6 ms·

That checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next t

That checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next to the post. 4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users happy. And as you'd expect from a library that parses a bunch of horrible undocumented formats in C, it's a huge insecure mess. Several heap overflows and arbitrary writes all over the place. Heap spray primitives. Lots of user controlled input since you provide your own JPEG. Everything you could want. So I wrote a little PoC out of curiosity. Crafted a little 20kB JPG that would try to allocate several GBs worth of heap spray. I submit my post, and the server dutifully times out. And that's where I'd like to say I finished my PoC and reported the vulnerability, but in fact I got stuck on a reliable ASLR bypass and lost interest (I did send an email about the library, but I don't think it was actively maintained and there was no followup) My impression from this little adventure is that 4chan never really had the maintenance and code quality it needed. Everything still seemed to be the same very old PHP code that leaked years ago (which included this same call to the vulnerable EXIF library). Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.

bigfatkitten 1y ago
As far as I can tell, no real maintenance has happened since Poole sold the site a decade ago. Hiroyuki paid for it and then mostly forgot about it.
- doublepg23 1y ago
  The current FreeBSD version the hacker displayed was from around the time of the sale so that tracks.
- FMecha 1y ago
  Nishimura for most part become a Japanese public personality - he has wrote for Japanese tabloids and has a YT channel.
  - bigfatkitten 1y ago
    Certainly explains why 4chan fell way down his priority list.
  - amadeuspagel 1y ago
    This in general is the main factor of the decline of the "old web". Many of the people who drove it, who run these forums, are simply happier running a substack, a subreddit, a facebook group, without worrying about servers.
ryandrake 1y ago
> Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt. This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even works. If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.
- SV_BubbleTime 1y ago
  >If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily. I’m an automotive CE… we’re getting there. Cars used to be DONE at lots… now, there are weeks to finish code before the customer lays hands on, and that time is factored in now. Worse with OTA updates. Now, so long as it’s fixed if enough customers complain that’s good enough. Cars used to be great. Then some morons connected them to the internet for no good reasons.
  - Shekelphile 1y ago
    > Then some morons connected them to the internet for no good reasons. Elon Musk and Franz von Holzhausen, to be precise.
    - SV_BubbleTime 1y ago
      No. Not even close. Far closer to Obama and his circle. Around Carpocalypse 2008, a bunch of three letter agencies started pushes for internet connected vehicles knowing the tech wasn’t there; but would be. I watched it happen. There was some shady shit, and the reality was 2008 wasn’t just about GM and Chrysler but and entire JustInTime mistake that could have stopped almost all car production around the world. Different topic, but the effect was government would be involved in cars a lot more than previously. Fast forward, and here we are. Your car ABSOLUTELY is spying on you, and the upside is you also get shipped unfinished vehicles. Be a culture war sally about Musk all you like, I know, the bad men say the mean things. But this isn’t on him. Tesla had to and in some ways is still learning that cars aren’t computers on wheels, but this specific “feature” came from Big Government first.
lazystar 1y ago
as someone who had to upgrade a stack from php 5.3 to 7.1 back in 2019... do you know what version of php they were running?
- s3krit 1y ago
  Based on one of the comments in the leaked source, at least php 6, though no idea what specific version: > // In PHP 6 this... doesn't seem to do anything? Let's try again in 7.
  - lobsterthief 1y ago
    PHP 6 was never released ;) Got stuck in development hell and they went straight to 7.
    - s3krit 1y ago
      Oh interesting, thanks! Which makes that comment in the code even more confusing

bigfatkitten 1y ago

As far as I can tell, no real maintenance has happened since Poole sold the site a decade ago. Hiroyuki paid for it and then mostly forgot about it.

doublepg23 1y ago
The current FreeBSD version the hacker displayed was from around the time of the sale so that tracks.
FMecha 1y ago
Nishimura for most part become a Japanese public personality - he has wrote for Japanese tabloids and has a YT channel.
- bigfatkitten 1y ago
  Certainly explains why 4chan fell way down his priority list.
- amadeuspagel 1y ago
  This in general is the main factor of the decline of the "old web". Many of the people who drove it, who run these forums, are simply happier running a substack, a subreddit, a facebook group, without worrying about servers.

ryandrake 1y ago

> Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt. This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even works. If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.

SV_BubbleTime 1y ago
>If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily. I’m an automotive CE… we’re getting there. Cars used to be DONE at lots… now, there are weeks to finish code before the customer lays hands on, and that time is factored in now. Worse with OTA updates. Now, so long as it’s fixed if enough customers complain that’s good enough. Cars used to be great. Then some morons connected them to the internet for no good reasons.
- Shekelphile 1y ago
  > Then some morons connected them to the internet for no good reasons. Elon Musk and Franz von Holzhausen, to be precise.
  - SV_BubbleTime 1y ago
    No. Not even close. Far closer to Obama and his circle. Around Carpocalypse 2008, a bunch of three letter agencies started pushes for internet connected vehicles knowing the tech wasn’t there; but would be. I watched it happen. There was some shady shit, and the reality was 2008 wasn’t just about GM and Chrysler but and entire JustInTime mistake that could have stopped almost all car production around the world. Different topic, but the effect was government would be involved in cars a lot more than previously. Fast forward, and here we are. Your car ABSOLUTELY is spying on you, and the upside is you also get shipped unfinished vehicles. Be a culture war sally about Musk all you like, I know, the bad men say the mean things. But this isn’t on him. Tesla had to and in some ways is still learning that cars aren’t computers on wheels, but this specific “feature” came from Big Government first.

lazystar 1y ago

as someone who had to upgrade a stack from php 5.3 to 7.1 back in 2019... do you know what version of php they were running?

s3krit 1y ago
Based on one of the comments in the leaked source, at least php 6, though no idea what specific version: > // In PHP 6 this... doesn't seem to do anything? Let's try again in 7.
- lobsterthief 1y ago
  PHP 6 was never released ;) Got stuck in development hell and they went straight to 7.
  - s3krit 1y ago
    Oh interesting, thanks! Which makes that comment in the code even more confusing