The original leak, from 2010 at least, possibly older: http://pastebin.com/4JVjS02b
4chan was hacked the other day, so the current source code could have been leaked, but if it was, this sure isn't it.
A diff that compares the old leaked source to the "new" one: http://pastebin.com/KkeLzb6q.
The hack of earlier today was due to an obsession over a female 4chan moderator. That should say enough.
Yes I hate PHP more than the next guy,
Yes this code is terrible,
But you know what? I can read it, and follow along. And that's actually more to say than other "beautiful" code that was obfuscated behind 3 or 4 levels of unnecessary levels of abstraction or indirection.
if ($sectrip != "") {
$salt = "LOLLOLOLOLOLOLOLOLOLOLOLOLOLOLOL"; #this is ONLY used if the host doesn't have openssl
#I don't know a better way to get random data system("openssl rand 448 > '".SALTFILE."'",$err);
if ($err === 0) {
chmod(SALTFILE,0400);
$salt = file_get_contents(SALTFILE);
}I don't blame people for buying into the TDD and other perfectionist bandwagons, until very recently the zeal around the topics meant that you couldn't question the fervent push for very narrow and specific types of software quality. I mean, people were saying "tests are documentation" and I had to nod my head and smile just so I wouldn't get trounced by folks without the development experience to know why that wouldn't work, but had read a blog post saying it does.
Don't they get a few million users? I'd say it's definitely nothing to scoff at.
It makes me wonder how many big profile websites might look like this or worse.
I still remember a week into the first job fresh-from-college me marching into the VPs office to tell him the source code was terrible and they were only still running due to luck. It was not well received (or right)
Things are different today though,people tend to use native apps, users want realtime features,hard to do that in pure PHP and scale.You often need 3rd party techs,mostly java based...
As if OpenSSL didn't prove this already.
That is technically correct but does not covey the scale at which 4chan operates. According to http://www.4chan.org/advertise,
Page impressions per month: 575,000,000;
Unique visitors per month: 25,000,000;
Posts per day: 1,000,000;
Alexa Traffic Rank: 836 (Global) & 371 (US)
Quantcast Rank: 305 (US)
Google PageRank: 6
If the beautiful code with 1000 pageviews/month does that, good
If the ugly code does that, good as well. It may be harder to maintain (depending on the circumstances, some "beautiful" code is dreadful as well) which means less money in the bank
Code is usually beautiful until it meets reality with all the exceptions, corner cases, input sanitation, etc
If it is for personal satisfaction, option 2. I guess I don't need to explain this one.
http://9ch.in/overscript/ http://9ch.in/overscript/files/yotsuba.txt
"extract($_POST); extract($_GET); extract($_COOKIE);"
extract is one of those moronic things though that only exists to create security holes and other bugs.
1. It's written in PHP. Finding a good PHP developer is nigh impossible (there are exceptions, like always). 2. I expected worse, to be honest.
Yep. Worked as a sysadmin in a company who had a product in PHP before. That was not fun. The bug count grew with each release in my time there.
Or is this some critical bit? (I noticed it handles cookies, but I'm too unexperienced with web, php or web-security to explore this wall of code)
Imageboard is dead easy in it's essence, so why not rebuild it from scratch, instead of feeding new bells and whistles to the existing spaghetti monster?
HAHAHAHAAHAHAHAHAA
Steal a cookie, gain access.. WTF
For more information on extract: http://www.php.net/extract
To make this easier, there was/is a tool called Firesheep that can be used to hijack session cookies. The popularity of Firesheep caused many sites to enable HTTPS by default (e.g. Facebook did so).
Man, 4chan is worse than I thought.
Redeveloping the site in Go, Dart, Python or Node, or whatever language you like best, wouldn't increase 4Chan's value in any discernible way.
At the end of the day, it works.