4 ms·

>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained

>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server. I don't want to live on this planet anymore

detourdog 2y ago
Always look on the bright side of Life. The non-sensicalness of it is just a phase. Remember the Tower of Babel didn't stop humanity. Here is a link that was posted a few days ago regarding how great things are compared to 200 years ago. Ice cream has only become a common experience in the last 200 years.. https://ourworldindata.org/a-history-of-global-living-conditions https://ourworldindata.org/a-history-of-global-living-condit...
- Noumenon72 2y ago
  Someone may have posted a link to it a few days ago, but the link is from 2016 with a partial update last February.
brynb 2y ago
that seems like a bigger lift than just deciding to help fix the bug “be the change” or some such
larsnystrom 2y ago
The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.
- hypeatei 2y ago
  The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.
  - dpcx 2y ago
    I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?
    - sebstefan 2y ago
      https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp >crc32($str) and hash("crc32",$str) use different algorithms .. >Password_verify() always returns true with some hash >md5('240610708') == md5('QNKCDZO') >crypt() on failure: return <13 characters of garbage > strcmp() will return 0 on error, can be used to bypass authentication > crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines >5.3.7 Fails unit test, released anyway The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has. https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.
      - rty32 2y ago
        People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...
  - bell-cot 2y ago
    Modern PHP is about as solid as comparable languages. It's two biggest problems are: Lingering bad reputation, from the bad old days Minimal barrier to entry - which both makes it a go-to for people who should not be writing production code in any language, and encourages many higher-skill folks to look down on it
coldpie 2y ago
As has been demonstrated many, many (many, many (many many many many many...)) times: there is no such thing as computer security. If you have data on a computer that is connected to the Internet, you should consider that data semi-public. If you put data on someone else's computer, you should consider that data fully public. Our computer security analogies are modeled around securing a home from burglars, but the actual threat model is the ocean surging 30 feet onto our beachfront community. The ocean will find the holes, no matter how small. We are not prepared for this.
- ffsm8 2y ago
  by this logic, every picture you'll ever take with your phone would be considered semi-public as phones are Internet connected. While I wouldn't have too much of an issue with that, I'm pretty sure I'm a minority with that
  - coldpie 2y ago
    > every picture you'll ever take with your phone would be considered semi-public as phones are Internet connected Correct. https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak https://www.cybersecurity-insiders.com/glitch-makes-data-from-google-photos-leak-to-strangers/ https://www.cybersecurity-insiders.com/glitch-makes-data-fro... https://arstechnica.com/gadgets/2023/09/apple-patches-clickless-0-day-image-processing-vulnerability-in-ios-macos/ https://arstechnica.com/gadgets/2023/09/apple-patches-clickl...
- GTP 2y ago
  > Our computer security analogies are modeled around securing a home from burglars Well, no home is burglar-proof either. Just like with computer security, we define , often just implicitly, a threat model and then we decide which kind of security measures we use to protect our homes. But a determined burglar could still find a way in. And here we get to a classic security consideration: if the effort required to break your security is greater than the benefit obtained from doing so, you're adequately protected from most threats.
JW_00000 2y ago
Have you ever witnessed a house being built? Everywhere is the same :) At least in our industry these issues are generally not life-threatening.
deleted 2y ago
[deleted]

detourdog 2y ago

Always look on the bright side of Life. The non-sensicalness of it is just a phase. Remember the Tower of Babel didn't stop humanity. Here is a link that was posted a few days ago regarding how great things are compared to 200 years ago. Ice cream has only become a common experience in the last 200 years.. https://ourworldindata.org/a-history-of-global-living-conditions https://ourworldindata.org/a-history-of-global-living-condit...

Noumenon72 2y ago
Someone may have posted a link to it a few days ago, but the link is from 2016 with a partial update last February.

brynb 2y ago

that seems like a bigger lift than just deciding to help fix the bug “be the change” or some such

larsnystrom 2y ago

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

hypeatei 2y ago
The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.
- dpcx 2y ago
  I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?
  - sebstefan 2y ago
    https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp >crc32($str) and hash("crc32",$str) use different algorithms .. >Password_verify() always returns true with some hash >md5('240610708') == md5('QNKCDZO') >crypt() on failure: return <13 characters of garbage > strcmp() will return 0 on error, can be used to bypass authentication > crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines >5.3.7 Fails unit test, released anyway The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has. https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.
    - rty32 2y ago
      People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...
- bell-cot 2y ago
  Modern PHP is about as solid as comparable languages. It's two biggest problems are: Lingering bad reputation, from the bad old days Minimal barrier to entry - which both makes it a go-to for people who should not be writing production code in any language, and encourages many higher-skill folks to look down on it

coldpie 2y ago

As has been demonstrated many, many (many, many (many many many many many...)) times: there is no such thing as computer security. If you have data on a computer that is connected to the Internet, you should consider that data semi-public. If you put data on someone else's computer, you should consider that data fully public. Our computer security analogies are modeled around securing a home from burglars, but the actual threat model is the ocean surging 30 feet onto our beachfront community. The ocean will find the holes, no matter how small. We are not prepared for this.

ffsm8 2y ago
by this logic, every picture you'll ever take with your phone would be considered semi-public as phones are Internet connected. While I wouldn't have too much of an issue with that, I'm pretty sure I'm a minority with that
- coldpie 2y ago
  > every picture you'll ever take with your phone would be considered semi-public as phones are Internet connected Correct. https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak https://www.cybersecurity-insiders.com/glitch-makes-data-from-google-photos-leak-to-strangers/ https://www.cybersecurity-insiders.com/glitch-makes-data-fro... https://arstechnica.com/gadgets/2023/09/apple-patches-clickless-0-day-image-processing-vulnerability-in-ios-macos/ https://arstechnica.com/gadgets/2023/09/apple-patches-clickl...
GTP 2y ago
> Our computer security analogies are modeled around securing a home from burglars Well, no home is burglar-proof either. Just like with computer security, we define , often just implicitly, a threat model and then we decide which kind of security measures we use to protect our homes. But a determined burglar could still find a way in. And here we get to a classic security consideration: if the effort required to break your security is greater than the benefit obtained from doing so, you're adequately protected from most threats.

JW_00000 2y ago

Have you ever witnessed a house being built? Everywhere is the same :) At least in our industry these issues are generally not life-threatening.

deleted 2y ago

[deleted]