How we broke PHP, hacked Pornhub and earned $20k • Hacker News Board

Re: How we broke PHP, hacked Pornhub and earned $20k

#101

Post by Annatar » Mon, Jul 25, 2016, 5:44 PM UTC

hrktb wrote: post #100

Annatar wrote: post #98

Earlier quoted context omitted.

The lesson we learned is that sometimes getting back to the roots (AWK) and using simple methods (regex) can be extremely effective. You are of course right that "what I can't do no-one can" is a bad thing.

IMO your lesson is to get to define a problem simply enough that you can apply a simple solution. This is not a given and usually needs serious design and project management skills. Otherwise even your simple solution would be drawn in "can you support multi-byte characters ? Do you handle non unicode stuff ? What if it leaks in your layers if code before reaching your awk library ?" and other problems that abound in…

your lesson is to get to define a problem simply enough that you can apply a simple solution.

Hear hear! So true. The problem is that making complex things simple is extremely difficult.

Re: How we broke PHP, hacked Pornhub and earned $20k

#102

Post by dmix » Mon, Jul 25, 2016, 7:20 PM UTC

MustardTiger wrote: post #97

dmix wrote: post #90

Earlier quoted context omitted.

I'm talking about clear separation of state via Monads making it easier to focus on the riskier input. For example when you are doing code reviews. That is about the developer nothing to do with some inherent functionality of Monads. Not sure what it being a "general interface" has to do with that. Maybe I wasn't clear.

>Not sure what it being a "general interface" has to do with that I was explaining what monads are. You have read some of the weird misconceptions about haskell and monads and are now repeating them.

How does purity not help the developer focus in on areas where user input might have a negative affect the codebase or system?

I used monads only as an example (in brackets) but it's hardly the only form where purity creates clear divisions in the codebase. So, once again, the specific functionality of monads has nothing to do with it. I'm speaking about the coding style that Haskell promotes making detecting bugs easier during code reviews.

Having done security reviews of code I would have loved to have that type of distinction exist in a codebase compared to the usual OOP mess (with PHP or Ruby for example, which is typically the only paid work available in infosec) where state/user input is leaking all over the place. Compared to clearly defined paths containing IO - which are separated from pure functions which don't have unexpected side effects and require far less scrutiny.

I'm answering my own question here but I was hoping someone who has more experience than me at conducting security-centric code reviews would chime in to provide their perspective.

Re: How we broke PHP, hacked Pornhub and earned $20k

#103

Post by adrianratnapala » Mon, Jul 25, 2016, 8:36 PM UTC

blastrat wrote: post #59

codedokode wrote: post #55

Earlier quoted context omitted.

> you should NEVER TRUST USER INPUT That is not clear at all and pretty useless. What does it mean? I should not accept any user input at all? > strip everything that is not needed That does not always work. What if I have a comment form that should accept any characters?

I'm not being a smartaleck, but "you shouldn't be writing code" with your attitude/approach. "NEVER trust user input" is an important security mantra to learn all on its own, like "wipe your butt/wash your hands" is in another context. The guy is writing a valid point on Hacker(!) News. People writing comments on HN (especially to summarize a takeaway from a longer form article) are not required to accurately recapit…

   NEVER trust user input" is an important security
   mantra to learn all on its own, like "wipe your 
   butt/wash your hands" is in another context.

Even the contexts are not so different. DNA is an information carrier, life is an information system, hygine and the immune system are information security mechanisms.

Though I am not sure who the user is in this analogy.

Re: How we broke PHP, hacked Pornhub and earned $20k

#104

Post by adrianratnapala » Mon, Jul 25, 2016, 8:36 PM UTC

justinlardinois wrote: post #32

nickpsecurity wrote: post #29

Earlier quoted context omitted.

Dude, that's horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it's relatively simple. Or are they already available but dev's often rely on these broken ones?

Hash functions designed for hash tables are generally not hard to find collisions for, so there's not much that can be done. You could shoehorn in a secure hash function, but that would hurt performance.

Or you could use tries.

Re: How we broke PHP, hacked Pornhub and earned $20k

#105

Post by nickpsecurity » Mon, Jul 25, 2016, 9:26 PM UTC

CiPHPerCoder wrote: post #99

nickpsecurity wrote: post #93

Earlier quoted context omitted.

I suggest somebody test SpookyHash-128 similarly to those to see how it performs. Designed to be collision resistant and fast. http://www.burtleburtle.net/bob/hash/spooky.html

Why not SipHash? https://www.131002.net/siphash/

Cuz I either forgot it or never heard of it. Also looks to be one Perl comments are referencing. Has good performance and published cryptanalysis. That's awesome! Looks to be good default for this sort of thing. Thanks for the link. Definitely going in bookmarks & probably future apps :)

Re: How we broke PHP, hacked Pornhub and earned $20k

#106

Post by MustardTiger » Tue, Jul 26, 2016, 11:27 AM UTC

dmix wrote: post #102

MustardTiger wrote: post #97

Earlier quoted context omitted.

>Not sure what it being a "general interface" has to do with that I was explaining what monads are. You have read some of the weird misconceptions about haskell and monads and are now repeating them.

How does purity not help the developer focus in on areas where user input might have a negative affect the codebase or system? I used monads only as an example (in brackets) but it's hardly the only form where purity creates clear divisions in the codebase. So, once again, the specific functionality of monads has nothing to do with it. I'm speaking about the coding style that Haskell promotes making detecting bugs ea…

I don't know how to be any more clear. Monads are not an example, that is the point. It is like saying in python "Given that all user input/state already has to be handled carefully (for ex: with dictionaries)." It is nonsense.

Re: How we broke PHP, hacked Pornhub and earned $20k

#107

Post by ckdarby » Sat, Jul 30, 2016, 7:57 PM UTC

khoury wrote: post #62

ckdarby wrote: post #43

That moment when the company you work at is on the front page of Hacker News xD

Seriously, please do an AMA. As a developer, I am very curious about how it feels like working for a company like that :)

In terms of working at the company, aside from the adult content on people's screen, discussions of adult content, etc it is honestly no different than working at any large company.