« first day (4482 days earlier)      last day (480 days later) » 

9:44 AM
http://olleharstedt.github.io/programming/2022/12/12/nbody-benchmark-in-php-c-polyglot-pholyglot.html

Made a new blog post about compiling PHP to PHP+C. ^^ For people who are not on reddit.
 
 
2 hours later…
11:51 AM
Morgens o/
 
@cmb github.com/php/php-src/pull/10391#pullrequestreview-1265227945 Would commit 2 be "Internal API changes" or "Build system changes" in github.com/php/php-src/blob/master/UPGRADING.INTERNALS? Also: I would amend the second commit to include the UPGRADING.INTERNALS change and then "Rebase and merge", so that the second commit is independently revertable, does that sound reasonable?
 
12:44 PM
@PeeHaa \o/
My first paintball video is out! Would love if some of you would check it out. youtube.com/watch?v=0-bgV46gw4s
 
Such a perfect intro
Friendly fire :D
I expected youtube.com/watch?v=2P5qbcRAXVk at 3 mins
:P
 
@PeeHaa LOL! That would have been a good alternative! =D
 
Sooooo how much monies did you spent on the gear? :)
It seems like an expensive hobby?
 
About $3500...ish
It is
 
Damn
 
12:56 PM
I went all in though. You can get what you need for $250
 
E and I also really still want to go for a couple of rounds
 
Places do rentals which makes it cheaper, but you definitely want to buy your own mask for about $50... the smell of the rentals is awful, not to mention all the scratches on lenses.
But I love my "space gun." But... pretty expensive.
@PeeHaa Thanks man! \o/
 
Are you playing with random people or are you one of those people with friends?
 
One of them is my son. The third video will start having some of my friends in them.
 
Some nice father and so[HEADSHOT]
 
1:07 PM
Everyone else is randoms.
lol
He's on my team.
The matches will go from 8 vs 8, to 24 vs 24... or more sometimes.
 
21 mins ago, by PeeHaa
Friendly fire :D
 
That was a random... but we're friends now. =)
NPC character
 
:D
It looks like so much fun
 
It is! Huge adrenaline rush!
@PeeHaa SO be honest, is video fun? engaging? etc?
Anything I should change? Last match is one of the longer ones.
 
@Krzysiek Yeah they are handled differently, I mean catching a union of exceptions was a thing prior to union types, moreover I'm not sure what point there is in catching DNF type eExceptions?
 
1:11 PM
Intro: a+
First match: action packed fun
After that it feels a bit less action, but still fun to watch
Total: would watch more
 
I thought about cutting some of the waiting out, but I wasn't sure if people would like to see the whole match or not. Good feedback. =)
 
cmb
1:27 PM
@TimWolla Oh, indeed, in this case that seems reasonable.
 
@IluTov are you handling github.com/php/php-src/pull/10395?
As it seems it's approved but not yet merged
 
@cmb That answered question (2), but which section in UPGRADING.INTERNALS is correct (i.e. question 1)? :-D
 
cmb
@TimWolla It put it under "2. Build system changes".
 
ack, thanks. I'll handle it tonight.
 
cmb
ta
aside: I think we should really drop the numbering in these files; diffs get out of hand, if the order is changed.
 
2:05 PM
@Girgias Yeah, I'll merge but I want to rebase onto 8.1. I'll be back on Thursday, I'll merge it then.
 
Okay :)
 
 
2 hours later…
4:27 PM
Am I the only one who seems to run out of memory recently when running the test suit?
 
php -d pcov.enabled=1 -d pcov.directory=src -d memory_limit=-1 ./vendor/bin/phpunit no :P
 
>_>
 
cmb
@ircmaxell I stumbled upon password_verify.phpt and I'm surprised that some of these cases return true, although the RFC says: "If there is any failure (hash is invalid, password is incorrect, hash is corrupted, etc), the function will return a boolean false." Thoughts?
 
4:48 PM
@cmb The assertions look correct to me.
 
5:10 PM
Question in regards to closure from static method thread on ML: why don't we / would it make sense to distinguish between Closure and BoundClosure on type level?
And UnboundClosure
> Static closures cannot have any bound object (the value of the parameter newThis should be null), but this function can nevertheless be used to change their class scope.
I believe avoiding nullablility on type level is less defensive code and easier static analysis, right?
From the doc's which means they could be represented by a type which doesn't accept $newThis
Does that make sense?
I'll take a closer look on it cuz maybe the solution could be bc compatible
 
@brzuchal "why don't we" - because the question on the mailing list is an x/y question. It's assuming an answer and then trying to get it to work.
"Asking why don't we just" is almost always a bad way of finding a solution, as it puts the onus on other people to find reason against an idea, and so allows 'ungood' ideas to slip through. The conversation should always be "we'll do this, because it's the right solution".
 
5:37 PM
I have a CLI tool that communicates with an API using an access token.

This CLI tool has no DB access, so I need to write down this access token somewhere in the filesystem for persistence, so I write a JSON with the access token to `~/.my-cli-tool` (the actual path can be overriden with env vars).

I want to encrypt this file, though, just to make it safer in case that file is compromised for some reason.
Q: Is the approach to persist the access token OK, given the circumstances?
Q: Any recommended way of encrypting this file?
 
if you encrypt it you need a way to unencrypt it, meaning you need to still have access to the key somewhere
you may be able to use an OS provided storage api
 
Exactly, that's the problem. I can only think about a hardcoded cipher, but that doesn't seem optimal
 
If your local system isn't secure it's game over either way
 
Would only offer protection against attacker that gets hold of the file without knowing that there's a hardcoded cipher
eg: can't trace back the file to the code that uses it
 
the only way is to do what most key management systems do and protect the key by a pw entered at use
 
5:45 PM
> just to make it safer

There is no real “safer” here. Either the file is encrypted with a user-provided value or it can be stolen. Attackers are going to know that ~/.my-cli-tool is going to belong to … my-cli-tool and will write malware specific to it, if it's worth it.
Unrelated, you should likely follow the XDG Base Directory specification: specifications.freedesktop.org/basedir-spec/…
 
Thanks for the food for thought. I think I have an idea.

1. Encrypt the file with a hardcoded cipher, which is not great but it's at least better than unencrypted
2. Allow the cipher to be overriden with an env var
3. The env var can be set at runtime by the user, eg: FOO_CIPHER=123 php my-cli.php

If the user is sensitive to security, he can pass a custom cipher at runtime.
 
re (1): No, it's not. False security is worse than no security. If the user sees their plain text data in the file then its obvious to them that it would also be visible to an attacker. If it looks encrypted, then they might think they are safe when they are not.
(3) might not be actually secure either. Environment variables are visible to other processes and they will also land in the .bash_history.
 
6:55 PM
=D
 
cmb
^ yes, that please
 
Shhh! He's back, everybody act normal.
 
wtf
Why did I get kicked? :P
 
@PeeHaa trying to summon a mod. If it doesn't work first time - you kick me?
1 min ago, by Danack
Mod - we found a security problem. Please delete everything back to 55873085
 
Success!
 
6:57 PM
lol that's dumb :D
 
@ZoestandswithUkraine apologies for noise. but a 'not good thing' occured.
 
They don't make em like they used to I guess :p
I still don't understand it. What a hit-and-run
 
What's the problem?
 
@Dharman accidental disclosure of an undisclosed security vector we'd like nuked
 
security issue in PHP was found, discussion is being taking in a private view, can transcript be rolled back
 
7:00 PM
Don't trip and kick me again though please
 
53 messages deleted
Is this good enough?
 
I think you still missed the initial one
 
cmb
Thank you so much, @Dharman.
 
@PeeHaa Where is your proof you were kicked?
 
7:02 PM
For the record, y'all need to be far more specific when you flag
 
cmb
@nielsdos Tim's message is unrelated (and harmless, and should not be deleted).
 
@Dharman thank you!!!
 
Ah okay my bad
 
@StatikStasis It's on my "record" for mods :-)
 
haha!
 
cmb
7:02 PM
@ZoestandswithUkraine Okay, will do next time. Thank you!
 
Neither of the two flags were specific enough to indicate a fixable problem
 
Thank-you.
 
@PeeHaa Kicks aren't logged
 
I, for one, am glad for that
 
He keeps his own ledger. He's vengeful like that. =P
 
7:03 PM
You know me
I still don't understand who or why though
 
If you need more deleted, let me know
 
Not sure where to avenge me :D
 
@cmb should this one be deleted?
 
cmb
@Tiffany No, this can be kept. Behavior is okay, as I learned.
 
:thumbs_up:
 
7:14 PM
@PeeHaa room owners kicking other room owners sends pings to online mods. Thank-you for your sacrifice.
 
Did a RO kick me?
 
Mods: No infighting in the war room
 
@PeeHaa @Danack kicked you :P
(yes)
 
Oh lol
 
@PeeHaa as I said, thank you for your sacrifice.
\o/
 
7:16 PM
I love it
 
There was almost certainly a grin when it happened, but, ye know, nothing to say you can't enjoy it
 
should the proofs of concept be deleted from 3v4l?
 
cmb
@Tiffany Oh, right. @Sjon, could you help with this?
 
7:41 PM
@cmb @ircmaxell and I basically did the full evaluation of the issue. How can I contact you in private for details?
 
cmb
@TimWolla Anthony already explained the issue to me on IRC. :) Alterative communication maybe via Twitter chat (or private chatroom here; not sure if "safe").
 
IRC works, what network?
 
you'ee both on Efnet: cmb69 and TimWolla
 
cmb
Or maybe just file an advisory at github.com/php/php-src/security/advisories.
 
Okay, will do.
 
7:55 PM
morns
 
 
3 hours later…
10:44 PM
heh how is it possible that a query in mongosh doesn't returns the same results with the mongo driver in PHP
(trying to use $filter in $group stage)
 
Hello guys
 
I see, it tries to escape characters so I just used use MongoDB\BSON\Regex;
 
 
1 hour later…
11:56 PM
@Danack are you busy February 14? thinking of trying to set up a hang out that day, because Ian will be at the speaker's dinner and I would feel weird if I went
 

« first day (4482 days earlier)      last day (480 days later) »