so i figured mail is the best
 
Safe to say r11 is monitored by the media, at least: theregister.com/2021/03/29/php_repository_infected @MarkR was quoted
 
ugh
 
@somnium Yeah, saw your mail
 
12:02 PM
Cool, perfect. I am off from the chat here, you can reach me either on twitter DMs @dsp_ or via mail
 
@Tiffany heh
 
._______. spies
 
Hey Register! go fuck off?
 
@IMSoP I wholeheartedly concur.
@Ekin o/
@PeeHaa awake yet?
@MarkR You're famous! Can I get your autograph?
 
12:18 PM
for the record, The Register still owes me beer from about 2004, for publishing a story I gave them.
 
@StatikStasis Soon you'll be able to get everyone's autographs, or at least their signatures
 
GPG signatures (yes, I killed the joke)
 
cmb
auto-closing of bug tickets is broken now :(
 
@cmb is taking bugs off life support in favour of github issues a likely occurrence? It was mentioned here yesterday as another piece of infra to burn.
 
12:26 PM
GH issues suck tho
 
Yeah, was wondering how auto-commit would work on bugs last night
 
Also you'd need to import all of the DB
 
@Girgias At least it requires an account...
To comment
No more rhsoft
 
Sure, but you can also run Mantis or something like that
I mean might make sense to have someone from a hosting platform not just sponsor a box but also maintenance of it
 
@cmb Yeah, we need to migrate the post-receive hook for that to a webhook
 
12:32 PM
The wiki is showing notices it's 3 years out of date, but those only appear to those logged in it, it looks like.
 
It can't be 3 years
There was a migration less then a year ago
 
Hotfix release available: 2018-04-22c "Greebo". upgrade now! [50.3] (what's this?)
 
cmb
yep, Wiki is not up to date; Stas wrote to internals long ago, but no action :(
it seems to me we suck at infra ;)
 
pls no quoting mr. journalist :D
2
 
Hi, I tried (multiple times) to subscribe for the Announcement mailing list but I'm getting no response. I've subscribed to another list with a gmail address, that worked but I want the Announcement subscription to use another e-mail. Does the subscription only work with certain domains or something like that?
 
12:55 PM
CVS emails also need to be changed I imagine?
Or should we just subscribe to the repo in some way to get an email on each commit push?
 
You can watch a project in github and you get notifications for it
 
php.net is down for me :-(
 
Same
Down for me too
It's just you. php.net is up. ¯\_(ツ)_/¯
 
Up here
 
Error 504
Gateway Timeout
This is what I get
BROWSER
Working

MYRA
Working

HOST
Error
 
1:02 PM
Works for me from the US
 
@ln-s I know that, also that might be rude, but don't make suggestions/comments about things you don't necessarily know. I'm talking about our current mailing lists which send an email on each commit and none of those work.
 
@beberlei got a VPN tunnel elsewhere? :P
 
@Girgias We actually already have a webhook that sends mails on pull requests
It even seems to be working ... apart from the mail sending part
 
@NikiC Huh, I mean I am subscribed to the repo so I got emails that way anyway, didn't know we had a webhook for that.
 
Mails stopped being sent at the end of January: news-web.php.net/php.git-pulls Shows how many people use that list
 
1:06 PM
Why is there no CHANGELOG.md ?
 
UPGRADING
 
One could monitor CHANGELOG.md and send that to the people who are subscibred
 
Is the file you want to look at
 
ah, thanks @Girgias
Yes, CHANGELOG.md implies other things such as semantic versioning, etc UPGRADING is more detailed so it's perfect for a mailing list
 
1:22 PM
Huh, just realized I didn't have the auto-signing of my commits enabled
 
But your still were able to commit ?
 
php.net 504?
 
@Dharman yeah
 
@ln-s Well obviously, I've got the rights too
 
@beberlei Down for me too, maybe just Europe?
 
1:25 PM
@Girgias I thought the idea was that every commit must be signed, else you can not even commit anything sorry if I misunderstood ?
@IluTov South america, down
 
@ln-s That's not how it worked, at least not now, if you have "karma" (i.e. the rights to commit) then you can just commit, but you needed to gain those rights
 
Checkout code, find some bugs to fix, open PRs
Or contribute to docs, we need more contributors to docs...
 
1:46 PM
@beberlei Works for me.
 
@SebastianBergmann weird
cdn magic probably
 
2:02 PM
@cmb ping
 
cmb
@Kalle pong
 
@cmb Is there any chance to have memcached (with the d suffix) added to the pecl build bot?
 
@cmb Damn, okay :/ github.com/yshurik/libmemcached-win perhaps?
Seems to be a 1.0.18
 
I've been looking at how the push webhooks work... I think handling of merges is going to be problematic. In that case you get something like gist.github.com/nikic/ce743798df197f45a6ab3e39042641b9 and it's not clear how to avoid duplicate processing for the merged commit
The "distinct" flag doesn't seem to work for this, because it will be false for both branches to which the commit was pushed
 
2:12 PM
@Crell Thanks for the remembering. It sounds logical but I have some improvement to do. Last few months I've been having back problems, and being in transition between jobs I've somehow postponed buying a really good chair. Your message kinda reminds me not to wait :)
 
cmb
@NikiC would it be possible to hook only for "master" commits?
 
@cmb Yes, that would be possible
I guess that makes sense, at least for php-src
Yeah, I think we should do that
 
cmb
Yes, would be good enough (for me).
@Kalle might be an option, but I have some concerns regarding that old version.
 
Is distinct: true something usable there?
 
@Sara nope
 
2:19 PM
Bummer
 
@cmb by the looks of it, it looks unmaintained, so I would by that alone too be concerned. I basically just need it to avoid having to use docker at work, so I'll try see if I can compile a copy for this testing
 
morns
 
I can update the wiki, but I'm not sure if we have local modifications that are going to be wiped out.
In other words: I don't want to break it and get blamed for it.
 
cmb
@Derick we have some additional plugins and the theme is custom, but other than that there shouldn't be issues (well, at least that was the case some years ago). Maybe just provide a PR (github.com/php/web-wiki/pulls).
 
Looks like you know it better that I do, so I'll defer it to you then.
 
2:28 PM
yay, php.net is working again
 
it is
 
2:46 PM
@Kalle this thread has some context about the two confusingly named memcache extensions: externals.io/message/102375
 
function_exists is now case-sensitive for aliases ・ *General Issues ・ #80914
 
@IMSoP We use memcached at work, which is why I need it :>
 
tl;dr is that the without-a-d one got revived, and the with-a-d one should probably be retired
probably worth looking at abstracting your code to migrate to the without-a-d version
 
@IMSoP I would love that, they only upgraded from PHP5 and Phalcon 1.x last year to 7.4 and 4.1 respectively :')
 
ooh, snap :)
I think when I glanced, it looked plausible to make a generic polyfill between the two
but I've not dug into the details so it may be more complex than it looks
 
2:51 PM
But it is a long way here, I mean someone recently decided to enable opcache in the docker dev config image because "oh it is a caching mechanism, lets have it"
 

« first day (3817 days earlier)      last day (1114 days later) »