| 01:14.53 | *** join/#ldstech Zygo (startkeylo@startkeylogger.hungrycats.org) |
| 01:31.44 | *** join/#ldstech tdeforest (~tdeforest@cpe-74-78-85-69.maine.res.rr.com) |
| 01:31.44 | *** mode/#ldstech [+o tdeforest] by ChanServ |
| 03:57.43 | *** join/#ldstech josephscott (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 04:38.18 | *** join/#ldstech Zygo (startkeylo@startkeylogger.hungrycats.org) |
| 05:38.32 | *** join/#ldstech sshaw (~decriptor@53.250.sfcn.org) |
| 12:51.57 | *** join/#ldstech tdeforest (~tdeforest@cpe-74-78-85-69.maine.res.rr.com) |
| 12:51.57 | *** mode/#ldstech [+o tdeforest] by ChanServ |
| 14:21.06 | *** join/#ldstech josephscott (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 15:04.54 | *** join/#ldstech sshaw (~decriptor@137.65.132.52) |
| 15:16.00 | *** join/#ldstech TimRiker (~TimRiker@bzflag/projectlead/TimRiker) |
| 15:16.00 | *** mode/#ldstech [+o TimRiker] by ChanServ |
| 15:53.08 | *** join/#ldstech TimRiker (~TimRiker@bzflag/projectlead/TimRiker) |
| 15:53.08 | *** mode/#ldstech [+o TimRiker] by ChanServ |
| 16:29.56 | *** join/#ldstech mastergunns (~mastergun@216.49.181.128) |
| 17:15.56 | *** join/#ldstech mastergunns (~mastergun@216.49.181.128) |
| 17:28.54 | *** join/#ldstech wally (d831b5fe@gateway/web/freenode/ip.216.49.181.254) |
| 18:40.31 | *** join/#ldstech LDSTech (~TimRiker@216.49.181.128) |
| 18:46.43 | *** part/#ldstech TimRiker (~TimRiker@bzflag/projectlead/TimRiker) |
| 18:46.57 | *** join/#ldstech TimRiker (~TimRiker@bzflag/projectlead/TimRiker) |
| 18:46.57 | *** mode/#ldstech [+o TimRiker] by ChanServ |
| 19:52.34 | *** join/#ldstech suresk (d831b5fe@gateway/web/freenode/ip.216.49.181.254) |
| 20:33.36 | *** join/#ldstech Raul (d831b5fe@gateway/web/freenode/ip.216.49.181.254) |
| 21:12.43 | *** join/#ldstech josephscott (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 21:58.36 | TimRiker | ~nslookup camping.rikers.org |
| 21:58.52 | TimRiker | ~nslookup camping.rikers.org |
| 21:59.54 | TimRiker | camping passes through right now.... |
| 22:01.22 | TimRiker | adding a vhost to apache... |
| 22:01.31 | scgallafent | I'm here. |
| 22:02.28 | josephscott | woot! a host name! |
| 22:02.36 | scgallafent | Hi, Joseph. |
| 22:02.41 | josephscott | howdy |
| 22:03.13 | scgallafent | I see the wildcard certificate for lds.org (and appropriate warning) coming through. |
| 22:04.46 | scgallafent | josephscott: See your email. |
| 22:05.23 | josephscott | hello fortify, my new friend |
| 22:05.27 | TimRiker | k. https://cpas.lds.org/ still works, and https://camping.rikers.org/ gets a phpinfo page. |
| 22:05.43 | *** part/#ldstech scgallafent (~scgallafe@c-67-185-194-104.hsd1.wa.comcast.net) |
| 22:05.56 | *** join/#ldstech scgallafent (~scgallafe@c-67-185-194-104.hsd1.wa.comcast.net) |
| 22:06.13 | scgallafent | That's what comes from hitting Ctrl-F4 on the wrong window... |
| 22:06.19 | TimRiker | what do we want there? camping.rikers.org is an apache alias for camping.lds.org so that should go the same place once dns is there. |
| 22:06.28 | scgallafent | I see both of them. |
| 22:06.35 | scgallafent | Can you check out revision 1 from subversion? |
| 22:07.06 | TimRiker | ~backwards |
| 22:07.06 | infobot | Did you know, Ctrl-Q makes your text go backwards in many IRC clients? You might be able to read this: .stneilc tsom sesolc tsuj siht esruoc fO |
| 22:07.16 | TimRiker | LOL |
| 22:07.44 | *** join/#ldstech scgallafent (~scgallafe@c-67-185-194-104.hsd1.wa.comcast.net) |
| 22:07.51 | TimRiker | hehehehe ROFL |
| 22:07.52 | scgallafent | Did that give you a smile? (Just for you.) |
| 22:07.56 | josephscott | beware bots in sheeps clothing |
| 22:08.16 | TimRiker | ~reverse .stneilc tsom sesolc tsuj siht esruoc fO |
| 22:08.45 | TimRiker | irc amusements. gotta luv em. |
| 22:09.04 | josephscott | easier to read that rot13 ;-) |
| 22:09.07 | scgallafent | Someone had to take the bait. |
| 22:09.15 | TimRiker | :) |
| 22:09.26 | TimRiker | ~rot13 Someone had to take the bait. |
| 22:09.26 | infobot | Fbzrbar unq gb gnxr gur onvg. |
| 22:09.33 | TimRiker | ~rot26 Someone had to take the bait. |
| 22:09.33 | infobot | Someone had to take the bait. |
| 22:09.37 | TimRiker | hehe |
| 22:09.53 | scgallafent | Is that your secret alter-ego GvzEvxre talking? |
| 22:10.01 | TimRiker | indeed! |
| 22:10.19 | josephscott | rot26, now there is something handy to have :-) |
| 22:10.29 | TimRiker | doubly secure! |
| 22:10.40 | scgallafent | If rot13 is good, rot26 is twice as good! |
| 22:11.07 | TimRiker | ~rot5 exactly! ~rot works with different values |
| 22:11.07 | infobot | jcfhyqd! ~wty btwpx bnym inkkjwjsy afqzjx |
| 22:11.28 | josephscott | haha |
| 22:11.33 | scgallafent | ~rot21 It's helpful that the plaintext is also in the channel. |
| 22:11.33 | infobot | Do'n czgkapg ocvo ocz kgvdiozso dn vgnj di ocz xcviizg. |
| 22:11.38 | TimRiker | ~rot1 HAL |
| 22:11.38 | infobot | IBM |
| 22:11.47 | scgallafent | That's my favorite. |
| 22:13.19 | scgallafent | josephscott: Most of the stuff in there is stuff we've already evaluated. |
| 22:13.22 | scgallafent | There are a couple of spots we could probably clear the warning by calling htmlspecialchars on a sanitized value. |
| 22:13.29 | TimRiker | rev1 is there now |
| 22:13.46 | scgallafent | That works. Thanks, Tim. |
| 22:13.58 | josephscott | I'll see about going through that tomorrow |
| 22:14.13 | TimRiker | calling specialchars on something that's already sanitized might not be what you expect. ie: double escaping. |
| 22:14.31 | scgallafent | Calling htmlspecialchars on a sanitized value seems redundant, but I guess it also provide some future-proofing in case someone changes the value coming in and doesn't see that it isn't escaped. |
| 22:14.42 | scgallafent | s/provide/provides/ |
| 22:15.11 | TimRiker | agreed as long as it's not supposed to contain any special chars like <>"' etc, you should be ok. |
| 22:15.57 | TimRiker | need to note which dirs in recprop need server write access. |
| 22:16.15 | TimRiker | right now /srv/www/vhosts/camping.lds.org is owned by root. |
| 22:16.27 | scgallafent | There are two spots where I use preg_match to check that a value is valid (hex color code) and don't escape it. Fortify doesn't like those. |
| 22:16.33 | scgallafent | root - :( |
| 22:17.28 | scgallafent | We've got a rewrite that will need to be added when we update to the release version. We can set write access on the required directory when that happens. The directory is in subversion. |
| 22:17.28 | TimRiker | dislikes web trees that are owned by the web server. not good security practice. any code directories should not be owned by the web server user. |
| 22:17.56 | TimRiker | but alas, that means you can't easily drop an svn update php script in place. |
| 22:18.00 | scgallafent | feels the same way, but root always makes me nervous. |
| 22:18.23 | scgallafent | The contents of the writable directory are svn:ignore. |
| 22:18.37 | TimRiker | could make a web data user that's non-root. no code is running as root, but currently updates are done as root. |
| 22:19.00 | scgallafent | I'm OK with letting you fight with the server config. One less thing for me to worry about. |
| 22:19.01 | josephscott | TimRiker: wanted to talk about how PHP sites are deployed in production, there are some good techniques for tightening things down |
| 22:19.02 | TimRiker | same rewrite that's on 5109 now? I might as well add it. |
| 22:19.26 | TimRiker | josephscott, let's talk about that tomorrow. you coming? |
| 22:19.40 | josephscott | yep, I'll be there all day |
| 22:19.47 | scgallafent | josephscott: I don't think adding the rewrite now will cause a problem. Correct? |
| 22:19.48 | josephscott | yes, meant to talk tomorrow about that |
| 22:19.52 | TimRiker | I've been pushing on larger issues.... we don't get OS patches applied systematically either. |
| 22:20.01 | TimRiker | kewel |
| 22:20.05 | josephscott | scgallafent: shouldn't |
| 22:20.16 | scgallafent | TimRiker: Go ahead and add the rewrite now. |
| 22:20.16 | josephscott | things that is a famous last word |
| 22:20.45 | scgallafent | figures we can't really break something that isn't deployed. |
| 22:21.00 | josephscott | OS patches, sheesh, next thing you'll want backups that you can actually restore from </demanding> |
| 22:21.14 | scgallafent | Did someone mention PHP updates? |
| 22:21.26 | scgallafent | slinks back to corner chuckling. |
| 22:22.05 | TimRiker | yeah! /* The Knife */ - stand up and fight for you know you are right... Classic Genesis on Pandora. |
| 22:22.24 | scgallafent | I take it Elder Monson isn't in the room. |
| 22:22.30 | TimRiker | hehe |
| 22:22.35 | TimRiker | headphones. |
| 22:22.49 | TimRiker | http://www.pandora.com/music/song/genesis/knife#lyrics |
| 22:24.22 | TimRiker | cute. they html encode the lyrics and javascript block copying. silly silly. |
| 22:25.57 | scgallafent | And that keeps me from copying them how, exactly? |
| 22:26.37 | TimRiker | my point exactly. it does annoy though. maybe that's the purpose. |
| 22:28.16 | TimRiker | RewriteBase should be / on this install? |
| 22:28.47 | scgallafent | josephscott: ? |
| 22:29.29 | josephscott | well, isn't this supposed to lds.org/camping/ eventually? |
| 22:29.35 | scgallafent | Yes. |
| 22:29.37 | TimRiker | sles 10.3 has phph 5.2.5 .. we should at least be there everywhere. |
| 22:30.02 | TimRiker | really? lds.org/camping? ugh... you want camping.lds.org to be the primary IMHO. |
| 22:30.14 | scgallafent | WAM :( |
| 22:30.29 | TimRiker | WAM handles camping.lds.org just fine. |
| 22:30.32 | josephscott | which is sort of like BAM ;-) |
| 22:30.49 | scgallafent | I thought it had to be lds.org/camping. Isn't that what you ran into with BSIR? |
| 22:31.23 | TimRiker | yes. I didn't have the proof to fight the battle then. so bsir is apps.lds.org/bsir when it should be bsir.lds.org |
| 22:31.46 | scgallafent | Is this a battle we want to get into? |
| 22:31.55 | TimRiker | they wanted me to be bsir.lds.org/bsir/ to which I ... uh .. said no. |
| 22:32.10 | scgallafent | Is that as secure as rot26? |
| 22:32.20 | josephscott | were "they" from the redundancy department? |
| 22:32.33 | TimRiker | if you don't do it now, it'll likely never happen. I'd say insist on camping.lds.org |
| 22:32.38 | scgallafent | As my wife says, "who is this 'they?'" |
| 22:32.52 | TimRiker | yes. they setup cdol.lds.org/cdol and they liked it. |
| 22:33.52 | scgallafent | If we can run successfully with WAM at camping.lds.org, I think I'd prefer that. I'm just wondering if that's a decision above my pay grade. |
| 22:33.56 | scgallafent | Of course, they can't cut my pay. |
| 22:34.18 | TimRiker | *.lds.org allows the use of different ips. this allows for not touching the f5 that drives lds.org when dealing with other low volume sites. you get lds.org/camping and you'll be shut out of changes for large periods of time. |
| 22:34.31 | scgallafent | josephscott: What was that about subversive technologies. <grin /> |
| 22:34.54 | TimRiker | I'll double your pay right now in preparation for the fight. :) |
| 22:35.29 | josephscott | bring it, may as well start the <strike>fight</strike> discussion now |
| 22:35.31 | scgallafent | If it eliminates some overhead and configuration, it seems like it would be an easy sell, unless the F5 is doing some filtering that they don't want us to bypass. |
| 22:35.34 | scgallafent | Let's go for it. |
| 22:35.42 | josephscott | other projects will run into this to, better to deal with it now |
| 22:35.49 | scgallafent | Agreed. |
| 22:36.23 | josephscott | I've probably ticked off a few people in church IT over the years already, I few more probably won't hurt ;-) |
| 22:36.37 | TimRiker | we just setup tech-stage.lds.org as a dual host mysql load balanced setup. wam handles it. no so-called "root context" |
| 22:36.42 | scgallafent | I started in high school. Hacked into the seminary computer (with permission) to show that it could be done. |
| 22:37.09 | scgallafent | OK. camping.lds.org it is. I'm sending email to Steve Knudsen now. |
| 22:37.12 | josephscott | mysql LB? |
| 22:37.39 | TimRiker | I'm already getting grief and praise for my ldsaccount preferred name. :) "Tim é<script>alert(7)</script>è¬ Riker" shows just like that in cpas. :) |
| 22:37.45 | josephscott | so, the answer to the original question, yes the rewrite base should be / :-) |
| 22:37.56 | TimRiker | kk. already added. :) |
| 22:38.45 | josephscott | that username is fine, as long nothing actually tries to execute the script tags *cough* tech.lds.org project page *cough* |
| 22:39.31 | TimRiker | hehe. tech.lds.org should be all clean now. our intranet is not though. |
| 22:40.05 | TimRiker | OS X email client mangles it with my email and tries to email timscript/script@ldschuch.org so no mac users can email me now. |
| 22:40.19 | josephscott | haha! |
| 22:40.40 | josephscott | now, if you can just come up with a name that breaks on Outlook you'll be all set |
| 22:40.42 | TimRiker | LB? |
| 22:40.54 | josephscott | "dual host mysql load balanced setup" |
| 22:41.58 | TimRiker | ah. yes. l7869 is mysql master, l7870 is the slave. joomla installed on both, but just pointing to master at present. joomla still has issues with image uploads on the filesystem, but most other things work. |
| 22:42.27 | TimRiker | not figured out if joomla supports read-from-local-but-write-to-master. |
| 22:42.48 | josephscott | was going to ask if joomla had a plugin for reading from slave, writing from master |
| 22:43.02 | josephscott | along with pinning writes and such |
| 22:43.03 | TimRiker | so, load balanced is a stretch. live backup is more accurate/ |
| 22:43.46 | TimRiker | I've found some conversations, but no actual support yet. not looked to hard. |
| 22:43.54 | TimRiker | s/to/too/ |
| 22:44.32 | josephscott | I wonder if joomla could make use of hyperdb |
| 22:44.49 | TimRiker | dunno. seen some others asking that question. |
| 22:46.15 | josephscott | well, if you wanted another fun single point of failure you could look at something like mysql proxy |
| 22:47.47 | josephscott | we ran that in production for one service, but ultimately decided it wasn't worth the extra complexity/failure point |
| 22:49.04 | TimRiker | nods |
| 22:52.29 | TimRiker | cpas is still setup for swedish. :) |
| 22:52.36 | scgallafent | The database? |
| 22:52.48 | TimRiker | yeah, default sort order etc. |
| 22:53.04 | scgallafent | I'm working on some changes to it. I'll change it over when I update the tables. |
| 22:53.13 | TimRiker | k |
| 22:53.54 | josephscott | utf-8 general for the win |
| 22:53.59 | josephscott | oh, and innodb |
| 22:54.04 | TimRiker | :) |
| 22:54.22 | scgallafent | RecProp should be all UTF-8. Both should already be InnoDB. |
| 22:54.35 | TimRiker | enables the "Designer" in phpmyadmin for chqpvul5230 just cause. |
| 22:54.44 | scgallafent | says unhappy things when he sees non-InnoDB tables. |
| 22:55.11 | TimRiker | cpas production is MyISAM |
| 22:55.25 | scgallafent | just bit his tongue. |
| 22:55.29 | scgallafent | Duly noted. |
| 22:55.36 | josephscott | I can think of two specific cases where MyISAM is required, likely only one of those would possibly ever be an issue with a church project |
| 22:55.44 | scgallafent | That means I get to check for data inconsistencies. |
| 22:56.03 | scgallafent | What are they? |
| 22:56.54 | josephscott | one (possible case for church projects) - using full text indexes |
| 22:56.54 | TimRiker | 1) not wanting a big /var/lib/mysql/ibdata1 on the filesystem? |
| 22:57.36 | josephscott | two - if you have lots (thousands upon thousands) of tables in a single DB, there is a "feature" in MySQL that acts like a memory leak for InnoDB tables, but not MyISAM tables |
| 22:58.01 | TimRiker | so I got 1 right? :) |
| 22:58.02 | scgallafent | Some days I just like my SQL Server box. |
| 22:58.15 | TimRiker | ~lart SQL Server |
| 22:58.15 | infobot | takes out SQL Server with the trash |
| 22:58.27 | josephscott | we have the "feature" issue with MySQL on WordPress.com, makes things interesting |
| 22:58.37 | scgallafent | josephscott: 1pm MDT tomorrow with Chad Butler to review Fortify results. |
| 22:58.41 | josephscott | *cough* PostgreSQL *cough* |
| 22:58.42 | TimRiker | cpas dev is InnoDB. but still swedish |
| 22:58.49 | josephscott | scgallafent: ok |
| 22:59.12 | scgallafent | I've heard from a couple of people that like PostgreSQL, but haven't taken time to try it. |
| 22:59.13 | josephscott | any idea where we will meet? |
| 22:59.34 | TimRiker | yeah? I'd like to be in that, but I have a 1pm conflict. mountain time I assume. |
| 22:59.40 | scgallafent | Correct. |
| 23:00.02 | josephscott | if you come from a traditional commercial DB background (Oracle, DB2, Sybase, etc.) the PostgreSQL feature set will match better to what you are used to than MySQL |
| 23:00.14 | scgallafent | I might have to try it on one of my other projects. |
| 23:00.20 | TimRiker | I don't know if that's a good thing or not. |
| 23:00.27 | josephscott | haha |
| 23:00.51 | josephscott | not that it doesn't have its own set of issues, they are just different that the MySQL set of issues |
| 23:01.00 | TimRiker | nods |
| 23:01.04 | josephscott | TimRiker: do you set sql mode to strict for MySQL installs? |
| 23:01.48 | scgallafent | I've got a 100GB of data in a replicated SQL Server database. It has it's own issues, but I like constraints and triggers. MySQL's constraints feel a bit ... lacking ... in comparison. |
| 23:02.15 | josephscott | MySQL triggers, well, just pretend they don't exist and you'll be better off |
| 23:02.23 | scgallafent | Yup. |
| 23:02.46 | scgallafent | josephscott: More email for you. |
| 23:02.57 | josephscott | and be careful with MySQL VIEWs, in some cases they can degrade performance |
| 23:06.32 | josephscott | scgallafent: ok, last time I just hung out in the cafeteria area all day. May very well do the same again tomorrow |
| 23:07.29 | scgallafent | That's what I was assuming. I'll be online except for a couple of hours while I go watch my daughter at a debate tournament. |
| 23:07.38 | TimRiker | josephscott, I have not been, but we should likely convert the dev instances over to script. |
| 23:08.23 | TimRiker | s/script/strict/ |
| 23:08.34 | scgallafent | Gotta run. Sounds like I need to shuffle children. |
| 23:08.49 | josephscott | won't necessarily prevent clients from turning it off, but for those that don't mess with it that can help avoid aiming the gun at their toes |
| 23:10.18 | TimRiker | nods |
| 23:10.36 | TimRiker | just looking to do what I can to encourage good behavior. |
| 23:11.00 | TimRiker | joomla floods if you turn warnings up or I'd do that as well. |
| 23:11.22 | TimRiker | lots of strict warnings as they still claim to handle php 4.x |
| 23:11.49 | TimRiker | like, say 350 warnings on the home page. things like that. |
| 23:11.57 | *** join/#ldstech Zygo (startkeylo@startkeylogger.hungrycats.org) |
| 23:12.15 | josephscott | ouch |
| 23:12.40 | josephscott | turning on display errors in dev is often times the only way to get people to pay attention |
| 23:12.46 | josephscott | too many devs ignore the error log |
| 23:13.23 | *** topic/#ldstech by TimRiker -> LDSTech http://tech.lds.org/Â || Public IRC Logs: http://infobot.rikers.org/%23ldstech/ || https://code.lds.org/ || CIA is in #ldstech-commits || LDSTech Service Day June 3 9am-9pm https://tech.lds.org/wiki/LDSTech_Service_Days |
| 23:13.58 | TimRiker | agrees. I normally run that way on my local installs, except when I work on joomla I can't get anything done that way. |
| 23:15.51 | TimRiker | I have not yet created a db for recprop on 5230. we can do that easy enough once dns is working. are you planning on putting WAM in front of CPAS and just not using it there yet? that's what I'd recommend. |
| 23:17.48 | TimRiker | apparently you get cn, LDSAccountID, preferredname sn, givenName for free but need a data sharing agreement in place for more. did recprop get a dsa approved? |
| 23:18.12 | josephscott | TimRiker: scgallafent is working on a dsa for recprop currently |
| 23:18.44 | TimRiker | I don't know if recprop needs more than the base stuff from WAM. an email might be nice, that needs ldsaccout DSA approval. |
| 23:19.07 | TimRiker | well, unless you get it by using the obvious security hole solution. |
| 23:19.18 | TimRiker | but that's discouraged. :) |
| 23:19.29 | josephscott | I was given the impression that it was needed because we wanted to all of the various data issues sorted out in one shot, so more than just ldsaccount auth |
| 23:19.59 | TimRiker | yep. depends on what you want access to. |
| 23:20.44 | TimRiker | ~x en sp well, headed home. catch ya tomorrow |
| 23:21.06 | TimRiker | hehe |
| 23:21.12 | *** join/#ldstech Zygo (startkeylo@startkeylogger.hungrycats.org) |
| 23:21.34 | TimRiker | ~x en jp infobot never fails to amuse me |