| 00:00.23 | *** join/#bzflag bryjen (n=bryjen@75.81.201.131) |
| 00:00.23 | *** mode/#bzflag [+v bryjen] by ChanServ |
| 00:07.36 | *** join/#bzflag jcp1 (n=jw@unaffiliated/javawizard2539) |
| 00:09.46 | *** join/#bzflag ahs3- (n=ahs3-@adsl-065-005-193-158.sip.rdu.bellsouth.net) |
| 00:19.16 | *** join/#bzflag spldart (n=spldart2@bzflag/contributor/spldart) |
| 00:19.16 | *** mode/#bzflag [+v spldart] by ChanServ |
| 00:22.31 | trepan | delusional_: meshface links can do that |
| 00:22.55 | trepan | (simulate a phydrv bounce with a fixed output velocity) |
| 00:23.17 | trepan | and fwiw, it looks like someone jacked the phydrv angular velocity DR ... |
| 00:24.13 | trepan | it seems to stutter, haven't looked at it much (15 seconds on spazzy's map) |
| 00:25.45 | delusional_ | DR = dead reckoning? are you saying his map is wrong? or the client code is wrong? |
| 00:26.01 | *** join/#bzflag me1 (n=ausom@bzflag/player/Me1) |
| 00:27.10 | trepan | client-code |
| 00:27.33 | trepan | (as a first guess, could be his map too) |
| 00:28.22 | trepan | but a map error looks to be unlikely |
| 00:55.18 | *** join/#bzflag mrapplecomputer1 (n=mrapplec@unaffiliated/mrapplecomputer1) |
| 01:09.24 | *** part/#bzflag mebigfatguy (n=dave@38.118.53.85) |
| 01:10.21 | *** join/#bzflag mebigfatguy (n=dave@38.118.53.85) |
| 01:19.37 | me1 | building trunk in MSVC i get an error in date: "c:\svn\bzflag3\src\date\builddate.cxx(179) : error C3861: 'GetNativeSystemInfo': identifier not found |
| 01:19.38 | me1 | " |
| 01:19.59 | JeffM | is that the only error? |
| 01:20.05 | JeffM | or do you get others? |
| 01:20.13 | JeffM | like messageboxa not found |
| 01:20.38 | me1 | for the date project, that's the only error |
| 01:20.59 | JeffM | what version of MSVC do you have? |
| 01:21.04 | me1 | 2008ee |
| 01:23.17 | JeffM | checking |
| 01:26.15 | JeffM | what version of windows are you on? |
| 01:26.23 | JeffM | it is a newer API call |
| 01:26.41 | me1 | XP |
| 01:27.29 | JeffM | if you right click on that item in the file and go to "go to definition" where does it take you? |
| 01:28.02 | me1 | it's not defined |
| 01:28.19 | JeffM | did you install the full platform SDK when you installed visual studio? |
| 01:28.59 | me1 | I have "microsoft platform SDK for windwos server 2003 r2" |
| 01:29.08 | me1 | if there's a newer version, i'll try that |
| 01:29.36 | JeffM | actualy there is something else to try first |
| 01:29.44 | JeffM | take the word "native" out of it |
| 01:29.49 | JeffM | so it's just GetSystemInfo |
| 01:29.53 | JeffM | and see if that works |
| 01:30.02 | me1 | yay |
| 01:30.09 | me1 | that works |
| 01:30.11 | JeffM | that sucks |
| 01:30.16 | me1 | heh |
| 01:30.27 | JeffM | it means we can't detect WoW |
| 01:30.29 | me1 | will that not work with newer windows versions? |
| 01:30.36 | JeffM | it should |
| 01:30.49 | JeffM | but it won't detect the real OS on 64 bit windows |
| 01:30.59 | JeffM | it'll return the WoW version, not the real version |
| 01:31.29 | me1 | ah |
| 01:31.41 | trepan | Cataclysm! |
| 01:31.47 | JeffM | you could try using this, http://www.microsoft.com/downloads/details.aspx?FamilyID=c17ba869-9671-4330-a63e-1fd44e0e2505&displaylang=en |
| 01:31.51 | JeffM | 2003 is pretty old |
| 01:32.23 | *** join/#bzflag R0b0t1 (n=Enigma@unaffiliated/r0b0t1) |
| 01:33.11 | *** join/#bzflag R0b0t1 (n=Enigma@unaffiliated/r0b0t1) |
| 01:35.24 | JeffM | did you install the SDK seperately or did the installer for 2008 EE do it for you? |
| 01:35.32 | me1 | I don't recall |
| 01:35.36 | me1 | I think it was seperate |
| 01:35.46 | JeffM | ok, then you just need to update |
| 01:36.05 | JeffM | I'm not that concerned about supporting a 7 year old SDK |
| 01:37.00 | JeffM | we said desuporting windows 2000 was fine too, so that'll just mean that you'll need a current SDK for windows XP+ |
| 01:41.30 | *** join/#bzflag xaver__ (n=xaver@pD9ED5F08.dip.t-dialin.net) |
| 01:45.10 | teatree | gnite |
| 01:45.31 | *** join/#bzflag chaoscon (i=jeremy@smartserv/ceo/chaoscon) |
| 01:47.44 | *** join/#bzflag PlasticTank (n=PlasticT@pool-70-19-80-24.ny325.east.verizon.net) |
| 01:51.25 | *** join/#bzflag chaoscon (i=jeremy@smartserv/ceo/chaoscon) |
| 02:11.03 | *** join/#bzflag Pimpi (n=frank@gondolin.pimpi.org) |
| 02:16.01 | *** part/#bzflag JeffM (n=JefferyM@bzflag/projectadmin/JeffM) |
| 02:20.40 | CIA-75 | BZFlag: 0360.242.104.73 07http://my.bzflag.org * r6851 10/w/Zone: |
| 02:32.58 | *** join/#bzflag llrr (n=llrr@219-90-167-196.ip.adam.com.au) |
| 02:37.21 | *** join/#bzflag JeffM (n=JeffM@bzflag/projectadmin/JeffM) |
| 02:37.21 | *** mode/#bzflag [+o JeffM] by ChanServ |
| 02:39.48 | JeffM | mrapplecomputer1: is your BZFSWebAdmin project open source? |
| 02:47.38 | JeffM | also why does it ask for global login info on it's own page not using the webadmin popup? |
| 02:53.41 | JeffM | sorry weblogin popup |
| 02:57.10 | mrapplecomputer1 | JeffM its not open source yet, but when I release it it will most likely bee |
| 02:57.13 | mrapplecomputer1 | be not bee ;P |
| 02:57.26 | JeffM | ok, then I'll be pulling it from bzbb |
| 02:57.28 | mrapplecomputer1 | also, It submits the data directly to weblogin for an easier more convient login |
| 02:57.34 | mrapplecomputer1 | ... |
| 02:57.34 | mrapplecomputer1 | . |
| 02:57.35 | mrapplecomputer1 | i meann |
| 02:57.38 | mrapplecomputer1 | its open source! |
| 02:57.40 | JeffM | also I'll be breaking your site as you are not doing what we want |
| 02:57.40 | mrapplecomputer1 | :D |
| 02:57.52 | mrapplecomputer1 | ? |
| 02:57.55 | JeffM | if it is not open source now, then we don't need it |
| 02:58.04 | mrapplecomputer1 | what are you talking about? |
| 02:58.06 | JeffM | the point of weblogin was to forece the site to use our page |
| 02:58.10 | JeffM | force |
| 02:58.11 | mrapplecomputer1 | umm |
| 02:58.15 | JeffM | you bypass that system |
| 02:58.17 | mrapplecomputer1 | strayers bzstats page does this |
| 02:58.20 | mrapplecomputer1 | so does bztraining |
| 02:58.26 | JeffM | ok, then I'll be breaking them too |
| 02:58.32 | JeffM | that's not how it was meant to be used |
| 02:58.43 | mrapplecomputer1 | so you want me to not allow it? |
| 02:59.11 | JeffM | the point was to send them and SHOW them the weblogin page so they know they are submiting the info to us, not you |
| 02:59.32 | mrapplecomputer1 | well doesnt the user have a choice? |
| 02:59.32 | JeffM | as for the open source stuff, we don't realy provide our hosting to support closed source projects |
| 02:59.42 | mrapplecomputer1 | they can clearly click the login at bzflag.org page |
| 02:59.49 | JeffM | the point of weblogin is to protect the user |
| 02:59.54 | JeffM | from evil websites |
| 03:00.00 | mrapplecomputer1 | isnt evil |
| 03:00.09 | JeffM | to do that we want to force them to SEE our site so they know they can trust us |
| 03:00.17 | mrapplecomputer1 | ok |
| 03:00.21 | JeffM | you may not be, but if we let people do what you are doing they COULD be evil later |
| 03:00.45 | mrapplecomputer1 | like key logging using javascript? |
| 03:00.45 | me1 | JeffM, there are quite a many sites offering both, you might want to tell them this too |
| 03:00.49 | JeffM | you have exposed an exploit in the system so thank you |
| 03:01.00 | mrapplecomputer1 | exploit? its just submitting a form |
| 03:01.11 | JeffM | yeah in a way that was not intended |
| 03:01.19 | JeffM | me1 they will find out when it breaks |
| 03:01.27 | JeffM | we offer no warranty on our service |
| 03:01.40 | mrapplecomputer1 | by breaks you mean it wont work anymore or youll block the site from using weblogin |
| 03:01.56 | JeffM | I will make it so that it won't generate a token unless they come from the form |
| 03:02.04 | mrapplecomputer1 | ah ok |
| 03:02.09 | JeffM | so your system of pretending to be the sumbiting form will not work |
| 03:02.12 | mrapplecomputer1 | thats disapointing :( |
| 03:02.35 | JeffM | why? what's to prevent strayer or someone from swaping out the form raondomly and making it log the password |
| 03:02.44 | JeffM | by having people enter into your form that can be done |
| 03:02.57 | mrapplecomputer1 | well you might wanna make a post in news and announcements |
| 03:03.02 | JeffM | why? |
| 03:03.11 | mrapplecomputer1 | umm so people know |
| 03:03.21 | JeffM | those that use the system should follow it's development |
| 03:03.26 | JeffM | most users don't care |
| 03:03.26 | mrapplecomputer1 | if strayer sudenly wonders why its not working he'll think its something wrong on his end |
| 03:03.28 | JeffM | just those sites |
| 03:03.33 | JeffM | he'll come here and ask |
| 03:03.36 | mrapplecomputer1 | ok |
| 03:03.43 | JeffM | he's done it all the other times we've busted his wacky ways |
| 03:03.56 | mrapplecomputer1 | didn't know strayer had "wacky ways" |
| 03:04.11 | JeffM | oh god, his system is a horrible bandwith wasting abomination |
| 03:04.18 | mrapplecomputer1 | o.O |
| 03:04.25 | *** join/#bzflag Digital_Pioneer (n=digitalp@adsl-99-68-85-22.dsl.ltrkar.sbcglobal.net) |
| 03:04.30 | mrapplecomputer1 | thats interesting |
| 03:04.32 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:04.45 | Digital_Pioneer | OK, now how do I make sound work in 3.0? |
| 03:04.47 | JeffM | now I do understand that the weblogin page is not that pretty so I would not mind adding some features to it to let the sending site set some colors and stuff |
| 03:04.54 | Digital_Pioneer | (2.99.x or whatever) |
| 03:04.55 | JeffM | Digital_Pioneer: same way you do in 2.0.x |
| 03:05.02 | JeffM | what OS are you on? |
| 03:05.03 | Digital_Pioneer | Won't work. |
| 03:05.05 | Digital_Pioneer | Linux. |
| 03:05.06 | mrapplecomputer1 | JeffM how about allowing users to send a .css file to use |
| 03:05.19 | JeffM | mrapplecomputer1: maybe, but I'd be wooried about what they could hide with that |
| 03:05.23 | Digital_Pioneer | Using PulseAudio, but ALSA default works through it. |
| 03:05.24 | JeffM | but I'd be open to discussion |
| 03:05.32 | mrapplecomputer1 | Ah i see |
| 03:05.50 | mrapplecomputer1 | well i wonder what one could hide in a css file |
| 03:05.56 | JeffM | lots of things |
| 03:06.10 | JeffM | Digital_Pioneer: does 2.0.x work on the same machine? |
| 03:06.19 | Digital_Pioneer | JeffM: Yeah |
| 03:06.30 | JeffM | did you build your 2.0.x or use a premade package? |
| 03:06.38 | Digital_Pioneer | Package |
| 03:06.50 | JeffM | do you have SDL dev installed? |
| 03:07.27 | Digital_Pioneer | Yeah |
| 03:07.28 | mrapplecomputer1 | What are you worried people might hide in there? I can't think of anything off hand. |
| 03:07.53 | JeffM | mrapplecomputer1: I don't know, I may be worried for nothing that is why I said I'd be open to discussion |
| 03:08.04 | JeffM | but it would have to be discussed with other devs |
| 03:08.12 | mrapplecomputer1 | ok |
| 03:08.26 | JeffM | Digital_Pioneer: what audio version of sdl and sdl dev do you have (assuming debian/ubuntu) |
| 03:08.37 | mrapplecomputer1 | well thanks for letting me know ill inform jcp about it |
| 03:09.04 | JeffM | mrapplecomputer1: if you want to make it open source then do it now, then you get people to help you work |
| 03:09.14 | JeffM | if not then it's just a closed source project, and bzbb isn't really the place for that |
| 03:09.31 | Digital_Pioneer | JeffM: Assuming wrong. ArchLinux, SDL 1.2.14, sdl_sound 1.0.3 |
| 03:09.38 | mrapplecomputer1 | ok JeffM ill work on that |
| 03:09.40 | JeffM | then you are on your own skippy :) |
| 03:09.56 | mrapplecomputer1 | o.O |
| 03:09.56 | JeffM | Digital_Pioneer: I'd debug it and see if SDL is initalising the audio system or not |
| 03:10.04 | JeffM | that wasn't for you mrapplecomputer1 |
| 03:10.09 | mrapplecomputer1 | oh haha |
| 03:10.21 | mrapplecomputer1 | I was wondering where that came from :P |
| 03:10.47 | JeffM | Digital_Pioneer: my guess is that the one you are building yourself has different settings then the one you got from a package |
| 03:10.58 | JeffM | and it's trying to init an audio system that dosn't exist for you |
| 03:11.15 | Digital_Pioneer | And what's this hub thingy? |
| 03:11.22 | JeffM | hub? |
| 03:11.26 | Digital_Pioneer | Yeah |
| 03:11.38 | JeffM | I dunno what you are talking about |
| 03:11.44 | Digital_Pioneer | :\ |
| 03:11.49 | trepan | global chat |
| 03:11.55 | Digital_Pioneer | It spits out a line in the logs, and there's settings for it. |
| 03:11.58 | JeffM | ahh that, yeah global chat |
| 03:12.04 | JeffM | cross server stuff |
| 03:12.08 | Digital_Pioneer | IC. |
| 03:12.25 | Digital_Pioneer | And latest SVN won't work with the current servers? |
| 03:12.36 | JeffM | nope |
| 03:12.42 | Digital_Pioneer | What rev will? |
| 03:12.46 | JeffM | 2.0.13 |
| 03:12.51 | JeffM | the 2.0.x branch |
| 03:13.05 | JeffM | it's in the branches section |
| 03:13.50 | Digital_Pioneer | No, I mean the 3.0 servers. |
| 03:14.04 | JeffM | I don't understand |
| 03:14.17 | JeffM | the current trunk client works with current trunk servers |
| 03:14.19 | Digital_Pioneer | mrapplecomputer1 says if I use latest SVN, I can't play on the 3.0 servers. |
| 03:14.26 | JeffM | he lies |
| 03:14.30 | mrapplecomputer1 | what? |
| 03:14.36 | mrapplecomputer1 | nooo |
| 03:14.37 | Digital_Pioneer | mrapplecomputer1: You lied to me?? :'( |
| 03:14.41 | JeffM | trunk svn is compatable with trunk servers |
| 03:14.43 | mrapplecomputer1 | i said you cant play on spazzy's server |
| 03:14.46 | Digital_Pioneer | I _trusted_ you! |
| 03:14.50 | JeffM | trunk svn is 2.99.x, development for 3.0 |
| 03:14.51 | mrapplecomputer1 | because there was a protocal change |
| 03:14.59 | JeffM | yeah we bumped the proto today |
| 03:14.59 | Digital_Pioneer | Right. |
| 03:15.04 | JeffM | it happens a lot in development |
| 03:15.07 | mrapplecomputer1 | Digital_Pioneer: you can play, but not on spazzy's :) |
| 03:15.10 | Digital_Pioneer | Scud. |
| 03:15.15 | JeffM | you'd have to go back to like this morning |
| 03:15.22 | Digital_Pioneer | So what rev do I need to play on spazzy's? |
| 03:15.28 | mrapplecomputer1 | just like meone did ;) |
| 03:15.30 | Digital_Pioneer | I've got 20710 |
| 03:15.37 | JeffM | go back a couple and see |
| 03:15.49 | TheRedBaron | JeffM: i've noticed my decks server i ran for 2.99 dev isn't running. It seems there's been some parsing changes in the map files. |
| 03:15.49 | trepan | r20708 |
| 03:15.56 | Digital_Pioneer | Thanks. |
| 03:16.44 | trepan | TheRedBaron: error log? bzfs -d9 ... |
| 03:16.53 | JeffM | blast007: you awake? |
| 03:17.10 | Digital_Pioneer | Ah-ha! My SDL is too old. |
| 03:18.38 | TheRedBaron | trepan: it just doesn't start - it throws this out with the rest of the map file |
| 03:18.42 | TheRedBaron | decks.bzw: warning (line 10): unknown dynamiccolor parameter "alpha" - skipping |
| 03:18.59 | Digital_Pioneer | So does it need a beta SDL?... |
| 03:20.32 | jcp | JeffM: What is wrong with having users submit their username/password on a form other than the my.bzflag.org website? If a user doesn't trust a particular website, then they can just go to the actual web login if they want verification that they're not being scammed |
| 03:20.59 | JeffM | jcp: because it's too easy for them to get in the habbit of it then that website silently change how the backend code works |
| 03:21.03 | JeffM | then they get screwed |
| 03:21.15 | jcp | Your argument is similar to one requiring all users submitting to login forms on the web to use https. While most people agree that https is a good practice, there are those that still use http and are ok with it |
| 03:21.36 | jcp | Then why not simply require users to provide an alternate link that paranoid people can use to log in at the bzflag website? |
| 03:21.38 | JeffM | yeah I'm sure there are people that would be ok with it |
| 03:21.43 | jcp | Exactly! |
| 03:21.44 | JeffM | but the risk is too great |
| 03:21.53 | TheRedBaron | jcp: one is within the realm of control under the maintainers - the other isn't :) |
| 03:21.55 | JeffM | users are not always smart |
| 03:22.00 | JeffM | we want to protect them |
| 03:22.05 | JeffM | most are young kids |
| 03:22.08 | TheRedBaron | logic would implicate to do what we can to protect em. |
| 03:22.10 | blast007 | JeffM: yeah |
| 03:22.10 | trepan | TheRedBaron: dynamic colors definitions are quite different now |
| 03:22.11 | jcp | Then let's ban http, for freak's sake! |
| 03:22.11 | JeffM | I know you guys arn't evil |
| 03:22.22 | TheRedBaron | JeffM: clearly you underestimate me :D |
| 03:22.28 | jcp | haha |
| 03:22.31 | JeffM | blast007: any way to make an image show up on a page only if the page is from bzflag.org? |
| 03:22.35 | TheRedBaron | trepan: if i comment out the lines - will that work? |
| 03:22.37 | jcp | but seriously, bzflag has been getting more and more totalitarian, and I don't like it |
| 03:22.46 | JeffM | jcp: if we had the money for a real certificate we'd do it |
| 03:22.54 | jcp | JeffM: I can tell you exactly how to do what you're after |
| 03:22.54 | TheRedBaron | jcp: how long have you been around bz ? |
| 03:22.54 | JeffM | and we will be looking into that |
| 03:22.59 | JeffM | jcp: sorry you don't |
| 03:23.01 | trepan | TheRedBaron: probably, if it's the default teleporter link material, you could just rename it |
| 03:23.06 | jcp | TheRedBaron: 2 years |
| 03:23.23 | JeffM | when dealing with people's personal data I want to take EVERY measure I can to ensure it's safe |
| 03:23.25 | jcp | JeffM: I really can. I shouldn't, cause I'm shooting myself in the foot, but all you have to do is check the page referer iirc |
| 03:23.26 | blast007 | JeffM: well, you could check the referer |
| 03:23.32 | jcp | Right, then let's ban http and go with https! |
| 03:23.53 | jcp | (and I'm referring to the internet in general here) |
| 03:23.57 | JeffM | jcp: the main point of it was to SHOW the user the bzflag.org site so they know to trust it |
| 03:24.05 | JeffM | jcp: I agree with you |
| 03:24.16 | jcp | Right. The users that don't trust other websites can simply go to bzflag.org instead |
| 03:24.18 | JeffM | but there are things I can do with some effort and things that woudl take too long. |
| 03:24.28 | JeffM | jcp: I don't want it to be a choice |
| 03:24.29 | jcp | In my opinion, it would be better to require that users provide an alternate link than to ban alternate login altogether |
| 03:24.42 | JeffM | jcp: ok, opinion noted |
| 03:24.42 | mrapplecomputer1 | agrees |
| 03:24.46 | mrapplecomputer1 | heh |
| 03:24.55 | JeffM | blast007: coudl some baddie save and rehost the image? |
| 03:25.08 | blast007 | well sure :P |
| 03:25.12 | jcp | BZNetwork, for example, is written entirely in Java, which is then compiled down to Javascript. Changing it to use a static login page would be such a pain, you have no idea |
| 03:25.14 | JeffM | then my idea is silly |
| 03:25.16 | TheRedBaron | trepan: http://pastebin.com/d4cc3f108 |
| 03:25.22 | TheRedBaron | which lines do you recommend i comment out? |
| 03:25.26 | JeffM | jcp: sorry it'll be hard |
| 03:25.31 | TheRedBaron | I'm utterly cluless when it comes to maps |
| 03:25.38 | JeffM | but that's what we initaly intended |
| 03:25.40 | jcp | Is it just me or is BZFlag becoming more and more totalitarian? |
| 03:25.44 | mrapplecomputer1 | yay for alternate login! |
| 03:25.51 | trepan | TheRedBaron: that whole block |
| 03:25.57 | trepan | one sec ... |
| 03:26.02 | JeffM | we have added some tigher controlls that's for sure |
| 03:26.04 | TheRedBaron | can i use /* */ ? |
| 03:26.06 | JeffM | given what people have done in the past |
| 03:26.07 | jcp | Right, which explains why my.bzflag.org runs like s*** |
| 03:26.07 | blast007 | jcp: wait, why would that be hard? |
| 03:26.15 | JeffM | jcp: no need to get mean |
| 03:26.16 | trepan | TheRedBaron: yup, you can now ;) |
| 03:26.23 | blast007 | maybe I need to read the whole discussion :P |
| 03:26.26 | jcp | You have the guts to talk about being mean? |
| 03:26.28 | JeffM | if you want to go there you won't like it |
| 03:26.32 | jcp | blast007: cause you have a single page that hosts the entire app, and it's like writing a desktop app |
| 03:26.33 | JeffM | ok, it's time out time for you |
| 03:26.35 | trepan | TheRedBaron: had to check, thought i might have added/removed the /*...*/ feature |
| 03:26.37 | jcp | and converting that to be static html is a bit hard |
| 03:26.40 | *** join/#bzflag JeffM2501 (n=JeffM@bzflag/projectadmin/JeffM) |
| 03:26.40 | *** mode/#bzflag [+o JeffM2501] by ChanServ |
| 03:27.00 | JeffM | jcp: if you want to discuss thigns in a civil manner, then that's fine, but if you want to get snippy this isn't the place for it |
| 03:27.07 | TheRedBaron | trepan: as soon as latest SVN finishes building i'll get you an answer on that :) |
| 03:27.11 | JeffM | I'm sorry you don't agree with me, it happens. |
| 03:27.19 | jcp | JeffM: You're just talking about that I'm being mean, and then going on about something that's going to be, sorry, mean, to all of the people that run such websites right now |
| 03:27.30 | jcp | that are going to have to spend quite a large amount of time to fix their websites after this |
| 03:27.40 | Digital_Pioneer | SDLWindow.cxx:93: error: invalid conversion from âintâ to âint*â |
| 03:27.41 | jcp | That's what I was mad at |
| 03:27.42 | Digital_Pioneer | :( |
| 03:27.44 | JeffM | jcp yes I am going to make a little work for 5 or so people to protect thousands. |
| 03:27.58 | TheRedBaron | JeffM: we have thousands in bz now? |
| 03:27.59 | JeffM | I feel its' a worth while tradeoff |
| 03:28.03 | TheRedBaron | damn. |
| 03:28.04 | jcp | Right. Like I said, that seems quite totalitarian to me |
| 03:28.09 | JeffM | there are over 30,000 registered users |
| 03:28.15 | JeffM | jcp: I know what you have said |
| 03:28.19 | JeffM | and that is your opinion |
| 03:28.22 | TheRedBaron | jcp: its more utilitarian |
| 03:28.32 | jcp | Like, for example, when you threatened to ban me from the listserv for "spoofing a real client" |
| 03:28.33 | mrapplecomputer1 | 5000 of which are spammers and 15000 of which have never signed on after registration? :P |
| 03:28.35 | JeffM | and I agree, yes we have cracked down on some things to protect peole |
| 03:28.47 | JeffM | jcp: yep, we have a usage pollicy |
| 03:28.50 | jcp | or when you were all mad about my "spam toolkit", which I got finished today btw |
| 03:28.57 | jcp | (and it's not intended for spam, so don't call "foul" on me) |
| 03:28.57 | JeffM | the list server service and user database is NOT open source. |
| 03:29.05 | trepan | Digital_Pioneer: change 'index' to '&index' |
| 03:29.07 | JeffM | the software that runs it is, but the data and service are not |
| 03:29.20 | jcp | I'm aware of that, and I can see why you can't make user's passwords free :-P |
| 03:29.21 | JeffM | jcp: I was not mad, I simply pointed out how it could be abbused |
| 03:29.36 | JeffM | jcp: free? as in give them out, that'd be stupid |
| 03:29.40 | jcp | hmm, I must have misinterpreted it then. What I got from it was that you'd ban me from the listserv if I did so |
| 03:29.48 | jcp | JeffM: exactly. I can see that |
| 03:30.03 | JeffM | yes because the list server is intened to be used by the game and the few other services we have |
| 03:30.09 | Digital_Pioneer | trepan: Now it has too many args. |
| 03:30.09 | JeffM | not for anyone to do whatever they wanted. |
| 03:30.16 | jcp | what I can't see is why the people in charge of such data have to be so controlling. Obviously you dont' want to let those out. But if a user signs on at a website, they're giving their consent to aht website |
| 03:30.18 | trepan | Digital_Pioneer: heh, forget that, one sec ;) |
| 03:30.25 | Digital_Pioneer | OK. :) |
| 03:30.28 | trepan | (don't have SDL 1.3 headers here) |
| 03:30.42 | JeffM | jcp: most users don't think of it that way |
| 03:31.03 | jcp | Well, another solution would be to require such websites to post some sort of notice by the login form. I'd be ok with that |
| 03:31.16 | JeffM | jcp: how do we enforce that? |
| 03:31.30 | mrapplecomputer1 | ban a website from using weblogin if they dont comply? |
| 03:31.31 | jcp | You could do remote login on a whitelist basis |
| 03:31.41 | mrapplecomputer1 | or that i guess |
| 03:31.44 | JeffM | mrapplecomputer1: that means we have to check them all |
| 03:31.47 | jcp | so people set up their website with the notice, then apply to you and get added to the list of sites that can remotely authenticate |
| 03:31.49 | JeffM | jcp: we may do that later |
| 03:32.02 | mrapplecomputer1 | jcp thats actually a good idea :P |
| 03:32.05 | JeffM | have a trusted sites system that can access a lower level API |
| 03:32.09 | JeffM | I have thought about that before |
| 03:32.12 | jcp | exactly. That would be ok with me |
| 03:32.13 | JeffM | but weblogin is not that system |
| 03:32.18 | jcp | And why can't it be? |
| 03:32.24 | JeffM | because I don't want it to be |
| 03:32.26 | *** join/#bzflag McYukon (n=chatzill@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:32.29 | jcp | It's not hard to check and see what website a form is being submitted from |
| 03:32.29 | trepan | Digital_Pioneer: hm, it looks ok as is (based on the SDL 1.3 header i'm looking at) |
| 03:32.31 | JeffM | I want a way for untrusted to use it too |
| 03:32.35 | jcp | You just check the referer header |
| 03:32.35 | JeffM | jcp: I know |
| 03:32.36 | trepan | Digital_Pioneer: take a look in your SDL_Mouse.h |
| 03:32.46 | jcp | JeffM: Right. Let everyone use the site hosted at bzflag.org |
| 03:32.48 | JeffM | you are giving techincal reasons, I want it from a design reason. |
| 03:32.49 | trepan | *SDL_mouse.h |
| 03:32.53 | TheRedBaron | anyone with a recent 2.99 client mind testing the server i just put up? |
| 03:32.58 | trepan | sure |
| 03:33.01 | jcp | But also allow submissions to that form remotely from whitelisted websites |
| 03:33.04 | jcp | and I already stated my design reason |
| 03:33.06 | JeffM | nope |
| 03:33.11 | JeffM | not gonna happen |
| 03:33.12 | jcp | I'll copy/paste it, one sec |
| 03:33.15 | jcp | why not? |
| 03:33.20 | JeffM | because I don't want to |
| 03:33.27 | jcp | Oh my gosh |
| 03:33.33 | jcp | "because I don't want to" |
| 03:33.36 | trepan | TheRedBaron: it's broken, i can't jump |
| 03:33.42 | JeffM | that's how all our features get made dude, because someone wants to do them that way, get over it. |
| 03:33.49 | jcp | 1: sorry, but that sounds like you're about 6. 2: I can't see how you can argue that that's not totalitarian |
| 03:34.05 | JeffM | I never said it wasn't |
| 03:34.08 | Digital_Pioneer | trepan: Expects an x and a y. Shall I lose the index? |
| 03:34.14 | JeffM | jcp: bzflag isn't a democracy |
| 03:34.21 | JeffM | never has been |
| 03:34.23 | jcp | Actually, the argument seemed to be that the bzflag community was more civil than it apparently is |
| 03:34.32 | TheRedBaron | trepan: but it runs? |
| 03:34.37 | trepan | yup |
| 03:34.46 | JeffM | civil? it's full of jerks man, go read in game chat for like 10 min ;) |
| 03:34.48 | TheRedBaron | cool |
| 03:34.51 | jcp | The idea is that open-source projects should be *open*. Not in the way of passwords, but when they provide services, they shouldn't make an effort to make people mad |
| 03:35.01 | JeffM | jcp: some are run that way, some arn't |
| 03:35.02 | trepan | Digital_Pioneer: what does your SDL/SDL_version.h say? |
| 03:35.18 | Flash | jcp: in a web world, "trust" is the most difficult thing to verify |
| 03:35.20 | trepan | SDL_MAJOR_VERSION / SDL_MINOR_VERSION / SDL_PATCHLEVEL |
| 03:35.23 | jcp | Right. And from what I'm getting, bzflag apparently is one of the less civil communities |
| 03:35.25 | JeffM | I'm not going out of my way to make people mad, I'm doing what I think is best to protect our userbase. |
| 03:35.28 | TheRedBaron | trepan: as for the jumping - does -j no longer mean jumping? |
| 03:35.30 | blast007 | jcp: "that are going to have to spend quite a large amount of time to fix their websites after this" 5 minutes is a long time? |
| 03:35.33 | Flash | if there is a private interface, it begs for hackers to abuse it |
| 03:35.35 | JeffM | jcp: if that's your opinon, fine |
| 03:35.52 | Digital_Pioneer | trepan: 1.3.0 |
| 03:35.52 | jcp | blast007: I don't think you read my issue with bznetwork |
| 03:36.10 | blast007 | how long could it take to replace a form that sends to a remote site with a link to a remote site? |
| 03:36.20 | blast007 | in both cases, the data returned in the same |
| 03:36.38 | trepan | Digital_Pioneer: hm, it might still be in flux, change yours locally for now i guess |
| 03:36.54 | blast007 | so how long should that take you? :P |
| 03:36.59 | Digital_Pioneer | Gah, I'm cursed. |
| 03:37.07 | Digital_Pioneer | make[3]: *** No rule to make target `../../bots/testbot/TestRobot.cxx', needed by `TestRobot.lo'. Stop. |
| 03:37.12 | jcp | blast007: cause it messes up my website. The whole thing is written using GWT, so it acts as if it's a desktop application that just happens to be running in the browser. It's not impossible to modify it so that the application shuts down and then starts itself back up, but it's not trivial either |
| 03:37.19 | trepan | TheRedBaron: -j still enables jumping; was only kidding, figured you didn't want jumping ;) |
| 03:37.20 | Digital_Pioneer | makes distclean |
| 03:37.29 | JeffM | jcp: that's one risk of using an online service, we offer no warranty on it. |
| 03:37.38 | TheRedBaron | trepan: :P |
| 03:37.44 | JeffM | it's happened in the past, it'll happen in the future. |
| 03:38.17 | jcp | I didn't say you did. I just said that you should at least be considerate of the people writing websites that interface with yours. In othewords, I'm not saying you're "required" to, I'm just saying that it would be considerate for you to. |
| 03:38.27 | jcp | and I'm arguing why you should, not why you have to |
| 03:38.43 | TheRedBaron | ok - got my servers back running - my work is done here. |
| 03:38.46 | TheRedBaron | ~lart JeffM |
| 03:38.46 | ibot | shoves a crumpet down JeffM's throat, happy now?! Huh? Want some JAM with that? |
| 03:38.47 | JeffM | I'll post in the fourms. I'm mostly sorry I didn't catch that this was happening sooner |
| 03:39.02 | JeffM | sadly we don't have a notification system for web changes |
| 03:39.07 | TheRedBaron | trepan: thanks for the help. |
| 03:39.10 | JeffM | it'd be nice to have something like that |
| 03:39.11 | jcp | so in othewords, you're just going to ignore me |
| 03:39.24 | JeffM | jcp: nope |
| 03:39.30 | JeffM | I have read what you have said and sugested |
| 03:39.31 | jcp | k, so, if you're going to do that, then would it be possible to give people, say, two weeks to get everything implemented and allow people to update? |
| 03:39.35 | JeffM | that is not ignoring you |
| 03:39.37 | jcp | ...and in essence, ignored it |
| 03:39.55 | jcp | well, the opinion I get is that it's going in one ear, getting processes, and then getting ejected straight out the other year |
| 03:39.58 | JeffM | just because I don't agree with you and am not going to jump right on your idea and implement it does not mean I am ignoring you. not in a long shot |
| 03:40.20 | JeffM | none of your reasons have weight more heavaly then the possiblity of an evil website |
| 03:40.28 | JeffM | I agree with you on the white list API |
| 03:40.30 | JeffM | totaly do |
| 03:40.34 | jcp | You didn't seem to |
| 03:40.37 | jcp | "Because I don't want to:" |
| 03:40.39 | JeffM | I said I did |
| 03:40.43 | jcp | and then you said you didnt' |
| 03:40.46 | jcp | *didn't |
| 03:40.50 | JeffM | no, you swap my words around |
| 03:40.55 | jcp | I'll copy/paste if you want |
| 03:40.58 | JeffM | I said that webadmin is not that system |
| 03:41.06 | jcp | why can't it be then? |
| 03:41.13 | JeffM | I did not say that we should not have a witelist api as well |
| 03:41.13 | jcp | I will implement the changes myself if needed |
| 03:41.31 | JeffM | it is not a techical issue I have said, it is a global design one |
| 03:41.36 | JeffM | I prefer my services seperated |
| 03:41.42 | JeffM | so you know exactly what you are getting |
| 03:41.48 | JeffM | modularity is king |
| 03:42.17 | jcp | I'm sorry, but they seem like exactly the same system, besides that one allows externally-submitted forms and the other one doesn't |
| 03:42.25 | JeffM | they are very similar sure |
| 03:42.32 | JeffM | and probably will share a number of backend components |
| 03:42.48 | *** part/#bzflag McYukon (n=chatzill@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:42.49 | JeffM | but when you hit a URL for auth I think you should know what you are getting, secure API or unsecure |
| 03:42.58 | JeffM | since I'd like to add MORE info to the secure API |
| 03:43.04 | JeffM | like server status and list server stuff |
| 03:43.13 | JeffM | group management etc.. |
| 03:43.17 | JeffM | that'd be awesome |
| 03:43.28 | jcp | and why not add those to the unsecure api? |
| 03:43.46 | JeffM | I'd not want an untrusted site getting lists of all groups ,or changing groups |
| 03:43.49 | JeffM | they could log stuff |
| 03:43.51 | jcp | The only difference is, the site *might* snoop on the unsecure api's username/password. They could then just turn around and use the secure api to auth if that's what they were going to do |
| 03:44.00 | JeffM | that's the deal the snoopers |
| 03:44.06 | Digital_Pioneer | make[2]: *** No rule to make target `pages.cpp', needed by `webadmin_la-pages.lo'. Stop. |
| 03:44.07 | jcp | what? |
| 03:44.15 | jcp | that doesn't grammatically make sense |
| 03:44.15 | JeffM | we have some people that seem to hate us badly, I'd prefer to not give them an inch |
| 03:44.18 | Flash | Digital_Pioneer: svn up ?? |
| 03:44.28 | Digital_Pioneer | Flash: That would rather defeat the purpose. |
| 03:44.30 | jcp | But by doing so, you're seriously disadvantaging those that are legitimate |
| 03:44.46 | JeffM | jcp: the four or five sites, yeah for a little bit |
| 03:44.46 | Digital_Pioneer | I'm trying to build a version that uses the protocol spazzy's server is using. |
| 03:44.54 | JeffM | and I have not seen that it is "seriously devestating" |
| 03:45.05 | Flash | jcp: security is a pain. If there were no thieves, we'd need no locks |
| 03:45.09 | Flash | but there are |
| 03:45.10 | JeffM | you have indicated that some work will have to be done |
| 03:45.19 | *** join/#bzflag McYukon (n=alko@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:45.20 | blast007 | jcp: pretty much all of the sites I've seen offer both a form and a link ... |
| 03:45.21 | jcp | I haven't seen any "seriously devestating" breach of passwords due to external authentication either |
| 03:45.32 | jcp | blast007: exactly! I'd be ok with requiring sites to do just that |
| 03:45.41 | jcp | and bznetwork supports that, but in an extremely ugly way |
| 03:45.43 | blast007 | no, my point is, remove the form and you're done :P |
| 03:46.23 | jcp | I still don't see what's wrong with allowing the form and requiring a link also be present for the users that don't want their data stolen |
| 03:46.35 | jcp | or a message telling them exactly what they're doing, and if they're paranoid go to the main site, etc |
| 03:46.42 | JeffM | it's not effectvly enforceable on our end |
| 03:46.46 | JeffM | that's the jist of it |
| 03:46.46 | jcp | And why not? |
| 03:47.00 | blast007 | I think JeffM's point is that it sets up users to think that they can log in with their bzflag credentials directly from external sites |
| 03:47.05 | blast007 | we have had phishing sites before |
| 03:47.06 | JeffM | because we don't have the manpower or desire to go and watch who hits the site, and see what they have |
| 03:47.24 | JeffM | yeah our users are too trusting |
| 03:47.32 | JeffM | so we need to make it harder for phishers |
| 03:47.36 | jcp | JeffM: then do it on a whitelist basis, like I said, only do it for the webauth |
| 03:47.46 | blast007 | someone had one on yahoo, luckily - so it was shut down within 24 hours of me reporting it :P |
| 03:48.01 | JeffM | jcp: why jus so you don't have to do a little work? |
| 03:48.14 | blast007 | jcp: in the time it took to argue this, you probably could have removed the form |
| 03:48.19 | jcp | no, I'm sorry but it looks a lot uglier |
| 03:48.23 | jcp | blast007: that's not the only issue |
| 03:48.34 | mebigfatguy | is always amazed at how badly people want to screw with a game |
| 03:48.38 | jcp | Any good website designer will tell you that consistency is good |
| 03:48.51 | blast007 | okay - so make all sites only have a link to log in ;) |
| 03:48.52 | jcp | and this totally yanks out consistency |
| 03:48.54 | JeffM | bassicly you want me to do this because your design wasn't flexable enough.....? |
| 03:48.55 | blast007 | consistency! |
| 03:49.01 | jcp | no, consistency with the website itself |
| 03:49.06 | *** join/#bzflag I_Died_Once (n=I_Died_O@c-98-244-158-51.hsd1.ga.comcast.net) |
| 03:49.09 | blast007 | we're doing it the paypal way |
| 03:49.12 | blast007 | :P |
| 03:49.15 | JeffM | jcp: that's the point we WANT it to look inconsisten so they know they are going elsewhere |
| 03:49.26 | jcp | oh my gosh |
| 03:49.30 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:49.33 | JeffM | it's a visual trust thing |
| 03:49.37 | jcp | and in all honesty, it's trivial either way to circumvent such a system |
| 03:49.44 | JeffM | please tell me how? |
| 03:49.47 | jcp | so I really still fail to see a point in it |
| 03:49.51 | jcp | well, how are you going to implement it? |
| 03:49.57 | JeffM | well that'd be why I'm discussing it here |
| 03:49.57 | jcp | Assuming the referer thing, then |
| 03:50.07 | jcp | (which is the only way I can think of to implement it atm) |
| 03:50.08 | JeffM | that and a session key |
| 03:50.15 | *** join/#bzflag McYukon (n=chatzill@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:50.34 | blast007 | could also add a random token to the form ;) |
| 03:50.38 | JeffM | that' |
| 03:50.42 | JeffM | yeah that's part of the key |
| 03:50.51 | blast007 | k |
| 03:50.55 | jcp | then, instead of routing the user to an external form, you route their data *through* the external site webserver |
| 03:51.11 | jcp | and it connects to the webauth system, authenticates, and then lets the user into their site |
| 03:51.17 | JeffM | can also make sure that the requesting host of the token check is not the same IP as that who got the token |
| 03:51.40 | blast007 | jcp: well sure, but then we just firewall those sites out |
| 03:51.42 | jcp | Then sites can use an open proxy |
| 03:51.49 | blast007 | ..... |
| 03:51.52 | *** join/#bzflag Alkofox (n=alko@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 03:51.53 | jcp | Do you have any idea the number of proxies there are out there that bzflag doesn't filter? |
| 03:52.05 | JeffM | you can never 100% combat hacking and piracy you can make it harder |
| 03:52.15 | jcp | It wouldn't be hard to use a bunch of those. And if one gets banned, then you just switch to another |
| 03:52.23 | blast007 | jcp: your points aren't making the point of doing this any less of a benefit |
| 03:52.29 | blast007 | cuz they can do that stuff already |
| 03:52.38 | jcp | but there's no incentive to atm |
| 03:52.46 | blast007 | sure there is |
| 03:52.47 | jcp | and implementing this won't help |
| 03:52.52 | jcp | what? |
| 03:52.59 | jcp | How can you circumvent a security measure that doesn't exist? |
| 03:53.04 | blast007 | getting people *used* to logging in at my.bzflag.org |
| 03:53.06 | JeffM | ok, I'll just remove weblogin then |
| 03:53.09 | blast007 | hehe |
| 03:53.16 | JeffM | yeah the point is to train people |
| 03:53.18 | jcp | JeffM: and your not-the-same-ip approach would make it really hard for developers to test out their applications on a local web server |
| 03:53.28 | JeffM | jcp: probably |
| 03:53.45 | jcp | I really stand in awe at the arrogance present here sometimes |
| 03:53.46 | JeffM | so we make a dev site for them to use that has a fake userdb, like paypal ;) |
| 03:53.57 | blast007 | or they run their own |
| 03:54.00 | JeffM | indeed |
| 03:54.03 | jcp | k, so they can't run stuff on their own home webserver |
| 03:54.05 | jcp | (like I do) |
| 03:54.10 | mrapplecomputer1 | Personally, I think this is an unnecessary security precaution that would just create more difficulties |
| 03:54.13 | JeffM | that is one thing I fear, they run there own form that looks like ours |
| 03:54.20 | JeffM | we have little way to protect against that |
| 03:54.30 | JeffM | mrapplecomputer1: I'm sure you do |
| 03:54.41 | jcp | JeffM: I don't get where you're going with that... |
| 03:54.50 | JeffM | going with what? |
| 03:54.52 | blast007 | ooo, we could charge a service fee! |
| 03:54.53 | blast007 | ;) |
| 03:54.55 | mrapplecomputer1 | haha |
| 03:55.10 | JeffM | that was one thing I talked about at the 2008 mentor summit |
| 03:55.13 | blast007 | pay us $20 and you get a weblogin API key! |
| 03:55.18 | JeffM | charge for stuff that gets abbused |
| 03:55.27 | JeffM | really cuts down on the abbuse uses |
| 03:55.28 | mrapplecomputer1 | haha blast |
| 03:55.39 | blast007 | mrapplecomputer1: I'm only half kidding |
| 03:55.43 | jcp | yeah, and then for those of us that host on a basement computer because we *have no money*... |
| 03:55.43 | JeffM | mrapplecomputer1: it is a very viable ploy |
| 03:56.08 | JeffM | jcp: you pay for your bandwith somehow, if you run webhosting you should be used to some fees |
| 03:56.13 | mebigfatguy | altho probably a good percentage of these are spoiled rich kids |
| 03:56.28 | jcp | JeffM: I'm 17, for gosh sakes. My parents pay for the bandwidth |
| 03:56.38 | jcp | and the power, cause I run a project that they're personally interested in on it |
| 03:56.43 | JeffM | jcp: then getting 5$ from them should not be too hard |
| 03:56.47 | jcp | but they're not willing to support a web key |
| 03:56.50 | jcp | oh, you want to bet? |
| 03:56.54 | JeffM | heh |
| 03:56.54 | jcp | They don't like bzflag |
| 03:56.57 | jcp | cause they claim it wastes |
| 03:56.58 | jcp | time |
| 03:57.04 | mebigfatguy | well, it does |
| 03:57.04 | JeffM | then maybe you should not be using bandwith for it ;) |
| 03:57.09 | blast007 | jcp: I'll bet you $5! |
| 03:57.13 | jcp | oh my gosh |
| 03:57.18 | JeffM | but I'm not ready to go there yet |
| 03:57.22 | JeffM | not by a long shot |
| 03:57.23 | jcp | mebigfatguy: I'm not saying it doesn't. They're just super anti-game |
| 03:57.27 | JeffM | we don't have that big of a problem |
| 03:57.27 | jcp | k, good |
| 03:57.35 | JeffM | I'm just saying it is NOT a joke solution |
| 03:57.45 | JeffM | it is a solution WAY down the steps that I'd take first |
| 03:57.49 | JeffM | but it is not a joke |
| 03:58.24 | JeffM | I'd whitelist long before that |
| 03:58.45 | Digital_Pioneer | These SVN checkouts of BZF do not compile without a fight. |
| 03:58.48 | JeffM | on that note, bzwebadmin would not be getting a whitelist as it currently stands, it's closed source. |
| 03:58.58 | mrapplecomputer1 | actually not :D |
| 03:59.07 | JeffM | what license is it under and where can I get the code? |
| 03:59.12 | jcp | I still don't understand your reasons for not whitelisting it? |
| 03:59.12 | mrapplecomputer1 | gpl |
| 03:59.14 | Digital_Pioneer | mrapplecomputer1: I'll take that source now. |
| 03:59.14 | jcp | s/?// |
| 03:59.15 | mrapplecomputer1 | code is here: |
| 03:59.22 | mrapplecomputer1 | svn://bzbureau.com |
| 03:59.23 | mrapplecomputer1 | iirc |
| 03:59.33 | mrapplecomputer1 | hehe Digital_Pioneer |
| 03:59.37 | mrapplecomputer1 | i thinkk |
| 03:59.38 | jcp | mrapplecomputer1: no, he's talking about the form where logins get submitted to |
| 03:59.45 | mrapplecomputer1 | what? |
| 03:59.51 | JeffM | jcp: actualy the entire project |
| 03:59.52 | jcp | And, given a server on which the list server (which *is* open-source) runs, it'd be trivial to re-implement webauth |
| 03:59.59 | jcp | JeffM: no, the list serve ris open-source |
| 04:00.01 | jcp | *server is |
| 04:00.09 | jcp | The database backing my.bzflag.org's instance of it is not |
| 04:00.10 | blast007 | svn: No repository found in 'svn://bzbureau.com' |
| 04:00.10 | JeffM | the site is not? |
| 04:00.11 | jcp | but the code is |
| 04:00.13 | mrapplecomputer1 | o.o |
| 04:00.22 | mrapplecomputer1 | thats concerning... |
| 04:00.26 | JeffM | where do we get the code for your site |
| 04:00.30 | mrapplecomputer1 | looks |
| 04:00.32 | JeffM | don't care about the data behind it |
| 04:00.34 | jcp | My site or your site? what? |
| 04:00.40 | blast007 | mrapplecomputer1's site |
| 04:00.43 | jcp | cause, my site is http://bznetwork.googlecode.com |
| 04:00.44 | jcp | ah |
| 04:00.45 | JeffM | but if I want to run my own version of your system on my server, how do I do that? |
| 04:00.52 | mrapplecomputer1 | ohhh i found it |
| 04:00.53 | mrapplecomputer1 | http://bzbureau.com/bzwa/ |
| 04:00.55 | JeffM | bzwebadmin is what I'm talking about |
| 04:01.00 | jcp | ah, ok |
| 04:01.08 | JeffM | mrapplecomputer1: that is not a public repository |
| 04:01.13 | mrapplecomputer1 | svn://bzbureau.com/bzwa/ |
| 04:01.15 | JeffM | also your posts did not mention that at all |
| 04:01.17 | jcp | well, someone ping me when the discussion moves back onto the topic at hand. I'll be back in a few minutes |
| 04:01.19 | JeffM | nether does the website |
| 04:01.21 | Digital_Pioneer | mrapplecomputer1: Needs a login? |
| 04:01.32 | mrapplecomputer1 | Digital_Pioneer: svn://bzbureau.com/bzwa/ |
| 04:01.35 | blast007 | doesn't allow anonymous logins |
| 04:01.40 | mrapplecomputer1 | o.o |
| 04:01.49 | JeffM | mrapplecomputer1: face it, its' not open |
| 04:01.54 | blast007 | it's asking for a username/password |
| 04:02.18 | mrapplecomputer1 | earth to blast007? svn://bzbureau.com/bzwa/ |
| 04:02.21 | mrapplecomputer1 | should be open |
| 04:02.27 | Digital_Pioneer | mrapplecomputer1: What's your root password. We can just login with that. |
| 04:02.29 | JeffM | blast007: we should update the acceptable usage pollicy as well to reference this |
| 04:02.38 | blast007 | k, worked |
| 04:03.01 | blast007 | now where is the license mentioned in the repo? |
| 04:03.03 | JeffM | mrapplecomputer1: where on your site does it mention this? or who to contact about getting the software? |
| 04:03.15 | mrapplecomputer1 | hmmm no where :P |
| 04:03.15 | blast007 | grepping for gpl returns nothing |
| 04:03.18 | Digital_Pioneer | mrapplecomputer1: This is definitely not the BZF 2.99 source you promised me earlier. |
| 04:03.24 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 04:03.27 | JeffM | mrapplecomputer1: then it is not an obvious open source proejct |
| 04:03.30 | mrapplecomputer1 | haha Digital_Pioneer |
| 04:03.31 | *** part/#bzflag McYukon (n=chatzill@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 04:03.37 | jcp | JeffM: for if the question ever comes up, mine is at http://bznetwork.googlecode.com |
| 04:03.40 | JeffM | these are the things we'd have a problem with if we had a whitelist system |
| 04:03.59 | JeffM | jcp: I'm not going to do a whitelist system now, I was just using it as an example for mrapplecomputer1 |
| 04:04.04 | jcp | JeffM: Mine is open-source, so you can go through the code if you want |
| 04:04.05 | jcp | ah |
| 04:04.09 | jcp | still doesn't get why |
| 04:04.22 | jcp | If it comes down to you not wanting to, I would be willing to code up the whitelist system |
| 04:04.23 | JeffM | because he is young and dosn't always "get it" :) |
| 04:04.39 | jcp | um, ok... |
| 04:04.40 | JeffM | I NEVER said I did not want to write a whitelist system |
| 04:04.43 | JeffM | ever |
| 04:05.02 | JeffM | I just said I am not doing it right now |
| 04:05.11 | jcp | Right! and I *would* be willing to do it now |
| 04:05.20 | blast007 | he didn't say "willing" either |
| 04:05.26 | *** join/#bzflag mrapplecomputer1 (n=mrapplec@c-69-180-173-220.hsd1.mn.comcast.net) |
| 04:05.29 | JeffM | you are more then welcome to submit it as a patch if you wish |
| 04:05.38 | jcp | blast007: well, I'm willing regardless of what he thinks |
| 04:05.42 | JeffM | cool |
| 04:05.42 | blast007 | ;) |
| 04:05.48 | JeffM | I never doubted that you were |
| 04:05.54 | jcp | JeffM: ok. What is the chance of such a patch being accepted? |
| 04:05.57 | JeffM | and you don't need my aproval or goahead to do it |
| 04:06.04 | JeffM | jcp: dunno, have to see it |
| 04:06.17 | jcp | Because, I know know php on an extremely basic level, so if I'm going to go and learn more of it so I can code this, I'd want there to at least be some chance of it getting accepted |
| 04:06.19 | JeffM | it would depend on how it works and what all it does |
| 04:06.25 | jcp | ok. What sort of requirements would it have to conform to? |
| 04:06.35 | *** join/#bzflag McYukon (n=alko@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 04:06.39 | mrapplecomputer1 | gah |
| 04:06.41 | mrapplecomputer1 | my keyboard just went nr? |
| 04:06.42 | JeffM | I can never offer any assurances that phantom code would be accepted :) |
| 04:07.00 | JeffM | not sure, the project would need a spec to start with |
| 04:07.06 | blast007 | jcp: paypal integration for the whitelist fee, for one |
| 04:07.10 | blast007 | ducks |
| 04:07.11 | jcp | I'm not asking you to. I'm asking you to tell me basic stuff that you'd want or basic stuff that would guarantee it wouldn't get accepted |
| 04:07.12 | JeffM | heh |
| 04:07.21 | jcp | blast007: pfft |
| 04:07.23 | blast007 | ;D |
| 04:07.39 | JeffM | well I'd like it to be part of the 3.0 stats push system |
| 04:07.53 | jcp | Then can we have webauth as it is currently until 3.0 comes out? |
| 04:08.04 | JeffM | as logins can be seen as a subset of the functions that API would need to do. |
| 04:08.11 | JeffM | jcp: nope |
| 04:08.18 | blast007 | the majority/all of the web services could be redone or heavily modified ... it's a mess the way it is right now |
| 04:08.23 | jcp | and why not? |
| 04:08.30 | JeffM | same answer as before |
| 04:08.39 | jcp | Because, I haven't heard of any serious breaches where a bunch of passwords have been lost yet |
| 04:08.43 | JeffM | this isn't "lets make a deal" :) |
| 04:08.49 | jcp | um, what's that? |
| 04:08.50 | blast007 | the way OpenID does it is interesting |
| 04:08.54 | JeffM | jcp all it takes is one ;) |
| 04:08.56 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 04:08.58 | jcp | what's that? |
| 04:09.11 | JeffM | yeah OpenID and some of the other systems are very interesting |
| 04:09.12 | mebigfatguy | one breach |
| 04:09.22 | blast007 | you provide a login name, and then it goes to the OpenID provider's site where you provide a password |
| 04:09.42 | blast007 | and the web service that you came from can tell it what information it needs (like email, name, etc) |
| 04:09.44 | Flash | functionally, aren't we just talking about an LDAP server? |
| 04:10.01 | blast007 | and you see what it the service will get, and confirm to give that info |
| 04:10.02 | JeffM | Flash: as a new backend for our stuff yeah |
| 04:10.09 | JeffM | but I'd still like to provide webadmin on top of that |
| 04:10.14 | blast007 | weblogin* |
| 04:10.18 | JeffM | yeah sorry |
| 04:10.28 | JeffM | for some reason in my mind it's webadmin |
| 04:10.40 | jcp | k, so if we're h***-bent on banning people from remote login, can we at least allow a custom CSS file or something to be present? That would at least improve the consistency aspect |
| 04:10.42 | JeffM | too many "Web" things |
| 04:10.52 | JeffM | jcp: possibly |
| 04:11.00 | jcp | what does "possibly" mean? |
| 04:11.01 | JeffM | that's what I was talking to mrapplecomputer1 about before you came in |
| 04:11.05 | Flash | what does CSS have to do with functionality? |
| 04:11.08 | JeffM | I agree that the page is ugly |
| 04:11.15 | jcp | Flash: because the... |
| 04:11.16 | JeffM | and it'd be nice to make it match the site |
| 04:11.18 | jcp | nvm, JeffM just said it |
| 04:11.24 | blast007 | a custom CSS is probably safe to have ... not like they could modify the form to point to something else |
| 04:11.30 | jcp | They can't |
| 04:11.34 | JeffM | so ether providing a CSS file, or css values for our page, I'd be up for that |
| 04:11.41 | jcp | The worst they could do is cover up the submit button or the username field, and I can't see what good that would do |
| 04:11.44 | jcp | or evil |
| 04:11.48 | JeffM | yeah I just wasn't sure what you could modify in a CSS |
| 04:11.58 | blast007 | and certainly making the actual page look better would be a plus |
| 04:11.58 | JeffM | if it's safe then yeah, I'll add a CSS link paramater |
| 04:12.03 | JeffM | yeah it's a fugly page |
| 04:12.18 | JeffM | knows a 'little' more about php and html now |
| 04:12.19 | JeffM | ;) |
| 04:12.29 | mrapplecomputer1 | well time to start coding some css |
| 04:12.33 | jcp | k. And could we possibly have, say, a week or two's delay before adding this? |
| 04:12.42 | blast007 | mrapplecomputer1: time to fix the login page's HTML first :P |
| 04:12.45 | JeffM | mrapplecomputer1: umm shoudn't you wait untill you know what fields you need? |
| 04:12.47 | jcp | Cause I need to code this into bznetwork and then get people to update their installations |
| 04:12.51 | mrapplecomputer1 | heh blast007 |
| 04:12.51 | JeffM | jcp: nope |
| 04:12.55 | mrapplecomputer1 | i mean that overall feel jeffm |
| 04:12.56 | JeffM | I'm doing it now |
| 04:12.57 | jcp | and woy not? |
| 04:13.05 | jcp | *why |
| 04:13.09 | JeffM | second verse same as the first |
| 04:13.15 | mebigfatguy | :) |
| 04:13.22 | jcp | What is wrong with giving people time to get this implemented so you don't break people's sites? |
| 04:13.35 | JeffM | because I find that breaking them makes them fix them faster ;) |
| 04:13.45 | jcp | How can you fix them if they can't log in to update them? |
| 04:13.48 | JeffM | and I'm appaled at myself for not seeing this use sooner |
| 04:13.51 | blast007 | eh, what? |
| 04:14.08 | blast007 | I don't know how your site works, but I don't log in to my website to fix my PHP code |
| 04:14.23 | JeffM | heh |
| 04:14.29 | jcp | JeffM: in otherwords, you're quite strongly inconvienencing numerous people out there |
| 04:14.34 | JeffM | it's java man, maybe it works differently |
| 04:14.39 | jcp | oh my gosh |
| 04:14.44 | JeffM | jcp: sure if numerous is under 10 |
| 04:14.50 | jcp | I wonder how many people here have heard of, wordpress |
| 04:14.55 | JeffM | I'm willing to take the heat |
| 04:14.56 | blast007 | oh no. we can't log in to see our BZFriends. The world as we know it is ending. |
| 04:14.58 | jcp | where you log in to update it |
| 04:15.07 | jcp | blast007: seriously, it's not funny anymore |
| 04:15.08 | blast007 | jcp: you don't *have* to |
| 04:15.11 | JeffM | jcp: and the only login you have is bzbb? |
| 04:15.17 | JeffM | I find that hard to belive |
| 04:15.17 | jcp | JeffM: yes |
| 04:15.30 | JeffM | that seems like poor design to me |
| 04:15.30 | jcp | You can enable an "admin/admin" account, but you can't change the credentials |
| 04:15.36 | JeffM | but hey I'm not a web guru |
| 04:15.36 | jcp | due to the fact that I rely on bzflag auth |
| 04:15.40 | jcp | and why would it be? |
| 04:15.47 | blast007 | so when our auth is down, you're basically screwed? |
| 04:15.49 | jcp | If you're counting on a service that is *supposed* to work... |
| 04:15.53 | JeffM | if the external auth breaks you should have a way in |
| 04:15.56 | jcp | blast007: YES. That's my problem |
| 04:16.00 | jcp | and why I wanted a week to fix it |
| 04:16.03 | blast007 | right, that's *your* problem |
| 04:16.06 | JeffM | jcp: thats a single point of failure |
| 04:16.08 | JeffM | taht's a bad design |
| 04:16.10 | jcp | JeffM: Oh, you do, but it gives everyone else a way in too |
| 04:16.20 | JeffM | from a general software design standpoint |
| 04:16.27 | JeffM | jcp: eww |
| 04:16.36 | jcp | blast007: so, you peoples are not willing to work with me then? Cause that's what you're saying, you're not willing to work with people to implement a solution in a reasonable time frame |
| 04:16.40 | JeffM | that's not how I'd write it, but hey |
| 04:16.50 | Erroneous | I'm guessing that it took some work and skill to hook it up to use our auth. a bit more work and a bit less skill and you can point it at some OTHER auth db temporarily to update it. |
| 04:16.55 | JeffM | jcp: you'll be able to use your form link you'll e fine. |
| 04:17.07 | jcp | I don't see what you mean |
| 04:17.13 | Erroneous | even a locally-running copy of the list server |
| 04:17.27 | jcp | The form link is disableable, since, because of the way it's done, it can sort of intrude on visual appearance |
| 04:17.31 | blast007 | or a fake login page that just says "Yes, they are authenticated!" |
| 04:17.52 | JeffM | tell you what, I'm gonna make dinner, then fix this page |
| 04:18.12 | jcp | but I still don't understand the problem with waiting a week |
| 04:18.27 | blast007 | jcp: quick, fix your page |
| 04:18.27 | jcp | Just tell people hey, if you don't have this done in a week, you're hosed, so get it done |
| 04:18.35 | Erroneous | jcp: look at it from JeffM's perspective. you (and others) took advantage of a bug in a system he wrote, NOT specified behavior. he's going to fix the bug asap. it's not a change to the specified behavior. |
| 04:18.57 | JeffM | the docs say to send them to our form |
| 04:18.58 | Flash | for a service designed to support numerous external users, you are correct. However, I don't think that's the main focus here |
| 04:19.11 | jcp | We *thought* it was allowed behavior, since we didn't think he'd be stupid enough to let something like that go unnoticed and not be ok with it |
| 04:19.18 | JeffM | jcp: you never asked |
| 04:19.23 | JeffM | sorry you made a bad assumption |
| 04:19.38 | Erroneous | I was gonna say it wasn't documented, but then, I guess given the state of our docs that could be overlooked... |
| 04:19.38 | jcp | Erroneous: so, if I was in his position, I'd tell people sorry, we don't allow this and we're closing it, you have a week to change your systems to fix it |
| 04:19.49 | jcp | I actually wasn't aware of any documentation on the webauth |
| 04:19.54 | Erroneous | jcp: I hope my bank doesn't think that way :) |
| 04:19.57 | JeffM | actualy I documented weblogin ;) |
| 04:19.59 | jcp | BZFlag in general is essentially undocumented, so I don't expect there to be any |
| 04:20.14 | JeffM | again bad assumption |
| 04:20.14 | Erroneous | jcp: yeah, that's what I mean. it IS actually doc'ed, but I can see how you might assume it wasn't. |
| 04:20.15 | jcp | Erroneous: bzflag passwords are not going to get a person put in jail |
| 04:20.26 | JeffM | tries to doc the things he writes |
| 04:20.32 | JeffM | hello.. API docs anyone??? |
| 04:20.36 | jcp | JeffM: an assumption perpetuated by most people in the bzflag community, as that would be one of the *only* things that is documented |
| 04:20.49 | JeffM | ok so people arn't prefect... it happens |
| 04:21.03 | jcp | Cause that's like about as stupid as me not assuming that my garage door doesn't allow someone to enter 1111 on the keypad and open the door |
| 04:21.13 | mebigfatguy | thats why he gets paid the big bucks |
| 04:21.14 | jcp | Right. But you don't have to punish people because they aren't perfect |
| 04:21.17 | JeffM | how did you guess my password!!!!!!! |
| 04:21.21 | JeffM | you hacker:!;) |
| 04:21.22 | jcp | You can give them time to implement a solution |
| 04:21.26 | Erroneous | jcp: if you found out that it DID take 1111, would you wait a week to change it? :) |
| 04:21.47 | JeffM | mmmmm bangers and mash:) |
| 04:21.55 | jcp | Erroneous: I was using that to make my point about the documentation. I really can't see a practical use where people would build stuff on the 1111 behavior |
| 04:22.09 | jcp | whereas people *have* built practical stuff on the webauth system |
| 04:22.25 | jcp | and either way, it's not a good analogy with what you're saying. The bzflag login form doesn't allow passwords to be 1111 to log in |
| 04:22.37 | jcp | If it did, I really can't see a possible non-malicious use of that, so I would disable it immediately |
| 04:22.53 | jcp | but, as has been proven, there *is* a non-malicious use for this external stuff |
| 04:24.19 | JeffM | jcp: thankfully not |
| 04:24.29 | mebigfatguy | how do you know it's non malicious? |
| 04:24.31 | JeffM | but as soon as this log goes public, there will be |
| 04:24.39 | JeffM | yeah there may be we dunno |
| 04:24.44 | Flash | but doesn't the presence of a malicious use argue for stricter controls? |
| 04:24.47 | JeffM | as we don't manualy track all sites |
| 04:24.47 | jcp | Then get TR to nix the log for today until a week from now |
| 04:25.03 | jcp | The log doesn't go public until roughly 21 hours from now |
| 04:25.13 | JeffM | and you say I am totolitarian and you want to censor ;) |
| 04:25.22 | Erroneous | pretty sure that's not the only log from here anyway |
| 04:25.26 | JeffM | indeed |
| 04:25.28 | jcp | You say that as if that's a good thing |
| 04:25.31 | JeffM | or loging client |
| 04:25.32 | mebigfatguy | expects to see this on the next episode of '24' |
| 04:25.33 | Erroneous | not to mention the human factor |
| 04:25.35 | JeffM | jcp: just making a point |
| 04:25.41 | jcp | which, I'm sure the dictators always think it's a good thing that they're the dictator |
| 04:25.43 | JeffM | yeah it's a bug, we are going to fix it |
| 04:25.44 | jcp | but everyone else... |
| 04:25.56 | JeffM | good thing bzflag isn't a country then I guess |
| 04:26.01 | jcp | Right. I honestly don't see what problems it can cause to wait one stupid week |
| 04:26.12 | JeffM | ok, I'm sure you don't see it |
| 04:26.14 | JeffM | that's fine |
| 04:26.27 | jcp | k, humor me and explain what one week's delay can do to me again. |
| 04:26.37 | mebigfatguy | one does now do to you? |
| 04:26.40 | JeffM | it's the same answer you don't like |
| 04:26.46 | mebigfatguy | er, what does 'now' do to you? |
| 04:26.48 | jcp | mebigfatguy: that came out slightly wrong |
| 04:27.00 | jcp | k, humor me and explain *to me* what one week's delay can do again. |
| 04:27.03 | jcp | mebigfatguy: how's that? |
| 04:27.17 | mebigfatguy | you say what does a week's delay can do |
| 04:27.22 | mebigfatguy | what does 0 week delay do? |
| 04:27.23 | jcp | JeffM: No, it goshdarnit is not fine. I'd like to know why it's not ok to wait a week |
| 04:27.24 | JeffM | jcp: thanks but no, I've spent too much time typing the same thing, I have to get this fixed. |
| 04:27.27 | jcp | why you want to go ahead with it tonight |
| 04:27.33 | JeffM | jcp: because I don't want to |
| 04:27.36 | jcp | No, you haven't given a straight answer on that |
| 04:27.43 | JeffM | THAT is the straight answer |
| 04:27.46 | JeffM | I know you don't like it |
| 04:27.51 | JeffM | I'm sorry you don't |
| 04:27.53 | jcp | So your sole reason is "because you don't want to". You want to break people's websites because you can essentially |
| 04:27.56 | jcp | No your'e not |
| 04:28.04 | jcp | That is probably the biggest lie I've heard today, I'm sorry. |
| 04:28.09 | JeffM | please do not tell me what am or am not |
| 04:28.10 | jcp | (no pun intended by any measns) |
| 04:28.19 | JeffM | ok, please feel free to belive that |
| 04:28.19 | jcp | well, you can't possibly be sincere |
| 04:28.27 | jcp | s/believe/know/ |
| 04:28.28 | JeffM | sure I can, you just don't seem to be able to see it |
| 04:28.33 | JeffM | it happens |
| 04:28.42 | Erroneous | jcp: if you had discovered a security bug in your code, you would want to fix it asap, right? |
| 04:29.02 | mebigfatguy | jcp: I'm sure JeffM doesn't want to break your site. |
| 04:29.05 | jcp | Erroneous: if it was used primarily non-maliciously, I'd alert users of it and then fix it in a week |
| 04:29.12 | mebigfatguy | but that may be less concerning than the alternative |
| 04:29.24 | jcp | mebigfatguy: oh, right. I'm sure he doesn't. He just wants to have his "priorities" ahead of anyone elses |
| 04:29.26 | jcp | *else's |
| 04:29.30 | mebigfatguy | yes |
| 04:29.32 | Flash | jcp: that's not the way security fixes work |
| 04:29.33 | mebigfatguy | exactly |
| 04:29.33 | jcp | mebigfatguy: I doubt that |
| 04:29.45 | Erroneous | I'm pretty damn sure JeffM's desire is not to tweak your nose or anyone else's, it's to get the fix in so he doesn't have to stay awake at night worrying about it. |
| 04:29.50 | jcp | mebigfatguy: If 20 passwords per day were being stolen due to this, I could see him not wanting to wait |
| 04:29.54 | mebigfatguy | the removal of bad, is better than the sustaining of good |
| 04:30.11 | JeffM | yeah, I totaly don't sleep much anymore |
| 04:30.13 | jcp | but you show me how many people in the last, well, since this system has been added, you show me how many passwords have been lost to it |
| 04:30.16 | jcp | and then I'll believe you |
| 04:30.16 | Flash | jcp: 1 password would be too many, if it were mine |
| 04:30.26 | JeffM | jcp: we don't know, that's what worries me |
| 04:30.27 | Erroneous | jcp: problem is that we have NO WAY to tell |
| 04:30.34 | jcp | Flash: I'd sacrifice my password if that was like the only one |
| 04:30.39 | jcp | Erroneous: there aren't server logs? |
| 04:30.51 | Flash | so you are putting your values above mine? |
| 04:30.54 | Erroneous | jcp: not that would tell us whether it was being used maliciously or not |
| 04:30.57 | Flash | isn't that exactly your argument? |
| 04:30.58 | jcp | Cause, that's bad design, if there aren't server logs |
| 04:31.16 | Erroneous | jcp: every request from your site, or from strayers, could be malicious, if you or he were. |
| 04:31.18 | jcp | Erroneous: cause, if you see the same ip authenticate multiple users, then you've got a problem |
| 04:31.25 | Erroneous | do you see the issue now? |
| 04:31.52 | jcp | Erroneous: I'm sorry, but I don't see it. Both of our sites are open-source, and we are both established members in the community |
| 04:32.01 | jcp | For that matter, how do I know JeffM isn't using my password at other sites? |
| 04:32.05 | Erroneous | when it runs through our page, we know the remote site did not have the password. when it does not, we know that it DOES. we do NOT know how it is used after that. |
| 04:32.17 | mebigfatguy | jcp: you dont |
| 04:32.20 | Erroneous | jcp: if you use the same password for bzflag as for anywhere else, you deserve what you get (no offense) |
| 04:32.21 | mebigfatguy | thats the point |
| 04:32.22 | jcp | Erroneous: right. My site runs it through your page |
| 04:32.25 | jcp | but only to submit it |
| 04:32.42 | jcp | Erroneous: I don't use the same password everywhere else. I use it at bzflag and a couple of other low-security places |
| 04:32.55 | Erroneous | right...you have the ability to collect the password. so does EVERYONE else who uses that method. |
| 04:32.57 | jcp | but if you're suggesting that I have a separate password for the at-least-12 places that I sign in to |
| 04:33.01 | mebigfatguy | guesses that jcp's password is jeffm_stinks |
| 04:33.02 | Flash | jcp: it really sounds to me like you have no idea about how to secure a site or data. The fact that things are more difficult for you is not a valid argument |
| 04:33.13 | jcp | I do have the ability, but just like JeffM is an established community member, so am I |
| 04:33.30 | jcp | mebigfatguy: oh my gosh, how'd you guess that? |
| 04:33.34 | Erroneous | I am willing to grant that you are not malicious, and that strayer is not. I can't guarantee that nobody else who uses that method is. |
| 04:33.36 | mebigfatguy | mentalist |
| 04:33.59 | jcp | Flash: I'm sorry, but (and I'm sure you'll turn this against me in some way or other) I really don't get your point |
| 04:34.10 | JeffM | time to see if I can remember my bz login |
| 04:34.13 | Erroneous | and I can't guarantee that your machine and his are uncompromised |
| 04:34.23 | jcp | and you do know that you can simply hit that nice, shiny view-source button on my page to see if I collect it or not |
| 04:34.30 | Flash | "since there hasn't been a (known) compromise, there must be no risk of compromise" |
| 04:34.32 | JeffM | good lord how do I not have filezilla |
| 04:34.46 | JeffM | Flash: said the ostritch |
| 04:35.01 | jcp | no, since there hasn't been a known compromise, a week out of several years isn't gonna hurt unduly |
| 04:35.04 | Erroneous | I have no way to verify if you are running the source you say you are or not. but again, my trust of YOU is not the issue here. |
| 04:35.22 | jcp | Erroneous: that's not what I mean |
| 04:35.33 | Flash | "since my house hasn't been robbed, there's no need to fix my broken locks" |
| 04:35.37 | jcp | view the source of the login page and look into what it does. It quite clearly submits their into directly to bzflag, without submitting to my server |
| 04:35.41 | Erroneous | jcp: as far as I'm concerned, every time a site has an OPPORTUNITY to collect a password is a breach |
| 04:35.43 | JeffM | jcp: what you are saying is that we should just hope it's all ok |
| 04:35.51 | JeffM | that's not good enough for me |
| 04:35.59 | Erroneous | regardless of whether it actually does it or not |
| 04:36.01 | jcp | Flash: well, if my wife didn't have keys cause my locks were broken, I'd get her some keys before I fixed them |
| 04:36.10 | Flash | you know there is no guarantee that you are running the code you point us to, right? |
| 04:36.17 | jcp | Erroneous: Mind *doesn't*, though, a simple page source view will show that |
| 04:36.30 | jcp | *flash |
| 04:36.41 | JeffM | jcp: sure if you always use that code, and don't randomly use a phisher page |
| 04:36.51 | jcp | Erroneous, Flash: in othewords, the password never goes through my server |
| 04:36.52 | jcp | IT doesn't |
| 04:36.59 | Flash | trust me |
| 04:37.00 | jcp | It goes straight to bzflag without even going near my server |
| 04:37.03 | JeffM | like we say, we trust you |
| 04:37.05 | Erroneous | jcp: but it could |
| 04:37.06 | JeffM | just not the others |
| 04:37.11 | mebigfatguy | jcp is a trustworthy guy |
| 04:37.15 | Flash | that's not the way security works |
| 04:37.15 | jcp | thank you |
| 04:37.16 | Erroneous | if you wanted to make it so, it could. and THAT we need to fix. |
| 04:37.18 | mebigfatguy | but pcj is a ja |
| 04:37.34 | Erroneous | jcp: again, you and strayer are not the issue here. the issue is that if you and he can, anyone can. |
| 04:37.40 | jcp | Yes, what I'm saying is give me a week to fix bznetwork so that you don't immediately break it |
| 04:37.48 | jcp | No, we *are* the issue because you're going to be blocking access |
| 04:37.56 | jcp | I'm not saying others aren't, too |
| 04:38.06 | JeffM | so you want special treatment? |
| 04:38.13 | jcp | but like I said in the locks thing, that's how I'd do it. I wouldn't simply lock my wife out until I get new keys |
| 04:38.18 | jcp | or make her wait for me to come unlock it, etc |
| 04:38.36 | JeffM | you have a wife? |
| 04:38.38 | mebigfatguy | tell her, you be home in a week, to let her in |
| 04:38.39 | jcp | No |
| 04:38.43 | jcp | JeffM: read up |
| 04:38.47 | jcp | you'll see why I was using that |
| 04:38.48 | Flash | and if your neighbor was in the habit of coming into your kitchen and raiding your fridge, would you be concerned about inconveniencing him? |
| 04:39.08 | Flash | I'm not sure your application merits the "wife" analogy |
| 04:39.08 | jcp | "raiding our fridge" is a bad thing |
| 04:39.15 | JeffM | good thing weblogin is not a house |
| 04:39.16 | Flash | not if you know about it |
| 04:39.18 | mebigfatguy | wonders if jcp's wife things bzflag is a waste of time |
| 04:39.19 | jcp | If our housecleaner used that to clean the house, I'd be ok |
| 04:39.20 | JeffM | and bzflag is just a game |
| 04:39.38 | jcp | mebigfatguy: I'm not married, I was using that as an analogy |
| 04:39.43 | JeffM | jcp: yeah bzflag is like your housekeeper you won't die if they don't get there way ;) |
| 04:39.44 | mebigfatguy | :) i know |
| 04:39.54 | Erroneous | jcp: what if you'd given your wife the keys, but she had left them at the office? would you leave the house unlocked with nobody home, or ask her to go pick them up? |
| 04:40.13 | Erroneous | because you HAVE been able to use this service as intended, you have just chosen not to. |
| 04:40.14 | JeffM | or left them on the subway with a tag that has the address |
| 04:40.17 | jcp | JeffM: and "good thing webauth is not a house" RIGHT! no-one's gonna die over passwords getting stolen. Seriously, you'd think this si a bank system from how worried you are |
| 04:40.22 | JeffM | how soon would you change your loks? next week? |
| 04:40.47 | JeffM | jcp: actualy we could get sued if our paswwords of minors get out |
| 04:40.56 | JeffM | COPPA allows for that |
| 04:41.01 | Digital_Pioneer | How do I compile the blasted thing? :( |
| 04:41.02 | Erroneous | jcp: I'd be more ticked off if they DIDN'T treat my information like it was gold to them. |
| 04:41.03 | JeffM | thats why many sites just don't do under 13 |
| 04:41.04 | mebigfatguy | given that people are stupid, the bzflag passwords may be bank passwords |
| 04:41.12 | Digital_Pioneer | The make system is broken. |
| 04:41.16 | jcp | JeffM: but you're not the one letting the passwords out |
| 04:41.24 | JeffM | jcp: yeah I was |
| 04:41.32 | JeffM | because I didn't take enough precauthions |
| 04:41.38 | jcp | You don't endorse sites that do it the wrong way and you're changing it in a week (hypothetical), so they need to fix their sites and its their pboelm |
| 04:41.42 | JeffM | the procecuter WOULD do that |
| 04:41.47 | JeffM | because we are able to be found |
| 04:41.50 | Erroneous | jcp: doesn't matter (negligence) |
| 04:41.53 | JeffM | the phisher not so much |
| 04:42.02 | Erroneous | not likely, but possible |
| 04:42.03 | JeffM | yeah neglegence is not a valid defense |
| 04:42.27 | Erroneous | and honestly, it should not take more than a few minutes to fix your site |
| 04:42.38 | jcp | k, whatever. If you're so paranoid about being sued by some rogue 12-year-old that wants money, then I really don't know what to say |
| 04:42.38 | Flash | (aren't you done by now?) |
| 04:42.43 | Erroneous | probably could be done by now if you had been doing it instead of arguing |
| 04:42.55 | Flash | as I said, you don't understand about securing sites or data |
| 04:43.00 | jcp | Erroneous: I could probably have. But there are other installations of my site |
| 04:43.08 | jcp | installations that I'm not seeing their owners online at the moment |
| 04:43.17 | jcp | so I can't contact them to prevent a problem from occurring witht heir sites |
| 04:43.18 | mebigfatguy | you'll be hearing from them shortly |
| 04:43.19 | Erroneous | jcp: email them a patch. as soon as they become aware, they'll upgrade |
| 04:43.20 | jcp | *with their |
| 04:43.49 | jcp | Erroneous: and there'll be downtime because of that |
| 04:43.52 | Erroneous | yup |
| 04:43.55 | Erroneous | there will |
| 04:43.59 | jcp | That's the freaking problem!!! |
| 04:44.11 | JeffM | yay, I rememberd my password |
| 04:44.22 | Flash | It's a game. Downtime can be tolerated |
| 04:44.34 | JeffM | specialy with a security hole |
| 04:44.39 | jcp | And so can stupid people's passwords |
| 04:44.39 | mebigfatguy | mom and dad will thank jeffm |
| 04:44.47 | Erroneous | hm, so which would you rather have...a few hours of downtime for a few non-critical sites, or a security problem? |
| 04:44.48 | JeffM | now you do bring up a good problem, we need a way to notify people |
| 04:44.52 | jcp | oh my gosh, like I give a darn about what they think related to bzflag |
| 04:45.04 | jcp | Erroneous: for a few non-critical passwords, I'l ltake the passwords. |
| 04:45.11 | jcp | oh my gosh, I'm spacefailing tonight. *I'll take |
| 04:45.25 | Flash | I hope you never work on any production database.... |
| 04:45.39 | JeffM | Flash: he will, once he gets a bit more experience |
| 04:45.48 | JeffM | it takes time to realize all this |
| 04:45.56 | jcp | If I work on a database where passwords mean potential money, then I'll think differently. But the people are being negligent too by submitting their passwords to external phish sites |
| 04:46.04 | JeffM | and if he has to make public APIs he'll do a lot of ground work to prevent this kind of stuff from happening |
| 04:46.07 | JeffM | it's good for him |
| 04:46.16 | jcp | oh my gosh |
| 04:46.19 | Flash | not if he won't see the issue |
| 04:46.20 | Erroneous | jcp: in that case, I will be carefully avoiding services you run. I prefer my (even non-critical) data to be well-protected. |
| 04:46.21 | JeffM | we obviously didn't do enough groundwork |
| 04:46.22 | jcp | I'll be back in a sec |
| 04:46.24 | JeffM | flash he will |
| 04:46.31 | JeffM | time does that |
| 04:46.33 | mebigfatguy | and he's learning php better -- which is a plus :) |
| 04:46.46 | JeffM | when you are 30, you know you were an idiot at 18 |
| 04:47.27 | Erroneous | pft, I know I was an idiot at 18 and I'm nowhere near 30 :P |
| 04:47.34 | JeffM | you are special ;) |
| 04:47.40 | JeffM | I guess I should have said, "by the time" |
| 04:47.46 | Flash | slow learner? |
| 04:47.54 | JeffM | he's a fast learner |
| 04:47.59 | JeffM | with an UNSTEALABLE car! |
| 04:48.08 | Erroneous | hah, speaking of security problems :) |
| 04:48.14 | JeffM | yeah |
| 04:48.20 | JeffM | so you gonna wait a week to lock it? |
| 04:48.27 | Erroneous | um, no :) |
| 04:48.52 | mebigfatguy | Erroneous thought installing a 'clapper' for his car was a good idea |
| 04:49.06 | Erroneous | left his car unlocked at a public train station in the middle of a city for three days, complete with valuables stored inside |
| 04:49.08 | JeffM | mebigfatguy: it's worst then that |
| 04:49.10 | Erroneous | and nobody bothered to steal them |
| 04:49.16 | mebigfatguy | nice |
| 04:49.17 | JeffM | it's cus it allready looks broken into |
| 04:49.20 | mebigfatguy | ha |
| 04:49.23 | Erroneous | haha |
| 04:49.25 | JeffM | it's a 'little' dirty |
| 04:49.39 | mebigfatguy | people thought is was a reality tv show ("who will steal this car?") |
| 04:49.39 | Erroneous | (I never wash it, and it rains what...twice a year here?) |
| 04:49.51 | JeffM | it may rain this weekend they say |
| 04:49.56 | Erroneous | cool, clean car :) |
| 04:50.11 | mebigfatguy | convertible? |
| 04:50.25 | Erroneous | nope, sedan |
| 04:50.48 | Erroneous | otherwise I'd be worried about the pile of papers in the back in the rain :) |
| 04:50.51 | mebigfatguy | mmm, that's good... otherwise you have to smash a window to get in, to put the top up before it rains. |
| 05:00.49 | JeffM | yay, part one is done |
| 05:12.48 | mebigfatguy | buys all the bzfellas webcams -- http://andialbrecht.wordpress.com/2009/05/09/when-merging-fails/ |
| 05:13.01 | JeffM | hah |
| 05:18.42 | DTRemenak | haha, I like it |
| 05:19.02 | DTRemenak | mebigfatguy: nice to see you around, by the way |
| 05:19.07 | mebigfatguy | likewise |
| 05:21.56 | *** join/#bzflag Yassen (n=Yassen@unaffiliated/yassen) |
| 05:23.34 | CIA-75 | BZFlag: 03JeffM2501 * r20711 10/trunk/db/weblogin.php: make the weblogin.php system only work if the site displays our version of the form. Block attempts that try to use there own form |
| 05:23.37 | JeffM | there we go, implemented and tested |
| 05:23.47 | JeffM | strayers site works using the link |
| 05:23.51 | JeffM | but not with the forms |
| 05:24.11 | JeffM | list server auth still works |
| 05:24.27 | JeffM | didn't check image upload |
| 05:31.49 | CIA-75 | BZFlag: 03JeffM2501 07http://my.bzflag.org * r6852 10/w/List_Server_Usage_Policy: add weblogin clarification |
| 05:39.03 | CIA-75 | BZFlag: 03JeffM2501 07http://my.bzflag.org * r6853 10/w/Global_Registration: Mention weblogin and third party sites |
| 05:39.26 | *** join/#bzflag jcp (n=jw@unaffiliated/javawizard2539) |
| 05:39.29 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 05:39.49 | JeffM | now to see about making it look less fugly |
| 05:40.27 | JeffM | oh god, I just yanked the header from the old bzflag site didn't I? |
| 05:40.48 | CIA-75 | BZFlag: 03jwmelto * r20712 10/trunk/db/weblogin.php: Fix URL typo |
| 05:41.42 | JeffM | hah, that's been in there forever |
| 05:41.57 | Flash | well, it's certainly non-critical |
| 05:42.29 | JeffM | but thank you |
| 05:42.42 | JeffM | sad part is that's the code I'm getting ready to remove |
| 05:42.50 | Flash | lol |
| 05:43.28 | JeffM | man I used to fear divs didn't I |
| 05:43.53 | Flash | CSS 2.0 takes time to get used to |
| 05:46.49 | Flash | have you gotten into AJAX yet? |
| 05:46.58 | JeffM | nope |
| 05:47.05 | JeffM | I don't realy like doing webwork |
| 05:47.11 | JeffM | I keep getting forced to do it tho |
| 05:47.25 | Flash | I don't either, but it seems unavoidable |
| 05:59.09 | *** join/#bzflag AAA_awright (n=a3@ip24-251-157-63.ph.ph.cox.net) |
| 06:03.01 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 06:06.24 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 06:15.21 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 06:26.53 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 06:31.07 | JeffM | any CSS gurus up? |
| 06:31.26 | Flash | guru would be a huge stretch, but give it a try |
| 06:31.31 | JeffM | http://my.bzflag.org/weblogin_new.php?&url=blah |
| 06:31.41 | JeffM | I want that world logo to be on the right |
| 06:31.47 | JeffM | and top aligned |
| 06:32.30 | *** join/#bzflag blast007_ (n=blast007@bzflag/developer/Blast) |
| 06:32.30 | *** mode/#bzflag [+v blast007_] by ChanServ |
| 06:32.41 | JeffM | maybe even pushed up to the blue bar at the top |
| 06:32.47 | Flash | where's the style sheet? |
| 06:32.51 | Flash | is it inline? |
| 06:32.54 | JeffM | no |
| 06:33.05 | JeffM | http://my.bzflag.org/weblogin_new.php?&url=blah |
| 06:33.12 | JeffM | bahh |
| 06:33.16 | JeffM | http://my.bzflag.org/css/weblogin.css |
| 06:34.29 | JeffM | the site can send in it's own css using ?css=WHATEVER |
| 06:34.35 | JeffM | but I think we should have a good default CSS |
| 06:35.06 | JeffM | does not like the purple in the header bar |
| 06:36.58 | Flash | this is one of my favorite references: http://www.barelyfitz.com/screencast/html-training/css/positioning/ |
| 06:37.50 | blast007 | that "CurrentMaintainer" thing could go away, or at least be updated to point to a real page |
| 06:37.57 | JeffM | yeah probably |
| 06:38.04 | JeffM | I'll just change it to TimRiker |
| 06:39.14 | JeffM | untill I can make it say "The BZFlag Foundation, and coffie shop" |
| 06:39.27 | *** join/#bzflag jcp (n=jw@unaffiliated/javawizard2539) |
| 06:39.28 | Flash | or coffee even |
| 06:39.41 | JeffM | why would we sell that? it's nasty |
| 06:39.48 | jcp | wait, what? |
| 06:39.51 | jcp | this just pinged me for some reason |
| 06:39.56 | jcp | whacks pidgin really hard |
| 06:40.01 | Flash | or did you mean coiffe |
| 06:40.02 | JeffM | dunno man |
| 06:40.50 | JeffM | need to right justify that copyright too |
| 06:41.04 | jcp | JeffM: is it alright if I commit a few changes to the message used in weblogin.php? It has some grammatical errors |
| 06:41.21 | JeffM | commit? |
| 06:41.28 | JeffM | just paste em here |
| 06:41.29 | jcp | um, svn commit? |
| 06:41.32 | jcp | k |
| 06:41.32 | JeffM | I'm editing the file |
| 06:41.35 | jcp | k |
| 06:41.39 | JeffM | commiting them won't get em uploaded |
| 06:41.50 | jcp | ah ok, that makes sense |
| 06:41.53 | jcp | I'll pastebin them if that works |
| 06:41.59 | JeffM | whatever |
| 06:46.28 | jcp | nvm, not worth pastebinning, I'll just send it directly |
| 06:46.36 | jcp | the last paragraph, with changes: Please contact the site owner to have them rectify the problem. If the site in question has asked you for your password, it's possible that the site may have stored it. It is highly recommended that users that see this message change their password. |
| 06:47.24 | jcp | And I don't know what the official idea on tense is (since I remember there was debate at the wiki over it), but the last sentence would be better as "We highly recommend you change your password to keep your account secure." |
| 06:47.35 | JeffM | isn't it it is, as the site isn't posesive :) |
| 06:47.44 | JeffM | the wiki is different |
| 06:47.45 | jcp | what |
| 06:47.54 | jcp | "isn't it it is" what the heck? |
| 06:48.08 | JeffM | "it's" is not the same as "it is" |
| 06:48.08 | blast007 | it's isn't possessive. |
| 06:48.14 | jcp | yeah it is |
| 06:48.18 | JeffM | you sure? |
| 06:48.24 | jcp | oh my gosh |
| 06:48.24 | blast007 | it's is a contraction for it is |
| 06:48.30 | jcp | that explains why you've grammarfailed all over :-P |
| 06:48.35 | jcp | "it's" is a contraction of "it is: |
| 06:48.49 | jcp | " |
| 06:48.49 | blast007 | its is possisive |
| 06:48.49 | JeffM | ahh ok |
| 06:48.49 | jcp | The posessive form of "it" is "its" without the "'" |
| 06:48.49 | JeffM | I get them mixed up |
| 06:48.50 | jcp | lol |
| 06:48.55 | jcp | does too |
| 06:49.01 | Flash | JeffM: try this: http://flash.pastebin.ca/1743788 |
| 06:49.03 | JeffM | jcp: that'd also be because I'm a little dislexic |
| 06:49.21 | blast007 | their is to many versions of words!!! |
| 06:49.29 | trepan | its -- it keeps the s close because it owns it, it rubs the lotion ... |
| 06:49.38 | blast007 | lol |
| 06:49.38 | *** join/#bzflag jcp (n=jw@unaffiliated/javawizard2539) |
| 06:50.05 | Flash | two issues: positioning is typically relative to the enclosing element, so if you want to position using styles, you don't want to use the flow |
| 06:50.22 | JeffM | heh |
| 06:50.34 | JeffM | I want to keep the word imediately in there, but I made the other changes, mostly :) |
| 06:50.34 | Flash | second, absolute/relative/static positioning is really hard to understand |
| 06:50.47 | JeffM | Flash: I just want it to look purdy |
| 06:50.50 | jcp | oh my gosh, I hate pidgin |
| 06:50.52 | jcp | JeffM: yeah, that's ok |
| 06:50.56 | *** join/#bzflag MrDudle (n=MrDudle[@unaffiliated/mrdudle) |
| 06:51.12 | MrDudle | on its skin |
| 06:51.13 | MrDudle | or else it gets the hose again |
| 06:52.20 | jcp | k |
| 06:52.28 | JeffM | Flash: tell you what, I'm just gonna check the sucker in, and you can edit the CSS file :) |
| 06:52.32 | JeffM | then I'll upload it again |
| 06:53.02 | jcp | JeffM: wait, the word "immediately" wasn't in there in the first place :-P |
| 06:53.13 | JeffM | it was in mine |
| 06:53.21 | jcp | oh, was looking at the version in subversion |
| 06:53.23 | jcp | but yeah, that works |
| 06:54.07 | jcp | oh, and the first paragraph, "loging in" should be spelled "logging in" |
| 06:54.18 | CIA-75 | BZFlag: 03JeffM2501 * r20713 10/trunk/db/ (css/weblogin.css weblogin.php): |
| 06:54.18 | CIA-75 | BZFlag: Replace the old and busted website look with CSS and stuff. |
| 06:54.18 | CIA-75 | BZFlag: let the site pass in a css url using &css paramater |
| 06:55.41 | Flash | is there a particular reason for your <div> layout? |
| 06:55.45 | CIA-75 | BZFlag: 03JeffM2501 * r20714 10/trunk/db/images/ (webauth_alert.png webauth_logo.png): weblogin images |
| 06:55.50 | JeffM | Flash: nope |
| 06:56.06 | JeffM | mostly just wanted to give max flexability to the site that sends in another css |
| 06:56.18 | JeffM | so they had sections to use in the CSS |
| 06:56.40 | JeffM | does not claim to be a div or layout master |
| 06:57.40 | Flash | where's BulletCatcher? These files don't have the "native" line property |
| 06:57.58 | JeffM | he probably never got to the db repo |
| 06:59.17 | CIA-75 | BZFlag: 03JeffM2501 * r20715 10/trunk/db/css/weblogin.css: props |
| 07:03.12 | CIA-75 | BZFlag: 03jwmelto * r20716 10/trunk/db/ (css/weblogin.css weblogin.php): Prototype layout change, using CSS |
| 07:03.13 | Flash | that simply moves the logo to the top-right, using CSS |
| 07:04.11 | JeffM | that does not look half bad |
| 07:04.15 | JeffM | http://my.bzflag.org/weblogin.php?&url=blah |
| 07:04.34 | Flash | yeah, that's how it looked when I tested |
| 07:04.35 | JeffM | shore up that login button and I think it'll be fine |
| 07:05.14 | jorgenpt | I thought eol-style was native per default? |
| 07:05.27 | jorgenpt | (but it breaks if line endings aren't consistent or something) |
| 07:05.27 | JeffM | only if your client is set up so |
| 07:05.49 | jorgenpt | Oh, never mind, yeh. |
| 07:05.58 | jorgenpt | It doesn't touch eol-style per default. |
| 07:06.12 | JeffM | I didn't have it set for css files |
| 07:07.19 | Flash | the login button is where it is because of some explicit <br> tags. If you want it right up under Password, that's easy |
| 07:07.35 | JeffM | k |
| 07:07.45 | JeffM | probably left over from old code |
| 07:07.48 | JeffM | yank away |
| 07:08.39 | CIA-75 | BZFlag: 03JeffM2501 * r20717 10/trunk/db/images/ (webauth_alert.png webauth_logo.png): png files is png files |
| 07:08.53 | CIA-75 | BZFlag: 03jwmelto * r20718 10/trunk/db/weblogin.php: remove extra line breaks |
| 07:09.34 | JeffM | perfect, thank you |
| 07:09.42 | JeffM | that looks cleaner then the old one I think |
| 07:10.47 | JeffM | and stryer can make it baby poop green if he wants :) |
| 07:10.59 | Flash | I haven't decided about when to use <div> for layout, and when <table> is appropriate |
| 07:11.21 | Flash | The best way to line up the field labels and the fields is with a table |
| 07:11.46 | jorgenpt | There're a gazillion articles about how to do it without tables, aren't there? |
| 07:13.03 | jorgenpt | JeffM: What kind of sanitation is done on the css-parameter? |
| 07:13.11 | JeffM | oops |
| 07:13.13 | jorgenpt | JeffM: Default PHP magic_quotes? |
| 07:13.28 | JeffM | I keep forgetting I'm not working in my framework :) |
| 07:13.59 | JeffM | feel free to make it better |
| 07:14.01 | JeffM | please |
| 07:14.02 | jorgenpt | (magicquotes have been deprecated by the PHP team) |
| 07:14.31 | jorgenpt | Why is the CSS doc an URL parameter to begin with? Isn't it more of a config file thing? |
| 07:15.26 | JeffM | it's so that sites can send in there own to make it fit there style better |
| 07:15.48 | JeffM | so strayer can make it green, and jcp can make it blue gray, etc.. |
| 07:15.53 | jorgenpt | Oh, different sites use it, ok |
| 07:15.55 | JeffM | in case they imbed it into an iframe |
| 07:15.56 | JeffM | yeah |
| 07:17.01 | jcp | JeffM: so is iframe embedding allowed? |
| 07:17.14 | jcp | cause, that would make solving my problem one heck of a ton easier |
| 07:17.17 | JeffM | I don't see anywhay I can prevent it |
| 07:17.25 | JeffM | and it gets the job doen |
| 07:17.26 | JeffM | done |
| 07:17.28 | CIA-75 | BZFlag: 03JeffM2501 * r20719 10/trunk/bzflag/misc/webauth/checkToken.php: mention that you have to send em to the login form, and that you can css it. |
| 07:17.36 | jcp | well, I meant more like am I going to be frowned on if I use it |
| 07:17.38 | JeffM | I'd be less worried about that |
| 07:17.43 | jcp | k |
| 07:17.58 | JeffM | I personaly won't think it's a "hole" or anything |
| 07:18.13 | Flash | iframes are generally looked down upon, precisely because of the kind of cross-site scripting we are advocating here ;-) |
| 07:18.14 | JeffM | now I would like to make the weblogin page use a cookie |
| 07:18.23 | JeffM | so it can do it's own "remember me" thing |
| 07:18.30 | JeffM | on a per URL basis |
| 07:18.34 | JeffM | but it'd be our cookie |
| 07:18.44 | blast007 | I would think the iframe would be just as bad as allowing an embedded form |
| 07:18.46 | Flash | it's been a while since I wrote a cookie |
| 07:19.01 | JeffM | blast007: is there a way to prevent it? |
| 07:19.14 | Flash | let's see.. I think I did it in /bin/sh and C++.... I don't really speak PHP and I'm getting senile |
| 07:19.15 | blast007 | sure, with javascript ;) |
| 07:19.29 | jorgenpt | JeffM: Something like: if (get_magic_quotes_gpc()) { $css = stripslashes($_VALUES['css']); } else { $css = $_VALUES['css'] }; $css = htmlspecialchars($css); |
| 07:19.29 | JeffM | think it's worth it? |
| 07:19.32 | blast007 | lots of sites have a simple JS to break out of frames |
| 07:19.39 | JeffM | jorgenpt: it's in svn, go for it :) |
| 07:19.57 | jorgenpt | I don't have that part checked out, hrrgh. :-p |
| 07:19.59 | jorgenpt | *finds URL* |
| 07:20.16 | JeffM | https://bzflag.svn.sourceforge.net/svnroot/bzflag/trunk/db |
| 07:20.18 | jorgenpt | Oh, I do |
| 07:20.37 | blast007 | jorgenpt: or we could just turn off magic quotes ;) |
| 07:20.39 | jorgenpt | Oh I don't. |
| 07:20.44 | jcp | What are "magic quotes"? |
| 07:20.48 | jorgenpt | blast007: You want your code to be portable, right? ;-P |
| 07:20.59 | jorgenpt | jcp: PHP feature that should (and will) rot in hell |
| 07:21.02 | blast007 | jorgenpt: not really |
| 07:21.07 | jcp | what |
| 07:21.15 | jorgenpt | jcp: Basically, automatic escaping of all incoming data from GET, POST, etc. |
| 07:21.20 | blast007 | we could just document that our stuff assumes that it's turned off |
| 07:21.37 | blast007 | isn't safe mode deprecated too? |
| 07:21.44 | jorgenpt | jcp: But it fails, because not all DBMs use the same escaping, you're not always using the data for DBs, etcetera. |
| 07:22.01 | jorgenpt | blast007: yaeh |
| 07:22.14 | jorgenpt | s/DBM/DB/ |
| 07:22.24 | jcp | ah, ok |
| 07:22.26 | blast007 | rewrites all the web services in Python |
| 07:22.28 | jcp | just found something on it on google |
| 07:22.40 | blast007 | well, actually, I should probably do "/me learns Python" first |
| 07:22.41 | jorgenpt | jcp: Plus, it relies on the server having it enabled, and if you don't have it enabled, your code suddenly has security holes! Woo! |
| 07:22.47 | jorgenpt | Python is nice :-) |
| 07:22.47 | jcp | lol! |
| 07:23.24 | jorgenpt | jcp: Which basically meant: Newbies learnt PHP, and learnt that "PHP fixes all escaping of incoming data for me, so I don't need to care", wrote code, shipped code, other people ran code on servers without magic quotes, servers were hacked. |
| 07:23.24 | Supertanker | blast007, hey, I know python. Enough to close my first bug report today, anyways... |
| 07:23.28 | jorgenpt | And things like that. |
| 07:23.45 | Supertanker | Oh god, not magic quotes |
| 07:23.58 | jcp | wait, like you don't enable/disable it with something in the page? |
| 07:24.01 | jorgenpt | (PHP has in 5.3 deprecated magic quotes, and they will be removed in 6.0. That's sadly about 1 or 2 major revisions too late) |
| 07:24.01 | jcp | cause, that's just stupid |
| 07:24.10 | jorgenpt | jcp: No, it's a server setting |
| 07:24.16 | jcp | yeah, that's stupid then |
| 07:24.31 | jorgenpt | jcp: and either you *can't* change the setting in your code, or if you can, it doesn't affect it. |
| 07:24.37 | jorgenpt | (because the escaping is done before your code is run) |
| 07:24.38 | blast007 | and I think it defaults to on, or at least it used to |
| 07:24.47 | Supertanker | blast007, not in PHP 5.x |
| 07:25.03 | Supertanker | ...I think. |
| 07:25.03 | blast007 | Supertanker: right, but I've been doing PHP since 2003 ;) |
| 07:25.10 | Supertanker | blast007, ah, okay :) |
| 07:25.26 | jorgenpt | You *can* fix it, there's a block of code (that the PHP people posted) that'll unescape everything if magic quotes are enabled. |
| 07:25.36 | Supertanker | Hey, maybe you could help me rewrite my site--I mean, uh, figure out why MDB2 refuses to return results with fetchRow(). :P |
| 07:25.48 | blast007 | jorgenpt: oh, and "register globals" is another evil ;) |
| 07:25.54 | jorgenpt | Hugh. ;-p |
| 07:26.19 | jorgenpt | blast007: In any case, the code probably still needs htmlspecialchars *writes fix* |
| 07:27.11 | blast007 | jcp: if ($_SESSION['isadmin']) $isAdmin = true; if ($isAdmin) { // something important here } |
| 07:27.23 | jorgenpt | Oh yes, uuugh. |
| 07:27.30 | jorgenpt | That's also autovivification though, blast007 |
| 07:27.43 | Supertanker | GET /index.php?isAdmin=true |
| 07:27.48 | blast007 | ;D |
| 07:27.48 | Supertanker | Oh ooops. |
| 07:28.14 | jorgenpt | That code shouldn't run, though, blast007, that would be ideal. ;-) |
| 07:28.33 | jorgenpt | (it should fail with "isAdmin hasn't been initialized/defined/declared" or something) |
| 07:28.35 | Supertanker | (Which is usually why I initilize important variables to False or somesuch beforehand) |
| 07:28.50 | blast007 | oh, that was referring to register globals |
| 07:28.53 | Supertanker | jorgenpt, that's a notice, not a critical error. |
| 07:29.01 | Supertanker | At least, from my experience. |
| 07:29.05 | jorgenpt | Supertanker: I know, I'm saying it *should* be an error |
| 07:29.05 | Supertanker | E_STRICT, isn't it? |
| 07:29.08 | jorgenpt | It isn't. It should be. |
| 07:29.16 | Supertanker | True, true./ |
| 07:29.48 | jorgenpt | Wait, it might not autovivify, I'm not sure. |
| 07:31.07 | jorgenpt | So it's an annoying thing both because of register_globals and because PHP will gladly let you use variables that haven't been initialized (making people write code that doesn't explicitly initialize variables, because they CAN!) |
| 07:31.24 | blast007 | :) |
| 07:31.29 | jorgenpt | Oh, you guys. Reminding me of all my pet peeves with PHP. :p |
| 07:31.48 | jorgenpt | I haven't used it in a few years. |
| 07:31.52 | Supertanker | *cough*Use Perl!*cough* |
| 07:31.55 | JeffM | do it all in weehttp :) |
| 07:32.11 | Supertanker | Because lots of random $ and # and % and ^ and &s are FUN. |
| 07:32.13 | jcp | *cough?*Use Java/GWT!*cough |
| 07:32.14 | jcp | * |
| 07:32.19 | Supertanker | And by FUN I mean an utter pain to remember. |
| 07:32.26 | blast007 | jcp: *cough*no*cough* |
| 07:32.31 | JeffM | jcp: weehttp is much faster |
| 07:32.41 | jcp | What is weehttp? |
| 07:32.49 | JeffM | and the problem with the list server machine is resources, like CPU |
| 07:32.57 | JeffM | tinny web server |
| 07:33.02 | jcp | Java doesn't use that much CPU |
| 07:33.12 | JeffM | it uses more then optimised C :) |
| 07:33.22 | jcp | entirely depends on what you're trying to do |
| 07:33.28 | JeffM | run a web server |
| 07:33.33 | Supertanker | Office 2007 doesn't use much CPU either. |
| 07:33.36 | jcp | Java owns C at memory allocation, and I mean by an order of magnitude |
| 07:33.38 | Supertanker | Or RAM. |
| 07:33.42 | jcp | Right, so it depends on what webserver you're using |
| 07:33.53 | JeffM | what do you mean by owns? |
| 07:33.57 | JeffM | uses more? |
| 07:34.06 | JeffM | allocates and deallocates faster? |
| 07:34.08 | Flash | and what does the web server have to do with it? |
| 07:34.13 | jcp | as in, a simple program that allocates an object then immediately discards it runs around 15 times faster in java than in C |
| 07:34.15 | jcp | yeah |
| 07:34.26 | JeffM | where did you see that? |
| 07:34.33 | Flash | java doesn't de-allocate |
| 07:34.37 | Flash | it garbage collects |
| 07:34.47 | jcp | correct |
| 07:34.53 | jcp | and I forced a garbage collection at the end of that cycle |
| 07:34.54 | JeffM | so it'll just leave arround |
| 07:34.57 | Flash | deferred management isn't faster, it just hides the cost |
| 07:34.57 | JeffM | you can do that in C too ;) |
| 07:34.58 | jcp | so I know the objects were all getting reclaimed |
| 07:35.04 | JeffM | yeah you pay in space |
| 07:35.06 | jcp | Flash: no, that includes garbage collection time |
| 07:35.09 | Flash | but you don't know WHEN |
| 07:35.23 | jcp | have you heard of, say, incremental garbage collection? |
| 07:35.26 | jcp | :-P |
| 07:35.42 | jcp | cause, Java 6 has that, and when you enable it there are like no pauses that I've ever seen |
| 07:35.45 | JeffM | tell you what split the diff, do it in C# |
| 07:35.51 | jcp | haha |
| 07:35.53 | Supertanker | Bahaha |
| 07:36.08 | Supertanker | Do it in Befunge. |
| 07:36.11 | Supertanker | Or Lolcode. |
| 07:36.17 | CIA-75 | BZFlag: 03daxxar * r20720 10/trunk/db/weblogin.php: Sanitize CSS URL that's display (to prevent XSS). :-) |
| 07:36.21 | JeffM | lolcode and C# woudl run the same |
| 07:36.27 | jorgenpt | Hmm, daxxar? Really? |
| 07:36.28 | jorgenpt | Oooh. |
| 07:36.35 | Supertanker | And C# would be easier to understand, I'd presume. |
| 07:36.45 | JeffM | indeed |
| 07:36.47 | jorgenpt | I blame you for this, BulletCatcher. |
| 07:36.54 | JeffM | can has system.web? |
| 07:37.03 | Supertanker | Or maybe you should write it in machine code, jcp. Total control over the memory. |
| 07:37.05 | jorgenpt | (I was fixing some copyright stuff or something, and used my old(tm) username) |
| 07:37.08 | Supertanker | No cheating with assembly. |
| 07:37.27 | jcp | Supertanker: pfft, I'd be bound to screw up somewhere |
| 07:37.40 | Supertanker | Don't we all? |
| 07:37.45 | Supertanker | If we didn't, there'd be no bugs. |
| 07:38.16 | JeffM | well weehttp is basicaly what bzfs uses for it's http stuff, it's rather secure mostly cus it just don't do much |
| 07:38.50 | JeffM | and it's not file based |
| 07:39.21 | Supertanker | I think I'll st[B |
| 07:40.14 | Supertanker | That was odd. |
| 07:40.20 | blast007 | JeffM: well, if we ever needed something different/better, there's always mongoose ;) http://code.google.com/p/mongoose/ |
| 07:40.40 | JeffM | can you replace it's networking system? |
| 07:40.49 | JeffM | that's the feature that I could not find in any of the existing ones |
| 07:40.54 | JeffM | they all want to do there own socket management |
| 07:41.02 | JeffM | and that wasn't going to work for what I wanted to do. |
| 07:41.03 | blast007 | it's a single c file |
| 07:41.15 | JeffM | so we could mod it |
| 07:41.36 | blast007 | oooo, a veeery long c file |
| 07:41.42 | Supertanker | Heh |
| 07:41.50 | blast007 | 4737 lines ;) |
| 07:41.54 | Supertanker | I'm agoing to bed and read/write awhile. |
| 07:41.59 | Supertanker | Sleepy and have story ideas bouncing around |
| 07:42.17 | Supertanker | jcp, tell me when you get that program written in machine code, I want to see it. |
| 07:42.24 | blast007 | no idea how hard/easy it would be to replace the network system in that |
| 07:42.45 | JeffM | yeah, dunno |
| 07:42.49 | jorgenpt | Good night! |
| 07:43.03 | JeffM | see ya |
| 07:43.28 | JeffM | we'll have to see what happens when people bang on bzfs http services |
| 07:43.36 | JeffM | I think fastmap gets used the most |
| 07:47.03 | jcp | Supertanker: nah, I'm gonna write one in pure fact |
| 07:47.16 | JeffM | loves the fact that his app can start a server in 2 lines of code :) |
| 07:47.18 | jcp | That'd be the slowest webserver evar |
| 07:47.44 | jcp | (not @ JeffM btw) |
| 07:48.15 | JeffM | does java have reflection? |
| 07:49.22 | trepan | yup |
| 07:49.36 | JeffM | reflection is awesome |
| 07:51.48 | jcp | heck yeah |
| 07:53.49 | Flash | well, I found a CSS solution for the form layout, but seems like a table is still the right solution |
| 07:54.40 | jcp | `restart |
| 07:54.53 | jcp | erg, wrong channel |
| 08:25.52 | jcp | So, before I add this in, figured I'd make sure it's ok. I finished up my BZFlag bot. Is it ok if it "impersonates" an official client to authenticate with the list server in order to authenticate with the bzflag server? |
| 08:26.24 | JeffM | what servers are you going to send it to? |
| 08:26.39 | jcp | My own and any server owner that wants one there |
| 08:26.47 | jcp | (which I already have one such server owner) |
| 08:26.54 | JeffM | so it's bzadmin |
| 08:26.59 | JeffM | not a bot |
| 08:27.00 | jcp | not quite |
| 08:27.02 | jcp | no |
| 08:27.03 | jcp | it is a bot |
| 08:27.09 | JeffM | you arn't helping yourself |
| 08:27.11 | jcp | You've seen marlen_jackson, right? |
| 08:27.13 | JeffM | I gave you a way out ;) |
| 08:27.18 | jcp | um, what? |
| 08:27.21 | JeffM | nevermind |
| 08:27.31 | JeffM | you don't even idenify it as a bot? |
| 08:27.35 | jcp | ok, it's bzadmin with a really fast thinking person behind it :-P |
| 08:27.38 | jcp | what do you mean? |
| 08:27.45 | JeffM | bzadmin can be scripted |
| 08:27.57 | jcp | I know |
| 08:28.05 | JeffM | what does it do? |
| 08:28.08 | jcp | well, actually, I sorta didn't know until after I had coded the BZFlag client library in Java |
| 08:28.19 | jcp | anything, really. It's programmed via a scripting language and via messages sent to it |
| 08:28.26 | jcp | You've seen marlen_jackson on freenode, right? |
| 08:28.29 | JeffM | no |
| 08:28.41 | jcp | care to join ##jzbot for like 10 seconds? |
| 08:28.44 | JeffM | no |
| 08:28.46 | jcp | pfft |
| 08:28.48 | CIA-75 | BZFlag: 03jwmelto * r20721 10/trunk/db/ (css/weblogin.css weblogin.php): |
| 08:28.48 | CIA-75 | BZFlag: Whitespace is for humans, not web servers. Update indentation to be consistent. |
| 08:28.48 | CIA-75 | BZFlag: Remove duplicate code |
| 08:28.48 | CIA-75 | BZFlag: Format field layout using CSS |
| 08:29.09 | JeffM | if you keep it to a subset of servers and don't abbuse the list it should be fine |
| 08:29.18 | jcp | k |
| 08:29.20 | JeffM | it's a highly automated bzadmin bassicly |
| 08:29.22 | JeffM | so that's ok |
| 08:29.27 | jcp | haha, ok |
| 08:29.49 | JeffM | if its' on IRC just don't bring it into any official bzflag channels |
| 08:30.06 | jcp | It's been on IRC for 9 months and you haven't noticed it :-P |
| 08:30.12 | jcp | so yeah, it won't cause any trouble |
| 08:30.12 | JeffM | it's not in here |
| 08:30.14 | jcp | I know |
| 08:30.16 | JeffM | so I don't care |
| 08:30.26 | jcp | I meant it had avoided for 9 months joining here, it's not gonna do it in a hurry |
| 08:30.36 | JeffM | are you saying I should somehow have magical knowledge of all the users on IRC? ;) |
| 08:30.51 | jcp | yeah, cause you're epic like that |
| 08:30.59 | JeffM | riiiiiggghhhhttt |
| 08:32.21 | JeffM | I didn't know you guys were abusing weblogin for a couple years :) |
| 08:32.30 | jcp | haha, good point |
| 08:32.42 | jcp | So, one more thing. The bot uses a custom clientquery string. Is that ok? |
| 08:32.54 | JeffM | is it descriptive? |
| 08:33.05 | jcp | "javawizard2539's JZBot, http://jzbot.googlecode.com: |
| 08:33.08 | jcp | s/:/"/ |
| 08:33.08 | jcp | that's it |
| 08:33.11 | jcp | without the quotes |
| 08:33.31 | JeffM | it'd be best if you took your name out and put in a real version number |
| 08:33.41 | JeffM | it's not like we say "Tim Riker's bzflag!" |
| 08:33.51 | JeffM | treat it like a profesional project ;) |
| 08:33.58 | JeffM | not a toy with your hand writen name on it |
| 08:34.38 | DTRemenak | works for Sid Meier and Richard Garriott :) |
| 08:34.53 | JeffM | yeah but they are just a 'tad' pretentious |
| 08:34.56 | DTRemenak | haha |
| 08:35.06 | JeffM | and look what it got lord british, a dead game |
| 08:35.08 | jcp | ok |
| 08:35.17 | jcp | still needs to set up a version number scheme for my bot |
| 08:35.34 | jcp | Releases are essentially r712, r1021, etc, which is extremely indescriptive |
| 08:35.42 | jcp | but yeah, I'll change that |
| 08:35.55 | DTRemenak | eh, that works. I've always preferred revision numbers :) |
| 08:36.01 | jcp | does too |
| 08:36.03 | DTRemenak | the idea is just that it should be identifiable |
| 08:36.03 | JeffM | what's the point of the URL in there? |
| 08:36.07 | JeffM | yeah |
| 08:36.13 | jcp | I'm just too lazy to figure out a formal system, yet |
| 08:36.16 | DTRemenak | JeffM: to give people somewhere to complain :) |
| 08:36.16 | JeffM | it should describe what it is, not be an ad for it |
| 08:36.25 | JeffM | we don't have that for players |
| 08:36.32 | JeffM | email may be a better place for it |
| 08:36.35 | JeffM | to be more consistent |
| 08:36.42 | JeffM | and show it's a bot in the player list |
| 08:36.45 | jcp | k. I just had it in there in case admins are wondering what it is |
| 08:36.49 | jcp | how would it do that? |
| 08:36.59 | JeffM | why would they wonder what it is, they asked for it to be there |
| 08:37.00 | JeffM | ;) |
| 08:37.06 | JeffM | its' part of the enter message |
| 08:37.19 | jcp | no, I mean like on my servers, there are probably 30 or so admins |
| 08:37.26 | JeffM | and you didn't tell them? |
| 08:37.30 | JeffM | what kind of owner are you |
| 08:37.31 | jcp | and I don't want to have to go around explaining to them what this newfangled bot thing is |
| 08:37.33 | jcp | pfft |
| 08:37.37 | jcp | Bambino does most of the management |
| 08:37.41 | JeffM | send it out on your admin mailinglist |
| 08:37.43 | JeffM | then have him do it |
| 08:37.48 | JeffM | how do you give your rules out to your admins? |
| 08:37.59 | jcp | we have them 1: as a help page, 2: as a page on our website |
| 08:38.15 | JeffM | and how do they know when they change? |
| 08:38.26 | DTRemenak | if you have a faq, an entry about that would probably be appropriate |
| 08:38.31 | jcp | well, that was one of the reasons I wanted the bot, was because I wanted to write a factoid that alerts them about news like that |
| 08:38.53 | jcp | cause, if rules change, they *don't* know about it at the moment |
| 08:38.53 | JeffM | a bot like that is a powerful tool, I'd think you'd want to train your admins on it |
| 08:38.56 | jcp | and that's not a good thing |
| 08:38.58 | JeffM | it should not be a suprise |
| 08:39.00 | jcp | well yeah |
| 08:39.37 | JeffM | from an application standpoint i'd think the bot would have a /about command that would give the URL |
| 08:39.37 | DTRemenak | it's just a matter of time, really...if they ban it they'll hear about it ;) |
| 08:39.41 | JeffM | that's how IRC bots do it |
| 08:39.50 | jcp | It does |
| 08:39.52 | JeffM | the URL isn't realy useful in a client query |
| 08:39.55 | jcp | you can pm it "help" |
| 08:39.58 | jcp | hmm, ok |
| 08:40.07 | DTRemenak | search robots on the internet use the url in their client id, so it's not unprecidented |
| 08:40.16 | JeffM | ahh |
| 08:40.19 | jcp | well, the other thing to its credit is that a google search for "jzbot" turns up my bot as the first result, so they could find info that way |
| 08:40.40 | JeffM | again it should not be a suprise to them :) |
| 08:40.49 | DTRemenak | ah, that's cool |
| 08:40.54 | JeffM | DTRemenak: tahts' more for the site to log right not for meat to read |
| 08:41.36 | DTRemenak | gets written to the server logs too |
| 08:41.46 | DTRemenak | likes urls |
| 08:41.47 | JeffM | true |
| 08:42.00 | DTRemenak | they're uniform. and resourcy. and have locations. |
| 08:42.04 | JeffM | heh |
| 08:42.30 | JeffM | tho his URL isn't really describing the exact resource |
| 08:42.35 | JeffM | just the root for the site |
| 08:42.55 | DTRemenak | mmm, it's pretty specific |
| 08:43.00 | DTRemenak | as specific as bzflag.org is for us |
| 08:43.03 | JeffM | yeah |
| 08:43.15 | JeffM | and we don't put that in the client qery |
| 08:43.25 | jcp | because they're already using it :-P |
| 08:43.28 | DTRemenak | no, we put it in the startup text |
| 08:43.51 | JeffM | that that's more of a help thing In my mind |
| 08:43.54 | DTRemenak | and really, if you're running anything on the bzflag protocol, you SHOULD know where to find those :) |
| 08:44.03 | JeffM | yay, the airships move :) |
| 08:44.05 | DTRemenak | just like IE and Mozilla don't put their urls in |
| 08:44.59 | DTRemenak | but whatever |
| 08:45.01 | DTRemenak | it's all bikeshed |
| 08:45.08 | JeffM | BLUE! |
| 08:45.10 | DTRemenak | and it's not even our product to argue about :) |
| 08:45.21 | JeffM | indeed, all just sugestions :) |
| 08:45.29 | jcp | yeah, but helpful ones |
| 08:45.35 | jcp | and I'm willing to do what the community wants |
| 08:45.41 | DTRemenak | afaik we don't have any hard and fast rules about what to respond to clientquery with, as long as it is sufficiently unique and identifiable |
| 08:46.09 | JeffM | yeah a version number at the least I'd think |
| 08:46.13 | jcp | yeah |
| 08:46.22 | DTRemenak | I think that'd be helpful to you, if nothing else :) |
| 08:46.33 | DTRemenak | (did I REALLY restart that...?) |
| 08:46.45 | jcp | yeah |
| 08:47.08 | jcp | k so, another question related to that, is there a simple and straightforward "svn ..." command that emits the working copy's current revision number without any other data? |
| 08:47.26 | jcp | cause I could have my build script dump that to a file and then have the bot read that from the file |
| 08:48.43 | DTRemenak | $Rev:$ might be useful |
| 08:48.52 | jcp | $Rev:$? |
| 08:49.01 | BulletCatcher | svn info | awk '$1 == "Revision:" {print $2}' |
| 08:49.09 | DTRemenak | http://svnbook.red-bean.com/en/1.4/svn.advanced.props.special.keywords.html |
| 08:49.11 | jcp | ah, ok, ty |
| 08:49.27 | JeffM | it's substiute it on checkout or update |
| 08:49.32 | JeffM | then no scripting |
| 08:49.43 | DTRemenak | if you include the text "$Rev:$" in a file, it will be replaced on checkout with something like "$Rev: 20399$" |
| 08:50.50 | DTRemenak | "svnversion ." would probably also do more directly what you're looking for |
| 08:51.09 | DTRemenak | outputs "20399" for instance |
| 08:52.30 | jcp | DTRemenak: I never knew about that. That's awesome |
| 08:52.40 | DTRemenak | svn is a pretty awesome tool :) |
| 08:52.43 | jcp | heck yeah |
| 08:58.15 | jcp | JeffM: k so, until I get a formal version number system down, how would "JZBot r1113 (Sat, 09 Jan 2010)" look? |
| 08:58.26 | jcp | (or anyone else) |
| 08:58.35 | JeffM | it's identifyable |
| 08:58.43 | jcp | k |
| 09:08.44 | jcp | hmm |
| 09:09.01 | jcp | DTRemenak: is there a way to tell a file to update when anything in the folder it's in is updated as well? |
| 09:16.15 | JeffM | ok, paralax scrolling looks pretty cool |
| 09:33.08 | *** join/#bzflag Foo_man_choo (n=spldart2@h188.70.89.75.dynamic.ip.windstream.net) |
| 10:06.55 | *** join/#bzflag TimRiker (n=timr@bzflag/projectlead/TimRiker) |
| 10:06.55 | *** mode/#bzflag [+o TimRiker] by ChanServ |
| 10:37.48 | *** join/#bzflag MrDudle (n=MrDudle[@unaffiliated/mrdudle) |
| 11:19.08 | *** join/#bzflag JStoker (i=jstoker@unaffiliated/jstoker) |
| 11:43.09 | *** join/#bzflag MarderIII (n=marderii@enneman.demon.nl) |
| 11:49.55 | *** part/#bzflag MarderIII (n=marderii@enneman.demon.nl) |
| 12:36.36 | *** join/#bzflag xaver (n=xaver@pD9ED5F08.dip.t-dialin.net) |
| 13:43.07 | *** join/#bzflag xaver (n=xaver@pD9ED5F08.dip.t-dialin.net) |
| 14:12.27 | *** join/#bzflag Tupone (n=Tupone@gentoo/developer/tupone) |
| 14:12.27 | *** mode/#bzflag [+v Tupone] by ChanServ |
| 15:18.12 | *** join/#bzflag mrapplecomputer1 (n=mrapplec@unaffiliated/mrapplecomputer1) |
| 15:27.22 | *** join/#bzflag bier (n=bier@pD9E2F47E.dip.t-dialin.net) |
| 15:59.49 | delusional_ | would it be possible to have a physics driver that quickly spins a tank around 180 degrees, then spits you off. |
| 15:59.56 | delusional_ | ? |
| 16:01.56 | *** join/#bzflag dexter- (n=Adium@bzflag/player/Dexter) |
| 16:02.02 | dexter- | blast007: ping |
| 16:03.38 | blast007 | dexter-: pong |
| 16:06.44 | mrapplecomputer1 | delusional_: no, i dont think so |
| 16:07.31 | trepan | delusional_: use a meshface link setup |
| 16:07.57 | trepan | (instant half turn) |
| 16:12.40 | ts | ~seen JeffM |
| 16:12.42 | ibot | jeffm <n=JeffM@bzflag/projectadmin/JeffM> was last seen on IRC in channel #bzflag, 6h 56m 27s ago, saying: 'ok, paralax scrolling looks pretty cool'. |
| 16:13.10 | ts | Hrm..need global login policy change |
| 16:13.34 | blast007 | ts: hmm? |
| 16:14.08 | ts | blast007: Which policy does apply regarding weblogin? The one in the wiki or the one in the script? |
| 16:14.18 | ts | They are not identical. |
| 16:14.40 | blast007 | which script and which wiki page? |
| 16:14.59 | ts | weblogin.php and http://my.bzflag.org/wiki/index.php?title=List_Server_Usage_Policy&oldid=6852 |
| 16:16.45 | blast007 | okay, and what is different? |
| 16:17.04 | blast007 | I don't see a "policy" in the weblogin.php script |
| 16:17.06 | ts | blast007: Note the last sentence at the wiki page. It goes as far as even disallowing local auth from my point of view |
| 16:17.27 | ts | Well, the script has a little error section |
| 16:17.36 | blast007 | okay..? |
| 16:18.16 | blast007 | in order to use the bzflag login creditials on a remote website, the users have to see our weblogin page |
| 16:18.32 | ts | If I interpret the wiki correct then even using weblogin (link to the script on official server) is forbidden if the site does have the alternate method of using a local login to authenticate |
| 16:21.07 | *** join/#bzflag teatree (n=Pook@dslb-088-064-049-092.pools.arcor-ip.net) |
| 16:21.22 | ts | blast007: What now? |
| 16:22.24 | ts | Please clarify it. |
| 16:22.30 | blast007 | doing so |
| 16:25.38 | ts | I can see why it would be not wanted to enter global login data at a different form but the local stuff should not be affected by the policy |
| 16:27.06 | mebigfatguy | fn-awesome: http://www.youtube.com/watch?gl=GB&hl=en-GB&v=a9xAKttWgP4&fmt=18 |
| 16:29.59 | CIA-75 | BZFlag: 03Blast 07http://my.bzflag.org * r6854 10/w/List_Server_Usage_Policy: |
| 16:30.06 | blast007 | ts: is that better? |
| 16:31.29 | CIA-75 | BZFlag: 03Blast 07http://my.bzflag.org * r6855 10/w/List_Server_Usage_Policy: /* Weblogin */ |
| 16:31.44 | ts | Well, I get their username and password. Just the password will be a LOCAL one (independed of global login) |
| 16:32.00 | ts | independent* |
| 16:32.07 | blast007 | ts: I added a bit more |
| 16:32.28 | blast007 | since I can read minds |
| 16:32.34 | blast007 | ;) |
| 16:32.38 | ts | yay |
| 16:32.43 | ts | Thanks :) |
| 16:33.06 | blast007 | np |
| 16:42.10 | *** join/#bzflag SpazzyMcGee (n=SpazzyMc@bzflag/contributor/SpazzyMcGee) |
| 16:46.42 | dexter- | by the way: there's gonna be a similar situation to the rikers cup going down this evening |
| 16:46.59 | dexter- | So global will definitely be on a strain |
| 16:49.38 | blast007 | dexter-: we'll make sure to stop the torrents around that time |
| 16:49.39 | blast007 | ;) |
| 16:51.52 | dexter- | mkay |
| 16:55.50 | *** part/#bzflag dexter- (n=Adium@bzflag/player/Dexter) |
| 17:17.45 | *** join/#bzflag Yassen (n=Yassen@unaffiliated/yassen) |
| 17:57.56 | *** join/#bzflag allejo (n=allejo@pool-173-51-205-154.lsanca.fios.verizon.net) |
| 18:03.13 | *** join/#bzflag allejo (n=allejo@pool-173-51-205-154.lsanca.fios.verizon.net) |
| 18:05.10 | *** join/#bzflag JeffM (n=JeffM@bzflag/projectadmin/JeffM) |
| 18:05.10 | *** mode/#bzflag [+o JeffM] by ChanServ |
| 18:10.47 | *** join/#bzflag SpazzyMcGee (n=SpazzyMc@bzflag/contributor/SpazzyMcGee) |
| 18:26.01 | *** join/#bzflag jcp (n=jw@unaffiliated/javawizard2539) |
| 18:33.44 | CIA-75 | BZFlag: 03JeffM2501 * r20722 10/trunk/db/weblogin.php: fail safely for systems that don't use a referrer ( it's weak security anyway ). |
| 18:37.37 | mrapplecomputer1 | smoooth, broke my form |
| 18:39.32 | jcp | form? |
| 18:39.39 | jcp | um, I thought that already broke last night... |
| 18:40.31 | mrapplecomputer1 | no it was fine this morning |
| 18:40.47 | JeffM | mrapplecomputer1: thanks for telling me that now :/ |
| 18:41.14 | jcp | mrapplecomputer1: How are you doing it, and what just changed? |
| 18:41.27 | mrapplecomputer1 | he added some formkey stuff |
| 18:41.36 | JeffM | I did that last night man |
| 18:41.40 | mrapplecomputer1 | oh i mean |
| 18:41.47 | mrapplecomputer1 | fail for sites that dont use referers |
| 18:41.50 | blast007 | must not have been fully updated on the server |
| 18:41.57 | mrapplecomputer1 | yah because worked fine for me |
| 18:42.04 | JeffM | actualy I made it PASS for people that don't use referers |
| 18:42.24 | JeffM | $validReferer = TRUE; // some systems disable referers, so we can't check em if it dosn't exist. |
| 18:43.41 | mrapplecomputer1 | aw JeffM did you just remove the evil little favicon.ico? :D |
| 18:43.53 | JeffM | huh? |
| 18:44.29 | mrapplecomputer1 | strange there was a favicon with like an evil face before on the "attempting to circumvent" page |
| 18:44.45 | JeffM | nope |
| 18:44.50 | mrapplecomputer1 | wierd |
| 18:44.57 | JeffM | you are sounding more and more like you don't realy know what you are talking about |
| 18:45.04 | JeffM | or your system has some oddness |
| 18:45.20 | blast007 | he's probably confusing his IRC client with his browser |
| 18:45.22 | blast007 | ;) |
| 18:45.31 | *** join/#bzflag kierra (n=jolie@unaffiliated/kierra) |
| 18:46.46 | ts | I guess he means the favicon at strayer's site |
| 18:46.59 | JeffM | possibly |
| 18:47.02 | ts | ..but that one is still there |
| 18:47.23 | ts | Guessing is an interesting game :) |
| 18:48.06 | JeffM | not when it really dosn't matter |
| 18:48.18 | ts | nods |
| 18:50.42 | *** join/#bzflag [dmp] (n=dennis@static.251.110.40.188.clients.your-server.de) |
| 18:54.25 | kierra | waves at JeffM :) |
| 18:55.03 | kierra | [dmp]: ping |
| 18:55.26 | JeffM | hallo, how are you? |
| 18:56.08 | kierra | i'm good, ty, behaving as usual |
| 18:56.10 | kierra | and you? |
| 18:56.15 | JeffM | I'll live |
| 18:56.32 | kierra | aw, doesnt sound good enough, Jeff |
| 18:56.33 | JeffM | if the third party web admins don't track me down and kill me |
| 18:58.09 | kierra | brlcad: ping |
| 18:58.11 | kierra | ty dmp |
| 18:58.31 | JeffM | brlcad: you arround? |
| 18:58.59 | kierra | goes in search of menotume |
| 18:59.20 | kierra | be sweet, JeffM ;) |
| 18:59.24 | *** part/#bzflag kierra (n=jolie@unaffiliated/kierra) |
| 18:59.38 | Supertanker | Oh my. |
| 19:05.22 | Supertanker | Guess I should give BZFlag another roll. It's been a few years, and it's about time I found something new addicting to do |
| 19:10.34 | [dmp] | bzflag.org gives a permission error |
| 19:11.09 | blast007 | [dmp]: does it now? |
| 19:11.29 | [dmp] | blast007: nope |
| 19:11.37 | blast007 | good, cuz I broked it for a bit there ;) |
| 19:12.12 | [dmp] | phew :) .. I was worried that I did something, since i just tried to log onto it for the first time in years :) |
| 19:13.10 | blast007 | heh |
| 19:13.53 | *** join/#bzflag temporalD (n=ATD@bzflag/serverop/TemporalDistraction) |
| 19:17.28 | Supertanker | [dmp] is responsible for single-handedly setting the BZFlag datacenter on fire. |
| 19:17.51 | [dmp] | Supertanker: .. and only by using tail and sudo tail :) |
| 19:18.30 | *** join/#bzflag dexter- (n=Adium@bzflag/player/Dexter) |
| 19:18.34 | dexter- | blast007: still there? |
| 19:18.47 | blast007 | nope, I'm over here |
| 19:19.05 | blast007 | sup? |
| 19:19.11 | dexter- | ah, yo |
| 19:35.37 | Supertanker | [dmp], that just means you're *really* good at lighting things on fire. |
| 19:35.38 | *** mode/#bzflag [+v spldart] by ChanServ |
| 19:37.47 | CIA-75 | BZFlag: 0375.168.114.233 07http://my.bzflag.org * r6856 10/w/List_Server: typo |
| 19:42.26 | *** part/#bzflag dexter- (n=Adium@bzflag/player/Dexter) |
| 19:50.12 | CIA-75 | BZFlag: 03Allejo 07http://my.bzflag.org * r6857 10/w/Mesh: /* Simplified Examples */ |
| 20:00.16 | *** join/#bzflag gfm (n=gfm@88-117-9-51.adsl.highway.telekom.at) |
| 20:16.54 | CIA-75 | BZFlag: 0396.30.139.102 07http://my.bzflag.org * r6858 10/w/Mesh: /* Simplified Examples */ |
| 20:27.20 | Supertanker | I wonder if I can remember my password from five years ago |
| 20:29.02 | JeffM | anyone got a site that does weblogin that they care to help me test soemthign wtih? |
| 20:29.06 | JeffM | with even :0 |
| 20:30.18 | blast007 | JeffM: sure |
| 20:30.30 | JeffM | swap it to weblogin_dev.php |
| 20:31.04 | JeffM | it should have an autologin feature per requesting site |
| 20:32.11 | JeffM | it should help offset the HOORIBLE pain users have to go thru when using the external form rather then an internal one |
| 20:32.27 | blast007 | almost worked |
| 20:32.33 | blast007 | the URL it returned didn't have a username |
| 20:32.37 | JeffM | hmm |
| 20:32.39 | JeffM | ahh ok |
| 20:32.40 | JeffM | got it |
| 20:33.27 | JeffM | had to mod the query and forgot that :) |
| 20:34.12 | JeffM | try now |
| 20:34.32 | blast007 | worked |
| 20:34.35 | JeffM | bets he spelled Automaticly wrong |
| 20:35.27 | DTRemenak | automatically |
| 20:35.36 | JeffM | thanks |
| 20:35.57 | blast007 | lasts 2 weeks? |
| 20:36.24 | JeffM | yeah |
| 20:36.26 | JeffM | that too long? |
| 20:36.31 | blast007 | nope, that's fine |
| 20:36.42 | CIA-75 | BZFlag: 03JeffM2501 * r20723 10/trunk/db/weblogin.php: add auto login feature per requesting site for ease of use |
| 20:36.43 | blast007 | probably the same as what phpBB does |
| 20:36.53 | JeffM | it stores a cookie per site too, in the my.bzflag.org domain |
| 20:36.59 | JeffM | and dosn't store the password |
| 20:37.07 | JeffM | so you can pick one site to auto and another not to |
| 20:37.07 | mrapplecomputer1 | JeffM: http://bzbureau.com/ewww.png |
| 20:37.23 | JeffM | mrapplecomputer1: please help me fix it |
| 20:37.28 | JeffM | what should I change in the code? |
| 20:37.49 | mrapplecomputer1 | Asking me for help? o.O |
| 20:37.57 | blast007 | I wouldn't bother yet |
| 20:38.01 | JeffM | hey I'll take help from anyone willing to offer it |
| 20:38.02 | JeffM | ok |
| 20:38.05 | blast007 | I'm going to play with it when I get home |
| 20:38.07 | JeffM | I am not perfect |
| 20:38.08 | JeffM | ok |
| 20:38.20 | mrapplecomputer1 | ummm im guessing this is just for safari? |
| 20:38.24 | mrapplecomputer1 | like it looks good in firefox/ie ? |
| 20:38.24 | JeffM | totaly wishes his company could hire blast007 |
| 20:38.45 | mrapplecomputer1 | ah yes it looks fine in firefox |
| 20:38.48 | JeffM | it looked fine in FF |
| 20:39.11 | mrapplecomputer1 | Well i would just put the checkbox before the Automatically anyways |
| 20:39.16 | mrapplecomputer1 | might fix it too |
| 20:39.46 | JeffM | done |
| 20:40.11 | mrapplecomputer1 | umm all i see is a new line |
| 20:40.21 | mrapplecomputer1 | not the checkbox before the text |
| 20:40.22 | CIA-75 | BZFlag: 03JeffM2501 * r20724 10/trunk/db/weblogin.php: checkbox before label |
| 20:40.33 | mrapplecomputer1 | ah |
| 20:40.43 | JeffM | <input id="RememberCheckbox" type ="checkbox" name ="remember"><label>Automatically login when going to '. $parsedURL["host"] .' </label> |
| 20:40.50 | mrapplecomputer1 | nvm |
| 20:40.57 | mrapplecomputer1 | i thaught we were still using _dev |
| 20:41.21 | mrapplecomputer1 | yah that looks fine, its just the text is now below the checkbox |
| 20:41.26 | JeffM | hmmm |
| 20:41.29 | blast007 | hehe, looks worse now, but whatever ;) it will be fixed soon enough |
| 20:41.33 | JeffM | k |
| 20:41.41 | JeffM | is not a forms guru |
| 20:41.46 | JeffM | I'm just glad it worked |
| 20:42.14 | blast007 | actually could be fixed by placing the input tag after the start of the label |
| 20:42.22 | JeffM | ok |
| 20:42.22 | mrapplecomputer1 | just going to say that |
| 20:42.25 | JeffM | I'll try that real fast |
| 20:42.31 | mrapplecomputer1 | also, might want to make the checkbox and the text one label? |
| 20:42.48 | blast007 | mrapplecomputer1: it is |
| 20:42.53 | blast007 | or will be, at least |
| 20:42.57 | blast007 | that's what I was meaning |
| 20:43.03 | mrapplecomputer1 | heh ok |
| 20:43.12 | blast007 | between <label> and Automatically ;) |
| 20:43.17 | JeffM | <label><input id="RememberCheckbox" type ="checkbox" name ="remember">Automatically login when going to '. $parsedURL["host"] .' </label> |
| 20:43.22 | JeffM | like that? |
| 20:43.36 | mrapplecomputer1 | yah |
| 20:43.40 | blast007 | yeah, but something is still screwy |
| 20:43.48 | mrapplecomputer1 | yah |
| 20:43.49 | blast007 | login button is now showing at the end of the line |
| 20:43.58 | JeffM | labels don't have a / tag do they? |
| 20:44.12 | blast007 | they have a close tag, yes |
| 20:44.14 | JeffM | oh no they do |
| 20:44.15 | JeffM | hmm |
| 20:44.21 | Flash | anything can have a close tag |
| 20:44.51 | Flash | or, XHTML can have the explicit close, like <br /> |
| 20:44.53 | mrapplecomputer1 | now the login button is screwed |
| 20:44.53 | blast007 | wonder what the W3C would say about <img></img> ;) |
| 20:45.10 | cygal | it is valid xml :) |
| 20:45.22 | blast007 | yeah, but who uses *that*? |
| 20:45.26 | Flash | it wouldn't render anything |
| 20:45.46 | blast007 | Flash: blah, well assume a real src in there... but anyways :P |
| 20:46.06 | blast007 | JeffM: I'll point at it later |
| 20:46.08 | blast007 | it's fine for now |
| 20:46.11 | JeffM | k |
| 20:46.12 | blast007 | poke* |
| 20:46.21 | JeffM | you have to point before you poke :) |
| 20:46.23 | Flash | so you COULD do <img /> (the space is important |
| 20:46.51 | mrapplecomputer1 | heres what im seeing bzbureau.com/ewww2.png |
| 20:47.43 | blast007 | mrapplecomputer1: yeah, I'll fix it later |
| 20:47.50 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 20:47.53 | mrapplecomputer1 | heh ok |
| 20:48.06 | blast007 | I leave work in like 15 minutes ;) |
| 20:49.34 | spldart | party at blast's house/apt... byob |
| 20:49.40 | spldart | 8-P |
| 20:55.00 | Supertanker | Hah |
| 21:01.22 | JeffM | DTRemenak: I am so gettting a pair of these for the first rocket motor test, http://www.fuzzhats.com/Classic-Aviator-Goggles--Brown-and-Gold_p_30.html |
| 21:06.09 | *** join/#bzflag bier|tp (n=bier@pD9E2F47E.dip.t-dialin.net) |
| 21:07.31 | mrapplecomputer1 | could someone request a hostmask for me off: bzflag/player/mrapplecomputer1 |
| 21:07.39 | mrapplecomputer1 | s/of/off |
| 21:07.57 | JeffM | when did you register on bzbb? |
| 21:08.30 | spldart | affordable. |
| 21:08.43 | spldart | ... the goggles |
| 21:09.12 | mrapplecomputer1 | like last year iirc |
| 21:09.24 | JeffM | dude, that could be 2 weeks ago ;) |
| 21:09.32 | mrapplecomputer1 | haha |
| 21:09.37 | mrapplecomputer1 | may 27 2009 |
| 21:09.42 | mrapplecomputer1 | my birthday ;) |
| 21:09.48 | JeffM | have you read the requirements page and do you meet them |
| 21:09.50 | JeffM | how old are you? |
| 21:09.53 | mrapplecomputer1 | 13 |
| 21:10.54 | JeffM | what other channels do you hang out in? |
| 21:11.15 | *** join/#bzflag Qew (n=qew@unaffiliated/qew) |
| 21:11.27 | mrapplecomputer1 | uhhh bzflag-chat bzfx bztraining bzbureau bzw bzexcess jzbot |
| 21:11.29 | mrapplecomputer1 | etc |
| 21:11.43 | JeffM | not etc.. PM me the full list |
| 21:11.51 | JeffM | you are wearing our name, we are responsible for it |
| 21:11.58 | mrapplecomputer1 | ok |
| 21:12.00 | JeffM | and you are a bit younger then I'd like |
| 21:14.47 | JeffM | and you haven't been denied for a freenode cloak or anything? |
| 21:14.56 | JeffM | last one I asked for was someone who couldn't |
| 21:15.11 | mrapplecomputer1 | nope |
| 21:15.23 | mrapplecomputer1 | i have unaffiliated/mrapplecomputer1 but i would like bzflag/players/mrapplecomputer1 |
| 21:15.32 | JeffM | if you abbuse it I'll take it away :) |
| 21:15.40 | JeffM | anyone else want one while I'm editing it? |
| 21:16.20 | jcp | JeffM: I'm thinking about it |
| 21:16.31 | jcp | yeah, I'd like one |
| 21:16.40 | JeffM | bzbb name? |
| 21:16.43 | jcp | and it would be bzflag/player/javawizard2539 |
| 21:16.45 | jcp | javawizard2539 |
| 21:16.54 | jcp | registered well over a year ago. I can look up the exact date if you want |
| 21:17.02 | JeffM | that's fine |
| 21:17.15 | jcp | ok |
| 21:17.23 | jcp | and do you want me to pm my channel list? |
| 21:17.34 | JeffM | naw your older |
| 21:17.36 | jcp | k |
| 21:17.45 | mrapplecomputer1 | heh |
| 21:17.45 | jcp | cause, it's pretty much exclusively java-related |
| 21:17.46 | jcp | ducks |
| 21:18.24 | JeffM | your IRC name does not match your bzbb name |
| 21:18.33 | javawizard2539 | it can :) |
| 21:18.41 | JeffM | what nick do you want it tied to |
| 21:18.42 | javawizard2539 | and I have this one registered to the same account |
| 21:18.49 | javawizard2539 | they're both the same account |
| 21:18.55 | JeffM | no, they arn't |
| 21:18.57 | javawizard2539 | jcp is grouped to javawizard2539 |
| 21:18.58 | JeffM | what is the root account |
| 21:18.59 | javawizard2539 | what? |
| 21:19.02 | javawizard2539 | it's javawizard2539 |
| 21:19.03 | JeffM | they are grouped |
| 21:19.07 | javawizard2539 | jcp and others are grouped to it |
| 21:19.11 | JeffM | that's not the same as being the same :) |
| 21:19.17 | javawizard2539 | wait, what? |
| 21:19.30 | JeffM | the way IRC works, is the cloak has to go on the root account |
| 21:19.33 | javawizard2539 | My unaffiliated hostmask was given to javawizard2539, and it automatically applies to all of my other accounts |
| 21:19.37 | JeffM | since it treats them all seperately |
| 21:19.38 | javawizard2539 | oh, ok. Yeah, root is javawizard2539 |
| 21:19.39 | JeffM | yeah it does |
| 21:19.42 | JeffM | IF you do it that way |
| 21:19.47 | JeffM | but if I did it to jcp it would not |
| 21:19.47 | javawizard2539 | which I'd prefer if possible |
| 21:19.57 | JeffM | mrapplecomputer1: this is your root account? |
| 21:20.03 | mrapplecomputer1 | yep |
| 21:21.07 | JeffM | javawizard2539: you get contributor not player ;) |
| 21:21.11 | javawizard2539 | JeffM: for future, reference, you can see the root of an account by /msg nickserv info nick |
| 21:21.15 | javawizard2539 | JeffM: ooh ok, that works |
| 21:21.21 | javawizard2539 | but don't apply it yet, I ned to add it to my bot first |
| 21:21.22 | javawizard2539 | *need |
| 21:21.24 | JeffM | anyone else? |
| 21:21.29 | javawizard2539 | what, specifically, would it be? |
| 21:21.30 | mrapplecomputer1 | im a contributor :P |
| 21:21.41 | JeffM | mrapplecomputer1: you do not have commit access |
| 21:21.43 | javawizard2539 | mrapplecomputer1: you don't have commit access iirc |
| 21:21.43 | JeffM | so no you are not |
| 21:21.45 | mrapplecomputer1 | eh |
| 21:21.54 | JeffM | I don't actualy set the cloaks |
| 21:22.01 | JeffM | I request them |
| 21:22.04 | javawizard2539 | ok |
| 21:22.14 | JeffM | then the mighty SportChick gets around to doing them when she has time |
| 21:23.02 | JStoker | :P Yeah. ;) Freenode rocks. :P |
| 21:23.17 | JeffM | and no that note, Ping SportChick, can you check the cloak doc when you have time :) |
| 21:23.24 | JeffM | she's away but that'll log for her |
| 21:23.49 | javawizard2539 | ok |
| 21:23.53 | mrapplecomputer1 | kk |
| 21:23.57 | JeffM | we just throw em all in a google doc and she checks it |
| 21:24.00 | javawizard2539 | so what would my cloak be? I need to add it to my bot before I get a new one |
| 21:24.01 | JeffM | that way we have record of it all |
| 21:24.06 | javawizard2539 | yeah |
| 21:24.23 | JeffM | so you didn't read the docs on cloaks? |
| 21:24.36 | jcp | I read them enough to know about bzflag/player/<callsign> |
| 21:24.43 | jcp | but I didn't read on the contributor ones. I'll go read though |
| 21:24.52 | JeffM | really, its' like ONE line below it ;) |
| 21:24.58 | jcp | haha, ok |
| 21:28.17 | jcp | wait, do I get /contributor or /developer? The doc states that /developer is for those that have commit access, which I do, but I don't contribute frequently |
| 21:28.40 | JeffM | that's why I'm giving you contributor for now |
| 21:28.42 | jcp | and "/bzflag/contributor/ibot" <--- I like that example |
| 21:28.42 | JeffM | :) |
| 21:28.42 | jcp | k |
| 21:28.46 | *** join/#bzflag McYukon (n=alko@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 21:29.07 | JeffM | anyone know a good video recompressor? |
| 21:29.22 | AAA_awright | ffmpeg, vlc |
| 21:29.56 | JeffM | with an inteface ? :) |
| 21:30.41 | JeffM | I've got a 350 meg avi and I want to make it more web friendly |
| 21:31.01 | spldart | I only barely stopped using divx a year or so ago and have been xvid ing my arse off. |
| 21:31.09 | spldart | ah |
| 21:31.36 | spldart | so drop resolution and sampling on audio then encode with limited video bandwidth |
| 21:31.41 | Flash | I use iMovie.... no help there |
| 21:31.44 | JeffM | guess I could youtube it and let it recompress it |
| 21:31.49 | JeffM | spldart: yeah but with what software? |
| 21:32.14 | spldart | I'd use virtualdub or one of the other similar a/v tools |
| 21:32.15 | JeffM | oh and it's got an odd resolution |
| 21:32.21 | JeffM | so windows movie maker dosn't like it |
| 21:32.25 | spldart | ic |
| 21:37.23 | TheRedBaron | blast007: you'd said you stop the torrents so global would work.... :P |
| 21:38.41 | spldart | hehe |
| 21:39.46 | AAA_awright | JeffM: vlc has a GUI, but for transcoding video it's bad |
| 21:40.04 | AAA_awright | It is possible and there are a few tutorials on it\ |
| 21:41.13 | JeffM | I may be doing it now in it |
| 21:41.52 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 21:43.29 | JeffM | and yeah it's an odd gui |
| 21:49.04 | *** join/#bzflag Wits (n=Warinthe@249.93.188.72.cfl.res.rr.com) |
| 21:55.56 | JeffM | and yeah... it did a horrible job at compressing :) |
| 21:56.35 | AAA_awright | ffmpeg does better compression, vlc tries to keep as much quality as possible |
| 21:56.46 | JeffM | I'm just sending it to youtube |
| 21:56.51 | JeffM | it'll take like an hour |
| 21:57.02 | JeffM | it'll compress well for them, it's all blue :) |
| 21:59.24 | JeffM | I still need someone to clean up the models on this thing :/ |
| 22:08.33 | TheRedBaron | global doesn't scale well :) |
| 22:08.40 | JeffM | nope |
| 22:08.42 | JeffM | no it dosn't |
| 22:08.51 | *** join/#bzflag Anthony_Luth (n=Anthony@unaffiliated/anthony-luth/x-0494258) |
| 22:08.54 | JeffM | it's phpbb, it was neever meant to scale or be used like we use it |
| 22:09.15 | JeffM | that's why there is a project to redo global with a more scaleable backend |
| 22:09.17 | TheRedBaron | ah. |
| 22:09.38 | TheRedBaron | its probably reading they tourny as a DoS |
| 22:09.59 | JeffM | no the tourny is a DoS to it |
| 22:10.32 | JeffM | each lookup does a lot of work, as all the user data is stored in phpbb, so we have to go get that in there way |
| 22:10.43 | JeffM | not in a way that would be optimal for us |
| 22:11.13 | JeffM | the new system is based on ldap so it should be a lot better |
| 22:11.20 | JeffM | we'll be able to split the services up |
| 22:12.25 | TheRedBaron | k |
| 22:13.33 | JeffM | or you guys could stop playing a silly LAN game on the internet :) |
| 22:14.09 | blast007 | TheRedBaron: lol |
| 22:15.32 | TheRedBaron | what all are you doing on auth? |
| 22:15.40 | TheRedBaron | should just be a simple DB lookup - no? |
| 22:15.52 | JeffM | it;'s a bit more cus of the tokens |
| 22:15.55 | mrapplecomputer1 | yay |
| 22:15.57 | JeffM | and there is more then one database involved |
| 22:15.59 | mrapplecomputer1 | cloaks applied |
| 22:16.02 | TheRedBaron | token's is a hash yes? |
| 22:16.07 | JeffM | no |
| 22:16.17 | SportChick | JeffM: I did the first one but need to talk to the second one |
| 22:16.19 | JeffM | the token is generated for you each login |
| 22:16.21 | mrapplecomputer1 | Thank you SportChick! |
| 22:16.27 | JeffM | SportChick: ok |
| 22:16.44 | TheRedBaron | JeffM: sounds like a hash :) |
| 22:16.56 | JeffM | the it's not |
| 22:16.57 | BulletCatcher | global load is down now, and Chesval will start in 35 seconds. |
| 22:17.19 | JeffM | mrapplecomputer1, jcp you have a misapplied channel |
| 22:17.31 | JeffM | #bztraining needs to be ##bztraining |
| 22:17.36 | jcp | JeffM: and why? |
| 22:17.41 | jcp | I own bztraining.org and I've filed a GRF for it |
| 22:18.00 | JeffM | jcp: is it an open source project? |
| 22:18.02 | jcp | yes |
| 22:18.18 | jcp | It's a server network and it back bznetwork |
| 22:18.21 | JeffM | then please talk to SportChick or a staffer about it, your cloak is being denied untill then |
| 22:18.28 | jcp | k |
| 22:18.59 | JeffM | and change to your root name so SportChick can see you |
| 22:19.03 | JeffM | and know it's you |
| 22:19.35 | blast007 | TheRedBaron: each time the list server is checked, 3MB of PHP files are loaded to handle phpBB3's unicode crap :) |
| 22:19.49 | blast007 | not to say that it was all that efficient before phpBB3 anyway |
| 22:21.32 | SportChick | JeffM: both are done |
| 22:21.38 | JeffM | thank you |
| 22:21.44 | JeffM | you are so very kind :) |
| 22:21.46 | SportChick | (and thanks for the ping, as I don't regularly check that doc) |
| 22:21.49 | SportChick | JeffM: heh |
| 22:22.15 | JeffM | one would not expect you too check it at all :) |
| 22:22.39 | SportChick | heh |
| 22:22.55 | JeffM | tho I like having it, keeps a nice record |
| 22:25.50 | mrapplecomputer1 | JeffM: "a possible security risk for user passwords." |
| 22:26.03 | mrapplecomputer1 | sounds like alot of people are going to be interested in using my bzfswebadmin |
| 22:26.54 | SportChick | JeffM: yep - good way to keep track of who is out there with a cloak |
| 22:27.20 | JeffM | mrapplecomputer1: you gonna fix the security holes first? |
| 22:27.30 | AAA_awright | JeffM: I've asked staffers many times about that, if you own a formal claim on the name you can use one # (assuming it is a "on-topic channel" which all channels must be) |
| 22:27.45 | SportChick | AAA_awright: only if you file a GRF |
| 22:27.57 | mrapplecomputer1 | JeffM: the only |
| 22:28.07 | AAA_awright | SportChick: When the new GMS is released as I understand, you are a staffer maybe you can further clarify that |
| 22:28.07 | JeffM | mrapplecomputer1: don't be so sure. |
| 22:28.20 | mrapplecomputer1 | the only security hole was that i had an embedded form |
| 22:28.32 | JeffM | mrapplecomputer1: that's not what I heard ;) |
| 22:28.36 | mrapplecomputer1 | and then some other stuff that doesnt deal with user passwords |
| 22:28.38 | JeffM | shell execute |
| 22:29.02 | AAA_awright | e.g. #git or #swig vs. ##politico or ##php |
| 22:29.07 | mrapplecomputer1 | but user passwords were, and still are, secure |
| 22:29.29 | JeffM | mrapplecomputer1: not if they can get to the shell and overwrite your pages |
| 22:29.31 | SportChick | AAA_awright: single hash channels are not deemed "authorized" at all without a GRF accompanying them, and then it's subject to GRF approval. In the future, the channels won't even be able to be created without an approved GRF |
| 22:29.35 | JeffM | but I wasn't just talking about passwords |
| 22:29.58 | AAA_awright | I didn't make any claim as to if they were authorized or not |
| 22:30.12 | AAA_awright | I didn't even know that was relevant |
| 22:31.06 | JeffM | I belive the goal they want is to make # channels all be just approved real groups |
| 22:31.11 | mrapplecomputer1 | JeffM: it may have some security holes, but that has nothing to do with user passwords and/or their security |
| 22:31.19 | JeffM | and not even let anything else exist unless it's ## |
| 22:31.21 | SportChick | AAA_awright: well, you said " if you own a formal claim on the name you can use one # ", which is not actually true - the issue is whether you have an approved GRF for the name. If you have a formal claim to the name, you increase your chances of obtaining an approved GRF |
| 22:31.26 | AAA_awright | Ultimately yes, that's the goal of the group managment system |
| 22:31.36 | JeffM | mrapplecomputer1: my inital comment was not about bzbb password security |
| 22:31.40 | JeffM | it was about your codebse in general |
| 22:31.41 | SportChick | but that's not really a discussion for this channel, so, if you have more questions, feel free to PM me |
| 22:31.58 | AAA_awright | I was responding to Jeff, but k |
| 22:32.18 | JeffM | AAA_awright: I was just passing along what I was told man.... |
| 22:32.20 | mrapplecomputer1 | Well right now all i see on the form is "a possible security risk for user passwords." |
| 22:32.25 | mrapplecomputer1 | which is not true |
| 22:32.45 | JeffM | umm ok, if you can't see your other security holes I guess that's your problem |
| 22:32.51 | JeffM | I just asked if you were going to fix them |
| 22:32.59 | JeffM | dunno where you got on this user password thing |
| 22:33.06 | mrapplecomputer1 | http://my.bzflag.org/bb/viewtopic.php?f=30&t=15550 |
| 22:33.10 | AAA_awright | JeffM: So was I, I've asked twice with the same answer, not until the GMS... lemme see |
| 22:33.37 | JeffM | AAA_awright: whatever, take it to #freenode and find out :) |
| 22:34.05 | JeffM | mrapplecomputer1: I still would not want to promote it with those other holes you have |
| 22:34.25 | mrapplecomputer1 | Im not asking you to promote it, im asking you to not lie about it |
| 22:34.26 | JeffM | where is the open source project site for it? |
| 22:34.33 | mrapplecomputer1 | its not open source |
| 22:34.33 | JeffM | I am not lying about it |
| 22:34.36 | mrapplecomputer1 | that part is true |
| 22:34.37 | JeffM | at that time it had a problem |
| 22:34.42 | mrapplecomputer1 | "possible security risk for user passwords." |
| 22:34.53 | JeffM | it had a possible risk for them |
| 22:34.55 | JeffM | that is true |
| 22:34.57 | SportChick | a_meteorite: you around? |
| 22:34.57 | JeffM | you had a form |
| 22:35.11 | JeffM | you have a shell execute problem where people could have overwriten your page |
| 22:35.16 | JeffM | sure, maybe you fixed it now |
| 22:35.21 | JeffM | but at THAT time it was not a lie |
| 22:35.27 | JeffM | I'm glad you are fixing it |
| 22:35.30 | mrapplecomputer1 | well its untrue now |
| 22:35.31 | JeffM | that's good |
| 22:35.56 | JeffM | cool, then get the other issues fixed and get it properly licensed for open source then you can repost it and tell people that you have resolved the issues |
| 22:37.59 | AAA_awright | JeffM: I'll ask again and send the logs your way if you aren't there (if that's alright), when I went there, as I understand, (1) Channels with # have a formal claim on their name and ## do not, (2) Groups with one # will need to register their group in the future to formally claim that name, others will need to rename to two ## |
| 22:38.49 | mrapplecomputer1 | JeffM actually that would be impossible because the user it is run under, bzfs, does not have that power |
| 22:38.53 | mrapplecomputer1 | never did never will |
| 22:39.19 | AAA_awright | SportChick: If it's about BZFX I might be able to help you |
| 22:39.46 | AAA_awright | mrapplecomputer1: bzflag.org can do more than you might think at first |
| 22:41.26 | AAA_awright | mrapplecomputer1: My own web admin /highly simply/ logged in users with a local username/password, and associated a global callsign with the weblogin.php form |
| 22:42.27 | *** join/#bzflag Think_Differentl (n=fatass@pool-71-178-118-39.washdc.east.verizon.net) |
| 22:52.50 | JeffM | mrapplecomputer1: you assume they can't elivate privs |
| 22:53.53 | blast007 | he's wrong anyway |
| 22:53.57 | JeffM | and from what I've understood you've already had problems with files being created ;) |
| 22:54.08 | mrapplecomputer1 | heh |
| 22:54.10 | blast007 | and renamed ;) |
| 22:54.20 | mrapplecomputer1 | yah just relized that |
| 22:54.20 | JeffM | that's just asking to be jacked |
| 22:54.29 | mrapplecomputer1 | thats what im working on now.... |
| 22:54.45 | JeffM | banning a few more usernames? ;) |
| 22:54.53 | AAA_awright | Are you keeping passwords in plaintext or what? |
| 22:54.54 | mrapplecomputer1 | no |
| 22:55.02 | mrapplecomputer1 | sqllite databases that prevent that |
| 22:55.29 | AAA_awright | As in, not hashed with something like SHA1? |
| 22:55.55 | JeffM | my bigest concern for your thing was the lack of clear open source licenses, project pages, and source distrobutions |
| 22:56.16 | JeffM | I'd also recomend you not realy announce it as done untill you've let a lot of people bang on it and review the code |
| 22:56.25 | AAA_awright | Take http://git.bzfx.net/~aaa/BZFSAdmin/tree/ for instance, LICENSE is provided just like the GNU spec says |
| 23:02.13 | JeffM | man do I need uverse, it only took an hour and 16 min to upload 350 megs :) |
| 23:02.42 | Think_Differentl | FIOS > uverse |
| 23:02.50 | JeffM | this is true |
| 23:02.59 | JeffM | fiber to house is better then fiber to node |
| 23:03.03 | JeffM | but I can not get that here |
| 23:03.14 | JeffM | and fios seems to take a LOT longer to get deployed |
| 23:03.27 | JeffM | uverse is going in like wildfire here |
| 23:03.42 | Think_Differentl | yeah, waiting for FIOS here in DC. it's all in the suburbs around DC, but not actually in DC yet |
| 23:03.42 | AAA_awright | But it's available in your zip code or some stupid marketing reason like that, right? ;) |
| 23:03.46 | JeffM | but it's not like a home realy has a choice |
| 23:04.05 | JeffM | it's available in the building across the street |
| 23:04.23 | JeffM | they realy are installing it |
| 23:04.24 | Think_Differentl | 50/20 plan is available around here, would love to get that |
| 23:04.27 | JeffM | I see the trucks around town |
| 23:04.45 | JeffM | when they finish a node the put a big oarnge sticker on it that says "uvers now available here" |
| 23:05.12 | Think_Differentl | heh |
| 23:05.20 | JeffM | it's kinda a cool ploy |
| 23:05.47 | JeffM | DTRemenak has uverse and seems to like it |
| 23:05.55 | JeffM | tho they can only get 18 megs down, not the 24 |
| 23:06.34 | JeffM | I just want the increased upstream |
| 23:06.42 | JeffM | well and the TV |
| 23:06.50 | JeffM | does not want to deal with time warner |
| 23:07.47 | Think_Differentl | or comcast for that matter |
| 23:07.53 | JeffM | that'd be even worse |
| 23:08.16 | JeffM | I heard that they are making it so that you can use your xbox 360 as an interface to the uverse TV, that'd make me happy |
| 23:08.21 | JeffM | since I already use it for netflix |
| 23:09.35 | JeffM | yay for HD uploadness. http://www.youtube.com/watch?v=mDocjoL5dGE |
| 23:10.43 | JeffM | hah, it recorded what was playing in lastFM, that's funny |
| 23:17.30 | *** join/#bzflag McSpider (n=McSpider@xplr-ts-v10-208-114-184-180.barrettxplore.com) |
| 23:40.56 | temporalD | those clouds remind me of "Time Pilot" |
| 23:41.07 | JeffM | heh |
| 23:42.42 | JeffM | gotta put some floating islands in there now |
