« first day (2896 days earlier)      last day (2269 days later) » 

00:00
"Keep a positive mind. Remember, a failed attempt doesn't make you a failure—giving up does." -Lorii Myers (source)
A failed attempt shows you how not to do something.
00:16
"A dependency defined in Gemfile.lock has known security vulnerabilities and should be updated."
@JennaSloan Dang that's a big table. xD
@JennaSloan /cc @Zoe
Oh, I thought your following message was referring to that webpage. xD
"rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.." - National Vulnerability Database
There are like 6 typos/grammatical errors in that paragraph.
How would someone do this? An array of scores (scores = [1, 2, 3, 3, 4, 5, 6, 6, 6]), capture the lowest occurrence and the highest occurrence and put it in an array. The result would be count = [2, 3]
But how to actually do this to get to the result?
@Farhad use a for loop
00:38
@Farhad This chat room isn't really for code tutoring. You might get more help if you ask a more specific coding question.
@JennaSloan Ah, that one.
Or you could use streams and a collector
01:21
morn
user8622974
morn
morn
@JennaSloan have you joined the bots?
@Tavo No, have you?
01:32
never left
I have officially peaked. I have named a project "SEXI" and everyone is going with it
5
@Michael related to what I just posted? :P
lol
I'm passive aggressively trying to send you a message. Get with the program.
Anyone's good with Ant or Maven builds? I want to know how I'm supposed to integrate the Lombok library properly in my project so that when someone else uses the generated JAR, it still uses Lombok (no crash happening and whatnot)
But your post does raise an eyebrow.
01:40
hey, project SEXI is a Java Restful API
so it's on topic
also, stands for Sgx EXternal Investors
I'm a funny man
also, I'll show myself out...
I am still on high alert from the shit storm that went down today
what happened?
we demand knowledge!
01:44
11 hours ago, by Madara Uchiha
Ah, no, I'm stupid, ignore me.
@JennaSloan Around 14:00 UTC
in this channel?
A dude was posting some vulgar stuff. I kicked him from the room. About 2 dozen mods showed up. xD
no one? :(
what the heck
@Michael because of the vulgar stuff or because of the kick?
01:47
I don't know. He posted a photo of a woman with the word "Vagina" on it. I flagged that. Then he posted a long message with nasty stuff in it and I kicked him. Then the mods showed up.
It's so stupid man. Who are these people who troll software engineering chat rooms.
Man babies
I think mods get a notification on their screen whenever somebody flags a message or gets kicked
@Michael I wonder if they just do it randomly in any chat rooms they can find
but you need a certain amount of rep to be able to speak in a channel, so it might as well be someone leaving his/her account open somewhere and people abusing that
He was using the whole argument about society being too politically correct and people being overly sensitive to act like he was a victim.
Good grief
Oh, he's a database specialist. That explains it.
01:56
strange. Seems to be an average SO user. I wonder why he/she would snap like that
He made a vulgar comment a few days ago. We let it slide.
I'm getting overly emotional. He's probably just a troll who wanted to see how much he could get away with.
Anyone, help? :(
Sorry @payne, this is not a help desk.
"Dedicated to the discussion of the Java programming language and general software engineering principles" :(
Can I use both Ant and Maven in a Java project that needs to be exported as a JAR?
> We are not on the clock: We are a group of professional and hobbyist programmers who like to spend our down time conversing with other like-minded individuals. We are not paid to field questions or provide advice. If you would like to ask a question, please remember that this room is not a help desk or consultation service.
I'm out, good night.
02:02
Alright.
Thanks anyways :)
niters Michael
@payne why do you want to use both. Also, why do you want to use Ant in 2018?
02:24
I basically don't know enough about those two to know if they will be exported with the generated JAR.

I've learned Ant through my software engineering course (very basic stuff), and barely touched Maven. I already have a piece of code from an old project that will suffice my build stuff, except I do not know how to integrate this Lombok library in the Ant code properly, so I thought maybe I could reuse my Ant code, and just import the library through Maven since it's so easy (and it's also the only thing I know how to do in Maven)
Hello
Hows it going?
 
2 hours later…
Zoe
Zoe
04:29
@JennaSloan which?
Right, I can just check :*
Seems to be an issue with GH pages 191
I thought I det it to 192?
Set*
Oh well. Might be a local system bug. I'll push an update as soon as I can
Zoe
Zoe
04:57
OwO it's snowing
Zoe
Zoe
05:08
Oof, seems like GH pages used 186 instead of 192 xd
05:21
hey Zoe
05:41
morning
user8622974
morning
Morning.
Zoe
Zoe
05:55
Hiya @Tavo
@Michael WTH?
hey Itachi
Zoe waves hand
Hey Tavo!
how's it going?
Good.. Good!
06:01
good to hear :)
How are things with you?
I'm pretty happy today. I've been coding uninterrupted all day, listening to Tracy Chapman and I have a coffee with me
what else can a developer ask for?
Haha, real nice.
I'm actually hiding, that's why I've managed
I'm sitting in a different floor, in a business unit instead of dev :D
wearing sunglasses and a hat :D
I have also been coding uninterrupted for last few hours, its a good feeling.
@Tavo Are you serious?
06:04
not about the sunglasses and hat
haha
I literally imagined you doing that :P
but it would be funny
ahahahah
I think people would find me easily if I were doing that
True that
I should buy a wig though...
everyone would be looking for a bald guy
anyway, this is getting out of hand
Haha
You look good with no hair ;)
06:08
Good morning, Hibernate 4 does not terminate application after running. Is the solutions in this post the only work around for this bug? stackoverflow.com/questions/30847009/…
@ItachiUchiha well thanks. But you've never seen me with hair anyway
there's an obscure pic of me with hair somewhere :P
@geisterfurz007 There is no longer a JRE. You can use JLink to create a trimmed down Java runtime for your application.
@Tavo That's true too. I was only complimenting on what I have seen ;)
@Simmant Yes, it worked thank you.
@ItachiUchiha hey, I'm not complaining. I'll take what I can
thats great
@ItachiUchiha hey buddy
06:14
o/
user8622974
\o
Damn bots
ahahah
\o
user8622974
06:15
o/
@Tavo Poor you. Only one of the bots likes you :P
again, I'll take what I can :D
Mornings o/
@ItachiUchiha Even more stuff to learn >.> Thanks for the keyword to look for!
@Wietlol This looks like something you might have looked for as well ^
@ItachiUchiha Thanks a bunch!
Is it at least somewhat similar to javapackager for JavaFX?
06:28
@geisterfurz007 btw, that person lives in Germany as well
Oh it is javapackager? What about Swing projects?
Javapackager creates an application bundle
jlink creates a java runtime image
You cannot use javapackager if you don't have a runtime image
Also, you can forget the fact that JRE was ever supplied for common usage.
Gotcha! So once I have that JRE image, I can just run the jar? I am still missing a (I'm sorry) link here between the jar I created (assuming I am still creating a jar) and the JRE image.
The JRE image will contain everything. There will be no jar. When you run jlink, you will get a file along with a bat/bash file. The bat/bash file is the entry point to your program.
That was the piece I was missing. Thanks a bunch!
06:38
If you combine jlink and javapackager, you will end up with an .exe or .deb etc.
But didn't javapackager still have a jar that backed the .exe file?
At least that is what I know from Java 8 still. A bunch of .dll files (on Windows), the jar files of the libraries and by application and preloader.
Or was that changed by combining JLink with javapackager from Java 9 on?
@geisterfurz007 I am not sure about that.
For example SceneBuilder still has jars in the app folder that is why I asked. Given that javapackager is removed now anyway it might not be relevant tho.
Either way, gtg. Thanks for your help once again @ItachiUchiha <3
welcome
DON
DON
How we can iterate collection of entity in java 8
userProfileCol.stream().forEach((K,V)->{

			});
06:54
Is userProfileCol a map?
DON
DON
it's a collection of type userProfile entity
How did you replace UserProfile with (K,V) ?
userProfileCol.stream().forEach(userProfile -> { });
DON
DON
My syntax is not correct, i'am just a beginner in JAVA 8, i'am trying to expertise in java 8
thanks for your help.
@DON Not sure how can you pass a BiConsumer to something which accepts a Consumer.
DON
DON
userProfileCol.stream().forEach(userProfile -> { }); so how can i access different attributes of userProfile inside java 8 foreach loop
similar to for(userProfile col : userProfileCol) {
col.getUsername();
}
for(userProfile col : userProfileCol) {
col.getUsername();
}
07:09
userProfileCol.stream().forEach(userProfile -> {
    userProfile .getUsername();
});
DON
DON
thanks
next i want to check whether username exist
int count = userProfileCol.stream().filter(UserProfileValue -> {}).count();
@DON It's ironical how you say that you are a beginner and yet you are so confident about your approach. #just.saying
explain "username exists.."
DON
DON
I mean i'am learning java 8 but i know how things are working in java 7, what iam trying to do is get data from DB based on the username and check whether it contains the password and check whether the user is active or not.
Morning
user8622974
Morning
07:22
Morning.
Anyone ever heard of beyond trust
DON
DON
userProfileCol.stream().forEach(userProfile -> {
    if(userProfile .getPwd().equals("test") && userProfile .getActive().equals("Y")) {
      ///////////////
    }

});
this is the way right ? @ItachiUchiha i dont know any other ways exist
userProfileCol.stream()
    .filter(userProfile -> userProfile .getPwd().equals("test") && userProfile .getActive().equals("Y"))
    .forEach(userProfile -> {
      ///////////////
    }
});
Does there exists a frontend framework that is focused on security i.e produce html that can almost all owasp recommendations or vulnerability scanners
userProfileCol.stream()
    .filter(userProfile -> userProfile .getPwd().equals("test"))
    .filter(userProfile -> userProfile .getActive().equals("Y"))
    .forEach(userProfile -> {
      ///////////////
    }
});
either of the 2 is ok
07:42
@objectiveME Nearly all of the vulnerabilities aren't solved in the client.
morn
user8622974
morn
morn
String literals should be on the left side of any equals() call
07:46
And userProfile should have an isActive that does the equals call. It's no business of any user of that class to know how a userprofile is defined as active
I recently got a report after a scan and made me rethink how i reaon about web apps
@objectiveME ..?
This is good owasp.org/index.php/OWASP_Focus but not enough
The most common vulnerabilities are XSS, SQLi, Session Hijacking, Social Engineering, and CSRF
Not necessarily in this order.
XSS has some responsibility on the client, to be sure. But the only rule you need to follow is "don't use .innerHTML in the client", and your client is "secured". Everything else, comes from the server.
SQLi is purely server-side.
Session Hijacking is trivially solved by TLS with a good cifer.
Social Engineering is a whole different branch of the problem.
CSRF is solved on the server-side.
Of course a scanner will scan your website and frontend, because that's what's public facing, they can't scan the server directly (unless you give them all the endpoints and code to review as well)
@MadaraUchiha true
07:50
Also, my career doesn't revolve around security. It's peripheral to what I do.
So I don't think it would "end" my career anytime soon.
@MadaraUchiha I didn't mean your career personally
I was just saying to mean that the vulnerbility reports generated forces people to change their code considerably
If you are short on timeand your company depends on things getting fixed, then its easy to see that the boss wont be happy
Look at this question I've asked and answered: stackoverflow.com/q/23740548/871050
Now, you can't see all the deleted answers, but take note of how many of the answers contain XSS in them
Just to clarify in case that wasn't clear: var x = <?php echo $var; ?>; is XSS.
($var isn't escaped)
The business case employed by this companies revolves around coming up with a obscure vulnerability only they can solve and they give you a report and list of companies that they recommend your company contacting to solve them
Ok let me check
My Goodness
Hold on just a minute,let me get your something...
@objectiveME That's not necessarily true.
I've worked and have been pen-tested (oh my!) a few times.
Every time they found something they detailed the input that managed to break things and what they recommend to do.
We haven't been offered magic solutions or cyber powder to sprinkle over our application
Although those definitely exist too.
looked at your answer and in almost all vulnerbilities quoted all comeback to this package
Its employed in banking applications would you believe
Probably the worst idea ever
@MadaraUchiha Thats nice. gets a bit more complicated if someone else the code and you are just there to fix the vulnerabilities and a deadline
Look at this gem @MadaraUchiha
function sound(surl)
{
document.getElementById("NewMessageBeepHolder").innerHTML = "<embed src=\""+surl+"\" hidden=\"true\" autostart=\"true\" loop=\"false\" />";
}
08:12
@MadaraUchiha just take a can of salt and sprinkle it
@objectiveME Get that javascript code out of here
Hey am comforted to know that any app with angularjs will fail any test conducted with beyondtrust software
control + f then serach for innerHTML
@JennaSloan so hostile. D:
This world is just messed up
hahaha even jquery is on the list code.jquery.com/jquery-3.3.1.js
that is subjective
08:18
@KarelG what is
> This world is just messed up
Everything is subjective
So sorry, cosider that repharsed
consider*
Hey, am either not getting the joke here or the gravity of the matter is yet to dawn on me
Who else has had a scanning report by beyondtrust
Its also comforting that this is the standard when it comes to vulnerability scanning in almost all major web applications ;dear minions,its been real,i shall proceed and go back to hawking
@JennaSloan even data coming from measuring instruments?
NOOOO
that is my reliance. I RELIED ON THESE
DON
DON
08:56
@ItachiUchiha thank you
09:54
morn
user8622974
morn
morn
I've been in this company for 10 weeks, and I committed 41 bug fixes / new features that are now verified on production - feels good man
And today is my last day here lolz
You other humans may not see me for a while, at least you won't see me for a week. Enjoy the time
@geisterfurz007 but he also uses JavaFX :(
@Wietlol Yeah sorry. I thought it worked in general. I just saw Native applications in Java 9 and thought it might be something for you.
USM
USM
10:08
hey guys, how to consume rest json file like this:
{
  "operations" : {
    "tasks":["some-data","someother"]
  }
}
I do have to take a look at JLink and JavaPackager though
J12 might include a non-javaFx JavaPackager
@USM ask CookieMonster?
Java 11 does not even contain any javapackager ;)
true
USM
USM
@Wietlol who is
10:10
Ninja'd
> Create a simple packaging tool, based on the JavaFX javapackager tool
@geisterfurz007 slowpoke :P
@USM first of all, it isnt a file
secondly, its not rest
thirdly... consume?
need moar explanantion
USM
USM
@Wietlol json request
json object (string)
USM
USM
ok , how can i consume that
Put it in a snickers and swollow it
10:16
#define consume
USM
USM
@RequestBody OperationsModel reqBody
//define consume
user8622974
Verb: consume (third-person singular simple present consumes, present participle consuming, simple past and past participle consumed)
  1. (transitive) To use up.
  2. The power plant consumes 30 tons of coal per hour.
  3. (transitive) To use (without using up).
  4. (transitive) To eat.
  5. Baby birds consume their own weight in food each day.
(12 more not shown…)
@unknown ambiguous
USM
USM
@Wietlol .............................................
10:17
The power plant consumes 30 json objects per hour.
How does it though?
USM
USM
to make sense
U will never come to the point... u will take a while...
I want you to explain what you want
consuming json makes no sense
Well "u" is just a letter, "u" won't get anything done.
you cant consume json
you can consume a data stream
USM
USM
@Wietlol consumes = MediaType.APPLICATION_JSON_VALUE
10:19
but I dont think you want to consume at all
USM
USM
in a @RequestMapping
the server consumes the stream
and you specify the type
USM
USM
oh my god
banging my head
I believe he's being called Wietlol usually
//lmgtfy java spring request consume header
USM
USM
10:33
@Wietlol i figured it oout
USM
USM
hey wheat
I have this code
		List<String> tasksList = Arrays.asList(arry);
		logger.info("tasksList {}", tasksList);

		if (tasksList.contains("SomeData")) {

			postReq(baseUrl + SomeData);
		}
		if (tasksList.contains(SomeData1)) {

			postReq(baseUrl + SomeData1);
		}
		if (tasksList.contains(SomeData2)) {

			postReq(baseUrl + SomeData2);
		}
here i am checking "contains" , if its there then calling its post request... and i have to check more than 10 data
how can i simplify this?@Wietlol
tasksList contains [SomeData,SomeData2,SomeData3]
make a map of all instructions
Map<String, Consumer<Request>>
then loop over the taskList and get the tasks to execute
izi pizi
USM
USM
//require a magical code
user8622974
@USM Maybe you should consider looking up the manual. (//help)
USM
USM
10:40
@Alisha I will consider looking up to weedLol
user8622974
@USM How can I //help?
damn i missed the mod party yesterday
:(
huh, mod party?
oh hey vogel long time no see
hey birb
10:45
~waves
Hi guys
yeah too many mods and several 10k+ users came to java yesterday because a message got flagged
hey other birb
and 3 blue guys
that is a lot
3 outta 26 is pretty heavy, yea
10:46
@ColdFire 10k+ users?
nothing like a blue flood on the se chat server
I need to access an file xls
USM
USM
@Wietlol not so..still struggling
that I have in my web project
10:47
@Doflamingo19 ApachePOI
yep I create the file with apachepoi
it effing sucks, but it's the best you gonna get when working with EXCEL
now I need to downoad file
so I need to get the url of this file
So I need to http url in my project
you created it, right?
and you want to shove it into a response, right?
yep and I put in /src/main/resources/exportedData
10:49
the solution is to write the file into the response with appropriate headers
now I need to download with GET
@Doflamingo19 eww
you don't wanna write it to your application jar
deploying a new version of the jar results in data loss that way
if the file itself can be lost, use /tmp
if you need persistent storage, use a predefined (preferrably configurable) path
@Vogel612 which is the http url from this file?
none
Webapps shouldn't expose their root resources folder via http
you need to explicitly map the requested URL to the filesystem yourself
and I can access to this file with REST?
10:51
if your application does the mapping, yes
in my web.xml?
nah. You just expose an endpoint for downloading these files.
GET https://[hostname]/[application]/exportedData/{filename}
@ColdFire I still don't get it - "10k+ users came to java yesterday" - it's just over 4k all time users in this room........ confuse me not ayee
@Tavo You're aware of the double entendre in that one?
Zoe
Zoe
So many users owo
10:54
@unknown 10k+ reputation
Zoe
Zoe
@unknown 10k+ means 10k+ rep
Ah thank you.
@Vogel612 it's the url in the get that I don't have
ya...
you need to define it
that's the whole point
you can't just ask a server for stuff that's on it's drive
the url of resources is :
11:05
much less so if the stuff is in a zip-compressed file
it gives me 404
but the file exsists
your webserver doesn't correctly map the resources endpoint then
How did both guys join at the exact same time? Or was that just clientsided delay?
Yeah probably just lag, nvm
@Doflamingo19 I cAn'T EvEn REacH tHAt wEbsItE WtF
@unknown Constructive comments or none please, thank you.
@Vogel612 how can I map the resource to endpoint with server-mapper?
11:10
depends on the webserver you're using and the rest endpoint provider you are using
how do you map the endpoint that generated the xls in the first place to a method?
exactly that way.
you write a method that writes the requested file to the response
make sure to protect against directory-traversal attacks btw
11:23
@Doflamingo19 "xxx" is an interesting name for a folder...
3
hmmm
@JennaSloan PG-13!
SafeSearch on
"XXX is the title, not the rating."
Get your heads out of the gutters people..
Zoe
Zoe
11:47
Lol
:D Don't let Michael see that one ;)

« first day (2896 days earlier)      last day (2269 days later) »