« first day (2741 days earlier)      last day (2430 days later) » 

08:00
Aha Oracle
that explains it.
08:20
morn
someone explain that to me? :D
Oracle owns the trademark to Javascript
oh lol
well we already knew that, no?
I mean, we all know the name JAVAscript comes from Oracle's Java
> For: providing computer programs, namely, utility programs, language processors and interpreters, that may be downloaded from a global computer network
Hi 👋
I am planning to build React Native offlin dictionary which contain more than 200,000 words in it.
Does SQLite can manage this much data or Would you suggest best library for storing all these data ?
@david sure, cause we, europeans, weren't sleeping by that time
offline and SQL don't look very compatible
08:37
@Neoares Nothing wrong with sqlite
@Neoares sqlite is basically a file
@Muhammed I'd be very surprised if SQLite would not be able to handle that
supposing you had 200,000 words at 10 bytes per word (assuming varchar), we'd be talking about 1.9 GB of space
that's not that bad for a database
are you storing that in the client?
> A manager, a mechanical engineer, and software analyst are driving back from convention through the mountains. Suddenly, as they crest a hill, the brakes on the car go out and they fly careening down the mountain. After scraping against numerous guardrails, they come to a stop in the ditch. Everyone gets out of the car to assess the damage.
The manager says, "Let's form a group to collaborate ideas on how we can solve this issue." The mechanical engineer suggests, "We should disassemble the car and analyze each part for failure."
btw, 200,000 * 10 bytes is 2M
08:46
hehehe
lol
@Neil Do you even maff
hi all
oh
maff
lol
08:52
quick maffs
no ketchup
meth
smoke trees
erryday on the block
yeah, he smokes big trees
2+2=4-1=3 QUICK MAFF
08:53
check da statistecs
everyday on the BLOCKJJJJJJJ
I weep for my country
I truly love your country
@GNi33 look at this graph
I love the british accent
hehe
@Neoares which one?
08:54
hey guys, do u think wrapping redis calls under try catch is a overkill ?
idk... the british one? xD
not the cockney
wait, how did I mess that up that calculation?
I mean compared to murican
I like scouse
@Prakhar Are you using async/await?
08:55
@Neil u smoked some trees
@GNi33 I used to make offline dictionary in ionic with sqlite. unfortunately the search query took around 9 second to get response :-(
Ah, should have divided by 1024 once more
noob
@Neil wait what
why were you dividing?
200,000 times 10 is 2 million
2 million bytes = 2 mega bytes
@Neil what
literally just add an 0
08:56
yeah, dude wtf
seriously, stop smoking trees in the morning
well 10 bytes, you multiply 200,000 by 10
he's international now, fam
@Neoares Yah, planning to make an offline app
oooh he fucked up cause he was doing the "realistic" conversion
that's why he said 1.9 instead of 2
he tried to show off, but forgot quick math lessons
@BenFortune a lottery game was removed from sale because lots of british people were not capable to determine which one of two negative values are the highest.
09:02
I did the meth
so ur country needs "moar mafff"
1 MiB = ~1.05 MB
anyone else can describe why Stack-Tree-Descendants is faster than Tree-Merge-Joins, I really cant understand about this......
@BenFortune yes. promisified the methods, and using async await
09:10
I wouldn't say it's overkill, depends on the flow of your application
A utility method wouldn't go amiss
I am having doubt regarding support charges from envato market? shall i ask in this place?
Probably not
okay @BenFortune
I am having doubt regarding support charges, whether we will charged $11.25 for every sales for next 6 months or only $11.25 for the next 6 months.
@Neoares Hahaha damn that was well done.
@IvinRaj Maybe you should ask Envato's support.
09:18
I can't believe it was made this way ....
okay @BenFortune
@RoyiNamir fake
Thanks ben. i'll wrap it in another async func with try catch and return some value under catch that can be identified as error.
@royi and ancient
yeah, that's not how they filmed that
@Prakhar not to me.
yeah... I see now that it's a fake
09:21
@RoyiNamir looks so fake
why would they print the same thing but reversed in the backend?
@New_2_Code indeed xD
Transparent maybe ? it could be an option
The image from wiki seems real but I don't think the lion just stood there...
lol
they have used a circus lion
Who just stood there ??
then put a frame in front of him
scary...
09:24
those animals are kinda tamed if they're fed and threatened well
@KarelG Just like developers.
RAAARWWWRRR
agree
grabs doritos
09:26
Developer is the most self-disappointing. You work in Hi-tech , but you make someone else's fortune...
Ah, the ol' reacher round
> reacher
wot?
He meant richer
but this is not the first time someone says it
(Richer) sorry
I never said it's mine. sure it has been said before. but it is something whcih I think about a lot.
09:28
> myne
myne ayes
What do you return from a function that can return value or no value ? null or undefined ? it seems that there are many discussion around this topic but still I find it interesting...
0
or null, or -1
it doesn't matter
but not undefined
why not ?
0 could be a value
because it's not defined
09:36
you don't check if function return by truthy /falsy
I do, sometimes
undefined doesn't mean absent.. null means absent
if you see undefined returned from a function, it's probably because something went wrong
I disagree. say I want to get a property from an object , via function foo(prop){} then if I try to get something which doesn't exists , I should get undefined
not null
let o={}
o.f //undefined
then just return o.f
it will return undefined if it is undefined
so it does return undefined.
according to what you've said , I should return null
09:40
yes, but you're not returning a hardcoded "undefined"
*unless i don't follow you)
I said you should not return a hardcoded undefined
^that's for sure
if you're returning a property, it sometimes will be undefined
you can not do anything
just check it on the other side
except you want to check for "undefined" in every single return statement
return variable || false
maybe that does the trick, but I'm not sure
that'd fail for 0, for example
10:00
@BenFortune WTF
Right?
@BenjaminGruenbaum Do i want to click that link? What is it about?
@RoyiNamir null and undefined are fundamentally different but I personally hate functions that sometimes return stuff
What's the use case?
@New_2_Code it's just the Oracle trademark for JavaScript which I presumed expired but apparently did not - funny.
Let's go a step back, why would the property not be there?
@BenjaminGruenbaum Aah cool. I remember reading something about that.
10:20
@BenFortune WTF
why is everyone so wtfd
@Neoares WTF
didn't you know? It's wtf wednesday
wtfdnesday?
10:24
No.
Why.
while trying to use react-native fetch, i am getting an error "network request failed".

People suggesting to change the url to ip address to solve the issue. I am using virtual host. so how am i to solve this issue now?

my url is http://example.local/api/
10:39
@masud_moni on iOS?
There is a setting required in order to make http (not s) requests
@BenjaminGruenbaum no android emulator nexus_6
Does the URL open from the emulator itself in Chrome?
Maybe there is a DNS configuration issue on the emulator
let me check...on the chrome of the emulator right?
just did a massive git cleanup: removed 53 branches.
@BenjaminGruenbaum it says the site cant be reached
where can i set the DNS server?
10:44
Do I look like Google?
I'd like to apologize if I communicated that it's appropriate to ask questions without research here - that is not the case.
@BenjaminGruenbaum hahaha...you surely not..
@BenjaminGruenbaum @rlemon
just a hint will do
@Zirak this is cool, did anything with it?
10:49
@BenjaminGruenbaum now that I know about it, yeah
super useful for us @Zirak
@BenjaminGruenbaum benchmarking, or iptables replacement?
I've had a system with like 1k rules and it was shit
Nothing on UDP though
@Zirak benchmarking the behavior of Peer5, which we do quite a lot of
to a non-js programmer, how many of this is already "outdated" (as in, its 2018, you dont dare to use that lib/framework/tool/w/e)
in C#, yesterday, by Avner Shahar-Kashtan
https://hackernoon.com/how-it-feels-to-learn-javascript-in-2016-d3a717dd577f
11:01
Looking at the network stack and figuring stuff about it - in general terms, I can go into very specific things when/if you come work here at some point :P
@BenjaminGruenbaum cool
@Wietlol almost nothing, the JS ecosystem isn't really moving fast at all
it's growing, but horizontally, the frontend stack in 2015 is still the stack today, it's still Webpack + React/Vue/Angular + TypeScript/Babel mostly - it's just more stable now.
Angular is not beta like it was back then, React has changed the API very little without breaking anything (yet) and Vue got a lot more mature.
Oh, and there is no need to use SystemJS really, most of the stuff is automatic
user image
2
@KendallFrey @rlemon @Loktar
i thought VueJs for example was kinda hated on here atm
Naa, it's towc that is hated and he likes Vue
11:04
i see
I must say that my life is much easier
I use kotlin-js and built a js file :D
@Wietlol that sounds very scary, also I'm not sure why you'd use Kotlin for it
kotlin js?
oh dear
11:19
@BenFortune That's gotta be the ST. Seeing one, even with the camo, in that environment, I'm warming up to the new look way more.
It looks so nice dude
11:31
Are you in a nice focus ben?
He was eyeballing a Vauxhall until Ford decided to tempt him with the new Focus line they're cutting loose lol
At least, that's where I'm at in Season 1 of "Ben Wants To Buy a Hatchback"
Isn't it better to let a server not respond anything instead of a forbidden message when a non authorized server tries to connect?
are there plenty cars from Vauxhall in UK?
I know Opel from it
@paul23 no
@paul23 That's just going to make it harder for your legitimate use cases
Ford, you're turning into a penguin. Stop it.
11:40
When creating temporary urls to further prevent access it also doesn't show the server layout.
Security by obscurity is not security
This combined with sending custom responses instead of http status codes would make standard attacks useless.
It's fun, if you have real security behind it
The only case where 404 instead of 403 is appropriate is when you don't want to reveal whether a resource exists.
Security by obscurity, and also by security.
11:41
@OliverSalzburg It is if the obscurity changes fast enough. - A password in the end also just "obscures" it if you give someone infinite time to brute force it.
e.g. a private repo https://github.com/uk-government/mass-surveillance-tool - you wouldn't want to reveal even the existence of such a repo to the public ;)
That example sucks
@ThiefMaster that's what I mean, I'd create temporary urls that only a trusted client would be told.
Of course there's also the normal security of encryption and credentials.
But I'm thinking about for example "testing the waters" by sending a lot of useless data to see the default connection speed. Then if I send sensitive data at a later point I can also check the return speed, if it isn't as fast as "expected" I stop trusting the connection due to someone who might be tampering with it.
@ThiefMaster that goes for most things
unless every endpoint requires auth, you should 404 first
So when my session expires, I have no way of knowing that from the client-side, because it just looks like someone deleted the repo
11:46
@paul23 that absurd, speed varies by the minute
And I do that, because security
@OliverSalzburg that's not really a problem. All of the session endpoints require auth, so those can 403.
@ssube You'd use a statistical average.. How else can I check if data isn't send through a government influenced pc?
But your buckets or repos or what-have-you should always prefer to stay hidden if somebody comes calling without access.
@paul23 you... can't, that's entirely impossible
@ssube So, whenever you hit a 404, you try to authenticate again?
11:47
how will measuring line speed detect a USB keylogger?
@OliverSalzburg no, why would you? You know whether the session is good or not.
How do I know that without revalidating it?
It's not meant for that: it's meant to measure if someone has tampered (or even read it) with the data between "being send from the user" and "received by server".
You have to validate it to know that it's valid...
@paul23 that's called TLS
Right. And if a request is responded to with appropriate status codes, you get that with every request
@OliverSalzburg every request has to validate auth anyway
I'm not sure what you mean, there's no difference to the client
11:49
@ssube Right and then it responds with a 404, because you're not authenticated
I thought that's the topic
if you request a resource (a concrete resource, like a user record or repo) that you aren't allowed to see (because of no/limited auth), then yes
With TLS the header data is still visible right? - I have to create it so that if a client uses our application in a foreign country that country's government can't notice that the client is actually using our application nor can it notice that it sends data to us. - Actually the "times of sending" are important to protect.
@paul23 that's called a VPN
Well last I heard those don't work too well nowadays.
@paul23 Well you have to trust the one providing that service of course
11:52
@OliverSalzburg the 404-before-403 only applies to resources where the name leaks some information. Things like /session/validate would prefer the 403, unless you don't pass a session.
@paul23 really?
@BenjaminGruenbaum why scary?
the reason why I want to use kotlin is basically because of how nice the language is
Yes, the government has actually warned that "even vpns aren't safe enough when going to X, always send data only through physical mediums when you do business in X".
lol, physical is about the least secure you can get
like Neil said, if you trust the VPN provider (ideally yourself), there's no downside
physical in "keep the data with you till you return home".
and "only take a fully cleaned/new computer to that country, never take sensitive data with you".
@ssube Well, I experimented with an approach where we would respond 404 instead of 403 and it was just plain stupid. Everyone is entitled to make their own mistakes, I'm just saying right now that it's not worth it and if you're scared of leaking the existence of a resource, then "hiding" it in this fashion is not the solution
11:54
@paul23 the US of A?
@OliverSalzburg how was it stupid? It's a very widely used method of not advertising data.
@GNi33 I live in the Netherlands if that would be your question.
Checking and returning a 404/403 to unauthenticated users is giving them an endpoint to enumerate.
Cutting down the street signs will not stop someone from breaking into you house. It will only prevent legitimate visitors from finding you
So what? Let them enumerate
Why offer them that data?
That's an intentional hole you've added to your security.
11:56
@OliverSalzburg That is because one can still find the streets. There are infinite number of end points possible, and a random string endpoint is just as hard to find as a random password.
You don't put a list on the outside of a safe with the contents.
@hilli_micha Circumstances have changed, going car shopping tomorrow
offer them data that an endpoint exists but that they arent allowed to view it?
@paul23 how about encrypting the data?
My current car is fucked beyond repair
11:57
or what am I missing here?
@GNi33 "In addition...."
why though?
scared of them torturing you for the private key?
@ssube With token-based authentication, every endpoint is an authentication endpoint. Not being able to distinguish between 403 and 404 is an issue and security is not provided by hiding resources like this
@OliverSalzburg If you're passing a (valid) token, it's not an issue.
I'm suggesting that you validate the token before checking whether the resource exists, which is a best practice against timing attacks and a few others.
in simple terms, if a hacker knows the entire architecture, encryption algorithms and token bindings, he should still not be able to break into your services and do whatever he wants
that is secure
11:59
If the token fails, you can immediately error out, rather than giving them a chance to list your repos/endpoints.
Obviously we check validity of credentials before looking up the resource
@Wietlol ^++
I feel like I mentioned this before, but, for the case where the token is no longer valid and I receive my 404, what now?
@ssube uh, shouldn't you always add some "random wait" when you fail early due to authentication problems? - You know to prevent the attack when a person can pick a lock by just checking the time your cpu/server is busy handling the request?
redirect to login screen?
12:00
How do I know that I need to get a new token and that the resource still exists?
8 mins ago, by ssube
@OliverSalzburg the 404-before-403 only applies to resources where the name leaks some information. Things like /session/validate would prefer the 403, unless you don't pass a session.
@paul23 "random wait" as in "tie up a connection and response thread for some large amount of idle time"? no thanks
@ssube Roughly same as a normal response would take.
you can handle it better by validating first and failing consistently
well to be fair, maybe you would return 403, and only 404 once authorization prerequisite has been met
@paul23 so it has to vary based on time of day, server load, which server is being used, etc? also no thanks
12:02
@Neil With a 404 on an API call?
@Neil the point is that you should return one or the other
if you mix them, you're leaking data before validating auth
@ssube If the token is invalid, the server doesn't even consider the actual request
it rarely makes sense to return a blanket 403 (a single public repo breaks that), so a blanket 404 makes more sense
if the token is valid, then you can reveal that the path was wrong or whatever
@Neil sure it does, to check the token
12:04
@Neil And then a malifide person knows that the business uses "Users" "cars" "add-user-to-car" functions: and the bad party can use that to get a rough idea how a business works.
@paul23 No, because you're returning 403 for every bad request with invalid token
if you have a git(hub/lab) server with /repos/private and /repos/public, and I ask for public first and get a 200, if I ask for private and get a 403, it's a safe bet that I'm asking for a valid endpoint
if I get a 404, I have no idea whether the name is valid
@Neil You'd also return a 403 for a page that "simply doesn't exist"?
returning a 403, in HTTP semantics, means "this would be fine but not for you"
@paul23 Yeah, otherwise you're giving away information about internal API without authorization
12:06
@paul23 you have to be consistent
the subtlety comes in whether 403 or 404 is most consistent
Well in that case isn't it wouldn't really matter.
if some endpoints are public, you no longer have a blanket 404, and that is the heart of my argument
Both 403 or 404 would do the same, it's just a number in the end.
12:07
the public endpoints should be known. nobody is going to be testing the server until he finds the public endpoint to login
418 all the things
It's up to the client anyways to react on it, so why not use a different number?
Boils down to: have a black box around the entire server or a black box around the security-sensitive area
tbh the only wrong way to do it is redacting words one-by-one
As you are likely aware, Oracle owns US Trademark Registration No. 2416017 for JAVASCRIPT. This chatroom prominently displays JAVASCRIPT without authorization from our client. The unauthorized display of our client's intellectual property is likely to cause consumers encountering this app to mistakenly believe that it emanates from, or is provided under a license from, Oracle.

Use of our client's trademark in such a manner constitutes trademark infringement in violation of the Lanham Act. 15 U.S.C. § 1125(a)(1)(A). In order to prevent further consumer confusion and infringement of our clie
12:11
@ssube yea, that's some bullshit
@MikeTheLiar that's a patent for refrigerators m8
the govt websites to look these things up are awful
not even going to try looking up trademarks
Shit I fucked up the copy pasta. It's still referencing app in at least one spot.
I have brought shame upon my ancestors.
@ssube I have the strong believe that is done on purpose; to prevent just anyone from filing patent registrations.
The patent system is broken
imho they need to seriously rethink it
ha, the patent and trademark searches are the same site
12:14
@ssube convenience!
shit son
@rlemon some 14+ hours a day.... Call it dedication?
addiction
me when I first got Diablo II
17+ hours a day..
That's like a perfect day: half an hour to eat/go to bathroom; 6 hours sleep.
12:38
@rlemon not available in my country
that's a shame
I'm not even german nor russian
WHY
the rain
Good afternoon humans,
I've been trying to play with custom elements in html.
Tried to create a custom element to act like a listbox
Example: https://jsfiddle.net/br9a61uj/

However as you can see a method in for the element is not available....
It is in the prototype of the element, not in the element itselves, the method can be used if it's coming from a clicked element, anyone any idea why/how to fix it?
It's the first time playing with custom elements btw and I am more of a back-ender than a front-ender
@GNi33 I loved that game
12:45
yeah, still do
My "goto" strat was meteor sorceress
@MikeM. I've never fucked with custom elements, but if you add a log you can see that the first item is your custom element, the second is not
and it errors on the second
console.log(tmpItem.constructor.name);
Ye I did that before, but it's quite a weird behavior
figure out why that is, and problem solved.
Ye but I can't seem to see the issue haha, it might be the way custom elements are being handled?
12:49
nope, you are calling a non existing function
I don't know enough about custom elements to tell you why it is, I just know how it do.
The method exists in the dom document property list of chrome tho'
@rlemon Me sado :'( haha
I think I forgot to put on deodorant today :(
this happens too often
Did anyone ask "Why do I smell onions in here?" today?
@MikeM. Well you did, technically. Just now
12:57
@JonClements neat
oh, sorry. that was rhetorical, wasn't it? ._.
deleting the room kicks me, but history back lets me see the deleted room
@rlemon huh?
I was in the room you just deleted.
yeah... I know :)
12:58
deleting the room auto brings me to the all rooms page.
hitting the history back button on the browser lets me see the deleted room still
Yeah... deletion mass kicks the room
Yup... because you've got a link and are 10k
neat, I've never had a link to a deleted room :P
not useful, just neat.

« first day (2741 days earlier)      last day (2430 days later) »