« first day (3898 days earlier)      last day (1276 days later) » 
02:00 - 22:0022:00 - 00:00

02:07
DonaldMon ・ *General Issues ・ #81161
03:03
JacobLum ・ *General Issues ・ #81162
 
2 hours later…
05:11
indirect in __sleep ・ Reproducible crash ・ #81163
 
3 hours later…
08:16
@NikiC ping
@JoeWatkins pong
we want this thing to be a hard Error in master, or leave as warning ? and what about branches before master, not sure what to do there ?
the warning says "should", but we're essentially enforcing must, which feels more like error than warning, but just promoting a thing to an error because of a bug doesn't seem right
@JoeWatkins okay to keep as a warning I think
ok, and branches before, do the foreach_ind ?
sounds reasonable
08:28
ok ta
09:03
"display_errors" php.ini is not normalized when set using ini_set ・ PHP options/info functions ・ #81166
09:18
Segfault when loading a large file ・ Compile Failure ・ #81167
09:35
microtime return variable's value is changing inside loop ・ *General Issues ・ #81168
lol
oh not as simple as it looks at a glance ... still pretty funny at a glance ... "time moves forward inside loop" ...
10:28
morns
10:38
do wa have any howto/example of howto to create an enum in a C extension ?
@cmb Where is your key to put on jump hosts? (not sure if I have root on all of them)
@RemiCollet Nope ... because it's not possible.
sounds a bit sad :(
@NikiC what exactly prevents that? i.e. normal class registration, setting ZEND_ACC_ENUM, declaring the backing type and enum cases and then registering the automatic functions?
I doubt it would work out of the box
Not sure if we have support for persistent (but non-permanent) constant AST for example
Not saying that it isn't possible, just that the groundwork isn't there
11:07
@RemiCollet Sorry :( We didn't do that as part of the RFC.
@JoeWatkins Sorry if this was mentioned before, I didn't follow the thread. Currently is_literal is only tracked for strings, right? I'm assuming that's why 'foo ' . $someInt results in a non-literal value? If this is the case, shouldn't the following return false? 3v4l.org/l99MW/rfc#focus=rfc.literals
In other words, all non-string values should probably return false as we have no way of knowing if they're tainted or not.
@cmb OK, let me .
cmb
cmb
ta
which jump host do you use @cmb?
cmb
cmb
currently 4, but I can change that
11:23
@cmb it's already there on jump3
I don't have access to 4
@NikiC Trivial PR for you github.com/php/php-src/pull/7172 (following up your work)
cmb
cmb
@Derick I sent you mail with verbose log. I have no idea what's wrong.
@IluTov I really think this will be needed... I was looking to try for one of my ext, but seems there is a lot of candidate ext for this usage
@cmb Changed it to use jump3 then?
cmb
cmb
directly tried to connect to jump3
11:37
did you use the right key? add -i .ssh/keyname to be sure
@RemiCollet Absolutely. It shouldn't be hard, enums are mostly just vanilla classes with the ZEND_ACC_ENUM flag. They also auto-implement the UnitEnum/BackedEnum interfaces, declare the name/value properties and define the from/tryFrom methods. Those things are done in zend_enum.c. I'm not sure how much of that can be reused for internal classes.
cmb
cmb
@Derick yes
is that the cmb20 one?
cmb
cmb
yes
@IluTov my dream, 2 API (register_enum(name) and register_enum_case(name, value), and event something to allow "enum" in the stub.php ;)
11:39
@RemiCollet Yeah I guess stubs support would be nice.
@IluTov that's how it started yes, but now we're being pushed to allow long to pass ... the reasons are in the thread, help with adoption and so on ...
@JoeWatkins Alright. Sorry for the noise then. I'll have to check out the thread.
I don't really love it, but just code monkey ...
I liked when it was just strings, but people complained that it's impractical and normal patterns wouldn't work ... I kinda think we were setting out to break those normal patterns and it's irrelevant ...
@cmb I can't tell either, but I do have these extra (optional) lines in my .ssh/config for some php.net hosts:
@JoeWatkins Doesn't sound great to me either... $_GET contains integers. That makes it useless for tons of cases. Most insecure websites will use raw IDs instead of slugs, which are also the websites that would profit most from this feature.
11:41
Host master.php.net
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

Host *.php.net
HostkeyAlgorithms ssh-dss

Try them? If not, we'll need to ask Sascha, I think.
@IluTov well, we're not really sure that it presents a problem, it's less pure ... but practically, how can you use it as a vector of attack ?
using int, or strings as ints (in case of _GET, input) doesn't seem to enable any injection, but seems to make it more practical ...
if we're wrong about that (and nikita seemed to agree that integers are not a problem, called them "uninteresting"), I'd love to have an example I can use to drop this int stuff ...
cmb
cmb
@Derick interesting: "no matching host key type found" (ssh-dss doesn't appear to be supported)
@JoeWatkins I guess that's true. I can't think of anything either.
yeah, that's commented out for me, I see now
@IluTov oh, don't say that ... please think of something :D
11:46
@JoeWatkins Haha
cmb
cmb
@Derick with only the master. additions, I get the same error like before. I wonder what that "Authenticated with partial success" is.
it's above my paygrade, sorry.
cmb
cmb
k, I'll reach out to Sascha. Thanks nonetheless! :)
12:34
@NikiC I'm not sure how I can add the dimension checks to ??, I'm staring at the code for the ZEND_COALESCE opcode and I don't see how it checks for dimensions
@Girgias does through FETCH_DIM_IS presumably
Ohhhhh, let me look at this then
@Girgias It would be good to split that PR for the two issues
@NikiC Yeah going to do that, didn't think it would be that complicated
@NikiC Doesn't seem to be the case, as this leads to zend_fetch_dimension_address_read() which handles the string offsets
@Girgias That looks like the right one, but notice the BP_VAR_IS check
It specifically suppresses a warning in isset context
12:40
Oh, indeed
So that's what these constants mean lol
@MateKocsis What happened to line breaks here? php.net/manual/en/mysqli.construct.php
13:00
@Dharman Could it be because the first signature is using constructorsynopsis and the other two are using methodsynopsis? github.com/php/doc-en/blob/master/reference/mysqli/mysqli/…
Very likely
@Dharman weird... as far as I saw, constructorsynopses and methodsynopses are both formatted by the same method (format_methodsynopsis), so there should be no distinction between them. At least I don't yet know what the problem is
@cmb could you elaborate on how I would process it? not sure if this is a function or I do something specific
also not sure if what I'm wanting to do is futile abstraction
13:19
@CharlesSprayberry is it worth getting myself on that waitlist for polywork?
So doing stuff we already did in PHP, nice
% a couple of new cases where some are already on my list
> Future Behaviour: only int will implicitly coerce. The rest will trigger exceptions

that would be nice
I think for string concat still allowing NULL makes sense
the rest not so much
Well float is actually kinda reasonable now
that's locale dependent, or is it not anymore?
and we still allow: 3v4l.org/LWOV3
13:28
@SaifEddinGmati You're using some kind of prehistoric PHP version again
@NikiC NOICE
@SaifEddinGmati Stop using PHP 7 lol me and @MateKocsis fixed that
cmb
cmb
@Tiffany function whatever() {include "file"; /* do whatever you want with the 3 arrays */}; if you don't know the var names, use get_defined_vars()
@Girgias which i was able to control that in customer projects :p
@SaifEddinGmati That's getting fixed with the deprecation of implicit float to int
Like I said... I'm working on this stuff, it just takes time to rollout
Wanted to look into coercision from bool to scalar and deprecate certain cases but don't have the bandwith for 8.1
13:32
@Dharman I think I got it. I forgot to handle constructorsynopsis and destructorsynopsis in one place
Do we even use destructor synopsis?
@cmb thanks
Also @SaifEddinGmati "are very close to having object → num conversion trigger exceptions" is basically what: github.com/php/php-src/pull/6106 is about
@Girgias is the end goal to get rid of coercing ( at least for non-int/nonnull ) completely?
For non-scalar values yeah, which is already mostly the case
13:35
@Girgias apparently not :)
@Girgias awesome!
Just that I discovered the offset handling non-sense yesterday
Which should be "fixed" for PHP 8.1
God TravisCI has a backlog for the ARM jobs
In php-fpm configuration, "request_slowlog_timeout" logs the requests when the script stop running or after the script hit slowlog timeout?
@Girgias @cmb Would it be too much to ask for "methodsynopsis" reviews? I have 4 pending larger PRs which are ready for (another) review.
Also, I'd love to finish this task before PHP 8.1 is released. :S
@MateKocsis I'll try to have a look, will need to be probably next week. Can you request a review from me on the PR on GitHub so that it's on the notificaiton queue?
13:49
sure!
cmb
cmb
@MateKocsis sorry, currently no time for this; need to work on Windows stuff
@Gordon In my opinion, yes. I need a portfolio of work I've done to effectively act as a resume and I like the way Polywork does it. polywork.com/cspray I also think that when they open up more functionality around searching and the way they handle contact preferences it could be a way to find/recruit people.
@NikiC do you maybe want to have a call at some point to go over the variance code?
14:10
@mario it's meant to be when the slowlog time is reached...I think.
@Girgias Yay, congrats.
Does anyone knowledgeable with PHD have anything against merging github.com/php/phd/pull/39 ? This is really annoying and hurts performance
@Crell Until it is actually merged I would wait for it :p But thanks :D
Hello all
need one help from you guys
for cross-site scripting attacks in application url
if I load 404 error page when somebody manipulates an application URL is a good solution? or do I have to sanitize the URL?
if sanitization url is not possible at all
in the application
any idea guys?
14:31
Depends what you're doing with the URL and if you display it anywhere.
If someone goes to yoursite.com/iamhacker, presumably that path doesn't exist, so showing a 404 makes sense. The issue comes in if you try to display "iamhacker" on the page somewhere, as that is a potential attack vector. So don't show that without proper escaping/filtering/etc.
the url in my project is like this yoursite.com/index.php?app=requests and I need to catch app value in my application
so when someone tries to give some yoursite.com/index.php?app=<script>alert('ghghghghg');</script>
i want to redirect the page to 404 error page or custom error page
is it a good idea to redirect the page to error page?
14:47
Morning
@muniya I have a strong suspicion you need to google and read up on "whitelisting user input" - such as owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/…
@JoeWatkins Naming philosophy question: Should static functions include the zend_fiber_ prefix or is it better that they don't? For example, this vs. this.
15:06
.......................................the windows users of Imagick still download random files from the internet rather than from the dependencies directory on windows.php.net. I still need to get that t-shirt made.
@Trowski I personally prefer prefixes because it helps when setting breaks in a debugger (completion) ... but I would say pick one and stick with it ... (and pick the one I like because it makes my life easier) ...
when I do zend_fiber in a debugger and press tab, I want it to show me all relevant symbols ... want/need/really like ...
cmb
cmb
@Danack everything needed to use imagick on Windows is supposed to be in the zips with the ext DLL (of course, old ImageMagick version)
I have no idea how to update
I will take the risk of being a backchair suggestions thrower; I don't know this particular case, but every time in my life where I've wondered about prefixing or not, I've later found out that prefixing would have been nicer. ymmv
@JoeWatkins Makes sense. I'll merge the two outstanding PRs and do a little cleanup.
@FélixAdriyelGagnon-Grenier backseat driver
15:27
Some will argue that the prefix leads to the assumption that it's part of the ABI.
@Trowski Just follow the existing convention :P
@NikiC Flip a coin to decide to prefix or not?
bitwise OR the name with /dev/random and if the result is printable, there's your prefix, otherwise no prefix
@Trowski Exactly
@JoeWatkins In case you missed it, this one is still open: github.com/php/php-src/pull/6898#issuecomment-863268793
15:58
that case that hits the assert, I don't think that should error
it doesn't reflect properly, so something is wrong, but it looks valid to me ...
@JoeWatkins Well, normally passing too many ? is an error and in this case foo(?) is a function with one argument -- the fact that it originally derives from a variadic shouldn't matter, no?
@JoeWatkins github.com/php/php-src/pull/6898/commits/… is practically safe, but would probably trip a thread sanitizer ^^
yeah, I'll stick it in a startup somewhere or something
or ZEND_TLS ?
@NikiC but there are no arguments, the first placeholder in the second application should take the place of the only placeholder in the first application and produce 2 required args
@JoeWatkins function test($x) {} test(?, ?); is an error due to too many placeholders. Here the foo(?) should behave the same way as if you had created a single argument function
16:18
Incident with GitHub Actions ・ GitHub Pages has Partial Outage
@NikiC urm ... yeah, you're of course right ...
16:37
@DaveRandom Hey. Sorry I didn't ping you yesterday. I ended up down a rabbit hole. I am still down it today, but could come up for air if you have time for pipes. :-)
@NikiC fixed, ta
the word edges should have more letters ...
17:14
Afternoon and Evening!
@JoeWatkins, do you want to get together with @PatrickAllaert and me on Tuesday to do the alpha2 builds, or would you like us to try to handle that on our own?
@ramsey I am free on Tuesday
@PatrickAllaert Still not on Thursday, though, right?
@ramsey Let's say it is unlikely
@Crell Was watching your presentation on arrays today during lunch. I can't deny that I was fairly amused by the linguistic commentary along the presentation :>
cmb
cmb
17:51
@Girgias, github.com/php/php-src/commit/… failed all CIs so far; can you please have a look?
@ramsey I can be there, if you want
@cmb Oh, yeah I'll fix it, seems a test from the float to int deprecation thing needs updating
Just going throught Maté SPL doc changes
cmb
cmb
ta
that merge looks messy
cmb
cmb
you didn't merge 8.0 into master :)
17:54
I did
strategy=ours then overwrite the commit with the master patch
I guess I fucked it up, squashed or dropped something I shouldn't have ...
cmb
cmb
ah, maybe :)
@JoeWatkins I'm fine either way. I'll set up an invite for Tuesday to invite you and @PatrickAllaert. If you can make it, great! If not, I think Patrick and I are good to handle it. :-)
18:20
@NikiC I somehow found this PR from yours: github.com/php/php-src/pull/4474 is this still relevant?
@Girgias I think so
@JoeWatkins The main issue was that you didn't update the test expectation for the PHP 8.0 branch, which is different both from master and 7.4, which was mainly what I was trying to do while also applying my bugfix, probably explains the messiness
Okay, well I won't close it then :)
All issues have been resolved!
@Girgias ah, I didn't know it was different for 8.0 ... sorry about that, should have checked ...
@JoeWatkins No worries, only saw it because of my bugfix which was targetting 8.0 only lol
I just did the same for the master branch so we're even :p
18:25
@kooldev did you have a look at revolt?
@Girgias it's not the worst mistake I ever made
Oct 9 '14 at 7:01, by Joe Watkins
you're not confident enough ... dude, a while ago I wiped PHP5.6 from the face of the earth ...
@Kalle I find the material is usually more digestible when the jokes are tastefully bad.
Okay that one is funny
The worst I did was remove "dead" code pointed out by CLion, turns out it wasn't dead code
@Crell I shared the presentation internally and said it was great. Sadly many of the developers in my company suffers from not fully understanding types and one in paticular is obsessed with arrays :'(
@Kalle Sounds like someone who has never been exposed to anything else. The problem is, the kind of people who really need to learn how to advance their understanding are the ones that wouldn't bother to read books, articles, etc. on how to do so.
18:37
@Crell Very true, I've been told the person has mostly been working for himself, and it really shows as his experience with PHP in terms of years almost rivals that of mine (mine is 21 next week). Eager to learn, but the pandemic makes the ability to do pair programming difficult due to time contraints
@Kalle If anything I'd think screen sharing makes it easier...
@Kalle in my experience it's much easier with screen sharing
I actually prefer to sit next to whoever it is with a machine each and do it that way, at least I have gotten more relevant questions like that personally but it could also be due to the location I am at (Finns don't talk a lot generally)
19:07
LeoRetSlalkcleme ・ *General Issues ・ #81169
more spam than usual lately o_O
I guess a new bot "beat" the captcha (which probably rejects more humans than machines at this point :P)
talking of bots...
I am not a bot
Thank you, Richard Nixon.
I was chatting with my husband about pair programming earlier; neither of us has really grokked how to do it "properly"
Honestly I quite dislike it. I code alone. I can code review or knowledge dump with someone, but actually writing code I want to not have humans involved.
19:19
Can't deny that I am in the same boat @Crell, I do enjoy knowledge sharing a lot to strengthen the team as a whole to invest future case of someone needing me being less :>
@IMSoP I guess we need a new mechanism to generate the capthas, I mean you can try obfuscate the output but it is only a patch solution and not a long term one
I think even the best captchas struggle to keep everything out
I wonder how akismet would fare; it might get too many false positives from bug reports not looking like blog comments, though
I have a Wordpress blog which I barely ever post to, and akismet blocks spam comments by the thousand
Hide everything by default until approved - No point in spamming it if the comments are never going to see the light of day. Obviously there's still going to be bots that don't care but it takes away at least some of the incentive to send new stuff.
that might stop RH, but spam is blind bots, so it wouldn't really help
I've seen plenty of spam comments that have been completely mangled so that they serve no purpose to the spammer, but the bot doesn't know or care
20:30
@IMSoP I think pair programming can really work well when either i) you have people with two very different skill sets ii) junior developers who aren't sure what they are doing, and don't know what questions they should be asking themselves....
for the spam, probably would be better to move to a "any bug report that has a link in it needs to be approved before being visible" model. As that removes the incentive to spam.
yesterday, by Danack
2 hours ago, by Danack
(btw, either a riot or football match appears to have broken out near me - might need to go check it).
actually wasn't football fans - apparently it was a tv show being recorded: imgur.com/a/XGiauKH
20:57
@Crell you might want to think about withdrawing, levi voted against it, and people aren't going to ignore what nikita said about it ... it probably does more damage than good to leave the vote running at this point ...
I don't know why levi voted against it, and he probably doesn't either, except the words designed to induce panic on the mailing list done exactly that ...
:-(
Aside from noting the nullsafe handling, I am not sure what other changes are reasonable to make based on Nikita's post other than "don't do it", which seems... undesireable.
that's what he wants, none of the questions he asked are actually questions, he's read the patch at least 10 times and knows the answers already
politics, I don't enjoy this bit ... I had fun writing the code, but it's not fun anymore when my own "team" are voting against me and other people are playing games ... I don't want to play any more ...
Well, without your vote it's just barely not passing right now. Excrement.
@LeviMorrison Ping?
I hate politics as much as you do. But I didn't even have fun writing C code with it. :-) It's writing PHP code in the future I was hoping to have fun with.
Pulling it now, though, would also look bad for "oh you're just pulling it because it's not passing" reasons. (Though, you still haven't voted yourself.
I just put my keyboard through the dishwasher and I cannot recommend it highly enough if you have a dirty/sticky keys
obv only the mechanical bit without the electronic bit
but srsly this is like a brand new (albeit still cheap and shitty) keyboard
It took up another ~6 hours today, and it looks like a waste of my time now ... that's good enough reason to pull it, to not waste any more of my time ...
I did have fun, but I also worked extremely hard for a very long time on it ... and it's gutting that it's not going to pass, but it isn't going to pass, and I don't want to spend the next 10 days fixing things for no reason, I have other stuff to do, that I'm being paid for ...
21:12
It would be really nice to know what people's objections are. Nikita apparently doesn't care about anything beyond named callables. Beyond that, I don't know if the objections are resolvable trivially or if they're impossible.
Yeah, similar boat here. :-( Especially since that also then blocks pipes, which is what I've been trying to work toward for the past year...
@Crell :wave:
Hi there. We're trying to figure out why you voted against the PFA RFC, given that your name is on it.
@Crell before nikita it was dmitry, internals needs a person to look to when they don't know the answers for themselves, to inform them how to vote, because most of the people voting aren't capable of judging for themselves ... most peoples objections then, are just going to be that nikita objects ...
Several of them voted no before Nikita's comments.
they're not the first comments he made, there's a whole rfc ...
21:20
I wasn't aware of the naming thing with variadics, but it makes sense. This alone could be considered a detail we can fix after merge, but overall I'm just not sure it's done Right. I had previously voted yes, btw.
Other than variadic naming in reflection (which I agree is probably post-merge-changeable), what else is not "Right" seeming?
What's the answer to "How does it interact with strict_types?"
I'll have to test, unless you know off hand, Joe.
see, what's really annoying me right now, is that you are capable of reading the patch, but you don't seem to have done that properly, so you're happy to say it's not done right, but don't even know the details ?
I haven't done it recently, no.
Honestly, I forget that strict_types is a thing. That was the first time I even realized PFA would need to have some defined behavior with regards to strict_types.
21:25
How come I have never used strftime()?
According to this question, this is the right way to create dates in local languages stackoverflow.com/questions/1328036/…
Had Nikita voiced that concern before? The strict_types one? This was the first I'd personally heard of it.
Ahh, it's because I am a Windows user and that function never worked on Windows
First I recall hearing about it, too.
really, because there's a test for it ...
Which one? (You did rewrite the entire test suite at one point. :-) )
21:30
and niki has seen it, and niki reads zend like he's neo looking at the fucking matrix, he knows exactly what it's going to do ...
Ah, found it.
The 2nd and 3rd argument is not nullable so you can't pass null like it says there
cmb
cmb
@Dharman I think most (all?) of Intl has been updated to the stubs yet
has or hasnt?
@JoeWatkins Nikita's comment on the PR is basically that it tests the happy case (same strict_types setting in definition and call), not the cross-file case (which is where they may differ).
cmb
cmb
21:34
@Dharman if setlocale() is the answer, you're asking the wrong question
Either way, when I pass null it throw
cmb
cmb
@Dharman hasn't
@cmb Yeah, I don't really know which question would answer that :D
@LeviMorrison he doesn't need to see a test for that, he wants it, but he absolutely knows how it will behave, he's reviewed the patch many many times in the last couple of days ...
cmb
cmb
but to their defence: IntlDateFormatter is only available as of PHP 5.3.0, and the answer is from 2009
21:36
Did people use strftime before PHP 5.3?
It's roughly the same time the sane PHP library DateTime appeared, right?
I don't know how we could use PHP back then
DateTime is from 5.2, I think. I... don't recall if I ever used strftime(). That was in the Before Times.
Then I say, let's remove it. I can't think of any use for that function
@JoeWatkins Does phpt support multi-file tests?
@Crell couldn't you mimic it with eval()? in terms of strict mode at least
21:45
Isn't this the reason why strftime should be used instead of date?
you can just include shit anyway
I guess includes work, sure...
afaik include is still identical to eval(file_get_contents()) anyway, at least in terms of semantics of that kind of thing
(which would be preferable probably as you can put all the code in the test file)
@cmb ext/intl in general is under-documented, and under-publicised
@Crell it takes strictness from application site
21:48
it's possible IntlDateFormatter is absolutely amazing, but I'd never heard of it until this week
@JoeWatkins The partial application site, you mean, or the final call site?
partial
@IMSoP ext/Intel is also sadly kinda annoying to maintain from reading the code
I find it it's at the same level as SPL from time to time
Hm. That feels... a little odd. I'd expect final arguments to be evaluated according to the final call site.
But partially applied arguments at the partial application site.
Not sure, people understand strftime at all stackoverflow.com/a/65061821/1839439
21:55
@JoeWatkins @Crell FWIW I'm not super opposed to the RFC
Oh hai.
It's more a "I'm not convinced we need this in this form" than a "this is going to be terrible"
What would you find convincing? (It's difficult to show "this would be used X amount", obviously, when the whole point is to enable patterns that were previously difficult and so avoided.)
well I mean, you watched the conversation, we had a simple version and it was universally hated ... I don't know how to make it simple, and please everyone ...
Also, does "this form" refer to design or implementation?
21:57
@JoeWatkins Oh, the new RFC is definitely much better than the original
while it has these semantics, while we have to try to support all these things, it's necessarily complicated, it seems to me ...
@JoeWatkins What would you simplify?
@Dharman I don't see the problem - they need the date to be displayed in Italian; date() and DateTimeImmutable can't do that, but strftime() can
02:00 - 22:0022:00 - 00:00

« first day (3898 days earlier)      last day (1276 days later) »