Charcoal HQ

ArtOfCode

9:00 PM

this may have something to do with it

J F

@ArtOfCode does running yarn add webpack-dev-server@2.9.7 work?

ArtOfCode

buncha warnings but yes

J F

What kind of warnings?

ArtOfCode

incorrect peer dependencies

J F

Can you copy/paste here?

ArtOfCode

9:08 PM

warning "babel-loader@7.1.2" has incorrect peer dependency "babel-core@6 || 7 || ^7.0.0-alpha || ^7.0.0-beta || ^7.0.0-rc".
warning "babel-loader@7.1.2" has incorrect peer dependency "webpack@2 || 3".
warning "compression-webpack-plugin@1.1.3" has incorrect peer dependency "webpack@^2.0.0 || ^3.0.0".
warning "extract-text-webpack-plugin@3.0.2" has incorrect peer dependency "webpack@^3.1.0".
warning "file-loader@1.1.6" has incorrect peer dependency "webpack@^2.0.0 || ^3.0.0".
warning "postcss-cssnext@3.0.2" has incorrect peer dependency "caniuse-lite@^1.0.30000697".

J F

huh, strange

ArtOfCode

I'm getting those with any yarn command, though, so that's unrelated

J F

As long as it works, it’s probably fine.

maybe just running yarn will help

ArtOfCode

Interesting, new error:

$ "/home/owen/ws/railsbase/node_modules/.bin/webpack-dev-server" "--progress" "--color" "--config" "/home/owen/ws/railsbase/config/webpack/development.js"
YError: Too many arguments provided. Expected max 2 but received 3.

still from dev-server

J F

Does that have a stack trace underneath it?

quartata

9:17 PM

ugh, Rails generates so many files....

I don't need a JS and a Coffeescript come on

J F

?

quartata

Like it has application.js but then when I made a controller it makes a bot_controller.coffee

I'm using one or the other

Why does it generate CoffeeScript by default anyways

J F

because CoffeeScript kinda looks like Ruby

quartata

giggles

J F

@quartata It does that so you can imagine that that file is only loaded on pages with served by BotController — although that’s incorrect.

SmokeDetector

9:20 PM

[ SmokeDetector | MS ] Bad keyword in title, link at end of body: Alabama vs Georgia CFP Final 2018 Live Stream NCAA Football Game Online by NK Boishak on meta.SE

tpu- by J F

J F

huh, a new kind of arrow ^

Glorfindel

!!/watch kingtv\.org

ArtOfCode

@JF sure does

at argsert (/home/owen/ws/railsbase/node_modules/yargs/lib/argsert.js:31:13)
at Object.Yargs.self.alias (/home/owen/ws/railsbase/node_modules/yargs/yargs.js:237:5)
at module.exports (/home/owen/ws/railsbase/node_modules/webpack/bin/config-yargs.js:12:4)
at Object.<anonymous> (/home/owen/ws/railsbase/node_modules/webpack-dev-server/bin/webpack-dev-server.js:54:36)
at Module._compile (module.js:641:30)
at Object.Module._extensions..js (module.js:652:10)
at Module.load (module.js:560:32)
at tryModuleLoad (module.js:503:12)

SmokeDetector

@Glorfindel Added kingtv\.org to watchlist

CI on cb8aa8e succeeded. Message contains 'autopull', pulling...

[ SmokeDetector ] SmokeDetector started at rev cb8aa8e (SmokeDetector: Auto watch of kingtv\.org by Glorfindel --autopull) (running on teward/Solar Flare)

Restart: API quota is 18204.

quartata

Rails is great at keeping a nice log of my mistakes

Hmm there's no way for me to modify this migration without changing the order

I guess I'll just do a proper update

J F

9:29 PM

@ArtOfCode very weird. What does yarn list --pattern webpack output?

ArtOfCode

...a lot

like a lot a lot

$ yarn list --pattern webpack
yarn list v1.0.1
warning package.json: No license field
warning No license field
├─ abbrev@1.1.1
├─ accepts@1.3.4
│  ├─ mime-types@~2.1.16
│  └─ negotiator@0.6.1
├─ acorn-dynamic-import@2.0.2
│  ├─ acorn@^4.0.3
│  └─ acorn@4.0.13
├─ acorn-jsx@3.0.1
│  ├─ acorn@^3.0.4
│  └─ acorn@3.3.0
├─ acorn@5.3.0
├─ actioncable@5.1.4
├─ adjust-sourcemap-loader@1.1.0
│  ├─ assert@^1.3.0
│  ├─ camelcase@^1.2.1
│  ├─ camelcase@1.2.1
│  ├─ loader-utils@^1.0.2
│  ├─ lodash.assign@^4.0.1

quartata

@ArtOfCode It doesn't look like Rails added the belongs_to....

Maybe I did this wrong

ArtOfCode

@quartata then you ran the wrong command :P

quartata

This was the resulting migration of one of them:

class CreateProofs < ActiveRecord::Migration[5.2]
  def change
    create_table :proofs do |t|
      t.reference :user
      t.bool :valid
      t.string :proof

      t.timestamps
    end
  end
end

ArtOfCode

references

not reference

quartata

9:31 PM

tsk

ArtOfCode

rm it and try again

quartata

that's so stupid

ArtOfCode

the heck is a proof anyway

quartata

why didn't it throw an error

Secure Remote Password protocol

The Secure Remote Password protocol (SRP) is an augmented password-authenticated key agreement (PAKE) protocol, specifically designed to work around existing patents. Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. This means that strong security can be obtained using weak passwords. Furthermore, being an augmented PAKE protocol, the server does not store password-equivalent data. This means that an attacker who steals the server data cannot...

ArtOfCode

@quartata rails doesn't know what a valid DB type is, so it accepts anything

quartata

9:32 PM

@ArtOfCode fun stuff

ArtOfCode

@quartata aaaaand... what do we need this for

quartata

@ArtOfCode it's for authentication, I do it for most of my PHP applications

I found a gem that's pretty easy to use

ArtOfCode

> PHP

found your issue

quartata

yes yes I needed food

ArtOfCode

seriously, though, what's wrong with just a key

quartata

9:33 PM

this is for logging in with a password

ArtOfCode

why add more complexity

quartata

like for real users

ArtOfCode

@quartata that's what Devise is for

quartata

It doesn't transmit the actual password

ArtOfCode

don't roll your own

quartata

9:34 PM

@ArtOfCode isn't that for OAuth?

@ArtOfCode I'm not

ArtOfCode

no, it's for user auth

@quartata if you're creating tables and things, you are

quartata

github.com/grempe/sirp

@ArtOfCode It's literally one string I have to store between challenge and auth

it doesn't assume what DB you're using

you might want to use redis i dunno

ArtOfCode

@quartata still, why go to the trouble, added complexity and dependencies, and custom code?

quartata

because I like it and it keeps my stuff safe when I'm not working with HTTPS

ArtOfCode

less error-prone if you do it the usual way

@quartata the only time you should not be working with HTTPS is on local development

in prod this should be on HTTPS

J F

9:36 PM

@ArtOfCode Can you try upgrading webpack? yarn upgrade webpack

ArtOfCode

done

same error

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body: A few questions about my PC build by Unknown User on hardwarerecs.SE

[ SmokeDetector | MS ] Username similar to website in answer: python automation script with web form by URI Online Judge on stackoverflow.com

Glorfindel

@SmokeDetector ignore

SmokeDetector

@Glorfindel Post ignored; alerts about it will no longer be posted.

Conflicting feedback across revisions: current, #1

quartata

@SmokeDetector I thought we didn't report ignore feedback to MS

did we change that

SmokeDetector

9:38 PM

naa- by Floern

J F

@quartata If you’re really paranoid, you can create and trust a self-signed certificate, then make Rails use it

quartata

@JF I wasn't thinking for local development

but yes I do have a self signed cert

J F

@ArtOfCode What does node -p 'require("webpack/package").version' output?

@quartata When would you deploy without HTTPS?

SmokeDetector

[ SmokeDetector | MS ] Few unique characters in body, repeating characters in body, repeating characters in title: d3dddddddddddddddddddddddddddddd by Verux rux on stackoverflow.com

tp- by J F

Mithrandir

sd v

ArtOfCode

9:40 PM

@JF 2.7.0

quartata

I wouldn't personally. but I don't ever assume something I make will be deployed to an environment with HTTPS

it should be able to be reasonably safe without it, at least for something like a password

Glorfindel

@SmokeDetector v

J F

@ArtOfCode OK, turns out webpack didn’t get upgraded :(. Try yarn add webpack@3.

quartata

I still don't get yarn

I should probably install it but

ArtOfCode

@quartata sure, but that ain't your problem. If you're deploying it, you deploy with HTTPS. If you're not, it's someone else's responsibility to do it

honestly, just use Devise

@JF same error

3.10.0 now

thesecretmaster

9:42 PM

@quartata If you're not using https, someone can inject JS to just grab the password. Just assume you're using TLS.

ArtOfCode

^ is a valid point

quartata

@thesecretmaster depends on the kind of attack

J F

Same trace even?

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in title, phone number detected in body, phone number detected in title: 1-866-359-6355 facebook phone number & facebook customer service number by keith darrel on stackoverflow.com

quartata

@ArtOfCode so does Devise just generate its own controller?

SmokeDetector

9:45 PM

tpu- by J F

Glorfindel

@SmokeDetector k

ArtOfCode

@quartata yeah, all in a gem

@JF yup

quartata

great, more generators fun

all right I'll try it

ArtOfCode

eh, not really, two commands

rails g devise:install

rails g devise User

three if you want the views, with rails g devise:views

quartata

but only because I trust that you know Devise better than I know this random sirp gem that I was mostly just crossing my fingers was compatible with thinbus since that's the only good JS library for SRP

J F

9:46 PM

@ArtOfCode but the line of code causing the issue was changed to fix it in the version you’re using.

quartata

~~so just remember when the world is on fire it's all your fault~~

maybe too much

joke went too far

@JF yaaarrrrrgs

J F

@quartata Pirate-themed!

Byte Commander

Eh, for the stickers form, does anyone know if they want to have an SE profile URL (from SE, SO or any other site?) or metasmoke profile URL or what?

ArtOfCode

I used my SO profile

J F

@ByteCommander I just did SO. You don’t have an MS profile

ArtOfCode

9:49 PM

@JF huh? Shouldn't be related to a help alias?

J F

@ArtOfCode at this point, I’d suggest rm -r node_modules yarn.lock

ArtOfCode

@JF weeeeell, you technically do, but you just can't see it

J F

and running yarn again

Mithrandir

@ByteCommander I used https://literature.stackexchange.com/users/58/mithrandir?tab=profile

Byte Commander

k, will use Ask Ubuntu then

thanks

ArtOfCode

9:50 PM

@JF same thing

Mithrandir

personally I'd use whatever your chat parents is, as /people links to your chat profile

J F

I have no idea why it isn’t working @ArtOfCode. Sorry :(

ArtOfCode

@JF nor me shrug

quartata

So that created a User model

ah, now it doesn't like me anymore

because I didn't give it a key

Byte Commander

"Your response has been recorded. You can expect your swag to arrive in the next 6 to 8 weeks! Or you can at least hope so... I hope so..." xD

4

Mithrandir

9:53 PM

yeah, I laughed at that too

quartata

class Command < ApplicationRecord
  belongs_to :bot
end

@ArtOfCode worked this time

and now the migrations are in a nice order

ArtOfCode

@JF reinstalling completely seems to have fixed the Yargs error, but still telling me it's missing argument values

quartata

now I can get to actually writing code

here we go

say @ArtOfCode did you know about ActiveJobs?

ArtOfCode

@quartata vaguely

quartata

I just noticed it made a jobs/ directory and it looks very similar to Whenever

but like builtin

ArtOfCode

9:57 PM

dunno

J F

Why does the SO dev survey tell you to leave the question blank if you prefer not to answer, but also give a “I prefer not to answer” option?

Catija

I wonder... I let him know that he could wait on mailing the stickers until they sent out the swag from the Hats contest on MSE... though, maybe that's more work for them.

I figured it'd save them some money if they're really sending the envelopes out FedEx.

Yvette Colomb

Congrats @SmokeDetector

quartata

so is authenticate_user! something that Devise provides? @ArtOfCode

ArtOfCode

@quartata yup

quartata

10:05 PM

last stupid question: does Ruby prefer the C++ style of

class Blah

public
  def ...

private
  def ...

end

or

class Blah

  public
    def ...

  private
    def ...

end

(C++ traditionally does not indent the access modifiers)

I should ask Rubocop

ArtOfCode

@quartata flat indentation, with a blank line

private

def something; end

quartata

so #2, but with a line break?

ArtOfCode

and the method at the same indentation level as the access modifier

quartata

gotcha

ArtOfCode

would recommend copying metasmoke's .rubocop.yml to this and running rubocop -Da to automatically fix most things

quartata

10:14 PM

definitely

hmmm it's occurred to me that having this trigger on an after_create or after_update isn't good because there's some other tables that have to be updated first

I kinda want it to happen as a background task though

not that it's that slow

but

ArtOfCode

Thread.new it from an action then

quartata

yeah that's good enough

This is right, right? render :text => "Missing config", :status => 400

J F

You can also do render text: "Missing config", status: 400 in new-ish versions of Ruby.

ArtOfCode

from 2.1 I believe

MS on 2.5

John Dvorak

public and private don't actually create new lexical blocks in Ruby. They just set an internal variable on the class that says what access should be given to new methods or, if given a method name (private def foo ... without newline), modify that method's accessibility.

quartata

10:24 PM

hrmm, I just realized this file ended up being called BotControllerController

ArtOfCode

@quartata yeah, you only need the name with rails g commands

Makyen

@ArtOfCode @Cerbrus With AIM installed, FIRE POSTs to .../api/w/post/{postId}/deleted, but the MS API always responds with an error: "Forbidden" and the message "The API key used to make the request is not trusted." The actual POSTS are sent in metapi.js. FIRE's code specifically tests for AIMs presence and only makes these calls if AIM's installed. This POST is just silently failing all the time.

Are these (delete) POSTs something that's desired, and permissions on the server need to change to accept FIRE's API key, or should sending the failing POSTs be removed from FIRE? BTW: FIRE detects AIM and calls the method to report a post as deleted here.It's not clear to me why this POST would only be done when AIM is installed (i.e. AIM isn't supplying the data, that comes from the SE API).

One possibility as to why: Is FIRE supposed to be borrowing AIM's API key for this POST? Did the call to send the POST just mistakenly get placed within the if detecting AIM (which is only supposed to hold setting the ai-deleted class)?

ArtOfCode

@Makyen Neither :) That's a thing that was originally intended to help us get deletion time statistics for all posts into metasmoke, instead of only some (Smokey only sends deletion times for some; it drops the websocket it uses to get them after 10 minutes, IIRC).

It didn't work, though, because (IIRC) FIRE only checks deletion times when the user loads the report, which is usually significantly longer than the true deletion times.

So either FIRE needs to update so that it fetches accurate deletion times and then I can re-trust the key, or it could just not try at all

quartata

@ArtOfCode Does AR automatically know to fetch the ID when I'm looking up a foreign key (like :user => <user object>) or do I have to do :user => user.id

ArtOfCode

@quartata the former

quartata

10:37 PM

nice

ArtOfCode

You can do either .where(user: User.first) or .where(user_id: User.first.id)

the actual column in the database is user_id, but if you pass user it'll recognise the association name and do the ID transform for you

quartata

right that's what I was wondering

Yvette Colomb

have you guys done the dev survey?

SmokeDetector

[ SmokeDetector | MS ] Pattern-matching website in answer: Manually add "jump to" sections in video on pornhub videos by Sheldon Funk on webapps.SE

tpu- by Yvette

Yvette Colomb

wtf is that spam?

Mithrandir

10:49 PM

@SmokeDetector f

ArtOfCode

@YvetteColomb it's not

SmokeDetector

tp- by Yvette

Yvette Colomb

tp was a mistake

Mithrandir

Deleting the message won't help much...

ArtOfCode

it's fixed

!!/location

SmokeDetector

10:50 PM

@ArtOfCode teward/Solar Flare

Yvette Colomb

I changed the feedback

soz - I'll get back to something else that is not stuffing up smokes

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, link at end of body, phone number detected in body: Office 365 Customer Service by Garry Smith on askubuntu.com

tpu- by ArtOfCode

Mithrandir

@YvetteColomb don't forget to retract the actual flag

Yvette Colomb

@Mithrandir thnx

quartata

It kinda bugs me that Rails automatically pluralizes things

Videonauth

11:03 PM

> SmokeDetector 100k reported posts celebratory swag!
Your response has been recorded. You can expect your swag to arrive in the next 6 to 8 weeks! Or you can at least hope so... I hope so...

omg lol

SmokeDetector

[ SmokeDetector | MS ] Misleading link: How to start with launchd a bash script that calls fswatch with \`&\` by kbdluv on apple.SE

fp- by Videonauth

Makyen

11:16 PM

@ArtOfCode Hmmm... AFAIK, the only way to determine that a post is deleted via the SE API (i.e. aside from the SE websocket) is to try to fetch the post's data and get nothing back. This means that there's no way to get a specific delete time (outside the websocket), other than: A) scrape the deleted post's page (which we're not supposed to fetch, just for that purpose); or B) poll, which means on the server side, you'd just want to accept the earliest (approximate) report.

I'm fine with leaving the POST in and just ignoring the error (as is currently done). It's not causing harm on the script side, just small net traffic & compute. However, if left in, I'd suggest: sending the POST regardless of AIM being installed, but only send the POST if the fact that it's deleted is new information (no check is currently made). At least with that change the data that's attempted to be sent would be as useful as possible, while not being redundant.

ArtOfCode

@Makyen the way to do it is to subscribe to the websocket

then SE tells you exactly when it's deleted

Makyen

11:30 PM

@ArtOfCode Yes, but if that's what's desired, then it makes sense for MS to do that (which it does for 10 minutes). It doesn't seem reasonable for all FIRE users to subscribe to the SE websocket for each post, just to all report the data to MS. The existence of the POST to report deletes in FIRE appears to indicate that the data is desired, but not enough to actually keep the websocket alive on the MS side. For FIRE, it already subscribes to the MS websocket, from which it gets deleted notices.

Currently, FIRE finding out that the post is deleted is just a side-effect of trying to get post information. I'm not suggesting that FIRE poll just to find out this information. If FIRE needs/wants the info, beyond what's already obtained from the MS websocket and as a side-effect of trying to get the post data, then it should subscribe to the SE websocket, as you've said. However, I'm not really seeing that FIRE having that info in real time as all that desirable.

ArtOfCode

@Makyen the idea behind letting FIRE do it was to distribute the load - instead of making MS keep WS connections alive for longer, let users do it because there's more of them.

Undo

@quartata use rvm

quartata

it just tries to install homebrew and call that

Undo

rvm.io

quartata

I've got a decent setup going where I have a shared folder with a vagrant instance that runs the app

It's not a huge deal

Undo

11:32 PM

for some definitions of 'decent' :P

but yeah, that works

ArtOfCode

If we want FIRE to do that, then it needs to get it from the SE socket - no other source is accurate enough. If we don't, that's fine - we get most from MS' socket monitoring

Undo

I've never had issues with rvm on macOS. Just works.

thesecretmaster

You probably have homebrew installed. I think it comes with macos

quartata

no it doesn't

thesecretmaster

Huh. I don't ever remember installing it, but I have it. Meh.

quartata

11:39 PM

Probably because rvm installed it for you

silently

and without mercy

thesecretmaster

Possible

Makyen

@ArtOfCode Hmm... OK. I'm not really familiar in detail with the actual load which keeping the socket open for longer than 10 minutes entails, but it seems that the overall load is quite a bit higher from having 10 FIRE users keeping the SE websocket open (and the MS websocket), and then having all 10 send a delete-report to MS when they get the data from SE. Overall, doing it that way seems wasteful, if FIRE is not already keeping the SE websocket open for other reasons, which it isn't.

@ArtOfCode OK. That sounds like: Remove it. If FIRE chooses to subscribe to the MS websocket for other reasons, then sending delete-reports to MS would be nice. I'm good with that & it sounds reasonable. It appears we were miscommunicating earlier. Sorry about that.

ArtOfCode

@Makyen nah that's fair enough

!!/test %20http

SmokeDetector

> Would not be caught as a post, title or username.

Transcript for