« first day (1538 days earlier)      last day (3413 days later) » 

12:01 AM
 
How did you get a picture of @FlorianMargaine?
 
that's me every morning
although I don't get what the message is supposed to mean...
 
that baguette looks phallic lol
 
@dylpickle Welcome to the JavaScript chat! Please review the room pseudo-rules. Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
 
@CapricaSix Awesome thx and happy new year
 
12:11 AM
If anyone has any Questions on the upcoming 1.0 release of rust-lang, come here: chat.stackoverflow.com/rooms/62927/rust
 
@rlemon ps4 game for next month
inFAMOUS: First Light (PS4)
Free for PS Plus members
woot!
 
nice
got any suggestions on local mp games?
 
Hangouts?
 
Writing my first real angularjs app right now, pure one page app which generates text from a form. Each form is built up of sub-forms which are identical to the user. Any how, I am using js classes to instantiate objects which are these subforms so i dont repeat my code alot. Should i be using a seperate controller for this or a service or something other than a boring class in my main controller?
 
Code example?
 
12:18 AM
sure h/o
 //-------------------------------------------\\
  //---Specimen Class Constructor---//
  var specimen = function(){
     this.desc = '';
     this.vol =  '';
     this.cc = '';
     this.sprayfixed = true;
     this.airdried = true;
     this.lb = true;
     this.cellblock = true;
     this.dropdown = "";
     this.errorsCheck = function() {
         if (this.formvol.$valid && this.formdesc.$valid && this.ccerrorbool){
            this.errors = false;
         }
         else {
            this.errors = true;
this is just sitting in my main controller
 
Question...
 
FYI - constructors usually start with an uppercase letter
 
What's the difference between using "var x = function() {}" and "function x() {}"?
 
yea i should have done that
not sure, I just was following the angular doc examples
 
@Firedrake969 practically, hoisting
 
12:22 AM
@Firedrake969 In the first, the function doesn't have a name, and only the variable (not the assignment) is hoisted. In the second, the function is named and the whole thing is hoisted.
 
What does hoisting mean?
 
117
A: JavaScript function order: why does it matter?

ZirakEdit: For an overview which also covers some ES6 declarations (let, const): https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Scope_Cheatsheet This weird behavior depends on How you define the functions and When you call them. Here's some examples. bar(); //This won't thro...

 
Thanks
So is it feasible to always use "function x() {}" instead of the former?
 
i learned something! thx :)
 
@Firedrake969 yes, that's what I recommend
 
12:26 AM
@dylpickle That's a great place to use a service, to answer your original question.
 
Ok, awesome - that's what I always do, so I don't need to rewrite all of my code I've ever written (only 6 months' worth :P)
 
@rlemon Gang Beasts!
 
If only jQuery knew about that...
 
amazing local coop game
you can get it for free as well on moddb
well.. its local arena.. but man its hilarious its so fun
 
@SomeKittens thanks, I will give it a shot and try to figure out how to use a service here
 
12:29 AM
@SomeKittens are you on OSX?
 
yup
 
got skype?
I'd like to send you a 70MB file and have you execute it
well, I'd like to know if it executes on OSX
 
@FlorianMargaine LOL, sounds sketchy ;-p
 
@FlorianMargaine uh huh
 
want to know if a binary compiled on linux x86_64 will work on OSX... which is supposed to be x86_64 too
@SomeKittens skype handle?
delete message, I can see it
 
12:38 AM
user image
2
 
12:49 AM
@PeeHaa github.com/Ralt/pgp-ext see the roadmap :P
 
1:11 AM
I am writing a javascript library that uses Robert Penner's easing equations. Is this all I have to do to give credit?

Includes Robert Penner's Easing Functions
http://www.robertpenner.com/easing/
Copyright (c) 2001 Robert Penner
All rights reserved.
 
1:32 AM
Happy new year!!!
Have you seen pictures or wishes that are related to computer science? :)
 
2:07 AM
@SomeKittens mind if I add ya on Skype as well?
 
does anyone know the answer to my question?
 
@Progo You need the disclaimer too
 
@BenjaminGruenbaum So that's why I couldn't access GitHub yesterday!
I can access it today though. We won't stand for this. You can't ban GitHub!
Anyway, happy new year guys! =)
 
2:27 AM
@monners I'm never on...
 
Well that's not helpful
 
3:28 AM
@Meredith the part that says, "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED..."
 
Yes.
 
ok, thanks!
 
4:24 AM
sigh
anyone on?
 
what on?
 
on what? You holdin'?
 
I need to decode this website
0x0539.net
in its source, under conditions, it will post that bundle of some sort of secret code
no need to set the conditions, just take the source, replace the <br /> with \n in Rust
and get the formatted code
now, how do I solve this thing :S
 
@Apoph1s have you converted it from hex?
 
I dont think that will work
cuz it contains an 8
which hex dones thave correct?
 
4:38 AM
hex has 0-9A-F
Looks like it's a PNG
 
yeah saw the word PNG at top
and photoshop
soo
look for a hex to png converter?
halp :c
 
5:18 AM
@Apoph1s Strange problem
 
5:42 AM
Bye!
 
 
2 hours later…
8:12 AM
@darkyen00 Hahaha Diwali?! XD Happy New Year, man!
 
Happy new year
 
Happy new year everyone :)
 
user4202350
8:37 AM
@All Happy New Yeat
 
9:15 AM
Can anybody with photoshop help me
just want something rendered with transaparent background as a .png
 
@darkyen00 Okay, where's the problem?
 
i don't have photoshop xD
 
the file i got is a .psd
can u do it ?
 
I'm on linux
No photoshop
You should ask in the HTML/CSS/WebDesign room
 
9:17 AM
uh oh ^ same here
Wait omfg google
 
9:31 AM
@darkyen00 you can try online tools, pixlr.com
 
@DroidDev You should tell that to him, not me :P
 
@SecondRikudo done :)
 
@darkyen00 I can has done it
 
@Mosho email ?
abhishek@goph.me drop me a line there :->
 
done
 
9:48 AM
thanks..
 
@darkyen00 done
 
thanks
@Mosho you forgot to send the rendered file.
 
10:07 AM
@darkyen00 done
 
many thanks friend mosho
 
np comrade
 
One comment: "PHP is popular because it is good."
I so want to sign up on that site just to tell the guy how much of an idiot he is.
 
11:56 AM
@SecondRikudo i use hhvm should i be scared
 
12:26 PM
@FlorianMargaine Haha, people starred that message instead of the issue
I guess that helps too?
 
@SomeGuy yeah...
@SomeGuy not sure...
 
Well, more people might see it and star the issue
 
I guess
alright, I worked well this morning github.com/Ralt/pgp-ext/commits/master
2 last commits are refactoring
and it's "usable" on miaou
"usable" because it's fugly, not full-featured, and you need a dev environment for the native app too
but I can encrypt messages for people and see the encrypted messages people send me, automagically
anyone wanna make a logo for the extension?
 
What are they called... the thing that determines the end of a statement as ';' and linebreak?
 
semicolon?
ASI?
 
12:40 PM
Yeah, thanks :-)
According to this test it seems that ASI is faster than MSI:
http://jsperf.com/asi-versus-msi

Should one then try to adhere to ASI instead of MSI?
 
Hi all
 
Hi
 
can someone answer my question
0
Q: DatePicker [eyecon] remove no of weeks

Mubeen1992I am using eyecon Datepicker plugin. Plugin is great but i want to remove Number of weeks showing on left side. here is my code (function($){ var initLayout2 = function() { $('#date3').DatePicker({ flat: true, date: ['2009-12-28','2010-01-23'], ...

 
1:12 PM
@Mubeen1992 Have you looked at the datepicker source?
It seems like alot of work to customize that calendar. Perhaps you should look towards another calendar. I really like CLNDR
 
1:30 PM
10 Reasons why windows suck

Developers Developers Developers ... Developers

(so thats was balmer trying to convey)
 
@E.Sundin basically i need calender for booking system i think there is not anyway in 'CLNDR' to select date range
 
@SecondRikudo yay for @ircmaxell
@E.Sundin that benchmark is broken.
 
@BenjaminGruenbaum jsperf.com/nothing-vs-semis
explain that
single semi faster than no semi ?
 
@darkyen00 it's faster by the ability of it to construct these functions over and over there is no JIT.
 
weird
 
It's not weird at all...
 
2:01 PM
Now it runs as expected
 
Ahaha
Crazy test
@darkyen00 The test you linked clearly shows the benefit of minimized javascript
 
@BenjaminGruenbaum read your sentance 4th time and finally got what you meant.
 
@E.Sundin it's incorrect...
 
@E.Sundin no it does not
 
:(
 
2:03 PM
What a shocker - it's exactly the same speed if you fix the benchmark :D jsperf.com/nothing-vs-semis/2
 
@BenjaminGruenbaum Err the nothing ran slower then the single semi for me hence i was shocked.
 
really? JIT decides based on literal length of the function body? Not based on number of tokens?
 
seems so.
 
wow, that's...
 
@ircmaxell the JIT just opts out of very long functions, usually.
A long comment is a known hack to shut it down :D
 
2:05 PM
@BenjaminGruenbaum I have no problem with that at all. The definition of "long" is what I find odd
 
(I agree it's stupid, but in practice it works for them)
 
it's as if they don't even parse the function first
 
^ I read in a book that after lexical analysis comments shouldn't enter any other step.
 
They just decide it's not worth it.
@darkyen00 in a JIT? what if you .toString the function?
V8 just generates assembly, and it has a really simple heuristic that sounds dumb : don't JIT long functions - compile them with the dumb compiler.
 
@BenjaminGruenbaum makes sense :-)
i never .toString a function ... so didn't thought of it.
 
2:14 PM
@darkyen00 s/shouldn't/normally don't/
most lexers do lex comments into a token
parsers ignore those comments, as do compilers, but they are part of the token stream, available to things like reflection...
 
Ah !
makes more sense.
@FlorianMargaine I finished the first article you linked on MDN, next ?
 
2:37 PM
@ircmaxell how is your traffic looking on your blog?
 
insane
 
@darkyen00 what article?
 
mdn
 
Mdn has many articles
 
that post is #7 all time... after less than 48 hours
 
2:38 PM
i want to learn programming from scratch quest.
 
@ircmaxell can you read lisp?
 
no
 
@ircmaxell Awesome :D Proud of you bro!
 
@BenjaminGruenbaum of all the content I've written over the years, Id rather the traffic be on something more substantial
 
2:40 PM
@ircmaxell it's very substantial - it's not as smart as a lot of your stuff but it's definitely interesting to read and meaningful.
 
ya
 
Hello, sorry to break in, what post are you talking about ? :)
I've read quite a few your blog posts over the time
 
Hello
 
I only host PHP on PaaS atm so there's that :D
 
2:44 PM
@BenjaminGruenbaum that's the smart way :-D
 
@ircmaxell maintaining a server is a lot of work.
 
hence why it's the smart way
 
To be fair - we pay quite a bit of money for hosting - probably as much as we would if we just hired a guy and bought a dedicated and did it ourselves - it's just easier and friction-less this way - it's like shared hosting without all the problems with shared hosting.
 
plus you have protection in the form of a contract and SLA
you do have an SLA, right?
 
Yes, of course
Although to be fair they didn't meet their end of the bargain for the first half a year - it got a lot better since then.
 
2:50 PM
that's good :-)
 
We didn't pay for the first two years and now migrating just seems not worth it.
@ircmaxell What do you use for hosting?
Wait, you work for Google now - that's probably not an issue :P What do you use for your personal stuff?
 
I use mostly SaaS, and when I need lower level, I use Google Cloud
I used to run my own dedicated servers, but I stopped that due to lack of need and lack of time
 
Sounds familiar :)
Then again Azure runs PHP 5.5.18 under the 5.5 option :D
Functions that take callbacks for ajax completion are silly
Also, 8 more points in the BB tag for a badge :D
 
there's a bulletin-board tag? :O :P
 
Bluebird
 
3:04 PM
@BenjaminGruenbaum as long as it's a patched version, then no problem there
 
@ircmaxell Well, they run every single hosted PHP website on 5.5 through it which is a lot so I'd assume it is. Would a phpinfo help you check?
 
no
it depends on patches they applied
which that won't tell me
 
Is there any way we can check from the outside?
 
not really
 
I guess the only thing to try is to reproduce the vulnerability
 
3:07 PM
actually, check the build date
 
Build Date	Oct 15 2014 12:58:38
 
can someone pls help me to implement that in javascript... stackoverflow.com/questions/25807795/…
 
^too broad
 
?
 
@BenjaminGruenbaum yeah, so it definitely does not include the fix for the latest CVE
 
3:14 PM
@ircmaxell Awesome, someone should let Microsoft know.
 
go for it ;-)
 
i have a list of file that contain "title (year)" i need a regex that produces an array with the title and the year... in javascript. the above one is already working and so it would be nice, else if someone can pls help me to create asimple regex...
 
Run Forrest, run !
 
@ircmaxell If it's hosted on windows is the vulnerability still relevant?
 
it's a machine-code-level remote-code-execution vulnerability. So yeah :-)
 
3:16 PM
coolbeans
link to to vunlerability?
 
I wonder if PHP should let you know when your version isn't secure.
 
how would it do that?
 
When you install you optionally enter your email, it periodically checks for updates - and sends you an email if there is a problem - or something like that.
 
:-)
 
3:19 PM
There's always a problem, your inbox would be full the first day ?
 
Honestly - anything is better than not knowing you have a vulnerability on your server.
 
You installed PHP, so you know, right ?
 
A lot of php projects are low maintenance contract jobs.
@adeneo imagine if users had to opt-in to upgrade their browsers.
 
i am invited
hiii : ;D
happy new year guys
 
Happy new year random internet person.
 
3:23 PM
random internet person
hell
xd
Somebody can help me about Shell Script ?
 
No, this is the JavaScript room
 
Yes and ?
 
@BenjaminGruenbaum - automatic updates and stuff is nice, but for the last 20 years there hasn't been a single time when PHP has been even remotely secure. By the time updates are relased, the exploits are so old that most people don't even remember them anymore. Point being, you installed the shit, and it's always vulnerable, so you know you have not one, but many vulnerabilities on your server
 
i have to use javascript with shell script
 
@adeneo that's just FUD.
There is nothing inherently more insecure about PHP than RoR, or ASP.NET, or Java.
 
3:27 PM
@BenjaminGruenbaum what about the "easter egg" that can reveal the PHP version you're using?
 
You can argue about bad defaults that enable stuff like sql injections (because a lot of tutorials and the "easy" way to do sql queries is with string concatenation) but PHP powers a lot of the internet and most of the bigger guys are doing OK, heck - wordpress alone powers more than 10% of the internet.
@JanDvorak you mean the fact the server usually sends it with requests? (like IIS does with ASP.NET, or ruby does by default and all that)
 
That's true, nothing is secure, it never will be, but PHP has had some real issues over the years
 
Your PHP version is not a secret.
 
@adeneo php itself has had only a few real issues over the years
 
Hello
 
3:28 PM
@BenjaminGruenbaum "it's possible to make a good page in PHP" doesn't imply "PHP is a good language"
 
@adeneo right, most things that stuck had real issues over the years.
 
@JanDvorak been gone for a few years
@JanDvorak nobody's arguing that
 
@JanDvorak oh, I don't like PHP - I think PHP is quite a bad language. I just don't appreciate the FUD.
 
how do i write a simple regex that returns an js array
 
We can argue language semantics all day but there is nothing more or less secure about PHP.
 
3:29 PM
var r
 
!!tell cocco mdn regex
 
@ircmaxell Not true. There is an init option to disable that, but it's enabled by default and most web masters don't know about it.
 
var r=\something\ ; string.match(r)?
 
@JanDvorak who cares if you expose the php version to the outside world? How is that secret?
 
3:30 PM
now, there is still a header that exposes the version
 
Why is that a secret? seriously.
 
but the guid is not
 
match!
now how do i convert this to js regex stackoverflow.com/questions/25807795/…
 
@BenjaminGruenbaum I once worked on a project identifiying wordpress, drupal, Joomla, Plone, Apache and PHP versions even when they were configured to not expose it
 
@adeneo how did kmeans work out for you?
 
3:32 PM
@BenjaminGruenbaum still... how's that easter egg even remotely useful? The fact that it couldn't be disabled until recently is a fail by itself even if not a security hole
 
it was actually easier than you'd think
 
@BenjaminGruenbaum - of course there is nothing more or less secure about PHP, it's all about how you use the language, not the language itself, a webserver is still a webserver, and a database is still a database, but PHP has had some rather horrible built in methods that are ease to use, but not very secure
 
@ircmaxell these frameworks and languages make no attempt to hide they're there.
@JanDvorak how is it a security hole?
 
@BenjaminGruenbaum no, but they do attempt to hide they are there. Especially with plugins that are supposed to do exactly that
 
Seriously, it's just the version of php they're using.
 
3:33 PM
@BenjaminGruenbaum - I got distracted and never got any further with kmeans, going to try again next week
 
web servers that send an entirely unrelated page when a specially crafted GET request is sent and it can't even be disabled = fail
 
@BenjaminGruenbaum it's security through obscurity. Which is not reliable but can have practical effects
 
@ircmaxell I don't get the point of those plugins... security though hiding what you're running seems naive at best and bad obfuscation that makes future updates harder at the common case.
 
@BenjaminGruenbaum How does that make future updates harder?
 
@BenjaminGruenbaum yes, it is obscurity. Which cah protect against a very specific class of attacker. Which is a good thing. As long as it's not your only line of defense
hiding the version information isn't a replacement for upgrading. But it can help protect
 
3:34 PM
@ircmaxell security through obscurity is only helpful when defending against attacks that are not targeting you - and if you care at all about security you update often enough to take care of attack that aim at the general public anyway.
 
@BenjaminGruenbaum still doesn't mean obscurity has no practical impact. It does.
 
@BenjaminGruenbaum with most web hostings you can't affect when you upgrade
 
@JanDvorak I meant changing the framework to expose more/less stuff. I still don't get why hiding stuff is meaningful.
 
@BenjaminGruenbaum it makes attacks more difficult
 
@JanDvorak only with shared hosting from the early 00s, today hosting usually comes as a VPS and you get to pick the version.
@JanDvorak not for a competent attacker.
 
3:36 PM
@BenjaminGruenbaum sure it does. It won't stop a competent attacker, but it may slow them down
 
@BenjaminGruenbaum Even a competent attacker has to attempt all known vulnerabilities if he doesn't know which ones may apply to you
 
@ircmaxell only when you don't take care of other stuff - I think that often the false sense of security isn't worth it.
@JanDvorak a competent attacker would automate that.
 
defense in depth.
obscurity is a valid layer
 
@ircmaxell by how long?
 
as long as it's only a layer, and not the entire strategy
@BenjaminGruenbaum doesn't matter. Any amount of time increases your odds of detecting it, and reduces their odds of a successful attack
 
3:37 PM
@BenjaminGruenbaum by as long as it takes to rule out the irrelevant vulnerabilities. Some can take long to rule out.
 
is the change negligible? sometimes. But not always.
 
Ok, there are cases obscurity is helpful - Not sending an X-Powered-By header isn't one of those cases.
 
It sure is
 
@BenjaminGruenbaum it helps against script-kiddie class attackers
 
As soon as the attacker knows your server configuration, he knows your vulnerabilities.
 
3:40 PM
@ircmaxell you should not be exposed to those to begin with.
 
And frankly, script kiddies and other minor trolls account for 99% of potential attackers.
 
Script kiddies don't use 0-day attacks.
 
@BenjaminGruenbaum the entire point of defense-in-depth is that if you make a mistake in one layer, other layers help make up for it
so you're right, you should not be exposed to them to begin with
 
@BenjaminGruenbaum it's not a 0-day attack if you're just a cheap-ass running a webhosting that doesn't provide a VPN.
 
Look at it the other way, if you wanted to hack someone, what would be the first thing you did? Most people would probably look at headers, trying to figure out what software was running on the server, what versions etc.
 
3:41 PM
^
 
but if you make a mistake, obscuring version numbers can help prevent a certain class of attacker from coming in...
 
And if they can't find out, most of them will give up
 
Meh, if you're aiming to defend against script kiddies you're not taking security seriously enough
 
script kiddies with the right script can take down anything !
 
3:42 PM
You can as much as you want - telling someone your server is powered by Apache isn't a security hole.
 
it's not a hole
 
@adeneo if that script launches the nuclear arsenal of the US and Russia? Sure.
 
but that doesn't mean removing it can't have a practical impact on security
 
@BenjaminGruenbaum two layers of security are better than one
 
Lying about it can be kind of funny - say your server runs PHP5.1 on IIS can cause them to waste an hour or two :D
 
3:44 PM
@BenjaminGruenbaum x-powered-by = "hey, remember how PHP 5.4.2 had this and that security hole? I know PHP 5.4.3 has been out for a few days, but I'm stilll running that.
 
@BenjaminGruenbaum - I think the best way to deter people is custom messages and headers. Whenever I inspect stuff like that, scan ports or try to access a server with SSH and get some custom message back, it tells me that someone knows what their doing, and the chances of finding a flaw are slim to none
!!afk dinner
 
X-Truth: If you try to hack this server - I _will_ find you and I _will_ kill you
Quite the hacker deterrent
 
x-powered-by: someone competent. Now scram, kid.
 
X-Powered-By: Your Momma
@ircmaxell Azure team lead said they'll look into it.
 
cool :-)
@adeneo but some will see that as a challenge
 
3:49 PM
@ircmaxell adeneo is afk: dinner
 
I'd much rather give them a honeypot that they waste their time on
 
X-Powered-By: Solar power. If you want to hack me, better block out the sun
 
@ircmaxell At a point if someone made too many requests to our API they'd start getting results that were sorta correct :D
Names off by one letter, values rounded incorrectly etc
 
@BenjaminGruenbaum exactly :-)
 

« first day (1538 days earlier)      last day (3413 days later) »