« first day (4015 days earlier)      last day (939 days later) » 
01:00 - 23:0023:00 - 00:00

1:28 AM
@Girgias twitter.com/Girgias/status/1446443027703205892 github.com/php/doc-fr would need to have the hacktoberfest tag if you're wanting to attract contributors for hacktoberfest
 
 
2 hours later…
3:06 AM
\o
 
 
1 hour later…
user4717133
4:07 AM
hello guys...
 
user4717133
exist any way to handler error from 400 to 505 with any composer package like htaccess custom error:
 
user4717133
ErrorDocument 400 /error/server_error.php
ErrorDocument 401 /error/server_error.php
ErrorDocument 402 /error/server_error.php
ErrorDocument 403 /error/server_error.php
 
5:18 AM
@Trowski ping
 
5:56 AM
posted on October 13, 2021

 
 
1 hour later…
7:21 AM
As a short poll:

What do you do with a project (website) that has over 1 Milion unique visitors per month and has no revenue (very low revenue)?

1. Finding a sponsor
2. Serving some ads inside it
3. Making a premium/freemium plan on the content
4. Getting paid-subscription for a full access on all activities
5. Selling (full assignment) the whole project to another company
6. Designing a new & customized revenue model (business-model) for it

Note: the current minor revenue is from two sides, both "donation (85%)" and "commission of paid questions (15%)"
 
 
1 hour later…
8:26 AM
Depends on what it is about. But I would never pick 2.
 
Thanks for your feedback .. noted that, it's a Q/A website
 
 
2 hours later…
10:00 AM
@Tiffany I use labels, because I don't want shitty contributions
 
10:24 AM
Morning
 
10:44 AM
Hopefully that sorts out the globals issues?
 
cmb
@Derick I'm going to check. You may want to check github.com/php/php-src/pull/7575.
 
OK. Did you test whether calculations with these negative -fs also work?
 
Hi! If I try to replicate userland code like `$a=[]; $a[]=&$a;` with the following Zend API code¹, I get a leak at `ZVAL_NEW_REF`, yet the refcounts look the same... I read through phpinternalsbook², but that didn't help. Any hints?
¹) http://sprunge.us/fxYLFo
²) https://www.phpinternalsbook.com/php7/zvals/references.html
 
cmb
@Derick 3v4l.org/kZroO (the bad thing is that even values less than -1 worked; will no longer be allowed with the patch)
 
OK
 
11:03 AM
@m6w6 The Z_ADDREF(r) looks too much?
Unless you want to keep around r, you only have one reference (from inside the array to itself)
 
@NikiC Without that, I get a failed GC assertion
 
@m6w6 Ah yes, I think you want Z_ADDREF_P(return_value)
As you now reference it from the reference as well
 
@NikiC Hm, that kinda fixes the leak, but generates different zval dumps than the userland code... and how would I add another $a[]=&$a?
 
@m6w6 Z_ADDREF(r) + add_next_index_zval probably?
Though if you want to replicate the userland case, what you probably want is to make your function return by-reference and make the return value itself a reference
Otherwise it's not true recursion (modifying the outer array would not modify the inner one)
If your function is by-value, then the outer structure can never be part of the cycle (well, apart from in the copy-on-write sense)
 
debug_zval_dump (slightly modified to peek one level further on recursion)

for userland $a: http://sprunge.us/vruK8U
for my leak: http://sprunge.us/dhsH8M
for your fix: http://sprunge.us/2sGAmL
 
11:30 AM
the difference gets worse with this code: `$a=[]; $a[]=&$a; $a[]=&$a;`
I guess the engine does some symtable magic and re-uses the existing reference
 
What would be the biggest drawback of building single binary program with PHP interpreter and PHP code embedded?
 
Looking at the ZEND_ASSIGN_REF opcode, and thus at zend_assign_to_variable_reference, it's doing addref on the reference, though
 
cmb
@Derick unfortunately not; it triggers a stack overflow. I think you must not call xdebug_set_opcode_multi_handler() which writes to XG_LIB(original_opcode_handlers[opcode]) during xdebug_init_library_globals().
 
it needs to write to xg->original_opcode_handlers[opcode]
did I miss that?
 
cmb
11:47 AM
yes; you'd need to pass that as arg
 
@cmb I am still very very confused why this is now necessary. It hasn't been for ever.
When Xdebug 3.0 came out, I had no complaints about this at all. And now issues keep coming in.
 
anyone from swoole here ? trying to understand why we have openswoole 4.7.1 and swoole 4.7.1 (same code)
 
12:05 PM
@RemiCollet not that I know of
 
@cmb Updated the branch. Going out for a walk now though.
 
asked on twiter, will see if I can get some explanation
 
morns
 
@RemiCollet The main chinese dude should be able to answer you, let me look up his name
@RemiCollet This guy twitter.com/doubaokun
 
He is quite chatty so I suppose he will answer shortly
 
I'm always a bit afraid when I see a openfoo appearing, thinking a closedfoo also exists...
 
Suspicious
maybe a supply chain attack ?
Would be worth checking
that's why I asked if you hashed every file, I could do it for you if you point me to two tar balls
find ./folder1 - type f | wc -l #count files in folder 1
find ./folder2 - type f | wc -l #count files in folder 2

find ./folder1 - type f | xargs md5sum > hashes_1
find ./folder2 - type f | xargs md5sum > hashes_2

diff hashes_1 hashes_2
more or less
 
@ln-s already compare, really same code (btw, pecl download openswoole; pecl download swoole)
(well 3 file removed... and a minor change in a header, but doesn't anything malicious)
@ln-s see answer to my twit
 
12:41 PM
"My permission has been removed from the organization"
eh ?
This file is new 805c20743c26f6297be29eaa8d7693ee ./ext-src/php_swoole_library.h
in openswoole
defines some static const chars with PHP code inside
Did he got banned from the PHP project overall ? I don't get the statement "My permission has been removed from the organization"
 
I guess from the swoole org
 
cmb
"The original Swoole package may include hot files downloading and updating from a private owned server causing security issues." If that is true, it is concerning.
 
1:04 PM
erm yeah
@RemiCollet Which I suppose it's in the 3 deleted files you found maybe
 
or some additional changes committed after 4.7.1
 
Would be worth monitoring traffic with wireshark while using swoole
 
@cmb O_O
 
Yeah... gonna need some more info on that
 
1:19 PM
Maybe he wants to collaborate as to where is this magical code
 
Bruce Dou is a huge promoter of Swoole. If he was removed from the org… something drastic happened.
 
see github.com/swoole/swoole-src/commits/version-4.8.0 (the Added release perm... revert... back .... revert....)
 
CMB where did you read that?
 
1 message moved to friendly bin
@ln-s it'd be better just to say chinese secret service rather than anything that is derogatory about someone's looks.
 
@danack So you think one shouldn't mock a fascist tyrant
 
1:23 PM
@MarkR is it that you are searching for ? twitter.com/RemiCollet/status/1448261056997040134
 
I'll keep that in mind
 
is there a way to get image rotation data from gd? I don't have exif or imagick extensions installed in this prod environment, and the Composer library we're currently using (which parses the bytes from the JPEG itself) has a license conflict with our software, we have to remove it.
 
@ln-s I think people should be on good behaviour when there is drama going on and not say stuff that gives the appearance of being a twat.
 
Right so, I can't say that a fascist tyrant looks like a disney character, but you can call me names
:pondering
 
Seriously. Behave when stuff is going on and don't pick fights with me.
 
cmb
1:27 PM
@ramsey nope :(
 
@RemiCollet FFS =\ ambiguous is ambiguous
 
@cmb That's what I was afraid of
 
cmb
@ramsey IIRC, getimagesize() and iptcparse() might help
 
getimagesize() doesn't have the info in it
I'll check the other
 
@RemiCollet @cmb Any idea if there's truth to swoole grabbing hot fix files from a private server?
 
1:33 PM
@Trowski I don't have more information that the above twit. Will be nice to have more "public" information
 
cmb
@Derick according to git bisect, github.com/xdebug/xdebug/commit/… is the culprit
 
@RemiCollet Please let me know if you find out anything specific.
 
@Trowski I think it's just a matter of installing swoole on a clean install and then capturing and filtering through wireshark to see if something is really going on, I could do it when I get some free time
 
cmb
@Derick still infinte recursion
script and settings from #2016
 
1:53 PM
@JoeWatkins pong
 
2:09 PM
@cmb Should I just revert that memory leak commit? :-/
 
2:25 PM
@Trowski So I wrote to bruce
He indicated this line
He also said: "Don't worry, the hot code downloading will be in the next release"
 
will or will not? :-)
 
@ln-s Good timing, I just found that myself, lol
 
haha
:)
 
@Derick It's in master at the moment, so supposedly yes, it will be in the next version. I haven't yet determined exactly how that code is used though.
 
" $url = 'https://business.swoole.com/static/swoole_dashboard/' . SWOOLE_VERSION . '.tar.gz';\n"
" $download_request = Coroutine\\Http\\get($url);\n"
" file_put_contents($tmp_file, $download_request->getBody());\n"
" $sh = 'tar zxvf ' . $tmp_file . ' -C ' . $dir;\n"
" System::exec($sh);\n"
" $f = $dir . '/dist/js/app.js';\n"
" $baseURL = 'baseURL:\"http://' . $remote_addr . ':' . $server_port . '/\"';\n"
 
cmb
2:47 PM
@Trowski the commit message says it all: "Added tests, improved server stats_file, fix core-tests" ;)
 
that sounds nefarious
 
Name servers for swoole.com are in China. Not inherently malicious since they were registered back in 2008, but it seems swoole.co.uk is used primarily?
 
@ln-s I have.... many issues with that code, I scarcely know where to begin...
Like... the potentially for a whole lot of servers to be pwned at once, sure... that part's obvious.
 
yeah
 
2:57 PM
@cmb hah, lol
 
But like...this PHP embedded in C, then all this really.... bad handling of memory buffers and system calls and.... yikes.
 
@cmb can I message you on Twitter?
 
cmb
@Tiffany yes, why not :)
 
@cmb it doesn't have the button to DM you :P maybe closed or need to follow me?
Or send me a message twitter.com/orcishtylae
 
@cmb I chose to use "revert", but have amended the commit with your github handle info
 
cmb
3:06 PM
@Tiffany I'm following you now; thanks for the handle (hard to find your account by the name)
@Derick thanks, but wouldn't have been necessary :)
 
Sure is.
 
You should join our AmongPHP discord, then you can DM there...
 
Discord? :-)
is that different from @ramsey's php.chat again?
 
It is different
 
It's what teh gamerz use
 
3:11 PM
@Sara I use discord for work ?
 
It's usable for work as well, of course.
But you can't deny it's got gamerness written all over it
 
true
 
Is anybody going to link me? :-)
 
Sorry, I assumed you didn't have the client installed and were going to poo-poo it
 
I don't among us but I would like to hang, is that allowed ?
 
3:16 PM
THeir web thing works...
 
Well, I wasn't prepared to see my face on a college wide email today lol
 
WHAT DID YOU DO???!?!?!?!
@ln-s Sure, but you should also among us
 
Is that a game?
 
My pleasure
 
Oh Derick....
 
3:17 PM
NOTHING BAD JUST WEARING A MASK WHILE AT MY SOCIETY STAND DURING FRESHERS FAIR
 
Actually, we may be switching to Goose Goose Duck now that they've got mobile support.
It's basically Among Us but with a lot more options and features
 
Apparently it's a windows game?
 
Windows and mobile, yeah
 
I never managed to get steam to work on Linux, because it's all 32-bit BS still.
 
Which distro are you on Derick? Because Steam works fine for me
 
3:20 PM
Debian unstable ;-)
 
hum
That's odd isn't Debian meant to have the easiest time getting Steam working
 
debian unstable
UNstable
 
Debian 10
 
HE'S A MAD MAN
 
:)
 
3:24 PM
It's been pretty stable
 
I just know that for Fedora I needed to install it via DNF instead of Flatpak as that doesn't work for some games
 
Debian is great, I've used Slackware for years going to debian was a breeze, learnt a lot when using slack tho
 
I started on Slack in the 90s, I went debian through much of the 00s, been Ubuntu for well over a decade now
 
Same, minus the ubuntu
Which version did you start? I started on ... 7 I think it was ?
The days of configuring win modems still haunts me until this day
:D
I had a year of freebsd
maybe 2
Tried to go netbsd once, I regreted that decision
Never tried openbsd,found theo to be part of the tin foil gang
packetstormsecurity.com/files/164501/… Seems like 2.4.50 could also be affected, not only 2.4.49
Patch or don't use apache all together :)
 
4:04 PM
@Sara Maybe remove this one 😀
 
It's got a timer on it.
 
Ah alright, there was something going on at the discord server and people mentioned it should be removed
 
4:26 PM
 
Name change incoming in 3..2...1...
Assuming they cannot use the swoole name here
 
well, they already have openswoole registered
 
wow
"Doing further my Owner permission has been removed"
 
FWIW, if you want to see what's in the downloaded tar.gz: business.swoole.com/static/swoole_dashboard/4.7.2-dev.tar.gz
 
@PeeHaa Would be my assumption too. That's going to be hot mess as Bruce maintains most of the english docs I believe.
 
4:37 PM
there's nothing alarming at present but it leaves a door open for a remote code execution vulnerability (that's my take on it, at least)
 
@Trowski Kinda shortsighted to name it openswoole instead of doing it correctly right from the start
 
@Derick At first glance it seems to be an innocent monitor of some sort. At least for now…
 
@Trowski this
 
Yeah, "for now".
 
until someone else takes over the project and changes it without users being aware
 
4:39 PM
@Tiffany Yeah, pretty much. Through that mechanism they could do almost anything potentially. What's with putting PHP code in a bunch of C chars arrays. For what purpose?
 
or if someone hacks it
 
@ramsey Well… that's a problem for almost any project. Mark and I were discussing that this morning a bit. We're all a bit vulnerable every time we run composer update.
 
I would love package signing support in Composer
 
If a tag is signed that should be able to be automated.
 
Supply side attacks are going to be utter hell in the next 10 years, no doubt
 
4:48 PM
Proof that open source is a bad idea and nobody should use it ever.
 
cmb
@Derick is that code automatically downloaded and installed without users explicit consent?
 
It looks like a future debugging server, they don't want to provide all the client side code embedded in the binary so are fetching it when the server starts and using that for their front end UI.
We didn't look deeply enough to know if there were any routes inside it that could execute server-side code / php files contained in the zip.
^ all just speculation based on the limited amount we looked through
 
@cmb looks like it, yes
 
cmb
Isn't that a GDPR violation?
 
yikes
 
4:54 PM
why would it be? the GDPR consent is about personal information
 
cmb
Well, or any other rights (at least somewhere)?
 
Nah, I don't think so. It's possible that exposing your server's IP could be logged, but I also don't think GDPR covers that.
GDPR can't be used as an excuse why something is shitty in every occasion :-)
 
cmb
:)
 
So that to cookie prompts.
 
Not GDPR related, really.
 
5:02 PM
ico.org.uk/for-organisations/guide-to-pecr/… a little crossover, but cookies are Privacy and Electronic Communications Regulations
 
Even if it is JS, It's clearly a security problem if they start mining bitcoin with my computer or doing god knows what with my browser
 
cmb
@NikiC, thanks for npopov.com/2021/10/13/How-opcache-works.html, and particularly for mentioning the Windows issues! A few notes:
"To make this work, opcache stores the SHM base address in a file" – that's no longer the case as of 7.3.22/7.4.10
"it’s possible for the CLI binary to share the cache with an Apache module" – that's no longer possible as of 7.3.14/7.4.2
"then opcache will kill remaining users." – sounds a bit hard ;)
 
But justified IMO
 
@cmb unrelated, but every time I see your avatar I think about mastercard
 
No-one ever expected the terminator to run PHP...
 
5:06 PM
haha
 
cmb
they stole my logo :P
 
@MarkR haters were right!
lol
cmb = Credit Master Beacon
 
5:18 PM
Bacon*
 
@Trowski an idea is forming, I pinged prematurely, I'll circle back around when my thoughts are in order ...
urm am I being dumb, I don't see the problem with what swoole is doing there, it's not very nice, but a reason to fracture a project it doesn't seem to be ? is something else going on maybe ?
none of what swoole is doing is very nice
or is it just that people understand that this is not very nice, whereas the rest of swoole they can't read and so can't tell that it's not very nice from the start ?
 
Seems more like they flubbed the communication. Pulling down remote files is a legit risk (especially as they don't seem to be signed) but it should be made very clear what it's doing
 
if you're going to object to anything, object to the way the thing works, how invasive is it, the fundamental changes it makes to core PHP features ...
@MarkR maybe, but also a legit activity, isn't it ?
point out to me any part of swoole that is very clear ...
it looks like an over-reaction from the community
 
Yes, entirely reasonable mechanism for pulling in additional as necessary, while also allowing upgrades on a separate cycle to your main releases. But it's amplified by an underlying distrust in the chinese devs I think
 
that is the core problem, I don't want to really admit it, but this feels like a scape goat for existing distrust ...
which is horrible ...
 
5:35 PM
It probably doesn't help that supply chain attacks originating in China aren't exactly unheard of.
It would likely have made more sense for them to include the client side code in a different package that someone could just pull down from git, avoiding the appearance of potentially injecting code.
 
if your a swoole dev, the top complaint you hear from non-chinese people is that documentation is terrible ... can you really blame them for wanting a 0-click setup ?
it's a nice interface, the users of swoole are going to want this thing ...
they're trying to make it simpler to use, it's pretty clear ...
 
Unfortunately it may have backfired pretty bad.
 
@JoeWatkins There's definitely some of that, but do keep in mind this whole fiasco was started by one of their biggest proponents.
 
@Trowski well yeah, that's what I mean when I question if something else is going on ... I'm not sure why the strong objection from bruce, but understand him forking in response to how he's been treated (being removed from org) ...
 
There appeared to be some power struggle that resulted in that outcome, yes. My understanding is he protested to the delivery mechanism and intended to change it, so they booted him.
 
5:45 PM
it's all over now ...
 
Any idea why PHP code is being delivered in that way? Why bury it in char arrays?
 
it's awkward to deliver php with an extension, it's not the only extension doing it, although I can't name any off the top of my head, it's a pattern I've seen repeated for absolutely sure
 
Any ideas why php-fpm would consistently be using CPU when no requests are being made?
Running inside a docker container, in case that matters.
 
sudo gdb -p procid
find out :)
 
@JoeWatkins I've concluded that to do so robustly is incredibly difficult, and preloading made it even harder. IMO it needs to be a first-class citizen for extensions at some point, with basic integrity checks and such.
 
5:58 PM
Does php-fpm have workers that are always running just waiting for requests?
 
probably stuck in a busy (read?) loop, poke around to see why ... fpm has too many possible states for me to enumerate or be of any more use, sorry ...
 
@LeviMorrison I once figured out how to embed php in an elf, I guess you could do the same for other formats ... it might need to be a feature of the cache, I guess you would always want this code preloaded ...
that might need to wait until the cache is actually a zend feature and not stuck in ext with no usable api
 
@PeeHaa because of the strong legislation in China against trademark infringement?
 
hehe true :D
 
6:07 PM
@LeviMorrison or maybe move in the opposite direction, further from the engine/dso ... maybe invent an "install request" where if PHP is found to be executing under a particular sapi (capable of serving the content you want to serve) and some file is not found (or not autoloadable?), we do some work to download using normal (but secure) methods ...
 
(the details of which can be part of the module structure, or any structure, so defined at build time)
 
@JoeWatkins Hmm… being that it's in a docker container that's a bit more difficult.
 
I already hate that idea
@Trowski I don't know the particular incantation to recite, but the internet will know
 
the main use case would be to ship PHP code with C code, and have them available together, rather than having to install two dependencies...aka I don't like the idea of having it downloaded at run-time.
 
6:16 PM
They could verify a hash of it at download, people would at least be able to verify it had not changed.
 
I see the advantage of shipping some of your API as PHP code, but you seem to loose that advantage when you embed the actual code in your extension, don't you ?
how do we take care of updating this magically installed/downloaded/materializing code ?
 
AFAICT, we have a solution for embedding PHP into extensions already.
Shove the source into a string literal that's compiled in, then point the preload mechanism at that string. Done.
Also, that script can be a phar if you need more complexity than a single script.
 
However, this is a shitty take on it: twitter.com/brandonsavage/status/1448345667454308353
 
@Derick what the actual fuck
 
You might say that take is.... puts on sunglasses Savagely bad.
 
6:19 PM
"the Chinese" wow
 
exactly
 
I have never seen Brandon say anything that is not completely stupid tbf
 
He's okay....
 
@JoeWatkins not sure who you're asking that question to.....but updating the extension would get the latest bundled PHP code. Another reason for shipping them together is to allow forks/patches to be shipped as one unit, rather than multiple.
 
Well he sure doesn't show it whenever I see him in public places :P
 
6:21 PM
That comment is pretty bad, but there are people in "the community" I would write off well ahead of him.
 
@Danack anyone interested in doing this really :)
 
Oh I would write off people in general and work based on that :D
 
True. People are the worst.
 
The worst!
 
I start to loose sight of the advantage when the release cycle is tied together, why not just write whatever you're releasing in PHP in C, if in fact, it has the same release cycle as the C it's shipped with and can't possibly be changed without recompiling anyway ...
then it looks easier to write in the language you're supposed to be writing in ... to me ...
 
6:24 PM
I'd love to be able to bundle PHP as part of PHP extensions, and to have a module linked on the function entry so observability tools know which module it's a part of (one disadvantage of how we do PHP packaging today is that it's not straightforward to do this, unlike php-src modules).
 
@JoeWatkins Because then the extension can't be sure that the PHP code it thinks is going to be there, is going to be there.
Also, I am lazy and want to hit one publish button, not two.
 
if it's implemented in C, it's there isn't it ?
 
@JoeWatkins I think there's real value in letting developers create meaningful APIs in script code that are backed by thin wrappers. Even the best C dev is more likely to make a horrible mistake in C than in PHP.
Also, the JIT behaves best when it's not crossing script/C boundaries.
PHP can be inlined in certain situations, C code can't.
 
there's stuff I would prefer to do in PHP, and call from the internals of Imagick.
 
Now, the real conversation we should be having, is putting more C++ into the engine.
 
6:28 PM
I do see that advantage, but without the advantage of a different release cycle it doesn't look like enough to me ... if the C code and PHP code have exactly the same cycle it might as well all be implemented in C ...
 
"it might as well all be implemented in C" - it's possible you're more comfortable writing C than I, or most people, are.
 
AFAIK, MongoDB's driver/library pair are on separate cycles, so yeah... there's no interest in bundling there.
 
cmb
Might as well stop maintaing php-src; users should write their Web apps in C. ;)
 
 
I must have used the wrong words
being that it's awkward there has to be good reasons, and many of them ... one of the main good reasons is separating from the release cycle (and more generally the development cycle) of the extension code, and it's such a good reason that if you don't have that separation there doesn't look like justification for doing the awkward thing ...
 
7:02 PM
I kept the first one vague ... I guess it's technically still stored in a file, just not a separate file...
@cmb It is ^^ Until very recently it even went directly for the SIGKILL, without even a friendly SIGTERM first
 
@Sara I'm a big no on that. C or Rust, please! I've used C++ for years, and the number of times I still shoot myself in the foot with C++ is incredible!
Also, freaking string (and other) ABI breaks in GCC 4 -> 5 are somehow still relevant despite how long ago this happened...
 
C++ is okay really
You just have to follow a few simple rules, like ignoring 80% of the language and never using the standard library
 
Yeah, that's probably true.
 
7:19 PM
Does anyone have suggestions or readings how to incrementally implement dependency injection into a legacy code base that doesn't use OOP (or uses static methods)?

I think any way to do it would be implementing bad practices so I'm wondering what's the least bad practice. I'm thinking Facades similar to how Laravel has would be the "least bad", but I'm sure I'm not the first one to come across this issue.
The issue is in functions which aren't defined in classes which use a class that has dependencies. Without dependency injection I would need to do
    new Foobar(
        new DependencyA(
            new SubDependencyA,
            new SubDependencyB,
        ),
        ...
    );
Which can get a little bit messy.
 
@scorgn in general docs.microsoft.com/en-us/azure/architecture/patterns/… - but also have you looked at the delegate functions in Auryn? that stops needing to wire all those up by hand.
 
I'll read up on that document thanks!

Quickly looking over delegate functions in Auryn I think that makes sense but I'm not sure to what degree it applies to situations where I don't have an instance of the container
 
A laravel facade is just a global variable....so you could just use a global variable. It's going to stay messy until the whole of the code is refactored, probably anyway.
 
My thought is to make Facade classes that have a reference to the service container and can forward static calls to an instance of the class that it created. I suppose a global variable would work the same, but the global variable would be the container itself.
Ah I think I see where the delegate functions come into play. They can be tied into dependency injection but also called from legacy pieces which don't have dependency injection?
 
7:39 PM
@scorgn yeah...tbh I was referring mostly to the avoiding having to have complicated code for creating objects, but yes, moving the code that creates objects into functions which can be reused by the injector, so that you don't have creation code lying around everywhere, is a nice benefit.
 
Ah I see, for the most part the objects are autowired so the logic for creating the objects is in the constructor signatures themselves
I am just getting pushback for creating a class that won't be able to be called by SomeClass::foobar() because it complicates things where we don't have dependency injection
 
yeah.....that's why it's a bit of a nightmare. an application that is fully autowired is very easy to manage (imo) and to maintain. But as soon as you have any code that is not autowired, it's easier to continue to drift away from autowiring than to sort out the (effectively) global variables leaking around in more places.
 
Right, and when you have to move towards autowiring from having no autowiring while things are drifting away from autowiring faster than you can implement autowiring then there becomes effectively negative autowiring
That's a lot of autowiring (or not a lot of autowiring)
 
7:54 PM
If you can find a small area of the application, and do all of that, it might be easier for your team to see the benefits of it, rather than having to drag them all the way for the whole application.
 
Incremental changes are always better :D
 
8:12 PM
Incremental changes are not always better, ugh. Ever tried remodeling a house while living in it? Much nicer to live elsewhere and have it all done at once.
Of course, that's not always feasible either.
 
@LeviMorrison If you're the only one living there sure :P
 
8:22 PM
@MarkR Yeah, found a typo quatting package on Packagist with arbitrary SQL execution last week.
 
I'm wondering what it would take to nudge the packagist folks towards code signing
 
@Derick GDPR covers IP addresses.
 
@kelunik Yeah, I was going to show it to him but it was already removed from github.
 
@kelunik only personal ones, not servers that belong to companies.
 
@Trowski I have a local clone if you want.
@Danack That's true, but local development servers ..., but it's usually anyway covered by legitimate interest, and not consent.
 
8:31 PM
@kelunik Nah, wasn't that important. Just came up in a discussion about potential attacks on dependencies.
 
8:46 PM
Does PHPStorm have some sort of autosaving without switching to another app or manually saving? It's probably the third time the jvm crashed on me and … yeah, my new code from the last 30 min is lost
 
@bwoebi yes, it does.
 
You too eh... I was wondering if anyone else had the issue where phpstorm just decided to insta-die. Sometimes I just click it and poof, it's gone.
 
@kelunik I only see "save if the IDE is idle"
 
@bwoebi not even in the local history? (right click on a directory to get to that option)
 
@Danack nope
 
8:49 PM
@bwoebi Local history doesn't have it?
 
1 min ago, by bwoebi
@Danack nope
that's like the first thing I checked
 
... real programmers bind save to their enter key >.>
 
haha
 
@bwoebi I hit Ctrl + S all the time, because it also auto-reformats the code for me.
 
cmb
@NikiC it's stored at the beginning of OPcache SHM, which is backed by the system's paging file, so yeah (anyway, thanks for the corrections, and also announcing possible further OPcache limitations on Windows :)
FWIW, OPcache with Apache mpm_winnt currently has the same issues as FCGI on Windows, because SHM is created for the control process, but the worker process re-attaches.
 
8:54 PM
@kelunik :-D I tend to write my code already mostly properly formatted
 
@bwoebi Mostly :P
 
9:30 PM
@cmb Not sure if we have much motivation to still implement those limitations though ... it seems like things have become somewhat stable?
 
cmb
@NikiC I guess file_cache_fallback shades the issues (albeit it's super slow on Windows).
and of course, the execute_ex location check
 
Hm yeah
 
@Derick do you know when the next PHP London usergroup meeting is?
 
10:03 PM
@bwoebi For PHP I do, but for Rust? I just write garbage and let rustfmt figure it out for me ;)
 
10:23 PM
1 message moved to friendly bin
@Arcanis-TheOmnipotent don't spam.
 
10:43 PM
# php -r 'class A { public readonly int $a; } class B extends A { public readonly int $a = 1; } var_dump(new B);'
PHP Fatal error:  Readonly property B::$a cannot have default value in Command line code on line 1
why have we restricted that?
 
If it has a default property, then doesn't that mean it's already been written and is therefore a constant?
 
@MarkR that's the point - having a constant value for the property in my subclass
 
@Girgias Was supposed to be last week... so I don't know what's up
 
01:00 - 23:0023:00 - 00:00

« first day (4015 days earlier)      last day (939 days later) »