« first day (1319 days earlier)      last day (3663 days later) » 
00:00 - 19:0019:00 - 23:00

user55340
12:02 AM
The closest I can get with anon-feedback is through the delated Data.SE query that I wrote: data.stackexchange.com/programmers/query/169976/…
 
user55340
Things you find in there: In march there were -5 anon feedbacks on programmers.stackexchange.com/questions/88403/… - which yea, is rather disappointing of a question and answer (and apparently still gets highish views)
 
@MichaelT if you saw this in the 10k tools, how useful would that be?
 
user55340
I'd be quite happy with seeing that in there.
 
well, that's not what I asked
 
user55340
I'd find it useful to go through - especially the down vote type ones...
 
user55340
12:09 AM
because thats the ones where new users are finding things and either saying "this doesn't help me" - it should either be edited into something that can be helpful or removed as something that can never be made appropriate for the site and sets out a "hmm... the site isn't so helpful" feel from the start.
 
user55340
More advanced users have down votes that they can use, or flags, or post on meta, or in chat... but the anon and low rep ones - this is their only way of giving feedback. And without us (10ks) being able to see it, we can't help them by acting upon it. So yes, I do find it useful.
 
user55340
One of the bits that is intriguing on the anon feedback is that it really does closely map to popular questions. This is what people are coming from google looking for apparently.
 
user55340
12:24 AM
If you glance at data.stackexchange.com/programmers/query/169976/… (modification of that query) you'll see that most anon-feedback is on high view stuff (even without activity on the question itself in the time frame)
 
12:37 AM
@MichaelT stands to reason. Remember, Google is the #1 source of views, and folks who do/don't find what they're after...
 
user55340
While thats not surprising, what is useful off that is "this is what people are looking for"
 
right
 
user55340
One of those 'tempting' things is to say "hmm... C++ exercises for beginners" is a high view and low feedback question... to completely rework that question into a community lock question and answer - to try to preserve the "this is something people are looking for" while trying to make it so that you don't get other answers if it becomes something people can answer again.
 
user55340
0
Q: C++ exercises for beginners

H_MiriI have just come across this collection of programs for beginners: http://www.cplusplus.com/forum/articles/12974/ Does anyone know of a similar source of practice but with some sample answers previously-written? To make sure you have got it right, so you can move on confidently... Thanks,

 
user55340
Its such an easy thing for people to search for... and stack exchange is probably one of the top answers for it.
 
user55340
12:46 AM
(its #3 behind the link given and a south african university link)
 
5:11 AM
posted on April 13, 2014

A novice asked of master Bawan: “Say something about the Heartbleed Bug.” Said Bawan: “Chiuyin, the Governor’s treasurer, is blind as an earthworm. A thief may give him a coin of lead, claim that it is silver and receive change. When the treasury is empty, which man is the villain? Speak right and I will spare you all blows for one week. Speak wrong and my staff will fly!” The novice

 
5:38 AM
@RobertHarvey well, maybe it's better to close (FWIW I CVed that "example") - but in this case, this feature wouldn't do harm would it? In closeable questions it would make bikeshedding (somewhat) harder, sounds good to me... :)
0
A: When there are many answers already, help me check that mine won't repeat others

gnatTo avoid misunderstanding, I realise that feature like this would make it technically harder for me to post an answer. Imagine I am willing to add 20th answer to some question, that would mean I have to pass through checking 19 prior answers before posting my own, go figure. But, if I really bel...

 
 
8 hours later…
1:30 PM
New feature: The homepage view shows why a post was put on the front page.
 
1:50 PM
Also, I just updated the proposed on-topic page on the Meta question. Feedback appreciated. (@RobertHarvey, @gnat)
 
2:06 PM
@ThomasOwens "freelancing and business concerns" and "developer testing" are out (latter essentially went into "development methodologies and processes"), is that intended? Overall, it looks okay to me, I ask about these only to double-check
 
@gnat I removed developer testing because it's "quality assurance and testing".
Did I remove "freelancing and business concerns" or did someone else? If I did, then it's because most of what's on-topic is covered under "development methodologies and processes" and "software engineering management", with the rest being off-topic because they are "career advice, salary, or compensation" type questions.
 
user55340
@ThomasOwens I believe you removed it as part of the last discussion.
 
Also, if they do get to the very bottom and see the link to other SE sites, they can easily find Freelancing. It's still beta, but it's a public beta.
 
@ThomasOwens fair enough. Approved :) Point about Freelancing.SE is well taken, I've seen it already mentioned in comments in some freelancing questions
 
The only thing that I'd like to see is somehow making questions about price points and choosing a sale price as off-topic. Although I suppose that's compensation?
So as long as there's no objections, maybe I'll just push it live tonight or tomorrow morning?
It's been on Meta for a while. People could have said something, edited, or whatever if they objected to anything.
One of the things I will do before posting is turn it into entirely markdown, though.
That way, it'll be easier to edit in the future. Right now, it's a mashup of markdown and HTML that's hard to read.
 
user55340
2:16 PM
@ThomasOwens You know they will only read it after they get told it was off topic and now part of the FAQ (btw, make a featured post about clarified on topic page) and then decry the evil mods that are changing the communities direction without input...
 
I intend to make a featured Meta post as soon as I make it go live that highlights the changes.
 
user20683
@MichaelT Bring it. (I had nothing to do with this but ENTP so I reiterate)
 
Did I say a trigger word or something that brings all the mods to the room?
 
user20683
@ThomasOwens F*Q
 
user20683
:P
 
2:19 PM
The answer to every Politics question:
0
A: Differences between parliamentary and presidential government

Meghraj TaterI think everything is in vai5n. Life sucks.

 
user55340
@YannisRizos btw, will be fun to watch Politics (from a safe distance) with the upcoming US midterm elections.
 
There's an election in the US? Time to give up my shiny Politics diamond...
 
user55340
Elections in the United States are being held throughout 2014, with the general elections scheduled for Tuesday, November 4, 2014. During this midterm election year, all 435 seats in the United States House of Representatives and 33 of the 100 seats in the United States Senate will be contested; along with 38 state and territorial governorships, 46 state legislatures (except Louisiana, Mississippi, New Jersey and Virginia), four territorial legislatures and numerous state and local races. Federal elections Congressional elections Senate elections All seats in Senate Class II will be up ...
 
user55340
(I'm already starting to hear political bits... though its more the initial posturing now of "lets send a bill to the other house of congress that has no chance of passing so we can get sound bites")
 
user55340
That said, might be fun to try to collect some data on the "how many questions tagged XYZ are asked over the course of 2014" where XYZ has some relevance to regularly scheduled political event.
 
user15026
2:31 PM
waves I am at wooooork :D
 
user15026
Which excites me more than it should.
 
So would anyone like to object to me posting that new FAQ page tonight or first thing tomorrow morning?
Otherwise, it's happening.
 
user55340
3:05 PM
@ThomasOwens sooner the better.
 
@MichaelT Hm. Maybe during my lunch break, then?
I'm thinking that'll be soon, since I'm not liking where this problem is taking me. Almost time to walk away and come back after a break.
 
user55340
@ThomasOwens Its more of "it can't happen too soon, please do it" than a "Do it NOW!"
 
I'm not sure if I've said this in here before or not, but designing APIs is hard. Designing messages (XML, JSON, binary, whatever) is easier. However, designing messages isn't something that can be done haphazardly. It still requires thinking and planning and some effort of good design.
 
user55340
3:29 PM
Seen in an advertisement: "I model for a living" followed by some UML.
2
 
@ThomasOwens I feel so sorry for the poor saps that don't know when to do this, stuck continually plying the problem unawares the best solution will come from a break
 
3:46 PM
Would anyone object to "professional programmers" -> "software development professionals"? Although that may be awkward with "...about software development" as the last words. I'll leave it, I think, unless someone confirms/denies.
 
user55340
I don't think its too big of a deal... it would suggest "not just programmers but QA, PM and similar people involved in the SDLC"
 
And I think we want that, yes?
 
@MichaelT "Professionals in the software industry" perhaps if you meant that, I rather prefer the emphasis on professional as it's a relevant qualifier that this site is focused around working industry folks with the hands on knowledge and focus
 
Is "software industry" appropriate? Does that adequately cover people doing this work in finance, aerospace, medical, etc? I think it does.
 
@ThomasOwens I believe so. The "software industry" is pretty well understood to mean the software folks crossing all the other sections. Like when someone says "The Service industry" they mean those working as service folks in the beauty salon space, restaurant space, tourism and recreation, so on and so forth.
 
3:55 PM
OK. Just wanted to be 100% sure. That's my understanding as well.
 
user55340
personally, I'd tend to the "software development professionals" over "software industry" because I know my former employer didn't consider themselves part of the software industry (despite having millions of custom SLOC).
 
user55340
But then, that was part of their problem...
 
Professionals and students?
> Mathematics Stack Exchange is for people studying mathematics at any level and professionals in related fields.
> Programmers Stack Exchange is for people studying software development at any level and professionals in related fields.
 
user55340
That sounds reasonable...
 
user55340
though I'd encourage people to be asking questions at the professional level.
 
4:02 PM
> Theoretical Computer Science Stack Exchange is a Q&A site for professional researchers in theoretical computer science and related fields. We welcome research-level questions in theoretical computer science (TCS).
 
user55340
That said, I've seen some truly awful code from professionals... so not sure if there's a distinction there.
 
@ThomasOwens This works, though I thought we explicitly left out the non-professional group from the site's scope (not that it's a bar that can possibly be enforced)
 
> Programmers Stack Exchange is a Q&A site for students and professionals in software development and related-fields. We welcome academic and professional-level questions.
 
user55340
It doesn't matter if they're a professional working on a hobby project or an intern working on real code...
 
I think "Programmers Stack Exchange is a Q&A site for students and professionals in software development and related-fields." is perfect.
Just leave it at that.
> Programmers Stack Exchange is a Q&A site for students and professionals in software development and related fields who are interested in getting expert answers on conceptual questions about software development.
I think that leaves it open to students and professionals that touch software development in some way who are asking questions that require expertise (gained through a combination of education and experience) of humans in the field.
 
4:09 PM
@ThomasOwens Looks good.
 
Writing up the Meta post now. About to push it all live.
 
hej killar
 
4:33 PM
I'm about to pull the trigger.
 
Do it. You know you want to.
 
Just proof reading one more time.
I'd hate to have an embarrassing typo somewhere.
 
@ThomasOwens "Our users will know fear and cower before our Help Center! Ship it! Ship it and let them flee like the dogs they are!"
 
Haha.
That reminds me of the Klingon programmer thing.
 
@ThomasOwens that's from where I took it :)
6
A: How do I approach a coworker about his or her code quality?

gnat ...the code simply wasn't indented, there were hundreds of lines commented out for no apparent reason, documentation was basically non-existent, coding standards weren't applied consistently (e.g. mixing camelCase and under_scored_variables), variable names were unintelligible, datatype choice...

 
4:36 PM
Done.
 
The SO article is on its 21st revision.
 
THE TRIGGER HAS BEEN PULLED
 
Remove the title; it's auto-generated anyway.
 
No one told me that!
Fixed.
 
@gnat Here, some youtube instructions for how to approach coworkers about that and many similar problems...
 
4:38 PM
Looks good. It's a nice length, too.
 
Getting rid of that duplicate subjective section really helped, I think.
 
@ThomasOwens "what language/technology you should learn next including which technology is better" - is comma needed between "learn next" and "including"?
 
It's actually readable.
@gnat Already done.
F5 up in here, yo.
 
@ThomasOwens yo it's there! very good
 
4:42 PM
Should I edit the line on programmers.stackexchange.com/about to match the one in the on-topic page?
 
What is a reasonable amount of time for planning a two week sprint? We use a full day and it feels like 60 minutes would be about right.
 
@MichaelT what's a good name for a class that's two numbers meant to be the left and right sides of a decimal for use in monetary calculations?
 
Asking ^ on main is instaclose right?
 
ArbitraryPrecisionNumber ?
Kind of a crappy name
 
MoneyAmount?
 
user55340
4:43 PM
@JimmyHoffa That works. Make sure you document that it deals with exact values.
 
user55340
Personally, I think that long, int with the int representing the scale is a better way to go.
 
@JohanLarsson not always money though. Multipliers, lots of things will use it
 
user55340
int.int has the difficulty of representing $0.01
 
@MichaelT I had no intention of making it int.int
 
user55340
and distinguishing that from $0.001
 
4:44 PM
@JohanLarsson 60 minutes? To define the sprint goal, breaking down any complex stories into more manageable tasks, estimating the tasks, and creating a sprint backlog?
 
@ThomasOwens Yes, what is your bid?
 
@MichaelT for our purposes, 0.001 does not exist
 
user55340
$0.10 vs $0.01 then
 
@JohanLarsson It depends on how good your team is at those things.
 
@MichaelT that's 10 vs 1 on the right side int
 
4:46 PM
1
Q: Updated /help/on-topic Page in Help Center

Thomas OwensFollowing a Meta discussion and some discussions in our chat room to iron out some finer points, we have completed an update to the "What topics can I ask about here?" page of our Help Center. Here is a summary of the changes: Minor rewording of the tagline. It still emphasizes questions that ...

 
user55340
Though you may use 10 for each of those... hmm.
 
user55340
I still find the price/precision approach an easier one to work with...
 
@ThomasOwens We suck harder than you can ever imagine :D
 
@ThomasOwens I would do that, otherwise every lazy sucker having their question closed will accuse us of inconsistency
 
user55340
Of note you're not working with an arbitrary precision with that then, you're working with a fixed point math.
 
4:46 PM
I mean, if you get a bunch of stories that are inherently clear and unambiguous and every comes to a quick consensus on what it will take to do the work, it'll go quicker than if your first estimates are all over the board and you need to do more grooming and discussion.
@gnat Done.
 
@MichaelT I agree though, long value + decimal placement int is a better approach, though our whole system has always worked with "Major" and "Minor" it calls the two values, I don't want to change the financial math approach now and be responsible for getting something wrong heh
 
I'm updating the rest of the About page as well.
 
@MichaelT Right, I know it's not arbitrary precision
 
@ThomasOwens If I ask my question on main it will be closed instantly right?
 
FixedPointNumber is another good name for the class, but that as well as ArbitraryPrecisionNumber are both ones that would have people here scratching their heads...
 
user55340
4:49 PM
/**
 * MonetaryValue is a class that represents an exact monetary amount
 * and can represent two digits beyond the decimal point.
 */
class MonetaryValue { ... }
 
@JimmyHoffa not C# right?
 
@MichaelT The problem there is we use it for multipliers as well... maybe I should just call it "Fractional" or "Ratio" as those are other values we'll represent it with
@JohanLarsson yes, C#.
 
decimal not enough? It is meant for money I think.
 
@JohanLarsson Decimal doesn't do the fixed point calculations and representations
frankly I don't know why they represent it the way they do for certain, I just know anywhere money math is done they take a "Major" and "Minor"
I'm just modelling some new stuff based on how it already all works, but I know I'm not going to touch anywhere we have money math just because I'm half afraid of what Ill find
 
@JohanLarsson Maybe not. I'd try to add more details about your team. What is your experience with agile methods, what flavor of agile are you using, and stuff like that. If you add details, I wouldn't have a problem with it.
 
4:52 PM
Ok, I'm more fishing for what some kind of industry average is. And perhaps what can be done to make it faster.
As it is now it is painful and expensive.
 
@JohanLarsson Industry averages aren't that useful. I'd recommend focusing on your problems. Maybe explain your current situation - what happens in your sprint planning meeting. Ask if a day (8 hours) is too long and how to reduce the time.
 
@JohanLarsson I think your last statement is a symptom and you're fishing for the cause in the wrong place.
 
@JimmyHoffa how do you mean?
 
@JohanLarsson The slowness may be a result of other problems that you are having.
 
@ThomasOwens we are new to it and I think an average to use as a benchmark/target has some merit.
 
4:55 PM
Describe your current process and the pain points that you see. We can come up with ideas for reducing the pain. Likely, that could speed up the process.
 
A half day to day long sprint planning isn't uncommon, but as @ThomasOwens said don't worry about industry averages, if your plannings are painful focus on that and what exactly other than the time makes them painful, because to do something right you need to take time out of the equation and spend as long as is needed to be effective. Call me crazy, but tell me there's not something else making them painful where the time is just something you want to shorten because of the pain
 
When a process is new, it tends to take longer to figure it out, as well. That's why I wouldn't worry about time, but reducing pain. Make fewer mistakes, solve problems.
 
@JohanLarsson time shouldn't be a target, time should be a side effect
 
I've got a meeting, but I think you do have a good question for the site in there.
 
yeah, one problem we have is that some of the guys don't want to work, they have np wasting a day sitting in a meeting
What makes it painful for me is that I want to code, code, code.
 
4:57 PM
@JohanLarsson That sounds like a personal problem you may want to work on. Sounds like a good question for TW or Productivity: "I prefer X,Y tasks in my job, but I must do Z also, how do I manage to be effective at Z regardless of my dislike for it?" -- something to that tune might be a good Q for you to ask, no?
 
They embrace uncertainty, absolutely love it. It is ideal cos it can be talked about without acting on.
 
user55340
Design and planning are as important as coding.
 
@JohanLarsson that's called bikeshedding.
well, at least it's similar to it
 
user55340
Sure, coding is what is does things, but doing things in the wrong direction can be quite bad.
 
yea, bikeshedding describes what is going on perfectly.
 
user55340
4:59 PM
There's nothing like finding out that the two teams have designed things in completely different ways before trying to hook them up to work together.
 
We are four devs.
 
@MichaelT I'm kind of surprised how slowly I code anymore sometimes compared to how quickly I used to churn out code... at least sometimes. Largely because I'm constantly trying to re-evaluate the design of what I'm doing. At least when it's new stuff, old or maintenance shit I can wing as quickly as my fingers move
 
And not much design going on. I'm the ~architect~ in the project btw.
 
@JohanLarsson Are you sure that's the right place for you?
 
user55340
I get the "I refuse to leave this code in the same or worse state than I found it"
 
5:00 PM
@JimmyHoffa how do you mean?
 
user55340
Architects aren't supposed to be the ones coding in many setups.
 
user55340
But its a bit too early for golf... ( c2.com/cgi/wiki?ArchitectsPlayGolf )
 
If you just want to code, architect is usually not something you want to do, you may be undercutting yourself and your team being misplaced like that. A good architect does code, but that's not the majority
 
user55340
You're supposed to make sure things hook up right, that the right overall structure is going to be implemented, that this fits with the long term plans of that other team who will either use a web service that is designed here, or implement their own (again...)
 
user55340
The architect of a building isn't the one pouring concrete - they make sure the builders are following the plans and that structure is one that won't be ripped down next month because of some design flaw...
 
user55340
5:04 PM
If you want to code, then code... but if you're an architect then most of the time the issues of code and debug aren't ones that you need to be concerned with.
 
Some background, it is a pretty small program and we are a small team. I'd say large parts are simple and straightforward.
 
@JohanLarsson many people avoid elevating past senior engineer or tech/team lead on purpose because as soon as you cross to management your coding days are done, and architecture much the same. It's common for people to love coding, and just spend their whole careers trying to hang onto that. Sounds like you may be one of those, though how long have you been coding now?
 
In the beginning there were discussions with the consultants in the project and management felt it took too much time and that the design must be owned by the non-consultants. Hence I was named ~architect~
 
user55340
(to an extent, I got laid off at Netapp years ago because I wouldn't - I enjoy coding and didn't want to move to the management path while my job was outsourced)
 
@JimmyHoffa Not long, been hobby programming a couple of years, been doing it at work for about a month.
 
user55340
 
@JohanLarsson oh.. sounds like you're in over your head, but so is your management from the sounds of things. You're in a mess, just enjoy the paychecks and play the game. Learn as you can and with luck in a couple few years you can move on somewhere that's properly organized.
 
user55340
The architect is responsible for putting the system together. How does it interact with other parts? What long term plans need to be on the horizon of that the design needs to not YAGNI itself into a corner? How will other groups use it? How are the APIs designed so that the code can be reused?
 
All of what @MichaelT including even monetary concerns are accounted for to an extent by an architect: Which RDBMS is the cheapest while still meeting our current and future needs? Will that RDBMS cost more in manpower over it's life, is it cheap and easy to find people to work on it or will you be paying out the nose for engineers to maintain it? etc etc
 
user55340
What is the ROI for this design choice vs that one?
 
@JimmyHoffa Don't feel over my head at all, I'm more enthusiastic about working than the others though.
 
user55340
5:13 PM
management comes to you and says "we need to get this out faster, if we scrap features ABC and XYZ will it make it out the door sooner?"
 
user55340
@JohanLarsson The thing is, you need step away from the code - you're supposed to delegate that and only get in there if something is partciarully hairy that needs that experience.
 
Architects attempt to account for tons of variables. It's never all perfect but that's why years of successful project experience is actually important for an architect where it's less important across other jobs in this industry. Many jobs in this industry can have their outputs generated based on known designs, and tested against their inputs and validate how well the person will accomplish the task, much of an architects job is instinct and intuition though, and only time can bolster those
 
I can't tell much about the program but it is simple stuff, no web, no db. The hard parts is some maths that is fun.
 
user55340
In the mean time, you need to make sure the API is clean, that another feature can be added without going back to the drawing board and scrapping everything, that you know where the product is going to be in the next version and the version after that.
 
hi
I wanna ask one question abt sql injection
 
5:16 PM
@JohanLarsson Aye, I'm sure you're doing fine. You're working for some rinky little place where management doesn't even know what the role of "architect" means which is a very common role across the industry. Enjoy the experience you're getting, like I said, in a couple few years you'll move on somewhere and have the experience on your resume to be moving somewhere that is properly organized and knows what they're doing
 
user55340
@Anant ask away...
 
i am confused abt where to sanitize the form post data. I mean i can follow two approaches . I can do this in controller and and i can do this in Model. But if i do it in controller, i can't use bind params in model. because it escapes the quote two times.
 
user55340
owasp.org/index.php/SQL_Injection - a really good place to start.
 
its in term of mvc , where to put the sanitation !
 
@Anant as a rule, you should always sanitize inputs at the last layer before they go to SQL. Always. Other layers on top of that are good too, but always there, regardless. Commands usually manage this for you though
 
user55340
5:17 PM
Some would say "no where" news.ycombinator.com/item?id=7585808
 
ok . so there the actually confusion starts. sorry if its seems silly .
 
user55340
Write the code in the first place so you don't need to worry about the injection in the first place. Prepared statements are a starting point for that.
 
user55340
string sqlcmd = "INSERT INTO Students (name) VALUES ('" + name + "')";
 
i got it, prepared statement are the best way
 
user55340
That code is bad because you'd need to sanitize the 'name' field.
 
5:19 PM
@Anant not silly, it's a good design question and could actually be put on P.SE
 
@JimmyHoffa Actually it is a really good place in many ways. I like that things are small and fits in ones head.
 
it might be a duplicate though so check
 
user55340
1
Q: Does it make sense to sanitize email form input?

BanagoSo, I'm expending this email submission form script for a client and saw something rather strange to my experience. As you can see below, the original programmer has sanitised the user input. Is this a good practice or does this makes sense at all? // Build Message Body from Web Form Input fore...

 
yes right.. that why i am not asking it !
 
user55340
There's a difference between tainted data and sanitized data... if you go through and try to protect the tained data so you can work with it by sanitizing it you will likely miss something and always be fighting the battles of what you missed or what someone has newly discovered.
 
5:21 PM
SQL injection should be sanitized out right where you transform to SQL, JavaScript injection should be sanitized out right where you transform to JavaScript, etc etc, this is my suggestion for all sanitization, that it be done at the end layer to ensure all other transformations are completed before sanitizing. That said, sanitization like validation is generally good to do along the line in multiple places because earlier catches are better performance and better UX
start with doing the safest thing which is to sanitize where transformation occurs, then doing the best thing which is to sanitize on the absolute front as well. This is simply my suggestion and my opinion about how such things should be approached.
 
user55340
If you say "data from anywhere else (be it 'trusted' database or user input) is tainted and needs to only be touched with a very long pole" you don't need to sanitize it can can regard it more 'properly'.
 
user55340
(I'm a 'leave tainted data tainted' proponent)
 
@MichaelT I'm not sure what you're referring to; I'm pretty sure he's only talking about regard of injection attacks
 
thanks i got it.
but here the question.
 
and I know you don't suggest he not destroy data that would cause injection
 
5:24 PM
$params['password'] = "java's";
//after sanitize it it becomes
$params['password'] = "java''s" ;

//but now if i used prepared statement and bind params in models:
// it tries to sanitize again the password and now it becomes
$params['password'] ="java''''s" ;
 
user55340
@JimmyHoffa If you regard the data as tainted and don't ever mix it in commands (such as string append in sql), you won't have sql injection.
 
let i choose to sanitize the data at first level in controller itself
then how can i used prepared statement and bind params in model itself !
 
@MichaelT ...huh? What do you mean "mix it in commands" ? Are you just saying don't ever use commands?
 
sorry, i am using perl/postgres.
 
5:26 PM
oh well
 
user55340
@JimmyHoffa sql = "insert into foo values (" + foo + ", " + bar + " )";
 
@MichaelT you're suggesting this?
 
@Anant everyone knows perl doesn't have controllers or MVC, they don't fit in regexp.
 
user55340
@JimmyHoffa I'm saying that if you regard foo and bar as tainted you'll never even write that in the first place.
 
5:27 PM
@MichaelT of course not, sanitizing data means never using anything but commands/prepared statements code
 
i also know that , But I am working on self maintained mvc LIKE framework !
 
@Anant don't worry about MVC, you've got PCRE!
(ignore me, I'm just prodding @MichaelT, he's a perlist and will likely have many gems for you...)
 
user55340
 sub age_by_id {
          # Arguments: database handle, person ID number
          my ($dbh, $id) = @_;
          my $sth = $dbh->prepare('SELECT age FROM people WHERE id = ?')
            or die "Couldn't prepare statement: " . $dbh->errstr;
          $sth->execute($id)
            or die "Couldn't execute statement: " . $sth->errstr;
          my ($age) = $sth->fetchrow_array();
          return $age;
  }
 
user55340
And there's a prepared perl statement.
 
user55340
You're working with DBI, so the postgressness of the database behind it doesn't matter.
 
5:29 PM
let i passed $password = $dbh->quote($params->{'password'}) ;
 
user55340
Note that $sth has a '?' in the query - thats the parameter. And then execute takes an argument that the database properly puts into the '?' with the proper escaping.
 
and then try to use .
 
user55340
You don't need to quote it when it prepared.
 
$dbh->do($sql,undef,$password)
 
user55340
The database driver / database itself does the quoting.
 
5:30 PM
yes thats what i am asking you .
so basically i should not use to sanitize the data in controller
this is all about mvc design pattern.
right ?
 
user55340
$sql = "select username, password from users where user.id = ?";
$sth = $dbh->prepare($sql);
$sth->execute($id);
 
user55340
There is no need to sanitize the data there.
 
ok fine.
 
user55340
The database itself will take $id and properly handle it - no matter if it has quotes or comments in it.
 
i was given a task /research work Wether i can use sanitization in controller ?
i guess i should not !
 
user55340
5:33 PM
Ahh! Ok... you're asking a different question now.
 
:)
this is basically abt applying escaping two times.
 
Unless you have an eval function somewhere, prepare statements should be all you need.
 
i mean there must be a way so only dangerous data should be escaped.
ok.
i mean $password ="someth's"; #its dangerous
 
It's only dangerous if it can be exploited.
 
$password = ""somthi''s" ; #its not dangerous
 
user55340
5:35 PM
$sth->execute("someth's"); # not dangerous
 
user55340
If your'e going to escape something, sanataize it just before its to be used in a dangerous fashion.
 
$dbh->quote('someth''s') = "someth''s" ;
this all i wanted !
but dbi does not do so
 
user55340
Because you don't want to url encode the data before passing it to the database...
 
user55340
because you might have a soap connection your'e going to send it to rather than a database.
 
instead it do : $dbh->quote('someth''s') = "someth''s" ; #someth''''
 
user55340
5:37 PM
Note that the quote rules for each database can be different.
 
user55340
So thats why you should let the DBI do it.
 
yes .. mysql use escape
\
postgres use quote
its all depends how we instantiate or create our dbh !
right ?
 
@Anant then for safety's sake you should use both escapes from now on!
 
user55340
The $dbh knows the database its backed by and will quote appropriately for it.
 
doubling them up is also good for safety.
 
5:38 PM
Don't listen to Jimmy. He'll tell you to use a monad to escape it.
2
 
user55340
@JimmyHoffa Just convert everything to [10]+ and insert that
 
@RobertHarvey there's no escaping a monad.
 
@JimmyHoffa . but it may leave the data inconsistent
doubling them !
 
@Anant do ignore me, I'm just messing with you. @MichaelT is right in what he's saying ,prepared statements void any necessity for what you're talking about wholesale.
 
user55340
 
user55340
5:41 PM
If you are going to go down the path of "sanitize the data", do it just before you get to where you're going to send it where it needs to go with the appropriate sanitization for that system. That said, its the wrong path - it looks good, but there's a lot of places to stumble. The safest approach is to use the proper templateing / prepared statements and let the system handle it correctly.
3
 
ok
 
user55340
$sql = "insert into users (name, password) values (?,?)";
$sth = $dbh->prepare($sql);
$sth->execute("Miles O'Brien", "foo");
$sth->exectue("Robert and 1=1 -- Drop tables", "bar");
 
@Anant when you use prepared statements, the driver sanitizes the data. This means you never have to, just use prepared statements and let the driver (postgres driver will do proper sanitization for it, and MySQL driver will do proper sanitization for it) sanitize it for you.
 
user55340
All that is perfectly safe without sanitization.
 
What @MichaelT means is that it's safe without you sanitizing it. The execute call delivers the prepared statement with parameters to the driver which sanitizes for you
 
5:44 PM
anyone know c++? i have a question
 
user55340
@Hellovart Try the lounge... (@RobertHarvey why are you looking at me that way?)
 
@Hellovart No one knows C++. No one at all. This is not a possible task. One upon a time people knew C++, but then C++ became...whatever it is now... and no one has known C++ since.
 
thanks Jimmy and MichaeIT
 
user55340
@Anant I'd still give owasp.org/index.php/Guide_to_SQL_Injection a read.
 
@Hellovart If you are trying the longe I suggest that you lounge with them for a while first. They are great but don't like driveby questions.
 
user55340
5:46 PM
Owasp is the source for web security... or a really good one if there are others too.
 
user55340
@Hellovart that said, if its a simple question... you might try here. The worst that will happen is we'll ask why you aren't using Java or C#.
 
@JohanLarsson we're actually pretty good about drive-by's here... now that I think about it, though that's probably due to our seclusion in a lesser known area of SE which means we don't get inundated.
@MichaelT why is my mind telling me there's a relationship between "owasp" and "oasis" ?
I can't recall what either of those are off hand
security standards bodies?
 
@JimmyHoffa yeah this room is as nice as they come. The lounge is not nice to newcomers at all times, hence my advice to be social before dumping the question.
 
@JohanLarsson I'm guessing the lounge is a C++ room, which I would expect to be unfriendly, if I had to try knowing C++ I'd be downright irate most of my waking moments
 
plausible
 
user55340
5:51 PM
@JimmyHoffa No relationship. OWASP is Open Web Application Security Project
 
What's OASIS?
 
user55340
A watering hole?
 
user55340
 
user55340
I was googling too!
 
5:52 PM
I guess they have similar goals, which is why I'm thinking of them together
they were a big source for the various standard SOAP protocols
err extensions
whatever you call them
including lots about security
> February 21st 2006
>
> The WS-Security 1.1 document set that was submitted for public review towards the end of last year has now been approved as a formal OASIS standard. Links to those documents can be found below in the Technical Work Produced by the Committee section.
 
user55340
I know how to make @gnat cry...
 
user55340
1
Q: What is the name of this puzzle?

user134115Anyone knows what is the name of this puzzle:

 
user55340
Open and upvoted and an answer thats not much better than the question.
 
@MichaelT nah, he just wants to buy a sword now
 
I'd say it's a perfect answer. It answers the question precisely, and even provides a link to a source.
 
6:01 PM
@MichaelT blog.stackoverflow.com/2012/06/… "We have a rule internally, @Yannis: “Don’t use behavior on Progse as a reference for anything”. ;-)" -- anything possible outside of Programmers
 
user55340
@RobertHarvey I've got a dozen puzzles at my desk... I could take a picture of each one and ask 'what is this?'
 
Yes, but that's a problem with the question, not the answer.
 
Interesting, i've just decided this particular website is pretty pointless to me, thanks for your downvotes in helping me determine this. — Sickest 5 mins ago
^^^ guys asking questions like this here end up in tears
 
They bring their forum habits here looking for better answers, and wonder why that doesn't work.
 
Hey. No one has started a total complainfest about the Help Center changes.
2
 
6:05 PM
It doesn't look all that different, really. All you've done is plug some of the poor question loopholes.
But that's no small thing.
 
@ThomasOwens I protested against missing comma, does that count?
 
@gnat Want to know what I do to people who protest things? Let's just say they take vacations.
 
user55340
@gnat @ThomasOwens is offering to put you on a cruse ship... a boat in particular... where you can program. Wait, how do you program on a boat?
 
-14
Q: Negative response from moderator, 90 point ding

Wolfpack'08Well, a guy answered my question in a very poor way. So, I flagged his useless response and told him why I was flagging it. The guy came back by down-voting my question and scolding me. Naturally, I told him that his feedback was as helpful as his answering style.... Why would I get dinged 90...

 
@ThomasOwens <complainFest> These are crap! Quit changing things! We all love PHPBB, why don't you just keep it the same way it's always been! Viva La Discucionnes! I'm going to open several threads on P.SE to share my opinions on your changes, we will have our site back!! </complainFest>
happy now?
 
6:07 PM
^^^ 15K point ding in my case
 
I wonder how long it takes to solve a puzzle having 250K tiles in it? — Robert Harvey 5 secs ago
 
@MichaelT how are you not familiar with OASIS? So much of the SOAP extensions come from them, and were largely implemented in Java before anywhere else
 
user55340
@JimmyHoffa as much as I like soap, its been nearly a decade since I've worked with xml based web services.
 
I fear you have been remiss. I'm downgrading you from advisor to mere counselor at this finding.
 
user55340
(I cry at night wishing for some standard json that would describe the json end point that I could validate against...)
 
user55340
6:24 PM
@RobertHarvey that 250k tile problem... I was thinking that if there is distinct chunking of the data 'spot one has this 7x7 set of tiles, go east from there and you get another 7x7 set of tiles that are distinct form the first set' you could have two tables, one of the tile chunks, one of the tiles themselves.
 
user55340
Then you could pull all the tiles from a chunk in one go. With proper partitioning of the table and indexes this could be quite fast.
 
user55340
On the other hand, if you're getting partials at each time, this could still be done if you're willing to sacrifice a bit of space by having the chunks and then doing the proper set options.
 
user55340
select tiles from table where condition1 minus select tiles from table where condition2
 
Is the problem retrieval or storage?
 
user55340
I'd guess retrevial.
 
user55340
6:29 PM
Storage is boring and I doubt you'd be doing chunk updates.
 
Hey, you remember that guy who wanted to troll this room with his relationship problems? What did I finally do to him to make him stop?
 
-1
Q: How does a super-user become a coder?

user126924I'm pretty good with computers, but thus far only front-end stuff (helping friends press ctrl-P), but I really want to get into coding. I have limited experience in HTML, but I'm looking to create programs. Which is the best language for a beginning coder like myself to get into coding, and how s...

^^^ close and delete votes welcome. Can't count how many close reasons it managed to mix together
 
user55340
One of each done.
 
6:45 PM
Has anyone here tried D (the programming language)? Impressions?
 
@RobertHarvey I want to. But like everything, I get bored with the tutorials and have no clue what project to work on.
 
I've long considered putting together a series of HELLO WORLD projects to test out various languages.
 
Isn't there a wiki of hello world in various languages?
Or, I guess, more generally, different things in different languages. Seeing some things that are like 50 lines of C++ or Java in like 5 lines of Prolog is mind blowing.
 
Yeah, that.
 
user55340
6:56 PM
I think the best "how to show off the language" is the "poker hand comparison" of Project Euler.
 
user55340
The thing is there are so many right ways to do that, and each language can be done differently.
 
00:00 - 19:0019:00 - 23:00

« first day (1319 days earlier)      last day (3663 days later) »