« first day (1725 days earlier)      last day (3449 days later) » 

18:01
FU PHP
@ircmaxell Is that a new web framework? The FU-PHP framework?
@ircmaxell related to the fact that there's no illegal offset type for line 8?
@bwoebi no, 9 should work
18:05
oh, I see.
but because it's a dynamic property fetch, it changes how it's executed and hence is stupid
but seems fixed in 7…
private function writeKeyToArray($name, $first, $second, $value) {
	if (!$this->$name->offsetExists($first)) {
		$this->$name->offsetSet($first, []);
	}
	$array = $this->$name->offsetGet($first);
	$array[$second] = $value;
	$this->$name->offsetSet($first, $array);
	return $value;
}
user895378
> and hence is stupid
user895378
^ you could suffix that to a lot of things in php-src planet earth :)
18:10
Does 3v4l disable the eval() button for everyone or just me?
just you probably
omfg, that actually hurt ... pthreads compiles against seven ... everything is broken, but it compiles ...
@PeeHaa does that for me too - just make some whitespace change...
Oooooooh lol
I just saw it being disabled and though. BROKEN!!!!
18:21
Second attempt at a random_int polyfill. This time with exceptions and supporting the full range of inputs. @ScottArciszewski @ircmaxell @SammyK
Argh. Could we please just kill resource
if anyone changes anything, I'm going to stab them in the face @PeeHaa
hehehe
@CodesInChaos typo gist.github.com/CodesInChaos/… should be max
@CodesInChaos Could you please just add braces
Also there is no such thing as random_string
18:29
@PeeHaa return "a9i49dks02,lsje"
totally random
@PeeHaa yes, that'll have to go outside the polyfill. That'll become my answer to that password question once it gets unlocked.
Unless the random_bytes and random_int PHP7 proposal gets extended with a random_string.
It won't. At least not for 7.0
IIRC @SammyK did add it at some point, but it was removed
At least it's switching to exceptions now.
@rdlowrey Yep.
18:34
@PeeHaa Good memory! It was called random_hex and it got no love so I pulled it out. // @CodesInChaos
Ah it was actually hex. Close enough :)
I wouldn't have been a fan of random_hex either, since that's just random_bytes+hexencode.
Plus it didn't work and it would crash with random segfaults. So there's that...
@SammyK The switch to NULL when you throw an exception in C means that I need to swap RuntimeException for plain Exception in the polyfill?
@CodesInChaos Correct
I don't know if that's what will make the final build but for now we're going more general
user895378
18:45
Let me solicit opinions. How do you guys feel about PHP's global per-request file stat caching and functions like clearstatcache()? Strengths and drawbacks? Do you think it's wonderful or terrible or meh? I'm purposefully trying not to influence your opinion with my question.
user895378
Asking for a friend.
@SammyK But for argument validation you'll stay with InvalidArgumentException?
@rdlowrey There was a bug report that made a good case for disabling it entirely (which could well be your 'friend').
user895378
@Danack spoiler alert: I think it's one of the worst things about PHP.
I'm also keeping that one as a Base Exception for now since we don't want to cross pollinate with SPL. Again - this might change once a few more php internals eyeballs hit the code.
user895378
18:47
@SammyK At least the segfaults were random ... instantrimshot.com
@rdlowrey Hi-o! :D
@rdlowrey It's one of those things I don't get bitten by enough to forget WTF is going on whenever I am bitten by it
user895378
@PeeHaa my main issue with it is this weird global, unmockable behavior.
user895378
It's saying "people won't be smart enough to not hit the filesystem a million times for the same file in a php request so we cache it even though it means terrible global nonsense"
I just renamed two variables to become closer in length so I could properly align them using spaces without looking odd
user895378
18:51
@PeeHaa yes! I do this all the time!
See! I'm not crazy!
user895378
Few things give me more unexpected pleasure than unintentional using variable names that line up.
I totally know that feel
@rdlowrey Few things give me more predictable displeasure than being unable to line up variable names.
user895378
If I get three lines in a row with aligned var names pyrotechnics go off in the background and I fire up my 80s Hair Metal Playlist. If it happens on four consecutive lines I immediately run out and purchase a lottery ticket.
2
18:53
@SammyK Why the hesitation in using exceptions that have been part of PHP for a long time?
@DanLugg You're naming it wrong
It's a BC consideration. It's much easier to modify the code to throw more specific exceptions going forward without breaking existing code. But going back to more general exceptions is a BC issue.
@rdlowrey Actually I think 90% of the cases where I hit something more than once I actually don't want it to cache
@NikiC got the SSA algo implemented, just fine tuning a bug in the reduction step
Greetings guys..
Anonymous
18:56
o/
@ircmaxell The one from the paper?
I think that last time was a create file -> // do stuff -> delete file -> check if file is actually deleted thing
@NikiC yes
@ircmaxell cool :) I thought it was pretty neat
yeah, pretty easy to implement as well
18:58
I created a file in editor and wrote few code Elastic search, it executes perfect.

Now, when i create the same file with PHP, it doesnt work. it throws error.

and both files are having same type of permissions.

I am using Ubuntu.
@ircmaxell I assume you did this as a postprocessing step, rather than the approach they're suggesting (directly from ast with the sealed/filled block markers)?
Anonymous
@Rafee paste your code somewhere, also what errors?
How can i create JSON array, data coming from MySQL?
Anonymous
Json_encode ^
this is what i have so far
//Request Statment
		$result = $this->connection->query($query);

		// echo mysqli_num_rows($result) . "<br><br>";


		while($row = $result->fetch_assoc()) {
			echo json_encode($row);

		}
19:00
$a = 1;
if (1) {
	$a = $a + 1;
}
return $a;
@NikiC no, I did it directly
except I didn't seal the blocks until the end of processing as a post-step
the build up of the phi nodes is done inline
@Jay I try but i didn't get array of JSON
Block#1
    Expr_Assign
        var: Var#1<$a>
        expr: LITERAL(1)
        result: Var#2
    Stmt_JumpIf
        cond: LITERAL(1)
        if: Block#2
        else: Block#3

Block#2
    Expr_BinaryOp_Plus
        left: Var#1<$a>
        right: LITERAL(1)
        result: Var#3
    Expr_Assign
        var: Var#4<$a>
        expr: Var#3
        result: Var#5
    Stmt_Jump
        target: Block#4

Block#3
    Stmt_Jump
        target: Block#4

Block#4
	Phi<Var#6<$a>>: = [Var#4<$a>,Var#1<$a>,]
    Terminal_Return
so it is a minimal SSA
Anonymous
@BrianS I'm not the best to help here, probably someone else here but could you var_dump your Json ?
Anonymous
If so, what's the output
19:03
@ircmaxell awesome
current is sending data like this
{"id":"1","title":"","description":"","category":"","location":"","time":"","vote":"0","distance":"0"}
{"id":"2","title":"","description":"","category":"","location":"","time":"","vote":"0","distance":"0"}
@NikiC I need to refactor to extract a lot of this logic out of that "Parser" class, but so far so good...
just need to fix one test failure before committing
Anonymous
@BrianS and that's using var_dump? You don't get anything before {"id such as array or object?
@SammyK I think we should we add some explanation about random_int min/max being inclusive to the docs
19:07
@Jay it does but i trim so you can understand whats happening.
@Jay this is what i am doing..
@PeeHaa I tried to update mysql to 5.6 and php to 5.6 on new VPS, but couldnt.
Anonymous
@BrianS could you paste it again with the characters before and after please
@Rafee Why not?
I could not figure it out..
19:09
I tried restart the vps too, but the same info
@PeeHaa, what was that image related to Mysql 5.0 package stuff.
Just a subtle reminder that saying that an error is thrown without telling us what the error is is pretty much useless ;)
Figure it out thanks
@PeeHaa Will do!
ah!
Anonymous
@BrianS no worries :)
19:14
@SammyK ty
@NikiC pushed
3.3.7, 3.6.5, and 3.7.3 released: fix for SSL certificate validation (cURL was unaffected): http://hhvm.com/blog/9773/cve-2015-4663 (thanks to @ircmaxell)
> As a reminder, most HHVM releases are supported for 8 weeks
Holy cow
@ircmaxell \o/
@ircmaxell yay
yup, got a bug bounty out of it as well
how did you find it?
Accident or looking for it?
19:21
was talking with Fred about another problem, and I was like "yeah, it's a good thing you're doing peer verification or this would be doubly bad". Then I was like "you are doing peer verification, right?". Then I looked into the code and was like "nope"
4
@ircmaxell eek
PHP is only doing peer verification since 5.6, right?
yes
well, by default anyway
user895378
@ircmaxell jeesy chreesy, for serious?
user895378
lol, guess you can tell I've never once used HHVM.
yeah. The exchange with the devs was awesome, but the exchange with the bug bounty was funny
they rejected it the first time saying "no proof-of-concept, no bug"
user895378
19:25
@ircmaxell omg, haha
my reply was funny... let me dig it up
This is massively exploitable. To demonstrate this, look at this POC script:

<?php
$socket = stream_socket_client("tls://tv.eurosport.com:443");
fwrite($socket, "GET / HTTP/1.0\r\nHOST: facebook.com\r\nACCEPT: */*\r\n\r\n");
echo stream_get_contents($socket);

In this example, two things happen that shouldn't. First, the connection to tv.eurosport.com is created and opened. This should be blocked by peer verification which would reject the connection request, because the certificate presented isn't valid . This is what should happen. HHVM (and hence all of Facebook's infrastructure) does n
@ircmaxell github.com/ircmaxell/php-cfg/blob/master/lib/PHPCfg/… This is because overloaded ops suck at nested issets?
@ircmaxell sigh
19:28
some of that isn't the prettiest, but I wanted to get it to run before I went through and refactored
I saw someone using register_shutdown_function to start an event loop. This seems bad, but I'm not exactly sure why. Anyone have some insight?
It looks like tick functions are no longer invoked, but other than that...
user895378
@Trowski law of least surprise, for one.
user895378
Also, if an exception goes uncaught no other shutdown functions are called which might be undesirable.
Yeah, it seemed like a lot of work to avoid calling run(), lol
user895378
Alternatively -- and I wouldn't recommend this to anyone ever -- one might use php.net/manual/en/ini.core.php#ini.auto-append-file
19:32
@rdlowrey
user895378
@bwoebi ikr. Why is that even a thing?
@rdlowrey Eww... no, bad!
user895378
It's a terrible idea
That's going on my list right next to the mbstring replacement setting.
user895378
yeah ... the joys of php.ini
user895378
19:33
PHP: The Bad Parts
user895378
Hmm ... would it be a horrible idea if PHP auto executed a __main() function if it exists in the global namespace?
yes.
Anonymous
@ircmaxell You mentioned in a blog post a while back that you enjoy teaching etc... Just wondering if you've ever done or thinking of doing online courses/tutoring?
I've considered it
user895378
Yes. It would be a horrible idea. Pretend I didn't say that.
19:39
@rdlowrey You could emulate that... but I don't see the point.
user895378
Yeah magic is magic. No reason why you can't have a single line invoking it explicitly.
@ircmaxell Why do you run another removeTrivialPhi pass at the end?
@NikiC I'm not sure. I think it was in case I sealed a block earlier (inline)
but it may just be a remnant from an earlier algorithm
@CodesInChaos I believe @ScottArciszewski is planning on offering this polyfill
Anonymous
@ircmaxell I'm suppose it would take up a lot of time
19:47
@SammyK Are you planning on having $min > $max throw?
@Jay yeah, that's the problem right now, but with luck that will change slightly ;-)
@Trowski I'd prefer if ($a < $b) list($a, $b) = [$b, $a];
Anonymous
@ircmaxell fingers crossed :)
@bwoebi I wouldn't
@bwoebi E_MAGIC
19:49
(and I wish we finally would have [$a, $b] = ...; to be equivalent to list($a, $b) = ...;)
@bwoebi that's going to make my CFG life difficult
then again, it's difficult already
@ircmaxell why?
@bwoebi Any technical reason it can't be done?
@bwoebi because I can't just look at the array to see if the variables are read vars or write vars
@Trowski not that it'd be aware of.
@ircmaxell you just have to look if it's rhs or lhs?
19:50
if it's an assignment context or not
Something we could consider for 7.1 then. I'd like that syntax.
@ircmaxell yes, but that you can solve at parsing level?
You still can internally make a difference
user895378
@ircmaxell I know I shouldn't be asking this question because I hate when people do it to me, but do you have any vague nebulous guestimate for when all your compilation work might reach a place where it's usable at a mass-market level?
19:52
@rdlowrey not sure. Depends on when I can find time. Likely not for a while...
@Trowski Yep! Just post a PR for it.
@rdlowrey do you want something specific? I could adjust priorities...
@SammyK nit: these should be errors, not exceptions.
user895378
@ircmaxell no thank you sir, nothing specific in mind. I was just genuinely interested :)
@bwoebi Yeah, there doesn't seem to be very clear consensus on that one. I can see the benefit of both I suppose.
19:55
@rdlowrey well, soon I'll be able to do some more work on them ;-)
@SammyK I was just going to say what @bwoebi said: Should be an Error.
user895378
An Error or an error?
God that ^
user895378
lol ... I knew this day was coming
See what you did @Trowski!!!!
:P
19:57
HAH
CURSES!
An Error :)
Errors are nice, no?
Honestly I think it could even be an E_ERROR instead of an E_WARNING due the the cryptographic nature of it. Do you think so @ircmaxell?
Since E_ERROR doesn't really exist (in most circumstances), generally I think error will mean a thrown Error.
19:59
@SammyK explain the situation?
@ircmaxell How to tweak the CSPRNG's
exception
it's not truely fatal, hence shouldn't be fatal
I have to run, I'll catch ya later
@ircmaxell You mean error ;)
@SammyK Whoa, random_bytes just issues a warning and returns "Minimum value must be less than or equal to the maximum value"
@ircmaxell Thanks - see ya! :)
20:00
That I don't like.
@Trowski Yeah, that's gonna get fixed. :)
Oh, ok... I thought that was merged already.
@SammyK not sure if you have karma to push? // or is there any other reason why PR?
hi everybody
can you please help me about this quesiton
-1
Q: What is the Maximum number of files that can be upload

Shaiful IslamI can see max_file_uploads=100 at my phpinfo. I want to upload near about 100 files together.But I see it does not post more that 25 file inputs. For test I made following script <form action="filecheck.php" method="post" enctype="multipart/form-data"> <?php for($i=1;$i<=100...

@bwoebi I wouldn't trust myself with push. :) But I'd also rather have lots of eyeballs on it before it gets merged in.
20:04
Wow 100 uploads that is probably going to be sucky :P
i know
but client requirements
but I got starnge problem
at my live server only 25 file request sent
@ShaifulIslam Did you check phpinfo() to see what values are live?
but 100 text input reqest sent correctly
yes
i asked my service providers
they dont know why it happens
@ShaifulIslam text !== file
20:05
@ShaifulIslam they? Who are they? nvm
hosting service providers
Did you check the values yourself?
yes
i can give you link
sure
20:07
Oh wait
2nd link is testing
You get errors back
> [error] => 4
oh
i told i just added 1st and 100th file
> UPLOAD_ERR_NO_FILE
Value: 4; No file was uploaded.
so others must be error
20:08
Only god knows why that would be an error, but mkay
but strange it works my local
@NikiC Any reason TypeError is thrown with a E_ERROR for the code? Or should that be 0 as well?
@Trowski yes
@Trowski sorry i could not understand you
@ShaifulIslam Have you enabled error reporting?
20:09
yes
@NikiC Ok, will change. ParseError is thrown with E_PARSE, but that makes sense I suppose.
@Trowski nope, that should also be 0
Is there any reason why function %s expects at least %d parameters, %d given is still an E_WARNING and not an Error?
@bwoebi phpdbg ^C ^D do not work
@NikiC ^D ? What's ^D supposed to do in phpdbg?
20:11
exit it
sigint is caught in phpdbg (just like in gdb)
@bwoebi nope
@ShaifulIslam are you running suhosin?
let me test…
I forgot the -p once but ^C doesn't exit it
20:12
not sure
0
A: What is the Maximum number of files that can be upload

PeeHaaYou are running suhosin which limits it to 25: suhosin.upload.max_uploads 25 25

@NikiC no, ^C doesn't exit it, intentionally. ^C halts a running program and starts interactive mode
i have to ask it
You don't have to. I see it in your phpinfo ;)
So I can change it?
20:14
Yes. But not in your php.ini, but in the suhosin config
@bwoebi right sorry. ^D should exit
ok I will ask my service provider if they can it for me
@NikiC ^D is EOF to stdin, right?
@bwoebi I think so
@bwoebi The liveliness patch is great for finding bugs in unrelated code ... just found a new leak while testing ^^
@NikiC Yeah, I think I found two unrelated leaks/crashes while testing liveliness ^^
20:18
@PeeHaa thanks a lot.
give me 1 day
I will accept your answer
@ShaifulIslam np
@SammyK hey you just spoke at a meetup I was at last Wednesday, thanks
@Pitchinnate Small world! Hi! :)
afternoon everyone
@NikiC for me ^D quits phpdbg
lxr.php.net/xref/PHP_TRUNK/sapi/phpdbg/phpdbg_io.c#90 … what are you getting in bytes variable if you break there? and then press ctrl+d while running?
20:25
yeah for sure
@ScottArciszewski are you scottchiefbaker on GitHub?
Lol - I didn't think so
My two github usernames are sarciszewski and paragonie-scott
Thanks
@bwoebi Code is never reached
@NikiC well, is it this lxr.php.net/xref/PHP_TRUNK/sapi/phpdbg/phpdbg_io.c#188 read() call where you're doing the read or is it somewhere else?
(just to be sure)
@bwoebi phpdbg_cmd.c:728
ah, readline
yeah, indeed no handling for eof here
20:43
@SammyK That pull request only handles RNG failures, but not argument validation.
@NikiC fixed now?
@CodesInChaos Indeed. There's another one for that. :)
Laravel many to many relationship not working for me.
@bwoebi nope, still just generates a new prompt
@NikiC how so? I'm testing for feof() now?!
20:54
@bwoebi dunno
@bwoebi I don't get why you're checking there for feof() anyways
if readline returns NULL, that's the EOF
there shouldn't be the need for an additional check
@NikiC not sure, but doesn't it return NULL on EINTR too?
@bwoebi Hard to see what's going on with sigint in gdb, but I think the answer is no
eintr also includes e.g. SIGIO
The docs only mention returning null on eof
not that that means much, of course :D
Meh, I'm going to install a linux VM now :s
21:05
@bwoebi See you were still on windows since the last debugging session :P
Hi all
Hey taco
hey again @PeeHaa
@PeeHaa nah, my os x just somehow doesn't like self-built readline/libedit
/me boos at @bwoebi's osx
21:12
It's probably just E_PEBKAC^^
@bwoebi Never attribute to PEBKAC what you can also blame on others!
@NikiC Oh, well. I meant the problem exists between behind the keyboard and behind my chair… so basically the whole world, just not me :-)
Coming from a support role, I hated when my co-workers wrote something off as PEBCAK. They inevitably would call back and it'd not be PEBCAK
@NikiC Any reason that you read the code from the thrown ParseError rather than using E_PARSE instead? lxr.php.net/xref/PHP_TRUNK/Zend/zend_exceptions.c#970
21:28
@NikiC Did you see the PVS analyzer warnings?
One thing I didn't verify: is that on master or 5.6?
@Trowski nope, it's just a leftover
From back when the exceptions weren't displayed as exceptions yet
user1804599
@rightfold hmh. No idea what to say about that.
22:02
TIL that a math heavy class and strict types are not compatible
Uhhhhmmm is this correct? I would (perhaps naively) assume PHP just hands over the mv command to the OS?
@PeeHaa I don't think he understands how a rename works...
@MadaraUchiha why do you think, that it applies only to me ?
22:20
@bwoebi "Well, in case of power failure such things are always possible…" Actually ... what guarantees does linux provide in that case?
@NikiC Good. Thought so
@NikiC basically… no idea.
/me is tempted to pull the plug
One block is written and one block isn't.
@Wesley: No, there will be no partial file. If the system stays up (e.g., you hit ctrl-C), it will be removed automatically. If not (e.g., power loss), the partial file may be left somewhere inaccessible on the destination disk, but should be cleaned up by the next fsck (which will most likely run automatically on reboot, since the disk wasn't unmounted cleanly). — Dave Sherohman Mar 18 '11 at 12:42
Makes sense
Night all
22:41
gn8
 
1 hour later…
23:47
Which ORM do you use?
@SammyK @CodesInChaos github.com/paragonie/random_compat/issues/4 - any thoughts on better randomness tests? :)
setting up a Linux vm is fun…
(especially if you fuck something upp^^)

« first day (1725 days earlier)      last day (3449 days later) »