7 ms·
4chan source code leaked (2010)
- TheAceOfHearts 12y agoI think this just goes to show that you can have a lot of popularity even if your code is just sorta glued together. Don't they get a few million users? I'd say it's definitely nothing to scoff at. It makes me wonder how many big profile websites might look like this or worse.
- marban 12y agoimgur might be a candidate.
- roryhughes 12y agoI doubt it. At their scale (a million uploads daily, three billion monthly pageviews), crappy code is unlikely.
- Grue3 12y ago>I think this just goes to show that you can have a lot of popularity even if your code is just sorta glued together. As if OpenSSL didn't prove this already.
- camus2 12y agoUsers dont care what your code looks like,Early Facebook code was no better and look where they are now... it's about the product. Wordpress is a piece of shit from an engineering perspective yet it's the first blog engine in the world. Because its features are not that bad. Things are different today though,people tend to use native apps, users want realtime features,hard to do that in pure PHP and scale.You often need 3rd party techs,mostly java based...
- wirelessest 12y agoHaving worked at a couple, I think I wouldn't be too far off to say all of them. I still remember a week into the first job fresh-from-college me marching into the VPs office to tell him the source code was terrible and they were only still running due to luck. It was not well received (or right)
- philtar 12y agoI almost did the same thing. But then calmed down and said maybe I have no idea what I'm talking about. I was right. I had no idea what I was talking about.
- deleted 12y ago[deleted]
- Fuxy 12y agoWell at least it's neatly organized into functions :P
- ANTSANTS 12y agoNot much to see here, folks. Someone took an old leak of the source code and commented out a few lines for a giggle. Only moot and the developers know what the site looks like now, but given the significant addition of functionality in the past few years, it's pretty much impossible that that would be the only difference in the source. The original leak, from 2010 at least, possibly older: http://pastebin.com/4JVjS02b http://pastebin.com/4JVjS02b 4chan was hacked the other day, so the current source code could have been leaked, but if it was, this sure isn't it.
- brador 12y agoWouldn't the ideal solution for 4Chan be an external data/processing server that dials in to the hosting server to dump out static files? That way the location of the external server remains, at least partially, a mystery, even after the main box is hacked?
- pearjuice 12y agoWhy? 4chan is not a high target. There is no reason to over engineer it. Mostly it will be prepubescent teenagers throwing a fit and bombarding the server with bandwidth. The hack of earlier today was due to an obsession over a female 4chan moderator. That should say enough.
- nwh 12y agoCloudFlare was hacked with the sole intention of taking over 4chan.org's domain. They're a huge target.
- valarauca1 12y agoOkay lets say they are a massive target. There is still a monetary issues. 4chan is a cultural and ideological landmark on the American internet. Not only are their clones, but "Cloning 4chan" is almost a business in and of itself. And they fail. 4chan's month to month profits are barely to not-at-all existent. In a purely dollars and cents way, 4chan is a failure. So their is very little monetary motivation for discovering the secrets of the 4chan's operation. Security is a trade off of Financial Risk vs Financial Investment. There is no Financial Risk in 4chan being hacked. They have no user accounts, they have no financial data. They have no overly complex-secret-sauce-search algorithm. The only thing to 'steal' is a collection of Japanese/American Pop cultural referential gif, jpg, and webm files.
- n4n4ki 12y agoSomebody should upload this to GitHub.
- Villodre 12y agoIt seems that it's too terrible to be the true code. "if($_COOKIE['4chan_auser']", "extract($_POST); extract($_GET); extract($_COOKIE);"
- joshcrowder 12y agoHa - I noticed that as well, wowza!
- spoiler 12y ago> It seems that it's too terrible to be the true code. 1. It's written in PHP. Finding a good PHP developer is nigh impossible (there are exceptions, like always). 2. I expected worse, to be honest.
- ialexpw 12y agoHuh, it isn't hard to find a good PHP developer at all.. (easy to find someone who can code better than that example)
- fest 12y agoIn my experience great PHP developers tend to find a way out from developing anything in PHP.
- brokenparser 12y agoLuckily, Javascript is always allowed in PHP projects and it can do a lot more today than it could a decade ago. Also, using it will often lead to having NodeJS on the server even if it's just for compiling assets initially. And NodeJS is bad ass rock star tech: http://www.youtube.com/watch?v=bzkRVzciAZg http://www.youtube.com/watch?v=bzkRVzciAZg
- ledneb 12y agoNo serious, modern PHP developer writes code like this. If it were a code sample for any respectable PHP job, it would be a massive "do not hire" flag.
- NewsReader42 12y agoif(isset($_COOKIE['4chan_auser'])&&isset($_COOKIE['4chan_apass'])){ $user = mysql_real_escape_string($_COOKIE['4chan_auser']); $pass = mysql_real_escape_string($_COOKIE['4chan_apass']); } HAHAHAHAAHAHAHAHAA Steal a cookie, gain access.. WTF
- Kiro 12y agoHow do you "steal" a cookie?
- aidos 12y agoThe best bet is generally an xss attack. Though there are other ways, you could sniff one on a wireless network if no encryption is in use.
- exDM69 12y agoGet on the same WiFi as your target, open up Wireshark and grab their HTTP communications. To make this easier, there was/is a tool called Firesheep that can be used to hijack session cookies. The popularity of Firesheep caused many sites to enable HTTPS by default (e.g. Facebook did so).
- mandalar12 12y agoDoes it mean that the password is stored in the cookie or I am missing something ?
- wfn 12y agoif ($sectrip != "") { $salt = "LOLLOLOLOLOLOLOLOLOLOLOLOLOLOLOL"; #this is ONLY used if the host doesn't have openssl #I don't know a better way to get random data
- slipstream- 12y agoI saw that. "LOLLOLOLOLOLOLOLOLOLOLOLOLOLOLOL" was my reaction, too.
- deleted 12y ago[deleted]
- arb99 12y agoa few lines down: system("openssl rand 448 > '".SALTFILE."'",$err); if ($err === 0) { chmod(SALTFILE,0400); $salt = file_get_contents(SALTFILE); }
- lispm 12y agoMy eyes, the goggles do nothing!!!
- Vaskivo 12y agoI thought the *chan code was open. Or is this some critical bit? (I noticed it handles cookies, but I'm too unexperienced with web, php or web-security to explore this wall of code)
- rossy 12y ago4chan's code (Yotsuba) has always been a closed source fork of Futaba, though there are several open source Futaba clones, like Kusaba X.
- cbg0 12y agoAny proof that this was at some point in time part of the source code or are we focusing on "PHP is bad" circlejerk here?
- pan69 12y agoF* me. No wonder PHP has a bad rap..
- onion2k 12y agoI think the fact that you can drive a multi million user website that was once valued at $1.2b (by a VC admittedly) on 2600 lines of pretty bad PHP code when most of the users are exactly the sort of people who'd try to hack it is actually a testament to how good PHP is. Redeveloping the site in Go, Dart, Python or Node, or whatever language you like best, wouldn't increase 4Chan's value in any discernible way. At the end of the day, it works.
- userbinator 12y agoI wouldn't say it's "pretty bad PHP code" if it did what it needed to, and as you say, it was rather resistant to attack.
- aaronem 12y agoPlease, please tell me you're joking about 4chan having been valued at $1.2 billion dollars by anyone.
- aaronem 12y agoThis itched me -- I've never gotten the impression that Christopher Poole was particularly stupid, and I couldn't imagine him reacting to a genuine offer of $1.2 billion for 4chan in any other fashion than by demanding cash on the nail and then taking it -- so I scratched it. The only thing I could find was a year-old thread from 4chan itself [1], in which the supposed VC never identifies himself, and in which (someone who is probably) Poole had the following to say: >>this thread >>my sides >>the stratosphere > >If this is actually your profession, you should probably find a new job. The advice never to believe everything you read is good advice in general; with regard to anything you read on, from, or about 4chan, it's indispensable. [1] http://4chandata.org/q/VC-estimates-4chan-worth-1-2-billion-a367656 http://4chandata.org/q/VC-estimates-4chan-worth-1-2-billion-...
- pearjuice 12y agoThis is not leaked recently but spread today which caused people to believe it was looted during the 4chan hack earlier today. The 4chan administration has been awkwardly silenced about the compromised 4chan website, but this isn't one of the reasons. http://9ch.in/overscript/ http://9ch.in/overscript/ http://9ch.in/overscript/files/yotsuba.txt http://9ch.in/overscript/files/yotsuba.txt
- mr_vile 12y agoyes, I actually added that leaked code to overscript in 2012, previously there was another leak in 2010.
- kevin818 12y agoHow can code be "leaked"? Wouldn't this imply someone was able to terminal into one of their servers?
- n1c 12y agoAny number of things could happen; maybe someone got access to a code repository, or a stray flash drive, or the web server was mis-configured and served the file as plain text (happened to fb once) etc.
- Anderkent 12y agoOr they found a file read vulnerability, or a server was misconfigured for a period and allowed files to be read, or a multitude of other options.
- mahkoh 12y ago4chan (or just moot's account) was hacked yesterday.
- deleted 12y ago[deleted]
- dewey 12y agoAnd yet, despite the horrible code, it's still powering an Alexa Top 500 page without any huge problems I've heard of.
- veew 12y agoYou jelly? You so jelly.
- roryhughes 12y agoCrazy. I knew PHP was bad, but this is just terrible.
- dewey 12y agoI know hating on PHP is en vogue but you could probably write the same ugly code with another language too.
- phaer 12y agoYes you could, but it's harder. extract($_GET) does not look as bad as eval(request.GET) but it's almost the same thing for example.
- harryf 12y agoNot possible. Other languages have features to prevent this.
- shocks 12y agoI highly doubt you have anything else to add because I'm sure you're just another person jumping on the "hate php" bandwagon - but go on, entertain me. Please elaborate.
- camus2 12y agoMost languages dont have extract($_POST) and hop,everything's overwritten... PHP has a lot of shit like this.Yeah you dont have to use them,but they shouldnt be here at first place,if PHP core devs cared about a sane API. PHP doesnt have a sane API. PHP core devs dont give a damn. That's why facebook developped Hack and HHVM.
- deleted 12y ago[deleted]
- goshx 12y agoAsk HN: Would you rather have a beautiful source code with 1000 pageviews/month or an ugly source code with millions of pageviews/month?
- NotUncivil 12y ago>millions of pageviews/month That is technically correct but does not covey the scale at which 4chan operates. According to http://www.4chan.org/advertise http://www.4chan.org/advertise, Page impressions per month: 575,000,000; Unique visitors per month: 25,000,000; Posts per day: 1,000,000; Alexa Traffic Rank: 836 (Global) & 371 (US) Quantcast Rank: 305 (US) Google PageRank: 6 Makes me wonder if WebM will increase or reduce 4chan's total traffic (when measured in bytes, not clicks).
- Igglyboo 12y agoI can't imagine WebM impacting 4chan anytime soon, it will probably reduce 4chan's load when(if) WebM takes off but I highly doubt more than a small fraction will choose WebM over a .gif in the immediate future.
- Robadob 12y agoWebM has caused longer animated content to be posted that wouldn't have been so possible as gifs (the limit is at 2 minutes iirc), so there will still be people posting large files.
- raverbashing 12y agoAbility to pay my bills If the beautiful code with 1000 pageviews/month does that, good If the ugly code does that, good as well. It may be harder to maintain (depending on the circumstances, some "beautiful" code is dreadful as well) which means less money in the bank Code is usually beautiful until it meets reality with all the exceptions, corner cases, input sanitation, etc
- egeozcan 12y agoIf my business relies on it, option 1, because ugly code tends to be less maintainable and a business should not depend on magic numbers and "LOLOLO...". If it is for personal satisfaction, option 2. I guess I don't need to explain this one.
- kaivi 12y agoI wonder what is the site's infrastructure_cost/ad_revenue ratio, because I have long had a feeling that it could be greatly improved. Moot has always been skeptical about innovating the board, even the iOS layout is still incomprehensible since the CSS shim has been added. Imageboard is dead easy in it's essence, so why not rebuild it from scratch, instead of feeding new bells and whistles to the existing spaghetti monster?
- freshyill 12y ago<font>? <table>? Man, 4chan is worse than I thought.
- mkoryak 12y agowhats wrong with <table> ?
- freshyill 12y ago<table> is for tables of information, not for layout. But seeing as how I was downvoted, the important thing to remember is that any hint of levity strictly forbidden on Hacker News.
- dang 12y agohttps://news.ycombinator.com/item?id=7609289 https://news.ycombinator.com/item?id=7609289
- TD-Linux 12y agoThe HTML was totally redone a couple of years ago. Check out the source on a page now.
- treehau5 12y agoI mean, Yes I hate PHP more than the next guy, Yes this code is terrible, But you know what? I can read it, and follow along. And that's actually more to say than other "beautiful" code that was obfuscated behind 3 or 4 levels of unnecessary levels of abstraction or indirection.