Perl 6 - the future is here, just unevenly distributed

IRC log for #metacpan, 2017-08-30

| Channels | #metacpan index | Today | | Search | Google Search | Plain-Text | summary

All times shown according to UTC.

Time Nick Message
04:15 karjala_ joined #metacpan
05:35 nakiro joined #metacpan
06:02 Valkyrie_ joined #metacpan
06:05 preaction joined #metacpan
08:01 Relequestual joined #metacpan
08:21 neilb joined #metacpan
10:11 Tempesta joined #metacpan
10:37 ilmari it would be nice if the file list in the diff view had zebra stripes
10:38 ilmari it's hard to line up the line counts with file names on a wide monitor
10:38 ilmari or one could use a table instead of an ul, and get the stats closer to the filenames
10:39 ilmari or make the numbers links as well...
10:46 mickey ilmari: can you please open an issue on GH? or better - a PR :)
10:58 ilmari which of the three approaches do you suggest?
11:00 mickey personally, all are good suggestions - I just think they will be followed up better on GH
11:01 mickey but i'm also not much of a client side guy... haarg's opinion will be more interesting to hear :)
11:01 * ilmari plays around a bit
11:01 ilmari yeah
11:46 xenu joined #metacpan
13:07 ilmari mickey, haarg: https://github.com/metacpan/metacpan-web/pull/1966
13:08 ilmari me-- # forgot to update the test
13:46 ilmari now with all tests passing and before/after screenshots
13:46 Mithaldu how can i figure out what SSL/TSL the metacpan server accepts?
13:48 haarg like, versions?
13:48 Mithaldu yeah
13:49 Mithaldu someone changed something and now opera 12 is unhappy about metacpan
13:49 dylan https://observatory.mozilla.org/analyze.html?host=fastapi.metacpan.org#tls
13:50 Mithaldu HM!
13:50 Mithaldu interesting, it does accept some tls 1.0
13:50 ilmari «Compatible Clients: […] Opera 12.15, […]»
13:51 Mithaldu that's a bit misleading
13:51 Mithaldu at some point opera auto-update automatically disabled TLS 1.2 so most people using that are on tls 1.0 only
13:52 Mithaldu i do however definitely have this available, so i can't imagine why the heck things don't work: ECDHE-RSA-AES128-SHA
13:52 ilmari uh, why would they _disable_ TLS 1.2?
13:52 ilmari also, downloading from opera.com seems to be giving version 47.something
13:53 Mithaldu ilmari: i don't understand it myself, start reading here: http://forums.opera.com/discussion/1861721/opera-12-check-for-update-resets-settings-for-tls-1-1-and-1-2/p1
13:53 Mithaldu ilmari: opera 15+ is an absolute lie
13:53 ilmari opera-stable_47.0.2631.55_amd64.deb
13:53 Mithaldu they developed opera until 12.18
13:53 ilmari what's 47 then?
13:53 haarg chrome
13:53 Mithaldu then they copied chrome, reskinned it, and labeled it opera
13:53 ilmari ah
13:54 Mithaldu because this allowed them to fire almost all their engineering staff that wasn't working on mobile apps
13:54 Mithaldu *mobile ads
13:54 ilmari and they haven't appeard to update chrome in a while
13:54 Mithaldu miiight have to do with the china purchase thing
13:55 Mithaldu some chinese malware company tried to buy the opera browser part of the company
13:55 Mithaldu dunno if they actually did
13:55 Mithaldu basically the website you're looking at there is something that would fit well in The Walking Dead
14:06 haarg afaik we don't really get any choices about what tls we support
14:06 Mithaldu we'll see, oalders already asked: https://github.com/metacpan/metacpan-web/issues/1967
14:24 haarg Mithaldu: https://observatory.mozilla.org/analyze.html?host=metacpan.org#tls
14:25 Mithaldu haarg: yeah, that was linked earlier
14:25 haarg no it isn't
14:25 Mithaldu ah, subdomain
14:25 Mithaldu i see
14:27 ilmari both metacpan.org and fastapi.metacpan.org support tls 1.0, according to the observatory
14:28 ilmari but only with a subset of ciphers
14:28 Mithaldu ilmari: nope, metacpan itself only mentions TLS 1.2
14:28 ilmari oh, right
14:28 ilmari I could have sworin it had 1.0 and 1.1 last time I looked
14:29 ilmari ah, no, that was fastapi that dylan pasted
14:29 Mithaldu yep
14:29 ilmari me-- # confuus
14:29 Tempesta joined #metacpan
14:30 Mithaldu i made the same mistake :)
14:30 dylan Sorry, that's what I had in my history. :-)
14:31 haarg we can't do arbitrary configuration of our tls setup, only choose from those two options.  and soon tls 1.0/1.1 will be dropped entirely.
14:32 Mithaldu which two options?
14:32 Mithaldu the one fastapi has and the one metacpan has?
14:34 haarg yes
14:34 Mithaldu haarg: excellent, that means it could be reverted temporarily and be given a warning
14:34 haarg i don't think we have any interest in doing that
14:34 Mithaldu it would be a graceful deprecation
14:34 haarg why can't you enable tls 1.2?
14:35 Mithaldu *sigh*
14:35 Mithaldu why do you think this is only about me?
14:36 haarg because it pretty much is
14:36 ilmari haarg: the problem is that opera 12 auto-disables newer tls when checking for updates
14:36 haarg so disable auto-update
14:36 haarg there aren't any more updates to be had
14:36 ilmari Mithaldu: you're the only one who's complained so far ;) and you and Tux are the only ones I know who use Opera
14:36 Mithaldu i've already set 1.2 for my own browser, but as with any issue that leads to undocumented problems without explicit error messages, the real bug is not that it doesn't work, but the lack of a human-readable message
14:36 Grinnz that's gonna be a problem for more than metacpan
14:37 ilmari Mithaldu: that's opera's fault for not giving a sensible error when TLS negotiation fails
14:37 ilmari there's nothing metacpan (or any server) can do about that
14:37 Mithaldu ilmari: yes there is and i already mentioned it
14:37 Mithaldu graceful deprecation
14:38 Mithaldu ilmari: also "you're the only one who complained" is a short-sighted argument
14:38 Mithaldu a lot of people do not bother to complain when they see errors, they just go and use something else
14:38 Mithaldu or give up entirely and go away
14:45 illywhacker joined #metacpan
14:46 dolmen joined #metacpan
14:51 mst Mithaldu: will users of opera get a warning if they hit something using the 1.0/1.1 scheme?
14:51 mst because if not, it seems like insisting on using it to the bitter end only delays the problem
14:51 Mithaldu mst: nah, it'd require a css overlay or something for opera users
14:51 Mithaldu given opera's state it won't even need a version check :v
14:52 mst right, so I'm not sure what we'd really gain, we've no way to add a warning
14:53 mst not at the protocol level anyway
14:53 Mithaldu not necessary
14:53 Mithaldu just throw up a warning for all opera users
14:53 Mithaldu no need to check protocol or whatever
14:53 ilmari even if they've enabled tls 1.1/1.2?
14:54 Mithaldu don't think a red strip saying "We're switching off TLS 1.0, enable your 1.2." at the top would bother those much who've enabled it
14:55 Mithaldu or add a little bit of JS to hide it with a cookie, if false positive really is a concern
14:55 mst if somebody sends a patch that detects opera and adds that bar, then personally I'd be in favour of turning it back on for as long as we can to warn people
14:56 mst but I can't speak for the people who actually have control of the relevant knob
14:56 Mithaldu thanks, if oalders or ranguard are open to that i'll happily provide the bits and bobs
14:56 Mithaldu at least with you saying that i know the suggestion isn't entirely insane :)
14:57 jberger I know I'm putting my head in the lion's mouth, but it looks like TLS 1.(0|1) WAS gracefully deprecated: https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan/
14:58 Mithaldu i never saw a warning, and i've been using metacpan a lot
14:58 Mithaldu i doubt fastly *can* inject a warning anyhow
14:58 Mithaldu left #metacpan
14:58 Mithaldu joined #metacpan
14:59 Mithaldu oops, wrong window
14:59 jberger hahaha, I got worried that I really stepped in it :D
14:59 Mithaldu haha
14:59 mst jberger: if he's been using it the entire time and got no warning about it, then I fail to see how that counts as graceful
14:59 mst at least as far as the word 'graceful' normally mean
14:59 ilmari can fastly inject a header into the request that indicates the tls version used?
14:59 Mithaldu i just hit ctrl+w to close the browser tab, and my irc client apparently accepts that as well
14:59 mst even mojo does better than that :P
14:59 Mithaldu mind
15:00 Mithaldu if metacpan tracks browser stats, and they show only 2 users for opera 12 i'm also happy to drop it :P
15:13 mst jberger: seriously though, that seems 'gradual' not not 'graceful'
15:14 Relequestual joined #metacpan
15:14 jberger I'll admit perhaps I misunderstood what was being asked
15:14 Mithaldu jberger: graceful means you get a warning if you try to use it :)
15:14 jberger I don't think I've ever seen a website warn users about the ssl/tls versions they accept changing
15:15 Mithaldu somethingawful did it unintentionally
15:15 jberger I would consider graceful security suite changes meaning giving browsers the chance to comply
15:15 jberger which I understand IS the problem in this case
15:15 Mithaldu they changed the settings for one of the server serving static content
15:15 Mithaldu so some images disappeared
15:15 jberger certainly THAT doesn't count as graceful notification!
15:16 Mithaldu well it's better than this ...
15:16 * Mithaldu makes screenshot
15:16 mst right, my firefox portable 3.5.2 that I use for my slides probably can't connect to a lot of things now
15:16 mst but then again it only ever connects to the internet by accident
15:16 Mithaldu http://i.imgur.com/ymVbvlw.png
15:19 Mithaldu mst: that reminded me of the opera mobile app for nokia phones
15:19 Mithaldu probably doesn't work for shit with anything anymore
15:19 Mithaldu but had the best user interface out of all mobile browsers
15:26 haarg Mithaldu: there are a handful of people accessing the site using old opera
15:26 Mithaldu \o/
15:26 haarg 0.066 percent of our traffic
15:26 haarg ish
15:27 Mithaldu how many users do you get in that timeframe?
15:31 haarg i can't get a count of individual users
15:33 mst given I've always regarded oldopera as satan, 0.0666 seems rather appropriate
15:33 mst opera users: ye shall know them by the number of the millibeast
15:33 Mithaldu hahaha
15:33 dylan LOL
15:33 Mithaldu haarg: alright :)
15:34 jberger mst: awesome
15:35 BinGOs mst: your firefox accidently internet
15:35 haarg Mithaldu: what version of opera are you using?
15:36 Mithaldu haarg: latest. 12.18
15:38 haarg windows 8?
15:41 haarg anyway, i don't know if we have information about the protocol on the server side or how much effort it would be to add, but i'm going to go with it's too much
15:41 Mithaldu win10
15:41 Mithaldu haarg: not sure what you're going for
15:42 mst haarg: yeah, hence why the proposal is "warn all opera users" rather than try and add that
15:42 Mithaldu oh, yeah
15:42 haarg but if we had a thing that was just on the front end, checked for opera 12.x, and could be dismissed and remember in localStorage they yeah that would probably be ok
15:43 Mithaldu i mean there's this, but i'd say that's too heavy: https://www.howsmyssl.com/s/api.html
16:39 neilb joined #metacpan
16:44 karjala_ joined #metacpan
17:31 clunker3 joined #metacpan
17:54 neilb joined #metacpan
20:02 Guest69 joined #metacpan
20:48 Khisanth joined #metacpan
21:00 dolmen joined #metacpan

| Channels | #metacpan index | Today | | Search | Google Search | Plain-Text | summary