4 ms·

Edit: The linked article talks about people spending the past few days reviewing for code modifications. Based on other sources (VUPEN Twitter, PHP.net), it app

by nbpoole 16y ago

Edit: The linked article talks about people spending the past few days reviewing for code modifications. Based on other sources (VUPEN Twitter, PHP.net), it appears to have only taken a day or so. It has been several days since Friday though ;) --- Original (too harsh) reply below, for history's sake: Who said it took days? The wiki was down on taken Friday, that note was put up on Saturday. And they manually reviewed all revisions in case the credentials leak on the wiki box led to SVN access. It seems like a perfectly reasonable response to me.

xd 16y ago
"Maintainers of the PHP programming language spent the past few days scouring their source code for malicious modifications after discovering the security of one of their servers had been breached." First paragraph of the linked article.
- nbpoole 16y ago
  Friday: "We are aware of a possible compromise of PHP.NET server(s) and a potential PHP source backdoor. "wiki.php.net" was taken offline" | https://twitter.com/#!/VUPEN/status/48696644975337472 https://twitter.com/#!/VUPEN/status/48696644975337472 Saturday: "php.net security notice" | http://www.php.net/archive/2011.php http://www.php.net/archive/2011.php The article backs up this timeline as well ("The site has been down since at least Friday"). Which do you trust more, the article with the linkbait title or actual facts? ;-)
  - xd 16y ago
    Yes, great points. I read the article linked to from the OP and didn't take the time to look elsewhere. I don't generally have time to crawl the web looking for the "facts" for every news story I read and have faith that a story being voted up on HN is based on a reliable source / article. I'm lost to why you felt it necessary to bait me with: "Who said it took days?", you could have just replied with the better sources you have just brought to my attention.
    - nbpoole 16y ago
      I'm sorry. I wasn't attempting to bait you: I've been following this story since Friday, so I only skimmed this article the first time through. When I originally replied to you, I didn't know why you thought it took days. But you're right, my tone was much too harsh: my apologies.
      - xd 16y ago
        No worries :)
- wvenable 16y ago
  It has been a few days, but there's no evidence other than that line to indicate they actually used all that time to review the source code. Probably just sloppy writing.

by nbpoole 16y ago

xd 16y ago

"Maintainers of the PHP programming language spent the past few days scouring their source code for malicious modifications after discovering the security of one of their servers had been breached." First paragraph of the linked article.

nbpoole 16y ago
Friday: "We are aware of a possible compromise of PHP.NET server(s) and a potential PHP source backdoor. "wiki.php.net" was taken offline" | https://twitter.com/#!/VUPEN/status/48696644975337472 https://twitter.com/#!/VUPEN/status/48696644975337472 Saturday: "php.net security notice" | http://www.php.net/archive/2011.php http://www.php.net/archive/2011.php The article backs up this timeline as well ("The site has been down since at least Friday"). Which do you trust more, the article with the linkbait title or actual facts? ;-)
- xd 16y ago
  Yes, great points. I read the article linked to from the OP and didn't take the time to look elsewhere. I don't generally have time to crawl the web looking for the "facts" for every news story I read and have faith that a story being voted up on HN is based on a reliable source / article. I'm lost to why you felt it necessary to bait me with: "Who said it took days?", you could have just replied with the better sources you have just brought to my attention.
  - nbpoole 16y ago
    I'm sorry. I wasn't attempting to bait you: I've been following this story since Friday, so I only skimmed this article the first time through. When I originally replied to you, I didn't know why you thought it took days. But you're right, my tone was much too harsh: my apologies.
    - xd 16y ago
      No worries :)
wvenable 16y ago
It has been a few days, but there's no evidence other than that line to indicate they actually used all that time to review the source code. Probably just sloppy writing.