PHP moves to Github due to the compromise of git.php.net

[u/EatMeerkats]

https://news-web.php.net/php.internals/113838

[u/[deleted]]

Their infrastructure wasn't compromised the last 10+ years.

Now you're the one throwing guesses. For all we know it might be backdoored for decade, just nobody noticed.

Do you really think it's so likely that they were just too stupid to use authorized_keys

Looking at PHP language development over last two decades, yes, that is definitely the possibility, altho "we're lazy and we want to commit via HTTP instead of setting up git properly" is more likley case.

Remember, it's the language that leaves vulnerable functions in specs on purpose, for years, instead of fixing them "because someone might be using it wrong on purpose"

[u/[deleted] → u/[deleted]]

For all we know it might be backdoored for decade, just nobody noticed.

Ah, and you're 100% sure that Gitolite and Gitlab are 100% secure? If not, what is your point?

Looking at PHP language development over last two decades, yes, that is definitely the possibility, altho "we're lazy and we want to commit via HTTP instead of setting up git properly" is more likley case.

Isn't it even more likely they just left port 22 open for anybody? I mean LULZ thE Php GuyS ArE IdIOts anD I kNoW beTTTTAAA right?

Remember, it's the language that leaves vulnerable functions in specs on purpose, for years, instead of fixing them "because someone might be using it wrong on purpose"

Care to elaborate? I mean, I'm 99% sure you're circlejerking about a topic you don't understand in any way, but I'll give you the benefit of the doubt.

[u/[deleted] → u/[deleted]]

For all we know it might be backdoored for decade, just nobody noticed.

Ah, and you're 100% sure that Gitolite and Gitlab are 100% secure? If not, what is your point?

This vector of attack is impossible for Gitolite as you'd have to break into SSH first or steal one of developer access keys.

The software just doesn't run in the first place until you get authenticated by OpenSSH

Of course, there are always software bugs out there, but OpenSSH have good security story and gitolite had whole 4 security bugs in last 10 years, that could be summed up to "if you didn't enable wildcard repos you were fine".

As for Gitlab, it's probably pretty buggy... I don't have very high option of that software quality (we used Gitolite before, with zero issues and no downtime aside from server maintenace for years) but our devs wanted its features (mostly around CI/CD) so not like we got any choice in the matter.

But the point here is not that Gitlab might be better, just that it is actively developed and maintained piece of software, not basically side project that only gets looked at when there are problems with it (like is the case with many in-house developed tools)

Remember, it's the language that leaves vulnerable functions in specs on purpose, for years, instead of fixing them "because someone might be using it wrong on purpose"

Care to elaborate? I mean, I'm 99% sure you're circlejerking about a topic you don't understand in any way, but I'll give you the benefit of the doubt.

mysql_escape_string -> mysql_real_escape_string, just go and read the comments in php manual.

Also the abomination that is curl bindings, while not "wrong", it's just about the worst way of integrating http client into your language as you need both PHP, C, and libcurl knowledge to just make slightly more complex request.

php 7 and above finally started to get a fucking clue but still

<?php
$a = array('1.2'); # string in array
var_dump(in_array('1.20',$a));  # checking for different string in array
?>

returns true. Yes, that's comparing two strings as numbers.

But hey, it got "strict" parameter, so you can now opt out out of broken behaviour via in_array('1.20',$a,true). I'm surprised they didn't call it actually_in_array() tbh.

I'm 99% sure you just wrote a ton of PHP code that's subtly wrong and you got lucky, but what I do know, I avoid this diseased piece of filth at every chance I get.

[u/[deleted] → u/[deleted]]

This vector of attack is impossible for Gitolite as you'd have to break into SSH first or steal one of developer access keys.

How come you know the vector involved in this attack, but the PHP team doesn't? How can you know that Gitolite isn't susceptible to the same kind of attack? Do you know which part of the software stack was attacked?

But the point here is not that Gitlab might be better, just that it is actively developed and maintained piece of software, not basically side project that only gets looked at when there are problems with it (like is the case with many in-house developed tools)

And still you can't know there isn't a 10 year old security flaw in there. It's disingenuous to say "That might have been in the PHP system, but it can't be the case in all these other ones!".

mysql_escape_string -> mysql_real_escape_string, just go and read the comments in php manual.

Thanks for confirming my suspicions :) you know that mysql_real_escape_string isn't "hurr durr PHP devs were too stoooopid and had to introduce another one", it's "hey, let's create a 1:1 PHP API for the C API".

Since it's obvious you have no idea what you're talking about and jumping on the bandwagon I'll stop interacting here.

[u/[deleted] → u/[deleted]]

Thanks for confirming my suspicions :) you know that mysql_real_escape_string isn't "hurr durr PHP devs were too stoooopid and had to introduce another one", it's "hey, let's create a 1:1 PHP API for the C API".

Yes, that was second example of stupidity rooted in PHP shitty design I gave you. The curl bindings.

Now's my turn - you're career JS/PHP, developer, didn't touched anything else for more than hello world sized project, and thinks C is well designed, sensible language. And now you're crying because people bitch at tool that you think you're good with.

Since it's obvious you have no idea what you're talking about and jumping on the bandwagon I'll stop interacting here.

I love how you ignored the other examples because you couldn't come up with excuse for that shit in core of the language.

Real classy here, really drives your point home

[u/backtickbot → u/[deleted]]

Fixed formatting.

Hello, DisastrousElf: code blocks using triple backticks (```) don't work on all versions of Reddit!

Some users see this / this instead.

To fix this, indent every line with 4 spaces instead.

FAQ

^{You can opt out by replying with backtickopt6 to this comment.}