10 ms·
Facebook Perl source code from 2005
- philfreo 13y agoThis is different code than the 2007 PHP code here: https://gist.github.com/nikcub/3833406 https://gist.github.com/nikcub/3833406
- a8da6b0c91d 13y agoI wonder why they switched from perl to php. Seems kinda six of one, half dozen of the other.
- Mithaldu 13y agoLooking at that code they probably didn't actually have a professional Perl developer on staff. The code isn't terrible, but certainly a far cry from good. It doesn't help that back in 2005 all the books for learning Perl were still teaching a code style from the early 90s. Edit: I revise the terrible bit, it's a little terrible, as it has SQL injections.
- a8da6b0c91d 13y agoThe problems with that code don't have anything to do with it being perl, though. It's just amateur in any language.
- matthudson 13y ago>"It's just amateur in any language." Can you point out specific instances of where it is amateur? That would be more helpful to learners.
- chromatic 13y agoAfter a quick skim, I found a few things. It's full of SQL injections, to start. (I really like using the subdomain name from the HTTP_HOST environment variable in a SQL query. That's a new attack vector I hadn't considered.) It's full of silly inefficiencies, such as iterating over an array and preparing distinct but trivially parametric queries for each element. It has a strange mix of effectively package global lexical variables and block-scoped lexical variables, which means that running this in any sort of persistent service model would be very buggy. It looks like it ignores parts of the CGI standard. It looks like it takes database connection information from cookies (except it never uses that code). The `find_node` function looks like it's using the wrong data structure entirely, but that's okay, because that pattern's repeated a few times. That's doubly suspect, because this seems like the sort of thing a WHERE clause in the SQL query could handle (though to be fair, it might require a subquery, and the version of Mysql Facebook had deployed in 2005 might not have supported those very well; I don't remember).
- rjbond3rd 13y agoIt seems much more ancient than 2005 (I would have guessed 1990's).
- abimaelmartell 13y agoalso their 2007 php sucks...
- philfreo 13y agoI'm not sure but I thought Facebook was PHP from the beginning. Perhaps they thought building the svg graph was easier in Perl for some reason?
- dutchbrit 13y agoIt was, and you are correct. Look at line #299 for a reference.
- bonemachine 13y agoPrecious.
- elwell 13y agodb user "mark"!
- 0x0 13y agoWow, the database connection ip and dbname were taken from http cookies!
- mst 13y agoEeeek. That code would've been terrible practice in 2000 when I first started writing Perl :( The Mysql module was deprecated in favour of the unified DBI interface, cgi-lib.pl was a perl4 library that was replaced by a module called CGI (shipped with perl5 itself from 5.4+). Calling functions with & is a perl4-ism and almost always the wrong thing to do in perl5, and C-style for is silly in most cases in Perl - for example; the loops in there would likely be better redone as foreach loops, or possibly just a grep. And, of course, YAY not using placeholders in the SQL. sigh
- neilmiddleton 13y agoJust goes to show how much code quality contributes to a successful product.
- X4 13y agoFully agree with you on that. Perfectionism or shooting the bird with one bullet only is not what made Facebook a billion dollar company. a) Serve b) Improve quality c) goto a)
- matthewmacleod 13y agoNo it doesn't - it only demonstrates that products can succeed despite poor code quality.
- ninkendo 13y agoI think that's what he meant... it shows how much code quality contributes to success: not much at all.
- matthewmacleod 13y agoAnd that's exactly what I didn't mean. It's a sample of one, and offers no information whatsoever about how much code quality can contribute to success, except that rubbish code doesn't totally preclude the hope that a product might be successful. Let's say things had turned out a little differently, and someone had used one of those SQL injections to irreversibly erase all of early Facebook's data. We'd probably never have heard of it again. Code quality is a good thing - like scalability, and security. Ultimately, you might succeed without it. But it'll probably be easier if you do.
- dkoch 13y agoAt least they had "use strict" turned on. Not sure why they weren't using DBI and placeholders to prevent SQL injection attacks in 2005.
- dmazin 13y agoWould someone be so kind as to explain the following: sub morph { my ($number) = @_; return ((((($number % 7) * 13) % 17) * 19) % 23); } It appears to be some sort of quick authorization check (there is a later `$code == &morph($user)` comparison).
- harpastum 13y agoMaybe some sort of strange hash function? It looks like it spreads the values fairly evenly from 0-23, while keeping nearby numbers separate. Here's what it looks like from 0-5: http://www.wolframalpha.com/input/?i=plot+%28%28%28%28x+mod+7%29+×+13%29+mod+17%29+×+19%29+mod+23+from+0+to+5 http://www.wolframalpha.com/input/?i=plot+%28%28%28%28x+mod+... If the input is only integers, the same pattern still appears: http://www.wolframalpha.com/input/?i=plot+%28%28%28%28floor%28x%29+mod+7%29+×+13%29+mod+17%29+×+19%29+mod+23+from+0+to+20 http://www.wolframalpha.com/input/?i=plot+%28%28%28%28floor%...
- alexeiz 13y agoIt's a really poor hash function. The only possible values are: 0,3,6,10,13,17,19. You can quickly see that only 7 distinct values are possible because of the initial $number % 7.
- curveship 13y ago11, the forgotten prime.
- jrockway 13y agoNo wonder they wouldn't let me use the username "jrockway/../../../../../etc/passwd".
- general_failure 13y agoWhat's funny is the kind of interview questions they ask at Facebook. They act is if they are rocket scientists creating major breakthrough algorithms.
- csense 13y agoSadly, Facebook was way better in 2005 than it is now. (I quit sometime around '08 or '09, after they started going downhill.)
- dangero 13y agoHopefully you kept your options then? Can you elaborate on what went downhill?
- andyhmltn 13y agoI have to agree. I still have Facebook (as it's one of the ways I can communicate with people who I don't have numbers for) but if I scroll down it in their mobile application a LOT of the content is adverts. Another big percentage is terrible videos/pictures from 9gag-esque accounts that people have liked. After you get passed all of that you are left with very little information that actually matters (status updates/pictures etc.) It's a combination of a problem with both the userbase and the platform.
- jakejake 13y agoIt's surprising to me how "old school" this code is for 2005. It looks similar to Perl code from the late 90's when CGI scripts and form mailers were all the rage.