Live data from Hacker News

A Docker-inspired Heroku clone in 100 lines of PHP

gist.github.com

1–10 of 34 posts

Re: A Docker-inspired Heroku clone in 100 lines of PHP

#3

https://gist.github.com/igorw/1d67f422689017e814a8#file-app-... Is it possible to craft a zip file that will write data to parent directories, or an explicit path?

unzip intentionally prevents such from happening. So while you could make a .zip file that intends to do that, you need an unzipping tool that would actually allow it.

Re: A Docker-inspired Heroku clone in 100 lines of PHP

#5

https://gist.github.com/igorw/1d67f422689017e814a8#file-app-... Is it possible to craft a zip file that will write data to parent directories, or an explicit path?

Who cares about a possible directory traversal when the entire purpose of this is to run arbitrary code?

It doesn't appear to attempt to sandbox the uploaded code at all. This is obviously not meant to be exposed to untrusted parties.

Re: A Docker-inspired Heroku clone in 100 lines of PHP

#6
post #4

I have never found "X lines of code" to be impressive. Write clean code and polish it and make it readable. Who cares how long it is. Hackers brag about lines, not engineers.

The actual number doesn't matter. It's just shorthand for "It's easy and quick! This isn't a mammoth 10k-line library".

Re: A Docker-inspired Heroku clone in 100 lines of PHP

#7
post #4

I have never found "X lines of code" to be impressive. Write clean code and polish it and make it readable. Who cares how long it is. Hackers brag about lines, not engineers.

Well, could be a reason this place is called Hackers News rather than Engineers News

Re: A Docker-inspired Heroku clone in 100 lines of PHP

#8
post #4

I have never found "X lines of code" to be impressive. Write clean code and polish it and make it readable. Who cares how long it is. Hackers brag about lines, not engineers.

The actual number doesn't matter. It's just shorthand for "It's easy and quick! This isn't a mammoth 10k-line library".

It's also shorthand for "doesn't have feature X or support Y and hasn't really been tested!"
Post reply on HN