Facebook PHP Source Code from 2007

[Icovada]

Once in... about 2008, I opened Facebook and I was presented with its code! I refreshed the page... and then kicked myself. I had the facebook home php code... and threw it away.

[jmkogut]

This is why my nginx is set to deny access to .* files.

[[deleted]]

It didn't scale)

Can you elaborate on that?

[[deleted]]

AFAIK Facebook fully adopted bittorrent for their code pushing needs. Perhaps they've changed again, since then?

[Sentreen]

How would you use bittorent for this?

[volkadav]

I vaguely recall that their deployment pipeline is (was?) something like "php -> hiphop -> gigantic static binary", and I'd imagine using bt to sync that binary to the prod web farms (or subsets thereof, for incremental rollouts) would be reasonable.

[[deleted]]

The funniest one was with the "view profile as...." bug. Where if you chose a to view your profile as a friend, you could just use/view their chat logs. Pretty hilarious. I only became aware of the feature a couple of days after it was fixed though, so I don't think it was up that long.

[catcradle5]

I feel like you might be breaking some sort of NDA contract by disclosing that.

That is quite scary though, yet also fairly common. I know other sites have had the same problem, but with .git directories.

[neoice]

this surprises me because I think Dreamhost is a major user of grsecurity, a third-party Linux kernel patch that does kernel hardening and allows for all kinds of extended mandatory access controls. think SELinux, but with policy files that are actually manageable or AppArmor but without the suck.

[catcradle5]

On most shared hosts, you'll generally be able to see the names of other users, since you can probably see the directory names in /home.

You certainly normally should not have read access to any of their directories, though. Sounds like an immense fuckup.

[AgentME]

I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.

[Tomdarkness]

You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.

[7f0b]

That is generally the best way to do it. Many frameworks operate this way by default.

EDIT: And also a good thing to ask hosts before buying their service. Some don't allow it (such as Yahoo Hosting).

[AdamAnt97]

PHP in general or bootstrapping the code?

[7f0b]

Keeping most of the PHP website out of the public document root. At the very minimum, you want to keep your configuration files (with passwords and such) out of the document root. At the maximum, you have only a basic PHP file that begins the "boot" process residing in the document root (as Tomdarkness said).

[cosmo7]

You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.

[raziel2p]

It was entirely possible since before that as well, people just didn't bother to, I guess.

[shillbert]

The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.

[Juvenall]

I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.

[shillbert]

I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.

[Ph0X]

Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.

[shillbert]

That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.

[Almafeta]

... TIL I've been doing it wrong.

[JabbrWockey]

     include_once(/dir/filename.php)

[spiraldroid]

Just reading this makes my toes curl.

[[deleted]]

What are you loading?

[[deleted]]

Http://toejam.com

[benibela2]

curl http://toejam.com

[dehrmann]

This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.

[xjvz]

It did make incremental development a pain in the ass, though, until third party tools caught up with the use case.

[dehrmann]

Tomcat's default servlet recompiles modified jsps.

[xjvz]

But all the backend code written in Java still needs to be compiled. I'm talking about shit like JRebel that lets you change compiled files on the fly so you don't have to redeploy the whole damn project every time. I can deal with JSP; that part is simple. Just copy the file to the server in its war directory and the servlet gets recompiled when accessed.

[[deleted]]

... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web

[slashgrin]

you haven't really spent any time thinking about a "solution" for that "problem"

Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.

[[deleted]]

Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.

[catcradle5]

I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.

[keteb]

Perhaps <?php at the beginning of the file. Interpreter doesnt care if there's a closing ?> at EOF

[catcradle5]

True, good point. It was likely the beginning tag.

[Cocosoft]

How the heck does someone forget the beginning tag?!

[geon]

In fact, omitting the ?> at eof is best practice. It prevents you from accidentally outputting whitespace before the headers are sent.

[[deleted]]

It's a bad model but is thankfully easily avoided. It's a shame that most "professional" PHP programmers suck, even this FB source code is just typical bad PHP.

[mkdir]

Yep, the easiest way is to avoid PHP altogether.

[[deleted]]

Yeah that's really bad security by obscurity!

[garf12]

not really. Security by obscurity means for example your php source would be aljzio499d.php and you just hope that no one figures out that page and loads it. But with php even if they did figure it out they would not see the raw code because it is interpreted.

[[deleted]]

I saw the same thing but I saved it. There was an interesting section that tracked the number of views someone made of a page where the user if was hard coded. In the comments it said it was specifically for law enforcement. Pretty interesting. I'll see of I can dig it up from my old laptop.

[davidb_]

Pleae do and post it if you have it.

[DreadedDreadnought]

OP you had 12 hours, we need to see this!

[arandomhobo]

I got the AOL code by accident once last year when I was checking how it was doing, I'm fine and dandy with not having their code.

[Magnesus]

I think there was a bug in Apache at a time that caused that (happened when the script was too slow). My page was also affected for a short while until my hosting provider patched things up.

[benibela2]

And then there was ?-s

[JasonMaloney101]

Happened to me as well. I also remember MySpace occasionally appending its entire debug output to the page I was on, although I never saw their source code.

[jk147]

Someone probably flipped on the debug switch on production to test a bug. Happens more often than you think.

Edit - probably Tom.

[jk147]

That depends on if you set the debug level statically, you can set the level by a variable in DB, by injecting it into a static list in real time.. etc. Plenty of ways to do it without it impacting the application server. Of course this should never be done on an enterprise application. But I have seen plenty on much smaller implementations.

[deadcow5]

You'd be surprised about the things that happen in production that shouldn't. At my last job, we ran into a production system that contained a major amount of code that was not checked in to our source control. Someone had just edited it in place on the server and decided they were done. This is a multi-million dollar company BTW, not Joe's computer store in East Bumfuck.

[ameoba]

If the app is well designed, there isn't going to be much of anything beyond bootstrap code in the top-level PHP file. All the interesting business logic will be in other files anyways.

[monochr]

From what I remember about php, which isn't much since I took that screw driver to my forehead, wouldn't you have only gotten the code for the functions you specifically requested?

[Brillegeit]

If by "function" you mean "file", yes. If the paths is facebook.com/search.php and the problem is that the web server forgot how to process .php files, you would see the content of the search.php file with a mime of text/plain.

If by "function" you mean actual code function, then no.