« first day (4433 days earlier)      last day (498 days later) » 

12:12 AM
@OlleHärstedt "$p = new "Point" be valid?" - No. There's no T_STRING after new. Compare 3v4l.org/bMnV9 ; also answers my "no clue about stringable".
 
 
8 hours later…
8:22 AM
o/
sup
yo does anyone here know a good text/post/book/whatever that goes in depth into PHP sessions?
I'm now looking at the official documentation
bout to write my own session handler, wish me luck
 
8:53 AM
 
9:27 AM
```Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may invite users to remove cookies and advise them they may be affected by a security issue.```
what does this mean
 
@hakre previously what?
in earlier php versions?
 
9:51 AM
@Danack if around, it seems something terrible in latest IM 7.1.0-53
@Danack see git.remirepo.net/cgit/rpms/php/pecl/php-pecl-imagick.git/commit/… (the REFLECTION diff) all the constant values have changed....
@Danack forget, it seems something wrong in my test build with "52" (no diff between 51 and 53)
 
@OlleHärstedt yes, earlier php versions (and my previous understanding, too, if that counts ^^)
 
JRL
10:34 AM
@cmb do you know if there's any documentation anywhere for the actual tensor extension? i've looked at it before, but it seems like it's almost a purpose built extension for just their ML framework.
 
Is it a bad idea to create a SessionHandler which stores things into a database rather than the filesystem?
 
@yessure no, in fact redis and databases are essential mechanisms for session handling in any distributed system
 
nice
thank you
 
I wouldn't use a database though, but I would use redis, or memcache
 
It depends on your redis availability imo. If you don't have redis taking snapshots to disk then if it restarts everyone gets logged out. Our larger systems operate on write-through with both redis and database. 99% of reads get handled by the redis but when there's data to be written it goes to redis + the DB. If it can't find the data in redis it looks at the DB then goes back to fill it in ot redis as well for the next request
(This is not worth it if you're writing something every page request such as last page time)
 
10:46 AM
I need to dive in more into redis and memcached because I've never used them

as now the idea is to write a class that implements SessionHandlerInterface which stores into a mysql the encrypted session serialized data
 
I one-way hash the session id so it can't be copy-pasted, I don't see a great deal of benefit to encrypting the data though unless you're storing third party auth tokens in it.
 
I don't get it... so your clients get the hashed session id while you got the unhashed one?
Yeah encrypting the data is more like a schizophrenia thing I got
 
paranoia is the word for that - schizophrenia is something else
 
No the clients use their original IDs but when they're stored in the database they're one-way hashed. That way if the DB was read-compromised for some reason, you can't take a hashed session ID and pass it along with your next request to use those credentials, as you'd be hashing a hash and getting something different.
There's no harm in encrypting the data beyond a small performance hit, it depends on how much time you've got and if your encryption keys are going to be meaningfully separated from the storage.
 
@Derick right, my bad
@MarkR good idea! Nice
@MarkR encryption keys would be the user session ids?
no session = bye bye data
 
11:00 AM
You would need to also do the session id otherwise you'd be storing the key in plaintext next to the data.
 
I won't store the session id at all
 
then how would you look up the data?
 
when a user sends me his session cookie
wait hmmmm
maybe that's not how it works
 
The session cookie is just an identifier, a long string, the data itself is stored server side. You use the id from the cookie to look up the data
 
yes
then I could store the hashed session id
 
11:06 AM
That would provide you with both the hashed and unhashed key to use for crypto
 
what do you mean?
 
If you were going to use the session id itself as part of the key to encrypt the data. Well you have the original plaintext when they send it via cookies, which is your key, and then you can hash it to get the value to look it up for persistence
 
yes
so if the db is compromised the attacker can't get anything out of it. Not the session id neither the session data
 
Yes, but like I mentioned you have to look at what you're storing in your session data. If you're protecting yourself against the DB potentially being read, or a step further and being writable.

Given proper key derivation functions etc it sounds like it would be an extremely secure system. But unless you're working on, say, a framework, or just for fun, you should be considerate to if it's the weakest link in your system
I do like the idea of using the session id as (part of) the key though. I might have to borrow that.
 
right
@MarkR what would you use as other part of the key? A random salt? Or a prefix?
 
11:19 AM
Likely a fixed key stored in the application config. The IV can be prepended
I need to step away and get breakfast, just an FYI if you're hyper-paranoid about the session being written to in your DB then encryption is (sometimes) not enough. You need to be able to authenticate the data too, and remember the attacker has at least part of the key (the unencrypted session id).
 
cmb
@JRL I'm not aware of any documentation. :(
 
12:28 PM
Was there ever considering to use some other mechanism of GC than ref counting in PHP?
Were it ever considered*
 
cmb
@OlleHärstedt To my knowledge, only refcounting ensures deterministic destructor execution (unless there are cycles, which is already an issue).
 
1:06 PM
Right
 
1:25 PM
@RemiCollet glad I could help, and insert joke about terrible things in every IM release here.
 
2:21 PM
@cmb And no one was willing to give up on that?
 
cmb
@OlleHärstedt I can't remember any discussion about that.
 
k
Depends on how reliant libs are on the destructor semantics, maybe
 
@OlleHärstedt "no one was willing to give up on that" - my understanding is that moving to an improve garbage collection system is something that would probably take multiple people working continually on it for multiple months/years. It's the type of thing that is hard to have done on a volunteer basis.
 
 
1 hour later…
3:30 PM
From internals - "I do not have the luxury of designing my own system. I am forced to use upstream." "They refuse to compromise even on documentation issues. I am totally helpless."
Shitting on your colleagues on a public mailing list is a choice I guess.
 
@Danack Maybe? Not sure.
A GC is a pretty challenging and interesting thing to try
The semantic break is the biggest reason no, I think
 
Yeah.....I seem to recall Sun spending a few hundred million improving those used by the JVM.
 
@OlleHärstedt hmm? I would have thought cleaning up the mess that is shutdown behaviour (that most people carefully avoid looking at) would be one of the stronger reasons for having a difference GC available.
 
OCaml has only one GC, and it's comparative with Java performance (when tuned to eat shitloads of memory instead of collect early).
But of course not certain PHP would benefit
Ref count might not be a bottle neck
 
3:53 PM
@Danack Really? Having predictable shutdown of files and database connections is a pro, as I see it. Similar to RAII, in a way.
If you remove __destruct(), people are forced to manually close stuff. Or wait until script end.
 
@OlleHärstedt that's not the bit that's a mess. Actually, I'm not sure this is up-to-date, and the situation may have been improved in the past decade, but there at least used to be some mess: stackoverflow.com/a/14101767/778719
 
@OlleHärstedt It is also really really hard. It took several attempts to get the circular reference GC working well.
 
4:10 PM
@Derick You can't copy-paste (to some regard) a current MIT license GC?
@Danack Oh ok :|
 
@OlleHärstedt The integration is the problem
 
k
Wonder how Boehm would do...
I'm planning to try it in my own PHP compiler
 
cmb
@Danack This is still messy, especially due to the desire to call the destructors.
 
I will continue to avert my eyes from learning too much about it.
 
@MarkR Didn't your outfit get renamed to iO?
 
4:26 PM
Once you commit to deterministic destruction, you're stuck in it
 
4:48 PM
@OlleHärstedt When I launch my own chat platform, one feature it will have is doing most 'etiquette' moderation done automatically, and in a way that doesn't interrupt the conversation flow or appear to be confrontational. But I haven't made it yet so...........
I'd pretty strongly recommend not asking a question with an inherent "anything I don't understand must be easy" in it, and instead asking "What would be involved with integrating a different GC library?". Not only is it more likely to be a productive conversation, it's less likely to make you sound like a ......a person not worth talking to.
 
morns
@samayo nah bro, not for like years now :(
 
5:41 PM
@Derick We were acquired by a company called BroadcastMed
 
@MarkR okay... unrelated to iO? Because I just got a recruiter (I think?) about iO and I thought that was your outfit
 
Yep, no relation other than a .io domain
 
okay
I got confused then.
 
5:56 PM
@Girgias was it intentional not support S|(Q&(F|S)) syntax for sum types? 3v4l.org/KgLvE
 
yes
it was DNF types
that's not a DNF type
 
hm, i expected it to be supported since S|(Q&(F|S)) is equal logically to S|(Q&F)|(Q&S)
 
S|(Q&F)|(Q&S) is supported
so write it like that
 
Requiring DNF format made the implementation much easier, made it easier for readers or people doing reflection to parse, and didn't reduce the possible rules to define. (Any boolean combination can be rewritten to DNF.)
 
@Derick i'm writing a parser, just wanted to make sure that it is supposed to error for that ^^"
 
6:02 PM
yes, it is supposed to error for that
 
It will.
 
I was wondering.
Should I use an INT and store unix time or should I use a TIMESTAMP attribute in my tables?
 
@yessure INT
 
@yessure Depends what you're using the field for.
 
@Crell it made my parser more complex :P
 
6:03 PM
@Crell session garbage cleaner
 
@SaifEddinGmati Only supporting DNF?
 
@Derick date and times can really be a pain sometimes
 
@yessure unix timestamp should be fine for that, as long as you manually make sure it's always UTC.
 
@Crell right
thx
 
6:04 PM
@yessure Yes, I am very aware. I wrote PHP's ext/date extension and have written countless things about it, including phpdatebook.com
 
@SaifEddinGmati Oh dear god.
 
WOW
 
so far, it is able to parse all of PSL :D
and it's *extremely fast
 
Planning to replace Bison? :-P
 
6:06 PM
The parser generator php-src uses.
 
oh, well, if it becomes 100% correct, then maybe i will give it a try, didn't try rust -> c before lol
 
6:31 PM
@Danack It wasn't my intent to sound dismissive or ignorant. :) But yes, maybe it's a better discussion for the #proglangdesign IRC channel.
Boehm is easy. But it's not a tracing gc.
 
7:37 PM
Have I mentioned that I hate docuwiki? I hate docuwiki.
 
@Crell Do you mean doKuwiki? :-p
 
Whatever the hell that thing is.
 
@Krell It's German, apparently. So, no C's in the name :-)
 
I kant even deal with that.
 
8:00 PM
@Girgias I'm currently working on completing the remaining Randomizer method documentation (specifically getInt() and getBytes() which are still lacking the description) – deciding onto "put which information where" is really hard, I don't want to repeat myself too much between method description and return value description :-(
And I'd also like the whole Randomizer documentation to be internally consistent which makes this even harder /o\
Procrastinating on that: Can we slim down the rand(), srand() and getrandmax() docs pages down to "alias of mt_*" or is the difference < PHP 7.1 still important for the current docs?
 
8:28 PM
is it bad if the session handler i'm writing doesn't implement the session handler's interfaces? php.net/manual/en/…
if I implement the interface I have to add a useless `return true` statement at the end of them.

also the function `gc` garbage collector... is kinda a pain to deal with... returning the number of deleted sessions, I have to run more queries for something I won't ever use
 
 
1 hour later…
9:54 PM
i don't know why I'm getting this error. `PHP Warning: session_start(): Failed to decode session object. Session has been destroyed in /tmp/asd.php on line 64`
https://pastebin.com/d4M5HTcX
:(
 
@yessure You'll have to debug your own code. I'd suggest writing some tests and using a debugger.
 
yeah now I'll try to use Xdebug
the thing is that writing a SessionHandler feels pretty much like coding blindfolded
 
10:10 PM
maybe find one that someone has written and read through it?
 
yeah, I'm looking at some
though the implementations I'm seeing have a different signature from the interfaces on the documentation
 
10:25 PM
@yessure I wrote that too ;-)
 
Niceee!!
Yo. I think that the problem here is the data deserialization. I tried using both "var_export(.., true)" and serialize(...) but i get the same results
 
oh,I also added var_export() to PHP :-D
I only have ever written session handlers in C though :-/
 
okay I have solved, I forgot the return flag on var export
although I think I'm going to use json or serialize for this session handler
@Derick !!! WOW
 
11:01 PM
" By default, the unserialization method used is internal to PHP, and is not the same as unserialize(). The serialization method can be set using session.serialize_handler. "
cool
 
11:49 PM
@SaifEddinGmati Yes, support for that could be added, but then you either need to decide if you do a normalisation a compile time (which turns out can get REALLY REALLY complicated the moment you have type aliases) or need to add support to type check such types which can lead to a lot of nested loops (abstracted away in function calls)
@TimWolla Sadly yes as the current docs cover all of PHP 7 + 8, the moment 9 gets released docs for 7 will be stored in an archive (and probably uploaded to the ne legacy docs provided by Zend) but until then
@TimWolla Repeating yourself is not too bad... a lot of the docs do that...
 

« first day (4433 days earlier)      last day (498 days later) »