- Feature Articles
- CodeSOD
- Error'd
-
Forums
-
Other Articles
- Random Article
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
The only excuse I can think of is that they were under pressure. A lot of pressure. Other than that, inexcusable.
Admin
And for the record, I mean that in a "cool motive, still ~~murder~~ inexcusably bad code" way.
Admin
The RW permissions appear to be write-only, which is another unusual feature.
Admin
Outsourced to cheap developers.
Admin
This right here is why people hate on PHP.
Admin
TRWTF is having typos in every single article in the year 2018. "Essentiallythis"?
Admin
Not unusual at all. Everybody knows that when you write there is no reason to read and verify the result. That's soooo DOS on 5-1/4". This is the almighty CLOUD here. No mistakes are possible!
Admin
It's not really php that's at fault here. You could have done the same kind of wtfery with any other server-side language. That developer, though, deserves a stern talking to.
Admin
This one was so stupid I think it killed me. A PHP script with root access to a machine that can read/write your whole storage system? Yeesh.
Admin
I think it's more because PHP enables too many people who shouldn't be doing this to ... do this.
Addendum 2018-09-17 17:56: Like, it lets you go a long way even if you haven't got a real clue about what you're doing.
Admin
Oh well, at least the servers were patched for shellshock, right? right??
Admin
Even if they were under pressure they could have maintained security to some degree. I mean they could have passed the url parameter of RW or RO and then in the code load the relevant access token.
This really is a WTF!
Admin
Wow. Like, wow. That cloud is about to be vaporized.
Admin
It is totally secure, we have determined the secret key in a guaranteed random way!
Admin
you must be now here?
Admin
Guys, guys GUYS!
Seriously - I think there's a culture of "PHP bad" regardless of what is in front of you. If it mentions PHP, it must be bad. And that, folks, is just was WTF as the actual WTF in this article. This could just have easily been done in any other language: C, C++, C#, Java, Go, Python, Ruby or whatever else you think is cool.
This is an architectural WTF and has nothing, whatsoever, to do with PHP.
Admin
is that you, Ben? waves
Admin
Is the cloud provider's API actually sane & accessible? It's totally possible that 'learn the API' wasn't a solution. Of course, this definitely wasn't better - the remote SSH thing could have been done with a lot more security, etcetc.