« first day (3903 days earlier)      last day (1028 days later) » 
00:00 - 21:0021:00 - 00:00

12:09 AM
Things going into the core / standard typically need to have an extremely high level of utility (str_starts_with, get_debug_type), or be able to accomplish something better than can be accomplished efficiently in userland (object based tokenization, datastructures)
 
clamp could be argued for as it could be used in ML where performance would be a limitation.
 
@Danack Could also be useful for image manipulation with Imagick, and server-side rendering.
Doesn't really matter I guess, cannot mail to the internals mailing list, something about only subscribers can post, but can't find a way to subscribe. 🤔
 
@Tiffany Cannot subscribe there either, "We were unable to subscribe you due to some technical problems." 😂
 
....computers are hard.
pretty sure the mailing the list method works:
> To subscribe to any mailing list, send an email to listname-subscribe@lists.php.net (substituting the name of the list for listname — for example, php-general-subscribe@lists.php.net).
 
12:23 AM
@KimHallberg you can also subscribe by emailing internals-subscribe@lists.php.net
 
And I only know that because I screwed up my mx settings for my domain, and so had to re-subscribe to the list recently....
 
How can subscribing via form be troubleshot?
 
Good question, the first thing I would do is read the error message and find out where that error message was supposed to be returned. That'll only work though if the message is only suppose to be returned when one specific thing goes wrong and not a generic we always return this error message.
 
12:39 AM
@Tiffany waiting until someone who has access to the logs is awake and poking them....probably.
 
1:33 AM
@Tiffany You could clone web-php and use the instructions at the bottom of the README to run it locally and test it that way, too.
@Tiffany I just reproduced it locally, but I'm seeing nothing in the error logs
@Tiffany It's this code that's doing it: github.com/php/web-php/blob/…
I dumped the value of $result, and it's the string "missing some parameters" :-)
 
1:58 AM
Curious. I'm going to set a reminder to play with this on Thursday.
Accessing main.php.net/entry/subscribe.php from a web browser produces the same message
 
Haha! I ran web-php and web-master locally so I could see what web-php is sending to web-master in that POST, and then I got this:
Fatal error: Uncaught Error: Call to undefined function get_magic_quotes_gpc() in /Users/ramsey/repos/php/web-php/include/layout.inc on line 251
Fun times
I'm running PHP 8
 
gg
 
I have PHP 7.4 on here, too, so I'll rerun with that
 
2:17 AM
Interestingly, I can't reproduce it locally when I change this line: github.com/php/web-php/blob/… and point it to http://localhost:8000/entry/subscribe.php
It succeeds
this is the relevant code in web-master that returns the error: github.com/php/web-master/blob/…
 
I don't think those are related to this issue
 
Linking the call stack because I'm on my phone and basically useless
@ramsey there's a function called clean that uses get_magic_quotes_gpc()
 
oh... the get_magic_quotes_gpc() error was in the layout.inc
 
2:21 AM
oh, yes... sorry. I was misunderstanding
that's not causing the mailing list subscription problem, though
but it is something that should be cleaned up
 
@ramsey FWIW, I didn't notice that part of the error message until after searching GitHub for get_magic_quotes_gpc usage
On php, that is
 
These are the relevant bits for the subscription error: github.com/php/web-php/blob/… github.com/php/web-master/blob/…
So, it seems that maybe some piece of data is missing when web-php posts to web-master
I wonder if it's the remoteip
Maybe when this got moved into the new data center a few years ago, this form stopped working :-)
 
@ramsey this is because the server is running on 7.4, correct? Kinda dug myself into a rabbit hole
 
My 14-year-old son just dropped something, and I heard him mutter, "oh, bloody hell." 🤣
 
I would've received a stern talking-to
 
2:27 AM
@Tiffany No. The magic quotes thing isn't related to the subscription error
 
Darn, but as you said, it should be fixed.
 
The subscription error happens because one of those POST values is empty. My hunch is that it's the remoteip value
@Tiffany Yep!
But I couldn't verify that because it works locally...
but that doesn't make much sense because when I sent a request from local web-php to main.php.net/entry/subscribe.php, I got the same error
Anyway, I'm gonna give it a rest for the night... if you want to bounce any ideas off me when you start to play with it, feel free to ping me
To clarify "it works locally"... I mean, when I run web-php and web-master locally and change the POST URL to http://localhost:8000/entry/subscribe.php :-D
 
Hmm, wonder what would happen if I spun up a droplet
 
 
3 hours later…
5:58 AM
For people in the UK - the alan turing notes are available from today, for people who want mint ones: bbc.co.uk/news/business-57554102
 
6:20 AM
@ramsey @PatrickAllaert @JoeWatkins about yesterday issue and crc32 API, after digging a bit more, I think there is something wrong, we have 2 implementations, 1 in ext/hash (always there) and 1 in ext/standard (also ways theres) ...
 
@RemiCollet can we let the a2 ship sail, and fix for a3 ?
a2 is going to build, and work, right ?
 
yes, thisd is not urgent, btw, I think we have 2 for years
(even if the crc32_bulid_update is new)
and some ext use ext/standard.... some ext use ext/hash... so not easy to drop one
the problem is that recent change is to take benefit of some optimization... while the other is already optimized....
perhaps we can drop the new API (not yet used), keep ext/standard/crc32.h as in previous version, and internally (crc32 function, phar, ...) used optimized version from ext/hash
but this seems a nightmare...
 
6:35 AM
messy
if you prepare something that makes sense, we'll ship it ...
maybe move it somewhere central (main or zend)
I've just written "or" 3 times, I don't know what's best to do there ... you probably do
 
/me quite busy with some other job... no time now
but keep it on some TODO.... if can founf some time and no one do it before
 
thanks
 
7:12 AM
Georgetam ・ *General Issues ・ #81193
 
7:40 AM
Hello, im new to stackoverflow and also with PHP
 
@Danack You called it 😄
I don't get it. If the implementation is so simple and unopinionated why would it need to live in userland?
 
7:58 AM
Get Timezone abbreviation ・ Date/time related ・ #81194
 
8:10 AM
pcntl_fork() cause child process hungup. ・ PCNTL related ・ #81195
 
8:52 AM
Apple distributes binaries of PHP, built from modified sources. Don't they have to make those patches public for license reasons? Do they? If so, where? Thanks!
 
I don't think they're obliged to do so by license terms, and even if they were, we would have no way to force them to do so @SebastianBergmann
 
@JoeWatkins Okay. So one would have reverse-engineer what else they change on the binary level.
 
yeah, it seems unlikely that's the only thing doesn't it ...
determining exactly what those changes are outside of elf sections would be ... a massive waste of time ...
since they've proved they're willing to do utterly stupid things, let's just all advise that you use homebrew built in the open, by people we (internals) can (and do) communicate with ...
if it's been removed from apple, what horrible things they are doing is, or is going to become quite shortly, irrelevant
s/elf/text/
 
9:15 AM
hello guys. please help me with this problem?
2
Q: PHP: How to search in array of objects and return the res

Paul Iverson Cortez I have this Array of Objects and I want to search a string to all of the keys and return all the data of the matched objects. I don't know if there's a duplicate of this question. hope you guys can save my day. the photo below is my code. I don't use eloquent btw and the data is from call-in SQL...

 
@SebastianBergmann I think they're dropping it in the newest version that is to be released in the coming months anyway. So you'll have to install PHP with brew.
 
 
1 hour later…
10:21 AM
@IluTov For my next trick, I will predict the sun rising in the morning....
Is the navigation sidebar on swagger.io/specification/#header-object quite broken for other people, not just me?
 
cmb
10:32 AM
header {display:none} solves it, I think
 
@cmb where would I put that in?
 
cmb
A custom styleheet? I just tried it in the development tools of my browser. That's a common issue with fixed headers; anchor positioning doesn't work out of the box. E.g. swagger.io/specification/#specification hides the actual anchor below the fixed header.
 
I've only used a custom stylesheet once before....and it seems chrome may have removed the ability to use them without an extension.
 
10:50 AM
@Danack Probability should be about the same
 
 
1 hour later…
11:57 AM
@scott-arciszewski
 
12:13 PM
I remember him saying a long time ago that getting in contact with him through here may not be the best
Can't find the message though
Apr 30 '17 at 16:37, by Scott Arciszewski
@tereško This is probably the least reliable channel to get ahold of me through :P
 
@IluTov in regards to Tyson's email you don't need to deal with sprintf() family of functions, and I would imagine print() would be handled on it own
 
12:25 PM
@JoeWatkins twitter.com/CiPHPerCoder maybe.
 
Morning
 
6 hours ago, by Danack
For people in the UK - the alan turing notes are available from today, for people who want mint ones: https://www.bbc.co.uk/news/business-57554102
it turns out that was a lie.
 
@StatikStasis what makes it even more 'amusing' is I checked with the 'chat' support in my banks app, to make sure there were available in Bristol....and was given bad info there.
 
Is it a limited run or will Turing be featured on the note from now on? If the latter, then I'm sure they'll eventually get broader in circulation.
 
12:32 PM
Why is phpcredits() still available in PHP 8? Is there a legal reason? It doesn't even have Nikita or Dmitry there
 
@Girgias It landed in spam on gmail...
I didn't even see you sent the email
 
@IluTov :(
 
No wait, they are there
 
@StatikStasis I'd like to get some mint ones, before they've been in circulation.
probably won't be a problem...but getting them on the first day increase that chance.
 
@Girgias I think so as well. But it would be good to mention it in the RFC, so I'll also remember to add a test for that.
 
12:36 PM
I got some close-to-freshly-minted coins from a Subway of all places, but it was next to a credit union, so there may be some relation (that is, I think I'm the first person other than the Subway that they changed hands)
 
@IluTov Yeah I was going to amend it, not sure how to phrase it as I would like to say any output functions bu that doesn't apply to the printf ones :|
 
@Girgias Output or string formatting I suppose
But it might be worth to just mention them explicitly. I'm not sure what functions are out there.
 
I would imagine echo and print being the only ones as I can't see anything else, other then maybe print_r
 
@Danack ah thanks
 
1:31 PM
not PHP-related question: I have an XML file that does not pass xmllint, I need to determine if the XML file has encoding issues, but xmllint will only list out the linting issues because there are so many. Is there a way to force xmllint to list all issues with a file, or maybe a trick someone knows of to detect if there are encoding issues in an XML file? I tried grepping for like ’, but nothing appeared.
 
cmb
check for valid UTF-8; preg_match(//u, $contents) !== false should do, or some mbstring function
 
thanks
 
52 MB of sources... including tons of libraries.... including crypto library... for a PHP extension... what can go wrong ? (awscrt)
 
@NikiC ping
 
cmb
1:55 PM
@RemiCollet guess aws-crt-ffi should be an external library
 
@cmb yes...
 
cmb
shouldn't be hard to build it thanks to comprehensive instructions ;)
 
Apr 14 at 18:39, by Danack
> It's great that AWS is building really powerful deployment environments based on open source software. To make this sustainable, where can open source projects apply for funding/sponsoring from AWS?
going to have a chat with them after 5g upgrade...
 
You are looking for $5 AWS credits? :P
 
@PeeHaa ah, you've asked them before. Here is the response I got: gist.github.com/Danack/7be3822a8e9f6c206440f0a4beb14b1e
 
2:08 PM
hehehehe figures :)
 
2:47 PM
@JoeWatkins pong
 
cmb
@Crell, had it been considered to only allow PFA on leading arguments (like JS Function.prototype.bind())? IMHO, argument order should be addressed otherwise.
 
OK, 2 hours fighting with ImageMagick, enough for a day
 
extra in u2 is only used for ZEND_EXTRA_VALUE (on literals) , could swap that for 2 uint16_t, and use the second one ... would it be just as unacceptable to add a branch to copy_value as it would be to use extra in u1 ?
(the other uses don't seem to collide)
I think I know the answer ...
also, I might be wrong about whether u2 is used on literals, but ZEND_EXTRA_VALUE on extra seems to be the only thing that may be set on literals ... am I wrong about that ?
 
@JoeWatkins how does this help you?
If this is about the literal tracking, it's not like having the flag for just literals would be enough
And u2 definitely can't be copied
You can only use type_info for flags that should be persisted across copies
 
3:03 PM
crap
 
I probably missed it, but why do we care if an integer is a literal or not?
 
I was hoping if I could just find the space I could come up with the magic
 
@JoeWatkins Well, type_info would be that space then ^^
But would make this a much harder sell, I think
 
yeah the only way to do that is bad, as discussed ...
well people are really hating it the way it is, so I think we have to quit support for anything but literal strings ... it looks less useful to me ...
@Trowski we don't, we allow is to pass the check because they can't lead to injection, only mistakes ... but we're not trying to protect against mistakes ... the rules without long support are strange ... if you do "this" . 42, you'll get a literal, if 42 is a var, you won't, if you sprintf("this %d") you won't get a literal ...
 
@JoeWatkins Ok, that makes more sense.
For the feature to make sense, concatenation with an integer var should work.
 
3:19 PM
if concat works, so too should sprintf - you could always write the same thing in userland (much much less efficiently) using that concat support ...
I didn't like long support at first, but nikita pointed out that (string) int should probably produce a literal, and called the inverse cast uninteresting, which it is, but allowing it leads to nice symmetry and makes the whole thing easier to reason about ... and allowing those casts to be implicit is the PHP way - if you use an int as a string, it's a string ...
but we've lost this argument whatever, so now we have to make it worse ...
 
I now understand the move away from is_literal with (string) $intval support.
is_probably_fine :P
 
calling it trusted ruined the productive conversation (and wasn't at all my choice), that was a mistake ... but I wish we wouldn't focus on the name ...
 
Carlosgab ・ *General Issues ・ #81196
 
3:38 PM
 
@JoeWatkins Should something like this be trusted?
I'm just trying to get a feel for where the trusted/untrusted (or whatever it's called) line is.
 
@Tpojka Oh, that's good!
 
@Trowski well, I set it on the class entry and missed the function, but generally will be set on symbols ...
 
@JoeWatkins So every location that generates a new zend_string has to determine if the flag should be set or not?
 
@Trowski what do you mean ?
the places where the programmer typed the thing should be covered in the compiler, the places where the flag ought to be carried should be covered by the vm, any other ext code creating strings should not do anything ...
 
3:49 PM
@Tpojka lol
 
@JoeWatkins Code creating strings then is marked as untrusted?
As is the case here, where the zend_string containing the filename is created internally.
 
@Trowski untrusted by default, yes
@PatrickAllaert ship it
 
@JoeWatkins My point then is that every location creating a zend_string will need to evaluate if it should be marked as trusted or not.
 
no, it should not be marked trusted
 
4:05 PM
The filename isn't trusted? Huh, ok…
 
no it should be, I actually assumed they were still interned, but now we only intern the rtd key
actually I didn't set it on either, I assumed they were interned ... I mean they're not actually typed by the programmer ...
 
I think this highlights why I'm still uncomfortable with this feature. If you miss something that should be trusted/literal, it may lead to people circumventing the feature and going "WTF." Inversely, what if we mark something trusted that later is vulnerable to manipulation in some way we didn't anticipate.
 
all of the symbol names are marked trusted
(they are what people tend to use in builder type code)
> that later is vulnerable to manipulation in some way we didn't anticipate.
I get the motivation for saying stuff like this, but it's harmful to the conversation actually ... you can't just say "that feels dangerous" without describing the nature of the danger ... this is basically what everyone is doing ...
 
@StatikStasis Hah, nice 1. :D
 
4:24 PM
@JoeWatkins the whole conversation is "not particularly great", and I'd prefer to keep my involvement through the mailing list rather than here. But if you're going to point out people aren't being helpful, I'm going to point out that my email that asks "what are people meant to be doing when the code detects a non-literal in the wrong place", hasn't been replied to, which is pretty frustrating for me.
@RemiCollet "are you winning son?" fyi, I'm working on making the frontend of phpimagick.com better, and then after that, I'm going to attempt to persuade the ImageMagick people to have better tests.
 
Trying to remember a term that seems relevant and it's completely eluding me... in court, depending on what's happening, the charged might be assumed innocent and the prosecution must make the case for why... and in others the charged might be assumed guilty unless they can prove their innocent (e.g. defamation) and I can't remember what the word is
 
burden of proof?
 
Yes! Thank you @Danack that's been bugging me for a good half hour now. I was wanting to use it to say that if you're calling a feature secure / safe / whatever, the burden of proof is on the author to demonstrate it's safety, rather than on others to demonstrate it's unsafe.
5
 
@JoeWatkins Kept conservative it's probably fine. A part of me is terrified that something in $_SERVER will be marked as trusted that should not. Maybe that's not a realistic concern.
I think I preferred the approach that marked things as "literal" rather than "trusted," even if it's just name, I think expectations have shifted.
Exception::getFile() is clearly not a literal, but it should be "trusted."
 
it's exactly the same code, you're just panicking for no good reason ...
@Danack the answer is application specific, it includes mitigation, exception, logging ...
@MarkR we're talking very narrowly about one kind of safety, in the case of "string" . int, int cannot contain any SQL, it is not actually possible for an SQL injection to occur here, not possible ...
that it still "feels dangerous" is just fuzzy thinking
 
4:39 PM
The problem is one of human nature, 99% of people using PHP have no training on security. Which is partly why PHP gets such a bad rap in the first place as it's a language people tend to get into without any proper education.... and there's only one thing worse than having no security, and that's thinking you have it when you don't.
 
@JoeWatkins numerous parts of the discussion have discussed a lot more than just SQL injections
I really don't understand the obsession with adding integers.
the number of people who have commented stating that they understand the premise and agree with the usefulness of a simple "is this a literal string" function is basically everyone I've seen commenting on this, bar 3. and two of those are people who are involved with the RFC.
 
not really, the problem is fuzzy thinking and knee jerk responses ... even when I point out that concatenation of a string and an integer cannot lead to an SQL injection, which is the only thing we're supposed to be dealing with, you still want to hedge your bets and say it feels dangerous and what if it's not secure ... even after I shifted the burden of proof, in 2 sentences ...
I understand the motivation for talking like this, but it's not helpful to the conversation, it really really isn't ...
 
@JoeWatkins I think that is brushing over the issue that I have with concatenating strings by default. That is going to lead to bugs in production, even when people have pretty good tests. I know that having to use literal_concat() would be annoying, but it means that any mistake includes the location where the error occurs in the stacktrace, instead of programmers having to manually figure out where strings come from.
 
@cmb Given the widespread inconsistency of PHP's standard library, that would render it incompatible with a whole bunch of useful functions. Like, say, array_filter().
 
I'm going to stop talking here as every attempt to talk about the failure mode in this room has led to it just being dismissed and so it's better for me to just keep it on list.
 
4:49 PM
My personal recommendation is to be very, very specific about what problem it's trying to solve, and have the RFC / naming reflect that, and if the function name ends up 60 characters long, fine by me.
 
It's been quite clearly stated that integers were added later, because "someone" said it would increase adoption - yet the only use case for integers we've been shown, is people who are too lazy or too inexperienced to write proper parameterised queries - if they're "using it wrong" now, they're definitely going to "use it wrong" when they have a function telling them something is "safe"
@MarkR is_literally_a_string_in_code_or_maybe_just_some_random_integer_yolo_what_could_possibly_go_wrong()
 
My sass levels are peaking today....
 
@Sara ... I didn't know you worked on front end code
 
@Sara And here I thought your message was unusually politely worded :P
 
@NikiC I try to reel it in as much as I can. :)
 
4:53 PM
@Sara Wait wait… so you're saying I didn't need to take like 8 math classes in my CS program?
 
@MarkR I feel like that's a word play on 'sass', but I'm not picking up the reference
@Trowski I'M saying you did. But I got in a toot war with someone over it.
 
@Sara Sass = CSS preprocessor... it was kinda a rubbish joke
 
morns
 
A programmer who doesn't math isn't a programmer.
 
4:54 PM
Depends which kind of math you're talking about.
 
@Sara what if we just math badly
 
"Math" is a... rather large topic.
 
@MarkR That was my guess about it, but just wanted to be clear it flew WAAAAAY over my head.
@Crell Basic Algebra
 
Earlier today on a Zoom meeting my boss was talking about his new Red shirt... and I told him to prepare for his immediate death at the hands of aliens... I had to explain myself.
 
Unnecessary if you're programming in HTML/CSS. Or SQL, for that matter.
 
4:55 PM
Like, if you're rusty on trig, fine. If you regard Calculus as dark magic, okay. But ffs, be able to find the area of a circle and the roots of a polynomial.
@Crell Okay, so we're gonna fight too then. Noted.
 
Come to my next picnic, we can nerd-fight then.
 
@MarkR heh... I understood that reference.
 
@Sara Unfortunately no-one else on the call did :|
 
Muggles, man....
 
@MarkR :)
 
4:57 PM
I never really realized how many non-nerds there are until I left California.
Like. Anyone from any line of work in the Bay Area would get your red shirt reference. They'd MAKE your red shirt reference.
East of the Sierras though.... it's a subdialect...
 
"... but, Picard wore red all the time and he didn't die. Don't you mean gold shirts?"
 
Basic algebra isn't a requirement for programming, it's a requirement for any job IMO.
 
Speaking of Picard... youtube.com/watch?v=6p-_9yzWyo0 the picard manoeuvre v2
 
@MarkR Were you on the call by yourself with the boss or were there others? Did anyone get it?
 
@StatikStasis Our entire AV director team, about a dozen people, I clearly need to build more star trek memes into the software. When you try to set a start date after an end date it already warns of a temporal paradox, maybe I should change all the submit buttons to "Make it so"
4
 
5:03 PM
=D
 
Endorse.
 
cmb
@Crell I'd leave it to userland to come up with functions which are useful for FP (and maybe address this issue in core later). I presume that a simple positional PFA for leading args would be less controversial, and likely had fewer edge-cases to consider. Would also be easier to read.
 
That wouldn't work for the "reference a function" use case, though.
And I don't know that it would actually be any simpler. (That's a Joe question.)
 
morns
 
5:14 PM
@cmb @NikiC Will you put that one to a vote if partials fail?
 
@cmb can ? target a variadic ? if it can, we tried those semantics already, they were universally hated because it means ? sometimes means one thing, and sometimes another ... if it can't, how do you target a function that is only variadic ?
any complexity you remove from the implementation lands on the users lap ...
 
cmb
@JoeWatkins I don't like those placeholders at all. Something like Function.prototype.bind() would be good for me.
 
@cmb At that point it's less typing to just make a lambda function as you can already do.
 
@cmb in case curious, it was and would be simpler, and it's what everyone else does ... but the first version tried to something closer to other languages and it just ended up confusing ... if we're going to accommodate php, there is no simple ... there's only the option to limit complexity by reducing scope and leaving out named/unpack, but reduce it further and leave out variadics and you no longer have a useful/usable feature ...
 
5:35 PM
Good afternoon. krakjoe has summoned me from the abyss of crypto implementations. :)
 
Hey Scott thanks for coming :)
 
Do you have a link for the RFC in question? :)
 
yeah sure, I was just doing a hello :) hi scott, nice to see you, and so on ..
 
/me waves.
 
please totally ignore the name, pretend it's something else (make suggestions if you like), try to focus on the content of the thing and what we're trying to do
 
5:39 PM
Gut reaction: is_untainted() is probably better
 
others have suggested that also, I think we wanted to avoid the concept of tainting, but duly noted ... I actually think at this point it's pretty descriptive ...
 
Davidtab ・ *General Issues ・ #81197
 
I see. This isn't a taint checking thing but a delineation between external input and literal values checked into code.
 
IMO is_literal was fine
Why did it change?
 
@ScottArciszewski right, but to expand a little and answer @PeeHaa
 
5:44 PM
Yeah, is_literal() is a good name too
(Sorry, this is my "live tweeting as I read the RFC" commentary, it may be answered by the doc.)
 
so we're writing the implementation, and some concatenations will result in literals and some won't, from a user perspective who doesn't know how the compiler works or why that is so, it seems unpredictable ... so then while this is going on, some people point out that they'd like to be able to concat ints and strings, because that's how they normally build queries, and since we see no possible pathway from "string" . int to an injection, this solved the problem of unpredictability ..
 
Yeah, the only way I can think of to turn int -> string into an injection is with chr()/pack()/sprintf()/etc.
"string" . $integer will not create that sort of failure mode
(I would not have the same confidence making this statement in e.g. C code, only PHP :))
 
Everything is a failure mode in C.
 
this is the first stumbling block for people, we're being pushed to revert to the initial unpredictable - and not very useful - behaviour without support for long ... I guess because they're sure I'm wrong, and that it can lead to injection but nobody can tell me how (of course they can't) ...
we know it's not "pure", but we're php, practical ...
 
5:53 PM
well of course, but that's an injection of your own making (see the statements about jumping over the guard rail) ...
we got a make_literal function within 10 minutes or something :) there was a hack in an earlier version of the RFC, but I suggested removing it ...
 
yeah, that's why I think the trusted name might be misleading; making something a literal when it was actually input is less likely to create a false sense of security
I don't think trying to stop people from outsmarting the guardrail is a meaningful use of time :)
the purpose of this function is to say whether something came from an attacker-controllable input, right?
The converse function might be is_influenceable() then?
anyway, that's just naming feedback; what was the question you wanted me to talk about :)
 
for strings yes, but due to technical limitations, we can't actually track the source of longs, but since "" . int can't lead anywhere bad (unless you push it very hard, on purpose), we reasoned that we don't need to track them, their values, and casting semantics, and output form in the case of sprintf are controlled
essentially, can we reasonably include this support for longs without that ability to track their source, and what would you call it, what terminology would be most palatable to describe that functionality ?
 
In PHP, a long can't be directly coerced into any sort of injection vulnerability because these vulnerabilities by definition are a code-data confusion. Numbers aren't the same language as SQL, HTML, etc. semantics and therefore carry no risk (Unless you intentionally jump the guard-rail).
So, yes, you can reasonably include them.
is_literal() does imply stringiness, is_trusted() might be misleading; something that hasn't been affected or influenced by an external entity (user input, filesystem, database, etc.) is really the essence of what you're doing here
 
I'd consider it a big help if you would make these thoughts public, either on the mailing list, or twitter, or anywhere we can point too, because I/we are not really being listened too, and if we're forced to go backward now, we end up with something much less useful
yeah, naming things, we still don't have a solid plan for a name ...
 
I mean, if you wanted to be cheeky, you could call it is_pure() or is_noble() or something
though that might offend the FP folks a bit since their definition of "pure" is different :P
 
6:04 PM
oooh I like is_noble, I think that might be a concept we are more free to define than anything suggested thus far
 
/me snarls.
 
:)
I take inspiration from the Noble Gases in Chemistry for that name
they don't generally react with other elements ;P
 
is_radon()
 
I'll bump the mailing list thread (I keep everything in folders to reduce notification fatigue, so I should have a copy of it even if I hadn't seen it before)
 
thanks for taking the time, it's appreciated
 
6:06 PM
BTW, I don't like "is_trusted" because there's immediately a question of "for what purpose?"
The two go together. I may trust someone to do some task but not another. Are they trusted?
 
we're doing ignoring the name ...
 
Just wanted to jump in real quick and ask, should voting choices be in the initial open discussion RFC? if so, what voting choice would work for a function? I'm thinking a simple yes/no?
 
I feel dead sorry for Craig, he held a pole and everything and got an overwhelming majority in favour of the bad name, overwhelming enough to ignore my pleading with him, and then he changes it, and everyone piles on him for it ...
 
As I said on the mailing list, I somehow missed the poll. Seems a lot of people did.
And, it's another example of why design by voting is terrible...
 
the only other option was crappy in the poll, but nevertheless ... where were you all when I needed you, I hated this name and think it derailed the conversation ...
 
6:10 PM
Again, I missed the poll. Sorry.
 
@LeviMorrison I also tried this exact point, that I saw you make on Andre's thing, because it's a good point, and he was forced to ignore that too, 18/3 is not a small majority (or turnout, for strawpoll)
 
I did chime in earlier about how it's important for me for some is_literal check to work with things like str_repeat on string literals. I haven't checked back in so I don't know the state of that, but last I read it worked, so good for that.
 
Hi @JoeWatkins, thanks for the email... I'm back if anyone wants to throw stuff at me.
@LeviMorrison Yep, the string concat based functions work now, thanks for the feedback :-)
 
read from the top, we got some feedback on the details, and I think the best name suggestion so far ...
 
@JoeWatkins what's your favourite name? I quite like all of them. tbh, I'm happy with any name, I just want to provide something useful (and address the issues that make my heart sink so, so, often).
 
6:23 PM
is_noble
 
that will do :-)
whatever will get people off the complains about the name.
 
email sent :)
 
@ScottArciszewski Thank you, I really appreciate your email.
 
as do I, thanks muchly for the unfuzzy thoughts
 
@KimHallberg people usually just put something like "proposed voting choices" then below "yes/no" and something about the RFC being accepted by 2/3 majority.
 
6:29 PM
yeah, the heading is included in the template that gets copied automatically when you start a page in the appropriate part of the wiki
 
Don't have to include anything in-depth unless you want to. If it's a simple "accept this RFC as stated" then putting a "yes/no" is good enough, imo
 
agree
I think we should change that heading in the template to just "Voting" though, because most of the time people forget to change it when actually opening the vote, and it always looks weird to see "Proposed Voting Choices" with a complete poll underneath
 
Happy to help! This was a nice break from what I'd been dealing with this week :D
 
@ScottArciszewski how is things at the moment, I've not seen anything on the paragonie blog for a while... hope that's a good thing (as in, your generally busy and enjoying it?).
 
There was a blog post just last month! :P
 
6:34 PM
oh, sorry, the Ristretto one... yeah, that looked interesting.
 
some fun stuff coming down the line with password authenticated key exchanges
everything else I've touched since early 2019 has been NDA'd :(
 
ohh, I'm looking forward to that... and as to your older posts, thank you for those as well, they have been really useful resources.
 
that looks interesting
 
thanks, I'm glad you enjoyed them :)
 
I really did, and still do (good to point people at them, rather than having to write stuff up myself)... and thanks for getting all of the other things into PHP, they have made my life so much easier.
 
6:44 PM
@Tiffany Yes, checked the voting RFC and 2/3 is the standard. 👍
 
@KimHallberg Voting nowadays is 2/3. You can just copy the voting syntax from some other proposal.
 
If you use the template, it should fill in everything you need.
 
Just make sure it's closed.
 
Done and done, that's what I did. 🙂
 
@ScottArciszewski o/
 
6:47 PM
Hope I did everything right at least, now I'm going to make some dinner.
 
good idea... food time :-) ... thanks again everyone.
 
7:03 PM
@KimHallberg Yes, looks good :)
 
7:20 PM
@Tiffany :)
 
@Trowski I don't use it regularly, but figured I may as well
 
7:43 PM
preg_match doesn't work properly ・ PCRE related ・ #81198
 
bet it does
 
:P
 
8:07 PM
@KimHallberg inbound = "within bounds"?
(looking at RFC)
maybe I'm misunderstanding "inbound" in context of CS...
but not finding anything useful/relevant while googling "inbound software development"... "inbound" to me means "this value is incoming" or "this value is passed to the function/method as an argument" which if that's incorrect, RFC should probably be revised with clearer meaning
 
@KimHallberg probably 'range':
> For a given input value, clamp generates an output value contained by the certain range defined by min and max. If the input value is within that range, clamp returns the value. If the value is below the minimum value of the range, the minimum is returned. If the value is above the maximum value of the range, the maximum is returned.
/tpyos excepted.
 
s/contained by/within/
 
s/since that constitute an invalid bound/since that is an invalid range/ - maybe.
@JoeWatkins quite a few people seem to be hitting pcre.jit bugs.
 
Hm, clamp() sounds like it would be very useful with partial application... :-)
(Pre-provide the min and max, then reuse it a bunch of times.)
 
Plus it's a fun word to say.
 
8:19 PM
Partial clamps?
 
@Danack ah, noted ... I hadn't noticed the trend
 
A slerping clamp function.
 
Someone should find an excuse to add the word "moist" to the language... I dunno, a partial hydration function
 
@MarkR ಠ_ಠ
 
@Tiffany ಠ_ಠ
 
8:27 PM
@MarkR ಠ_ಠ
 
dayum, John McAffee just took his own life rather than be extradited to the US bbc.co.uk/news/world-europe-57589822?
 
@Tiffany @Danack yeah, range might be better wording, English isn't my first language so expect typos and grammar mistakes. 👍
RFC now says in range instead.
 
8:42 PM
I'm from the west country in England....so my spelling may be slightly out of date.
 
😂
 
It's funny because it's true.
 
00:00 - 21:0021:00 - 00:00

« first day (3903 days earlier)      last day (1028 days later) »