« first day (4020 days earlier)      last day (912 days later) » 

1:42 AM
@StatikStasis ^ :-P
 
 
5 hours later…
 
4 hours later…
10:35 AM
Morning
 
mrnng
 
11:01 AM
Meowing
 
o/
 
11:17 AM
does someone know how to implement security questions after login? such that when a user clicks login , they are asked to first answer aquestion after which they'll be fully logged in or not if they fail it as per what they set at registration
if any ideas please point me to the right direction
i have tried searching but none yet
 
Unless your security question is a OTP, don't :)
 
@PeeHaa not sure i get what u mean but whaat i need is that at sign up a user will be asked to answer some security qns. Then at login they'll be asked to comfirm their answer
otp is not ideal for the kind of application i am using
 
imho the security questions like your mother's maiden's name (which I assume you are talking about) is not ideal for anything
 
okay but i want to implement it. do you know some good resources on this?
 
@DaveRandom =D
Morning all
 
11:32 AM
Yo Statik
Good news! I spent yesterday half setting up our studio in the new house \o/
 
@Dr.Mukama Please do not do that. It doesn't matter what the security questions are, it's a security antipattern. It lowers security and annoys users.
Set up two factor authentication or passwordless login
Security questions are in reality nothing more than extra passwords
 
well my supervisor is asking me to implement it even after the argument that otp sent to the phone number is better. she wants that and its not questionable
 
does your supervisor have a supervisor too? You can take the issue up
If you see a security issue you should speak up
 
@Dharman I doubt there was ever an argument :)
 
for otp i have it in some other system but the feedback we are getting is that sometimes a user may not have access to their phone and yet a login is emergent
 
so the supervisor after we talked about it decided that shes seen some banks implement it and that its more convenient
@Dharman thanks let me read thru
 
I wonder what kind of shitty bank implements that
It would be good to know so that I never open an account with them
my bank uses 2FA
If you really want to avoid OTP/2FA you can implement computer generated passphrase on top of the normal password. e.g. a nonsensical sentence made up of 10 English words of varying length. Ask the user to remember this and then you can ask them to provide part of this passphrase as an answer, say 5 words. It's still a terrible idea, but better than letting users come up with their own answers
Bare in mind that this doesn't really provided added benefit over a normal password
so I don't really understand what would be the idea behind implementing questions/answers like you suggested in the first comment
 
@Dr.Mukama Password + Security Answer is not a good setup because it's only 1 factor - they are both "something you know". A second access requirement should be a different factor (hence the term "multi-factor authentication"): en.wikipedia.org/wiki/Multi-factor_authentication#Factors
 
Not to mention there's probably not a single person out there whose basic security q's havent been leaked by a data breach at some point, either that or who publicly posted them in response to a facebook image wanting to know what you'd name your pet if it was the last sandwich you ate + mothers maiden name
 
Whenever I see a site using security questions it is a huge red flag for me.
"If your account balance was your SSN, how much money would you have?"
 
11:46 AM
Most security Q answers can be gained through casual conversation, especially if an attacker knows the target.
 
If im forced to put in a security answer they usually end up being given randomly generated passphrases
 
"What was the name of your first pet?" -- "JDXnCJ%C4#P!PB@#hd@MmPKs@U&47V4k8cXnh9mmzMX6Q7JeMUdk"
@MarkR ^^ :-)
 
The really annoying ones are the forms they don't let you copy and paste... I shouldn't have to open element inspector to have to use a secure pw
 
I had security questions for my bank, but I think it's because I opened my account over a decade ago. I wonder if they've improved things since then.
 
@salathe I was rather fond of JDXnCJ%C4#P!PB@#hd@MmPKs@U&47V4k8cXnh9mmzMX6Q7JeMUdk, he loved chasing sticks, when he got old I let him stay with my mother, Y3KaZgQkPYMdnRqvgZpDJnsNEzG85CZDw48CTeXD
 
11:53 AM
@MarkR Me too, he was a wonderful tortoise. <3
 
@PeeHaa NICE!! Can't wait to see pics!
 
@Dharman after reading through this article in additon to the like flaws i pointed in our meeting i will try to repush for 2fa in the next meeting. thanks
 
12:08 PM
Need to order some more stuff, but we are getting there
 
Find your supervisors mothers maiden name out from a public source and suggest using it as test data :-) that would get the message over.
 
 
2 hours later…
1:54 PM
Are we going to do a JetBrains™ Marketing Message Sparkle and Dazzle Release Announcement for every minor release? :-/
 
It's got quite a few features in it, so I don't mind for v8.1.
 
cmb
@salathe I would at least skip the translations.
 
2:12 PM
@kelunik honestly at this point no idea, we don't have fiber support in Tideways and/or XHProf yet, so i don't know how that will work or look like and such
the nice release announcements make for good hackernews / reddit link to pages, its a much better marketing for php as a language imho, so +1 for me for 8.1
 
Datadog doesn't have fiber support either. No idea yet what that will look like, though I'm hoping the hooks we added will be sufficient.
 
2:32 PM
@LeviMorrison yeah, question probably is whether Datadog has any interest in hooking to the revolt loop directly
(at some point)
 
the problem for a trace base instrumentation really will be that internals need to be rewritten massively to keep multiple traces in parallel
 
It was remarkably easy for Xdebug.
 
 
3 hours later…
5:25 PM
@beberlei It's not about fibers, but rather which metrics you might want to have about the event loop.
 
5:50 PM
@bwoebi Same for Datadog. Do you need any APIs for that or will you just monkey hook into the classes?
 
When do you expect that Revolt will start having real world application?
 
@MarkR Do you mean releases to be used in production or libraries that work with it?
 
All of the above. When will the release be production ready, and amp on top of it, and when do you expect to see the first production apps using it?
Wondering if we'll have an opportunity to learn from other people's mistakes soon after launch, or if we need to make them all ourselves =)
 
No idea TBH, most of our libs already have branches compatible with it, but would be great it people run into mistakes before release. :P
Original intention was to have it ready with PHP 8.1 GA.
 
@kelunik the problem is that one first needs a design how to track fiber stacks - because obviously makes very little sense to mix independent traces (i.e. function call stacks from unrelated parts)
and then one can design how to nicely integrate the loop
 
6:05 PM
@bwoebi Yeah, I'm not worried about fiber switches, they have the observer API @ internals.
 
yeah, I'm not either, just saying that it makes little sense without a concept of multiple trace stacks at all - which we don't have yet
 
The PHP streams API has no peek() type operation, correct?
 
@Crell seek?
You can read and then seek back the read bytes
 
6:24 PM
@NikiC that only works on stdio streams though - I guess he means recvmsg with MSG_PEEK, which is only available in ext/sockets via socket_recvmsg(), but not with the streams API
 
That assumes a seekable stream though. Which I suppose makes sense... Hrm.
 
@bwoebi true
 
This is screwy. If I'm reading this xdebug profiling output correctly (which is highly questionable), my serialization pathway is around 6 times more expensive than the deserialization pathway. I... have no idea why that would be.
 
6:49 PM
@MarkR Another good one... cannot recall if I already sent or not. =/ youtube.com/watch?v=OeDcKVOXDgA
 
 
2 hours later…
8:22 PM
PSA: Stack Overflow moderator elections are underway.
4
 
8:33 PM
Hrm. readonly promoted properties and inheritance don't really get along well, do they.
 
8:49 PM
looking for phpstorm plugin suggestions: a time tracker that splits minutes/hours by days... the built-in time tracker just tracks what I've worked in a total amount that I have to figure out myself
like if I spend four hours on a Monday in a project, then six hours on a Tuesday... I need that info instead of a total accumulated hours
I'm absolutely fucking horrible at tracking the time I spend on code and would rather have it done by my IDE
 
9:09 PM
going to try wakatime
 
Let me know if it works well, I need something to keep track on how much time I spend doing stuff in IDE
 
10:03 PM
Woah, I've not gotten a segfault in years.
 
@Crell I get them regularly, no matter whether PHP, Java or MySQL :D
 
Lucky you?
 
@Girgias if you don't need to track time between days, the built-in time tracking feature works pretty well.
 
I mean, between days would be good too, but I didn't even know it had one built-in <-<
 
@Girgias blog.jetbrains.com/phpstorm/2016/08/… it's very barebones but works well enough
by "barebones" I mean that I haven't found a way to reset the time on a task other than removing and adding it again... but being able to tie a task directly with a branch is nice
and I seem to have broke wakatime because I installed the plugin before registering an account?
 
10:40 PM
@Derick Wanted to report a bug in xdebug, but got gist.github.com/kelunik/071554cd822eafe22a51bfb646b6632b :P
Seems it didn't like my ➜ in the text. bugs.xdebug.org/view.php?id=2036
^ @Crell There you have another segfault. :P
 
mornings. now a php userland question that is bugging me and google lets me down:
given using curl < php 8.1 and doing a multipart/form-data POST request to do file uploads against some API or other kind of PHP ...
... from a string (instead of a file), I used data://... to base64 encode the string and pass it over to CURLFile as a standard path.
now for some reason curl chokes on that while when I do the same with a temporary file the world is fine.
 
@kelunik someone is not setting their charset to utf8mb4 ...
 
Now I'm trying to understand how I can find out whether data:// is supported on a platform or I need to fall-back to tempfile().
 
> chokes
what's the error?
 
any idea how I can check if the current runtime configuration allows curl to read stream wrapper URLs?
@Danack if I had an error message. curl chokes (gives error return FALSE) when setting the curl options which includes the CURLFile (set as array). it comes after curl_init() which returns fine.
I can also see this message in the logs, but my assumption is that it is related to the input to the PHP script and not to what I do with it with curl:
> PHP Warning: Missing boundary in multipart/form-data POST data in Unknown on line 0
Given there is one file upload request that my script then receives, gets a temporary file (as PHP file upload), turns it into a string sigh so that I needs to take the string, turn it into data://... to pass it over to curl again so that another post request with multipart is done.
I can do it putting the string into a tempfile and give that path to curl. CURLFile is fine with that. Somehow only not with data://... with the same content.
So I'm wondering if data:// is n/a on that platform (which I think could be as it can be disabled) and wondering how to find that out from PHP.
Something like supported wrappers (or enabled ones).
stream_get_wrappers() lists data.
maybe not allowed for inclusion ..
file_get_contents() also has no issues with a data:// path. maybe I just can't check for that and go with the temporary file.
 
11:15 PM
@Danack I thought you might find this amusing reddit.com/r/ProgrammerHumor/comments/qalod6/…
 
isn't she the daughter and he the father?
 
11:30 PM
@kelunik Yeah, it's using MySQL which doesn't understand UTF-8 properly
 
11:41 PM
@Derick by default. Setting tables charset to utf8mb4 and collation to utf8mb4_0900_ai_ci (apparently) makes it understand it reasonably well.
 
Yes, but I am not going to muck with this.
It's Mantis, not my own code/database.
 

« first day (4020 days earlier)      last day (912 days later) »