Tuesday, 2013-01-22

*** Joins: dhx1 (~dhx1@60-241-62-124.tpgi.com.au)00:09
dregad@dhx1 greetings00:19
dregaddo you know if oss-sec have assigned CVE's to the remaining 2 issues ?00:19
dhx1dregad, hi00:37
dhx1dregad, they haven't yet... it probably got forgotten/no one was interested00:38
dhx1I wouldn't wait on them to release the new version of MantisBT... just remove the CVEs from the announcement00:38
dregaddhx1 i was going to do exactly that, just checking before working on preparing the release01:34
dhx1thanks :)01:38
dregadso all we needed to get you back to mantis was a few good security issues, eh ? ;-)01:39
dhx1haha01:40
dhx1I haven't been coding anything lately...01:40
dregadslacker :P01:40
dregadbusy life ?01:41
dhx1I was playing with PostgreSQL and trying to implement RBAC security/etc01:41
dhx1more uninterested01:41
dhx1you've been doing a great job keeping MantisBT going though!01:41
dregadit does feel lonely sometimes01:41
dregadi can hear the echo of my commits for days after they're pushed01:42
dhx1I've been happy to see GitHub send me patch request notifications constantly from random people :)01:42
dregadyou can switch off the notifications, you know that ?01:42
dhx1I actually like receiving them even if I don't read any... lots of random committers is a sign of a healthy project01:43
dhx1the reason I was playing with PostgreSQL is that I think most web apps are !CRAP!01:44
dhx1mostly because they use a relational database server without ever defining any relations/constraints/triggers/etc01:45
dhx1thus they end up being high non-consistent (and hard to manage) because they reimplement (poorly) the logic that relational database servers are designed to provide (at high levels of performance/scalability)01:46
dregadits always the same story01:46
dregadand the same goes for large, enterprise-class commercial applications too, by the way01:46
dregade.g. Siebel01:46
dhx1oh yes, even worse... they abstract a database on top of a database :o01:47
dregadit's often driven by the needs to support several RDBMS01:47
dhx1a bad idea IMO01:47
dhx1support the SQL standard and handle quirks separately for weird implementations that don't follow the standard01:48
dhx1my attempts are stuck because row-based security within PostgreSQL is not implemented01:50
dhx1it's a very difficult problem to solve as well (other database servers seem to implement RLS to lower standards that PostgreSQL won't drop to)01:51
dregadyou're right on principle, but the problem is you can't force people to use a given RDBMS01:53
dhx1you can if you're the only user haha :P01:54
dregador an RDBMS vendor (even OSS) to strictly adhere to the standard01:54
dregadspeaking of which - have you noticed that the SQL standard is not freely available on www (at least i was not able to find it)01:54
dhx1yeah, thank ISO for that01:54
dregadbastard$$$$01:55
dhx1I did find it somewhere before... let me see01:55
dhx1the latest standard has a few drafts online: https://www.google.com/search?q=intitle%3A%22final+committee+draft+%22+intitle%3A9075+site%3Ajtc1sc32.org+201101:56
dhx1https://en.wikipedia.org/wiki/SQL:2011 for more01:57
dregadbut if you need SQL92, you're out of luck01:58
dregadcheers for the link anywa01:58
dregad*y01:58
dhx1SQL92 is fairly old...01:58
dregadyes but still in use01:58
dhx1it'll mostly be rolled up in the new standards though01:59
dregadand sql2011 will be available in major rdbms in a bastardized version in about 2020 ;)02:00
dhx1it's like HTML/C++11 though... implementations slowly add features over the years and may never fully adhere to the standard (some parts of the standard may be wrong/cannot be practically implemented/no one cares about those features)02:01
dhx1http://www.postgresql.org/docs/9.2/static/features-sql-standard.html02:03
dregadpostgres is good with standards compliance even though there are a few disgressions02:05
*** Quits: dhx1 (~dhx1@60-241-62-124.tpgi.com.au) (Quit: Leaving)03:34
GitHub84[mantisbt] dregad pushed 18 new commits to master-1.2.x: http://git.io/sNVr9A05:43
GitHub84mantisbt/master-1.2.x f8a81a3 Lapinkiller: fix #14559 - Filter for adm_report_config.php...05:43
GitHub84mantisbt/master-1.2.x 259f95c Damien Regad: Issue #14559: improve adm_report_config.php filter...05:43
GitHub84mantisbt/master-1.2.x 8890b21 Damien Regad: Make it possible to edit config options in adm_config_report.php...05:43
GitHub134[mantisbt] dregad tagged release-1.2.13 at ff8d72a: http://git.io/rE3Sbg05:43
*** Quits: Amgine (~Amgine@wikinews/Amgine) (Ping timeout: 246 seconds)06:24
*** Joins: Amgine (~Amgine@wikinews/Amgine)06:38
*** Joins: giallu (~giallu@fedora/giallu)06:46
*** Joins: giallu_ (~giallu@fedora/giallu)06:48
*** Quits: giallu (~giallu@fedora/giallu) (Ping timeout: 272 seconds)06:52
* dregad is now away - Reason : away06:56
* dregad is no longer away - Gone for 8 secs06:56
*** Quits: kirillka (~Miranda@195.242.142.17) (Quit: kirillka)07:13
*** Quits: Amgine (~Amgine@wikinews/Amgine) (Ping timeout: 240 seconds)09:36
*** Joins: Amgine (~Amgine@wikinews/Amgine)09:36
*** Joins: Paul_46 (~IceChat09@cpc1-enfi15-2-0-cust580.hari.cable.virginmedia.com)11:06
*** giallu_ is now known as giallu12:57
*** Joins: BD-- (BD-@78-20-186-15.access.telenet.be)13:23
*** Quits: BD-- (BD-@78-20-186-15.access.telenet.be) ()13:29
*** Quits: giallu (~giallu@fedora/giallu) (Ping timeout: 272 seconds)14:52
dregadhi jreese16:05
jreesehowdy16:05
dregadhow are things16:05
jreesedoing well16:05
dregadgood to hear16:05
jreesehow are things on your end?16:06
dregadquestion: have you ever used the adm_config_report.php page on mantisbt.org ?16:06
jreeseI think so, but not sure16:06
dregadit's getting hard to keep motivated @work with the site closure looming on the horizon.16:07
jreeseI can imagine16:07
dregadso i spend time on mantis ;)16:07
jreeseand yes, just visited that page, and I have used it16:07
dregadwait, does it load now ?16:08
jreesehttp://www.mantisbt.org/bugs/adm_config_report.php loads for me16:08
dregaddammit16:08
dregadit was breaking this morning16:08
dregadbeen spending hours to figure out why16:09
dregadnot for nothing as it turns out as there was indeed an issue with the updated code16:09
dregadbut still, don't understand why it was not loading for me16:09
jreesewhen in doubt, login from incognito mode or private browsing session :P16:10
dregadshit, it's still not loading here16:10
dregadi get a blank page16:10
dregadand nothing in the error log !?16:10
dregadwhat do you mean, incognito mode ?16:10
jreesePHP fatal error16:10
jreesethat's the only way it won't show up in logs16:11
dregadwell it's a memory issue for sure16:11
jreesein Chrome and Firefox, there is a way to start a private browsing mode (Chrome calls it incognito mode)16:11
dregadi tested with a dump of 'bugs' db locally16:11
dregadah i'm on firefox, maybe it works on chrome (don't have it installed)16:11
dregadanyway, in 1.2.12 this page would load, requiring ~160M memory (the bulk of which is to load the user selection list at the bottom)16:12
jreeselol16:13
dregadand with 1.2.13 updates, the memory footprint increases to nearly 700M (!)16:13
jreesesounds like the issues we were having with the edit issue page, which is why the user dropdown is now async16:13
jreesewow16:13
dregadthanks to several calls to our good friend array_merge()16:13
dregadand having 20K+ users in the system16:13
dregadanyway, i wanted to find out if it had ever worked for you16:15
dregadas on my test box, with memory_limit = 128M (same as mantisbt.org), it fails to load even with 1.2.12 code16:15
jreeseyeah, it's always worked just fine on my own installations16:15
dregadi get PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted16:15
jreeseI can't remember the last time I tried running it on mantisbt.org before today, but maybe the issue is related to your own permission level16:16
jreeseie, if you're not an admin16:16
dregadnah16:16
jreesebecause it seemed to load relatively quickly for me16:16
Paul_46oh just the person16:16
dregadyou can't access that page if you're not admin16:16
jreeseah16:17
Paul_46dregad: i'm starting to think that it'll be easier to work on mantis2 as a new project16:17
Paul_46people keep doing retarded things in mantis116:17
Paul_46apart from adm_config_* being something that we do need to replace for various reasons16:19
Paul_46(so i'm not quite sure why we working on updating it)16:19
dregadjreese: can you confirm the memory usage and time to load on your browser16:19
dregadPaul_46 because people use it and need it fixed16:19
Paul_46we do a commit to master-1.2.x 20 minutes before a release16:19
Paul_46dregad: what was *broken* with it?16:20
jreeseTime: 1.7684 seconds.16:20
jreesememory usage: 79,904 KB16:20
Paul_46it looked like new functionality to me16:20
dregadPaul_46 check the related issues on the tracker - major performance issues if you have a large config table16:20
dregadand the filter is indeed new functinality, but extremely helpful in the above case16:21
Paul_46anyway16:21
dregadjreese - i don't get it16:21
dregadwhy won't it load for me here !?16:21
Paul_46I'm going to leave it to others to port those patches16:21
Paul_46I have language strings converted16:22
jreesedregad: no idea16:22
Paul_46and some free time16:22
Paul_46so back to mantis216:22
Paul_46over the next week or so16:22
Paul_46and we need to get it into an alpha state16:22
dregadjreese: you are talking about http://www.mantisbt.org/bugs/adm_config_report.php right ?16:23
Paul_46personally, i'd rather we undid the 1.2.13 addition for the adm_config stuff16:23
Paul_46as it changes cookies16:23
jreesedregad: yes16:23
Paul_46and i'd rather not see that change in master/2.x at least not in that way16:24
Paul_46but then people just release what they feel like so who cares16:24
Paul_46:)16:24
dregadPaul_46 - I asked about this nearly 1 week ago on the mailing list16:25
Paul_46hidden away in a thread about a security issue in a feature we added in a .12 release16:25
dregadwell that's not the point16:26
dregadyou could (should) have responded then and there16:26
dregadnow is a bit late isn't it16:26
Paul_46can you port some of your patches to 2.x?16:27
Paul_46once i do locale/lang_get commits which gets rid of next16:27
Paul_46or more, pulls everything that dhx/myself thought was left in next16:27
dregadonce 2.x becomes something more tangible, i'll gladly stop working on 1.216:28
Paul_46http://piratepad.net/5pfh2ikYa8 was the list I had from talking to dhx at end of october16:28
dregadand port whatever16:29
Paul_46as soon as i'm happy those are clear, it means there's nothing left in next we need16:29
dregadyour branch has been forked so long ago, do you have a record of everything you did (or did not) port16:32
Paul_46I was trying to find that earlier on16:32
Paul_46i think there's a 2nd pirate pad doc16:32
Paul_46I also had some printouts16:33
Paul_46it shouldn't be too hard to diff though16:33
dregadyou must be joking16:33
dregadyou ported some things not keeping the commit messages16:33
dregadand there's no diffing the source, it's too different16:33
Paul_46yea, well the initial fork of the source was done at the point both dhx/myself stopped working on stuff on master for a bit16:35
Paul_46but then other new people came along and started16:36
Paul_46which I initially ignored as it was mainly rombert doing soap stuff which was 'ok'16:36
Paul_46but then effectively that was also a mistake16:36
Paul_46as you say, the source is now quite different16:36
Paul_46there's security "fixes" in the mantis-2.x branch that aren't in master16:37
Paul_46and security fixes in master that need porting16:37
Paul_46and stuff that's now been fixed in master that we'd gone 'best way to fix this is to rewrite X' or whatever16:38
Paul_46== lovely mess16:38
dregadwelcome to the real world16:38
Paul_46i'm hoping though it shouldn't be too hard to tdiy up16:39
Paul_46main thing is i need to try and get dhx's locale stuff sorted16:40
Paul_46which would be really useful if siebrand still came on here as he could generate the .po files dhx was planning on using16:40
dregadyou can get hold of siebrand on #mediawiki-i18n16:40
Paul_46does he not come here anymore? ;/16:41
Paul_46mm, think he's said that before16:41
dregadjreese, just installed chrome, it behaves a bit "cleaner" than firefox, in the sense that it reports an HTTP 500 instead of a f*ing blank page16:41
jreese:)16:41
dregadbut adm_config_report.php still won't load16:42
jreeseworks for me :D16:42
dregadi don't understand how that is even possible16:42
jreeseI've always wanted to close a legitimate bug with that16:42
dregadLOL16:42
Paul_46anyway, i'm off to bed16:42
Paul_46dregad: btw, i'm thinking mantis2 needs to be sync'd by 3rd weke of feb or it probably wont happen16:43
jreeseso IOW it's not going to happen? :P16:43
dregadwhat do you mean16:43
Paul_46jreese: well, it'll happen16:44
Paul_46as I want to update mantis at work at some point16:44
Paul_46but more, if I spend some time between now and then16:44
Paul_46update work16:44
Paul_46i'll probably have a break for a month until april16:44
dregadjreese, mind to PM me your IP so I can lookup in the apache logs16:44
Paul_46which means it would get more out of sync16:44
jreesedregad: it's Facebook's public IP: 173.252.71.616:45
Paul_46anyway16:45
Paul_46nn16:45
Paul_46dregad: btw, you stopped going on skype?16:45
dregadi don't start it up all the time16:46
dregadeats too much memory16:46
jreeseI don't start skype either, because then people try to talk to me, or even worse, video chat....16:46
Paul_46well, i'm gone i guess16:46
Paul_46but we do need to work out a time to go through things16:46
Paul_46as atm, whether we end up with a 1.3 releae or a 2.x release or giving up with mantis altogether16:48
Paul_46every time someone does a commit we generally add 2 days to the next non-security release16:49
Paul_46nn16:50
*** Quits: Paul_46 (~IceChat09@cpc1-enfi15-2-0-cust580.hari.cable.virginmedia.com) (Quit: If at first you don't succeed, skydiving is not for you)16:50
dregadjreese - i get it16:55
dregadcan you try to select 'all projects' and reload the page please ?16:55
jreeseah ha16:56
jreese50016:56
dregadok, i'm not crazy ;)16:56
dregadat least its consistent16:56
jreesedregad: this is why I said "when in doubt, use incognito mode" :P16:56
jreesethat was the first time I've ever logged into mantisbt.org from this machine16:57
dregadbut the default project is stored in user's preferences, not in a cookie16:58
dregadso incognito does not help16:58
dregadbut anyway, at least now I know why it behaves like that16:58
dregadso thanks :)16:59
dregadand it turns out the culprit is not my changes to adm_config_report, but an older commit17:01
jreeseah, forgot that was a user pref17:02
jreesebeen too long17:02
jreeseor not long enough...17:02
dregad21746dd1 / fix for #1013017:02
GitHub64[mantisbt] dregad pushed 2 new commits to master-1.2.x: http://git.io/Q9lDBQ17:38
GitHub64mantisbt/master-1.2.x ced463b Damien Regad: Changed version to 1.2.14dev17:38
GitHub64mantisbt/master-1.2.x e61e63c Damien Regad: Fix huge memory consumption for print_user_option_list()...17:38
*** Quits: dregad (~dregad@203-236.193-178.cust.bluewin.ch) (Quit: We be chillin - IceChat style)17:47
*** Joins: intripoon (~quassel@manz-590c9c02.pool.mediaWays.net)18:02
*** Quits: intripoon_ (~quassel@manz-590f0d68.pool.mediaWays.net) (Ping timeout: 256 seconds)18:05
*** Joins: kirillka (~Miranda@195.242.142.17)21:15
*** Joins: giallu (~giallu@fedora/giallu)23:46

Generated by irclog2html.py 2.10.0 by Marius Gedminas - find it at mg.pov.lt!