Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

121–130 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#121

Post by xp84 »

donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild.

It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of its newer features and they just carried on, echoing through stack overflow posts forever.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#122

Post by dartos »

zoover2020 wrote: post #108
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

This is why PHP is mostly banned at bigCo

Isn’t Facebook one of the biggest?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#123

Post by dartos »

xp84 wrote: post #121
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

JavaScript land fares little better.

IMO it’s because php and js are so easy to pick up for new programmers.

They are very forgiving, and that leads to… well… the way that php and js is…

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#124

Post by jeremyjh »

NovemberWhiskey wrote: post #114
zoover2020 wrote: post #108

Earlier quoted context omitted.

This is why PHP is mostly banned at bigCo

To paraphrase: you can write PHP in any language. PHP is a negative bias for bigCo mostly because of the folkloric history of bad security practices by some PHP software developers.

By “folkloric history”, don’t you actually mean just “history”?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#125

Post by [deleted] »

krageon wrote: post #55
hypeatei wrote: post #23

Earlier quoted context omitted.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

It's very easy to make PHP safe, certainly now that we've passed the 7 mark and we have internal ASTs. Even when using eval, it's beyond trivial to not make gross mistakes.

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#126

Post by kevindamm »

doubled112 wrote: post #70
candiddevmike wrote: post #28

Earlier quoted context omitted.

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

Doesn't every place have a collection of ideas that are half implemented? I know I often choose between finishing somebody else's project or proving we don't need it and decommissioning it. I'm convinced it's just human nature to work on something while it is interesting and move on. What is the motivation to actually finish? Why would the the technologies that should hold up the Internet itself be any different?

While that's true, it dismisses the large body of work that has been completed. The technologies GP comment mentions are complete in the sense that they work, but the deployment is only partial. Herding cats on a global scale, in most cases. It also ignores the side effect benefit that completing the interesting part -- other efforts benefit from the lessons learned by that disrupted effort, even if the deployment fails because it turns out nobody wanted it. And sometimes it's just a matter of time and getting enough large stakeholders excited or at least convinced the cost of migration is worth it.

All that said, even the sense of completing or finishing a thing only really happens in small and limited-scope things, and in that sense it's very much human nature, yeah. You can see this in creative works, too. It's rarely "finished" but at some point it's called done.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#127

Post by awesomeMilou »

dartos wrote: post #123
xp84 wrote: post #121

Earlier quoted context omitted.

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

I'm sorry, I haven't encountered bare eval in years. Do you have an example? And even then it's actually not that easy to get RCE going with that.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#128

Post by donatj »

awesomeMilou wrote: post #127
dartos wrote: post #123

Earlier quoted context omitted.

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

I'm sorry, I haven't encountered bare eval in years. Do you have an example? And even then it's actually not that easy to get RCE going with that.

Something like half of of reported JavaScript vulnerabilities are "prototype pollution" because It's very common practice to write to object keys blindly, using objects as a dictionary, without considering the implications.

It's a very similar exploit.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#129

Post by smsm42 »

zoover2020 wrote: post #108
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

This is why PHP is mostly banned at bigCo

You're saying all big companies ban whole language ecosystem because somebody on the internet used one function in that language in knowingly unsafe manner contrary to all established practices and warnings in the documentation? This is beyond laughable.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#130

Post by wwweston »

z3phyr wrote: post #87
iscoelho wrote: post #52

Earlier quoted context omitted.

Let's not fool ourselves by saying we're purely profit driven. Our industry argues about code style (:

Our industry does not argue about code style. There were a few distinct subcultures which were appropriated by the industry who used to argue about code style, lisp-1 vs lisp-2, vim vs emacs, amiga vs apple, single pass vs multi pass compilers, Masters of Deception vs Legion of Doom and the list goes on, depending on the subculture. The industry is profit driven.

> > Our industry argues about code style (:

> Our industry does not argue about code style.

QED

Post reply on HN