« first day (1638 days earlier)      last day (1542 days later) » 

18:01
There's enough people that know about RD at MS. At the very least they're smiling at the work we're doing. Right?
At least two.
I'd be even more interested in them open sourcing the VBE.
isn't that implied with OSing the VB6?
That'd be the black box we'd need?
18:02
However, they will certainly never do that.
Woot! Found the bug I've been trying to find for the last 2 weeks.
2
@IvenBach that would probably make Wayne go frantic
Because his lunch'd be eaten?
I would be interested in the hack they pull regarding host interaction stuff, like document modules.
^ I'm guessing it's more than one hack.
18:04
lol no, because then he would get to see all the hidden doors just waiting to be slammed open
There might be one thing that isn't a hack.
@IvenBach more like everyone's lunch getting eaten
:click: Ah....
@Comintern nice. get a plate and hang it on the wall!
step 1: fork VBE. step 2: fork VSCode. step 3: ...
18:06
@MathieuGuindon Remind me again why we can't just transpile VBA to C# and interact with the proper COM libraries as needed?
There'd no longer be hidden knowledge of "This is how you do Foo on the Bar"
With ThunderFrame's ways to get the data from a closed document, we could write our own editor.
@Hosch250 I'm not entirely convinced that you couldn't do that.
@Hosch250 we probably could... assuming a magical clean way for .NET to play nice with COM libraries
Doesn't .NET play nice with COM mostly?
18:08
if a .NET program can't play nice with COM, then the VBE probably doesn't either
@Hosch250 mostly because of GC
@Vogel612 VBE is COM
@this VBE isn't playing nice either ;-)
MdiChildHack
Yes, that's on VBE, though.
and most likely doesn't have anything to do with COM.
hmm ... can't we use an unsafe code block in C# to sidestep the GC issue?
18:10
(I'd be surprised if COM was involved at that level. Normally you only do so if you intend it to be a component that's used by others (e.g. activex controls)
I have no idea how GC and unsafe work, but it feels like unsafe should modify the GC semantics
MdiChildHack is most likely due to laziness in implementing the docking system.
@Vogel612 one has nothing to do with other.
@Vogel612 If that's the case, could we maybe obsolete VBA?
In fact, I'd argue that we are already writing unsafe C#, without the unsafe
6
18:11
:-D
because .NET GC has absolutely no idea about the COM objects, and its RCW/CCW abstractions works okish.... until it doesn't and then it leaks something bad.
TBH, transpiling VB6 would be much, much simpler than VBA.
^
VBA is bascially code + host
No host interaction required.
18:13
how do you transpile ThisWork.WorkSheets.Add()?
I see "host interaction" as nothing more than "just another COM type library reference"
Ah, but to transpile, the target language must support COM
remember, COM is ABI.
True, but there's some other Voodoo going on there.
the persistence is irrelevant to.. oh wait
yeah
The compiled binary than got shoved back into the document would need to have all the right interfaces available in a way the host could call them
18:14
IDK if you even can implement the necessary ABI using javascript....
@Comintern not impossible, but probably requires significant input/cooperation from MS
certainly not using javascript itself. You'd have to write the javascript compiler to handle that and that'd be no longer "just another javascript"
wow... I had no idea that those VB6 fans were so... fanatical!
Hmmm... Although, you could just drop a shim into the document... VBAInterop...
that would make someone happy. #shim
18:17
Sure there are 1000s of COBOL programmers out there, but I can't imagine that any of them are clamoring to write more COBOL. I'd guess that most of 'em are doing it because A) that's all they've ever done and/or B) it pays well
LOL - I was envisioning the VBA project bin in, say, an .xlsm file would be a shim.
> Doing a thing well is often a waste of time.
That's what I envision all project managers saying to themselves.
@FreeMan I'd bet for VB6 programmers it's heavily in favor of "A".
@IvenBach I had that argument this morning.
@Comintern probably, though I keep considering COBOL for B)
then I bang my head on the desk to remind myself how bad it hurts.
@Comintern You'll have to fight Vogel for my last condolence.
@this ABI???
18:21
you know what API is, right?
A Basic Instruction?
~hands Iven's last condolence to Comintern
API = Application Programming Interface.
ABI = Application Bullsh*t Interface?
ABI = Application Binary Interface
18:22
I'll show myself the door ...
i think @Vogel612 's definition is best
Consider how you have to write the Declare statement in VBA.
So instead of Worksheets.Add you'd need 000011101011100.0111000001110?
To do that, you need to know a bit of C++
to set up the data types correctly, etc., etc.
e.g. map VBA's Long to C++'s int
actually to std::int32_t
18:23
BUT --- you are still doing it the C++'s way
because for reasons int does not have a defined size
so if you can't invoke the method using C++'s way (e.g. using stdcall calling convention, etc.), then you're screwed.
#TIL, Vogel (goes to show how often I code in C++ )
ABI avoids that by giving you the specification of the layout of everything in binary format.
So instead of just simple Dim foo as Long it'd be along the lines of Public Declare PtrSafe Foo system32.dll ... as shown in docs.microsoft.com/en-us/office/vba/language/reference/…?
which is why COM can be language agnostic - all it matters is that you adheres to the same binary format for calling a method, defining parameter, etc. etc.
> If no length modifiers are present, it's guaranteed to have a width of at least 16 bits. However, on 32/64 bit systems it is almost exclusively guaranteed to have width of at least 32 bits (see below).
18:26
Since I know nothing of C++ I'm still struggling to use your breadcrumbs.
hmm. not sure how I can explain - API and ABI are similar but differ primarily in how they make themselves available to consumers.
IIUC - an API specifies a Long while an ABI specifies 32-bit integer. With the API, if the calling language's definition of Long doesn't match the internal definition of Long Bad Things Happenâ„¢. With an ABI, the caller sends a 32-bit integer, no matter what it wants to call it (Long, LongLong, Fred, Whatever) and the internal code gets its 32-bits and Good Things Happenâ„¢
@this - @IvenBach ^ ??
yeah
#winning!!
in Discussion between miroxlav and Comintern on Stack Overflow Chat, 9 mins ago, by Mathieu Guindon
hmm, you wouldn't happen to be looking for an OSS project to contribute to? Rubberduck can use devs that know VBA and C# (it's written in C# 7.x/latest)
18:35
weirdly, I'd never heard of an ABI more than 10 minutes ago, and just assumed it was a typo
in Discussion between miroxlav and Comintern on Stack Overflow Chat, 6 mins ago, by Mathieu Guindon
and no Slovak translations so far ;-)
@FreeMan I'm thinking if you pass a LongLong or a Fred and it gets truncated on the copy to the stack, Bad Things Still Happenâ„¢
The idea of a 32-bit integer, regardless of language, is unambiguous. Hence language agnostic.
But if Fred is a 32-bit integer and the ABI is expecting a Long 32-bit integer, then it won't (shouldn't) get truncated. right?
No, but if Fred is a 64 bit double and the ABI is expecting a 32 bit long, then it would.
You know, like we call him Mug, but really he's Mathieu
18:47
@FreeMan I think that was the breadcrumb I needed.
If Fred is a double and the ABI expects a pointer...
@Comintern But it it's a 16-bit would it be expanded? IE #BadSTuff = overwriting stuff it shouldn't.
@Comintern right. The calling language passes in a Fred because that's what a 32-bit integer is called in "Callese" while the ABI, written in ABIlene calls a 32-bit integer a George. The key is they're both talking about a 32-integer.
If I pass a 64-bit double to something that's expecting a 16-bit string, well, then that's on me for being an id10t.
In practice, yes. It would have 32 bits allocated on the stack (and assuming that the byte order was the same and the bit layout was compatible) it would get expanded.
Abstractions.
18:51
What happens if it's wider is that the stack just grabs the low (or high depending on the byte order) 32 bits and pushes that to the stack.
@IvenBach I think you and I are understanding on a high level, while @Comintern is delving much deeper than either of us are thinking about.
That protects the stack from being smashed by an overflow.
@FreeMan Oh, yeah - I'm off in assembly land.
I've written some of that. For a VAX. Back in '89ish...
@Comintern that's the thing about the ABI - you shouldn't be worrying about the stack, right? you just match up the bit-size in your language to what bit size the ABI specifies and everything is good...
@FreeMan We're off in the clouds while the big ducks are on the ground. Occasionally they go into the trenches like Wayne.
@FreeMan Correct. The ABI manages the stack interaction.
18:56
~heavy sigh
@FreeMan An accurate understanding of computers would make this a lot easier for me.
I just kind of fake it, learning along the way.
@IvenBach join the club
Feels like just us are in it. Everyone else already understands it, or they fake it better than we do.
The instruction cycle (also known as the fetch–decode–execute cycle or the fetch-execute cycle) is the basic operational process of a computer system. It is the process by which a computer retrieves a program instruction from its memory, determines what actions the instruction describes, and then carries out those actions. This cycle is repeated continuously by a computer's central processing unit (CPU), from boot-up until the computer has shut down. In simpler CPUs the instruction cycle is executed sequentially, each instruction being processed before the next one is started. In most modern...
^ That's surprisingly good.
@IvenBach mostly faking it better :)
and having become pretty good at googling
19:04
I've gotten better at that too. #UseTheSearchNoob
@IvenBach lol!
May 11 at 15:40, by this
@IvenBach use the search, Luke.
It was said a bit nicer though. I've learned to #ReedBetweenTheLines
> Just installed build .4244 on Win10 Excel 2016:

Received a false positive `Object Variable '{x}' is assigned without the 'Set' keyword` on the `Application.StatusBar = ...` line, so I used the `Ignore Once` quick fix to ignore it until the underlying false-positive is resolved.

Starting code:
```VBA
Private Sub PrintDataRows(ByRef Report As Worksheet, ByVal HeaderRow As Long, ByVal clinicList As ProcessClinic, ByVal MSS As MonthScoreSettings)

Dim MS As MonthScore
Dim CI As Cl
^sigh...
@Duga Help me out there. What did the quick-fix break?
Ahhh...
@FreeMan You didn't have a stale parse did you? That looks suspiciously like the code module was dirty when it ran.
Hmm especially with all the green tests for the quickfix
Quickfix CanExecute should be disabled if the target module is dirty... can we do that?
@Comintern Yes it is.
19:19
I was able to replicate it after a fresh parse.
Yeah, I didn't want to have to report something like that - I tried it several times.
@FreeMan ignore once isn't tied to any specific inspection.. they all do that?
Ignore once when applied to a Consider renaming parameter inspection:
'@Ignore HungarianNotation
Private Function SetSheetTitle(ByVal generatingQuarterly As Boolean, ByVal rptDate As Date) As String
i.e. it worked correctly
hmm that helps narrowing it down a bit
I wonder if the code that finds the target context is borked.
it's 19:30 UTC on a Friday... Everything is borked...
19:32
And if I worked in UTC I'd be off work now.
> `Ignore once` when applied to a `Consider renaming parameter` inspection:
```VBA
'@Ignore HungarianNotation
Private Function SetSheetTitle(ByVal generatingQuarterly As Boolean, ByVal rptDate As Date) As String
```
i.e. it worked correctly
^for the record
Granted, I would have been really late this morning.
#MeToo
Yay! The wife just called with the message I've been waiting for. TTGH!
;)
19:34
^
Hmmm... probably not a context problem - it issues an IdentifierReferenceInspectionResult.
...and of course, I was the last one to touch it. sigh
@Comintern I know the feeling :)
20:01
yay! I'm a id10t!
everyone else has their cache invalidation and off-by-one errors; I have my double negations!
clearly we're a bunch of idiots
:)
Rubberduck: Written by a bunch rubber-necking idiots who need to rubberduck more
LOL
I don't have no double negations though.
I recall reading somewhere that English is in minority in how it treats double negatives.
Well it certainly isn't not in the minority
20:10
Should I go and get that dog and rabbit for you?
FWIW, I'm sorry if my self-deprecation has been rubbing off on any of you guys - please don't do that; you're all anything but idiots, don't let anyone tell you otherwise.
Not at all - If I do something stupid, I'll call myself on it.
^
I already had the self-deprecating sense of humor before I came here
Same.
I think in general it's probably better than arrogant denialism.
20:22
^^
20:42
TFW you spend ages trying to work out why the webcam isn't working on your eBay laptop, then realise that it doesn't have a webcam
facepalm
#TIL what a tetronimo is. Suddenly Tetris has so much more meaning.
What else have I missed out on by not studying algorithms!
21:01
four-block-shape?
Yes.
hmm .... I just now notice that Tetris uses all rotationally invariant cojoined four-block shapes
brainfilter for stupid graph theory jargon turned itself off...
:(
Aug 9 '17 at 21:03, by IvenBach
I'm not dumb... Just slow.
@Duga One more! Then His Holy Mugness can tweet our achievements to the interweebs.
21:04
lol
@IvenBach note that interweebs and interwebs are very different things
Wut...
that race has been going on since what, 300-350 stars?
oh that's not a new thing?
i thought oletools used to be way ahead of us until relatively recent
I think it's interweeds, not interweebs. CompuServe, AOL, BBS's etc. - The Interweeds.
21:09
I knew there was a reason for 4:20. You don't make up an appointment randomly.
hmm
Aug 27 at 8:49, by ThunderFrame
wow, 646 stars... RD just passed decalage2/oletools to be the 2nd-most starred repo (that returns in a search for "vba") after VBA-tools/VBA-Web... roll on 650
interesting:
:whips RD: Giddy-up. They're gaining on us.
~grabs popcorn to enjoy watching Iven get stomped by RD
I think you'll find it just mite bit difficult to ride a rubberduck.
The best it could manage is a squeak, I'm afraid.
@Vogel612 Even without teeth RD is more than capable of trouncing me.
21:14
unrelated heavy sigh...
The irony is that by openly talking about our race with "the other project", we're promoting them in our Google results for things like DISPID.
The ID is in the listbox and I have pulled it. But I'm just not sure how to designate to not use quotes around the IN criteria without determining the type of the bound column. Otherwise I get a query like SELECT foo FROM bar WHERE myID IN ('1','2','3') which results in a type error. I want ...myID IN (1,2,3) but if I have an actual string, I want the function to work there as well ...myStr IN ('a','b','c')Elizabeth Ham 2 mins ago
@this ^ any ideas?
By the stats page, to get stars we should add a Rubberduck.WebScraping API...
I'd say "don't use IN and parameterize the query, but this is likely Access/ADO
 * !!!!!!!!!!!!!!!!!!!!! This is a dirty copy of code of the …! Instructed by […].
 * !!!!!!!!!!!!!!!!!!!!!
21:15
@Comintern IKR!
lightly anonymized to give the semblance of protecting the innocent
@Comintern "the repo that shall not be named" then
The more I play with XML documentation in throwaway stuff the more I want it in a real code base.
you're highly welcome to add some to the RD codebase
21:19
:thinks-about-it: I'll start with my own code I modify
@MathieuGuindon If the ListBox is bound, shouldn't you be able to determine the data type of the column it's bound to? Pretty sure you can do that with UserForms.
I'm clueless about Access forms.
@Comintern x-y problem, I think. she's concatenating the IDs into a WHERE clause "IN" statement
I see that Mat already answered.
Not familiar with Access/DAO, but it looks like this might help. If possible, prefer a parameterized query so that the database engine can work out the correct parameter type, instead of string-concatenating the where clause. Benefits include correctness, performance, ...and security. — Mathieu Guindon 1 min ago
this?
@Comintern Yes you can infer the type but not from where she's looking - that would be from a different property altogether.
21:21
Right. Access doesn't let you create table valued functions, does it.
Yes, though I'd say that security is overrated in the context of Access.
No, not really. We're basically talking SQL-89.
OOOOOOOLLLLLLLLDDDDDDDD SKKKKKKOOOOOOOOLLLLLLL
but that xkcd can't possibly be over-linked
for the context it's alluding, nope.
See, the critical difference is that you're hijacking a website remotely.
you can't really hack an Access database remotely.
@Vogel612 what's the preference with XML docs? Obviously on the external API and inspections, but what else? public members in general?
By time you've reached it, you already can pwn everything else.
21:23
lol IKR
e.g. you're on a remote desktop
and then there's the fact that it doesn't do multiple statements
still not a reason to not learn to use parameterized queries. not learning to use them causes php
so the worst thing that will happen out of a SQLI could do is a buggy application
Unfortunately for a dynamic IN.... That's not easily solved with parameterized queries.
@this ORLY? That sounds like a challenge if I ever heard one.
You can, don't misunderstand me.
Just call a VBA function in query, pwned.
21:25
lol
My point is that the typical injection attacks won't work on Access.
True, but I'm guessing you could still do some damage.
Anyway, a better solution would be probably to insert into a temporary table and join that. Pesto, dynamic filtering!
Good suggestion but I'm afraid it won't work. For example, ID 1 would be in the string ("2,6,10") but that doesn't mean 1 is one of the IDs in the list. — Elizabeth Ham 1 min ago
21:26
Again, cost/ROI works against it, I think.
@this unless they're just a UI to a SQL server... then they work just fine...
oi, wrong level assessment there
I was thinking more along the lines of LEFT JOIN TableValuedFunction(ListBox)
That presumes you're using PTQ, though.
21:27
LEFT JOIN TempTableInsertedFromListBox would owrk, though.
I don't see why it wouldn't.
I wonder if you could use Access SQLI to DoS a machine.
hmmm. convoluted but i can see a possible way
Like some kind of SQL fork bomb.
21:30
something like SELECT * INTO [C:\Temp\fooN].Foo FROM MSysObjects o1, MSysobjects o2, MSysObjects o3;, with N being incremented
hmm. need a way to create a blank file first, I think.
Can you put arbitrary VBA code in a query somehow?
6 mins ago, by this
Just call a VBA function in query, pwned.
I think you used to be able to - that's a bus sized security hole.
Still can.
Access is a bus sized security hole
21:32
Note that there's the sandbox mode thing, though.
so you can't just plop down a random Access file and run VBA code.
Double decker bus sized security hole. Sideways.
might be a wee bit challenging driving it sideway.
Anyway, I think you still have to do a bit of social engineering to get them to trust the file, then all bets' off.
doesnt the bus driver in Harry Potter manage that?
(nah)
hmm. i do remember him turning a bus like crazy but actually driving it sidway?
21:34
Remember though, we're crashing the bus, not driving it.
lol
Maybe there's a way to run VBA without sandbox but TBH I wouldn't know. If it's possible, then it'd be true for any Office programs.
I would kind of doubt it. What makes Access "special" in that regard is that you can open connections remotely.
I don't think there's a way to call an Excel UDF via ADODB.
If there was, I would have done something incredibly cool and probably somewhat stupid and dangerous with it by now.
For vBA to run, it has to be the current file that's opened; you can't run VBA that's housed in other file
hmm, "show designer" doesn't work, but doesn't log any exceptions either
and you cannot run VBA without first enabling the contents of the file.
Hence why I think you still have to first breach the trust center somehow.
21:41
the typelib API is going to make a few folks nervous I think
Apr 10 '17 at 3:36, by ThunderFrame
Ohai, Unviewable+ modules
Huh. I thought VBA handled forward declarations.
Because we un-obscured their "security"?
Not sure if that's the same thing. I'm an id10t, ignore me - I forgot the TAPI exposes the private members
Because we can write invisible code?
I'd be more nervous about that, personally.
to be fair it's just the modules and members, not the actual code, right?
21:44
we still can't see the actual implementation, so there's that.
(or is it??)
right
we'll know that there's a AFilthyDirtySecret method housed in MyCoolAPI module
but we won't know what it actually does.
Based on the "hidden" code I've seen, they hide it because it's trashy.
The Adobe VBA code is horrendous.
But remember - you can execute any code, private or not from Immediate.
didn't they deprecate it?
(in the literal meaning of the word)
I think they defecated it.
21:46
@Comintern The Adobe VBA code is horrendous. #FTFY
I think that's a fair statement.
@this but we can presumably run it and break and then... what's the VBE listing
The thing is, knowing that a FilthyDirtySecret exists is 90% of the battle.
^
@MathieuGuindon how would you break if you can't put a breakpoint in the FilthyDirtySecret?
it'd have to be long running that you could ctrl + break but... ?
IDK.
21:49
I'm not entirely sure I care though. If your business model is based on hiding code in Office documents, then that is your bug, not the code itself.
I'd guess same question applies to UV+ protected code that pops a msgbox and then you just ctrl+break onto it
just a blank page? junk?
 's?
Good question. I honestly don't know.
In ACCDE, though, the source code are really gone
you'd be left with only the p-code.
in theory you can "debug" that but there's no tool that works at that level, is there?
> I work for a non-profit and someone has kindly donated a Mac mini (late 2012) to us. However, it has Windows 7 installed on it (why, I don't know).
bwahahaha
Doesn't that make the documents non-portable?
.... Ok.
@Comintern backward, no.
forward is fine.
21:53
What about bitness?
locked to the Access you made ACCDE from
therefore you must distribute both 32-bit ACCDE and 64-bit ACCDE from one same ACCDB
(and you must have both 32-bit Access and 64-bit Access in order to compile the ACCDB; neither can cross-compile)
Lovely. It kind of sounds like a PITA.
yes. that's why we don't recommend making shrinkwrapped commerical application with Access.
It's fine as a internal LOB application where you have more control over the environment and that's 95%+ of our clients' usage.
Hopefully amongst other reasons.
I know there has been a number of software that are Access-based and continued to be sold even today
21:59
ttqw
but they are actually more like "consultingware". Not a true shrinkwrapped application.
Viewable++ might have to be my next major project.
lol
and as an extra bonus -- a p-code debugger
HHICB?
IKR?
The problem with unviewable code like that is that it makes bypassing malware checks easier.
As evidenced by "the project that shall not be named".
aren't they supposed to be looking at p-code?
if the AV software only reads source code then i have to say it's... dumb.
22:02
In theory, but a lot of them take shortcuts.
probably explains a lot about Symantec.
There was one I saw with a "bad functions" list.
lol wut?
Like I'm a malware author because I use Kill or have reference to an FSO.
i guess they didn't thunk that I could just obfuscate that code or use some wicked wizardry to make it look innocent.
22:04
"OMG! You could delete files with that!"
22:15
@mansellan everything you want, I guess?
Rubberduck is sorely underdocumented
add docs wherever you want, preferrably docs that are helpful :)
The art is in documenting what isn't obvious from the source code. That's usually the intention or some high level architectural design.
@this not always. For a lot of internal API even just documenting what's in the code can help, because putting it into prose already can help understanding the code
my main problem is that when code changes, the documentation can become obsolete
that's always a problem
It's something we're going to have to start looking for in PullRequests
from a POV of ROI, documentation that is at high level usually serves well in long run.
But yes, I do agree that we're awfully underdocumented.
22:23
that's true
Let's start with a contributing.md
That outlines the different paths to contributing.
Like, "here's what you'll touch if you just want to work on inspections".
"Here's the code explorer".
"Here's the parser. Buyer Beware"
we already have that.
22:55
I think what could use some (xml) documentation are our internal API interfaces.
23:40
> This appears to be a binding issue (as opposed to being related to setting the object to Nothing). When I put break-points at the top of OpenDesignerCommand.EvaluateCanExecute and OpenDesignerCommand.OnExecute I can't hit either one of them no matter what I do in the UI.
:click: another "egghead" light-bulb moment.

« first day (1638 days earlier)      last day (1542 days later) »