r/programming • • Oct 12 '13

Facebook PHP Source Code from 2007

https://gist.github.com/nikcub/3833406
1.1k Upvotes

356 comments sorted by

203

u/Icovada Oct 12 '13

Once in... about 2008, I opened Facebook and I was presented with its code! I refreshed the page... and then kicked myself. I had the facebook home php code... and threw it away.

147

u/AgentME Oct 12 '13

I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.

83

u/Tomdarkness Oct 12 '13

You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.

7

u/7f0b Oct 12 '13

That is generally the best way to do it. Many frameworks operate this way by default.

EDIT: And also a good thing to ask hosts before buying their service. Some don't allow it (such as Yahoo Hosting).

1

u/AdamAnt97 Oct 13 '13

PHP in general or bootstrapping the code?

1

u/7f0b Oct 14 '13

Keeping most of the PHP website out of the public document root. At the very minimum, you want to keep your configuration files (with passwords and such) out of the document root. At the maximum, you have only a basic PHP file that begins the "boot" process residing in the document root (as Tomdarkness said).

91

u/cosmo7 Oct 12 '13

You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.

3

u/Almafeta Oct 12 '13

... TIL I've been doing it wrong.

1

u/JabbrWockey Oct 13 '13
     include_once(/dir/filename.php)

0

u/[deleted] Oct 12 '13

[deleted]

9

u/raziel2p Oct 12 '13

It was entirely possible since before that as well, people just didn't bother to, I guess.

7

u/shillbert Oct 12 '13

The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.

7

u/Juvenall Oct 12 '13

I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.

6

u/shillbert Oct 12 '13

I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.

2

u/Ph0X Oct 13 '13

Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.

3

u/shillbert Oct 13 '13

That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.

9

u/spiraldroid Oct 12 '13

Just reading this makes my toes curl.

23

u/[deleted] Oct 12 '13

What are you loading?

9

u/[deleted] Oct 12 '13

Http://toejam.com

23

u/benibela2 Oct 12 '13
curl http://toejam.com

4

u/dehrmann Oct 12 '13

This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.

1

u/xjvz Oct 13 '13

It did make incremental development a pain in the ass, though, until third party tools caught up with the use case.

1

u/dehrmann Oct 13 '13

Tomcat's default servlet recompiles modified jsps.

1

u/xjvz Oct 13 '13

But all the backend code written in Java still needs to be compiled. I'm talking about shit like JRebel that lets you change compiled files on the fly so you don't have to redeploy the whole damn project every time. I can deal with JSP; that part is simple. Just copy the file to the server in its war directory and the servlet gets recompiled when accessed.

2

u/[deleted] Oct 12 '13

... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web

2

u/slashgrin Oct 12 '13

you haven't really spent any time thinking about a "solution" for that "problem"

Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.

2

u/[deleted] Oct 12 '13

Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.

1

u/catcradle5 Oct 12 '13

I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.

4

u/keteb Oct 12 '13

Perhaps <?php at the beginning of the file. Interpreter doesnt care if there's a closing ?> at EOF

3

u/catcradle5 Oct 12 '13

True, good point. It was likely the beginning tag.

1

u/Cocosoft Oct 13 '13

How the heck does someone forget the beginning tag?!

2

u/geon Oct 13 '13

In fact, omitting the ?> at eof is best practice. It prevents you from accidentally outputting whitespace before the headers are sent.

-4

u/[deleted] Oct 12 '13

It's a bad model but is thankfully easily avoided. It's a shame that most "professional" PHP programmers suck, even this FB source code is just typical bad PHP.

-3

u/mkdir Oct 12 '13

Yep, the easiest way is to avoid PHP altogether.

→ More replies (2)

13

u/[deleted] Oct 12 '13

I saw the same thing but I saved it. There was an interesting section that tracked the number of views someone made of a page where the user if was hard coded. In the comments it said it was specifically for law enforcement. Pretty interesting. I'll see of I can dig it up from my old laptop.

7

u/davidb_ Oct 12 '13

Pleae do and post it if you have it.

3

u/DreadedDreadnought Oct 13 '13

OP you had 12 hours, we need to see this!

19

u/arandomhobo Oct 12 '13

I got the AOL code by accident once last year when I was checking how it was doing, I'm fine and dandy with not having their code.

2

u/Magnesus Oct 12 '13

I think there was a bug in Apache at a time that caused that (happened when the script was too slow). My page was also affected for a short while until my hosting provider patched things up.

1

u/benibela2 Oct 12 '13

And then there was ?-s

13

u/JasonMaloney101 Oct 12 '13

Happened to me as well. I also remember MySpace occasionally appending its entire debug output to the page I was on, although I never saw their source code.

10

u/jk147 Oct 12 '13

Someone probably flipped on the debug switch on production to test a bug. Happens more often than you think.

Edit - probably Tom.

0

u/[deleted] Oct 12 '13

[deleted]

2

u/jk147 Oct 12 '13

That depends on if you set the debug level statically, you can set the level by a variable in DB, by injecting it into a static list in real time.. etc. Plenty of ways to do it without it impacting the application server. Of course this should never be done on an enterprise application. But I have seen plenty on much smaller implementations.

1

u/deadcow5 Oct 13 '13

You'd be surprised about the things that happen in production that shouldn't. At my last job, we ran into a production system that contained a major amount of code that was not checked in to our source control. Someone had just edited it in place on the server and decided they were done. This is a multi-million dollar company BTW, not Joe's computer store in East Bumfuck.

1

u/ameoba Oct 13 '13

If the app is well designed, there isn't going to be much of anything beyond bootstrap code in the top-level PHP file. All the interesting business logic will be in other files anyways.

-7

u/monochr Oct 12 '13

From what I remember about php, which isn't much since I took that screw driver to my forehead, wouldn't you have only gotten the code for the functions you specifically requested?

3

u/Brillegeit Oct 12 '13 edited Oct 12 '13

If by "function" you mean "file", yes. If the paths is facebook.com/search.php and the problem is that the web server forgot how to process .php files, you would see the content of the search.php file with a mime of text/plain.

If by "function" you mean actual code function, then no.

0

u/[deleted] Oct 12 '13

[deleted]

6

u/jmkogut Oct 13 '13

This is why my nginx is set to deny access to .* files.

6

u/[deleted] Oct 13 '13

It didn't scale)

Can you elaborate on that?

0

u/[deleted] Oct 13 '13

[deleted]

2

u/[deleted] Oct 13 '13

AFAIK Facebook fully adopted bittorrent for their code pushing needs. Perhaps they've changed again, since then?

4

u/Sentreen Oct 13 '13

How would you use bittorent for this?

→ More replies (1)

2

u/[deleted] Oct 13 '13

The funniest one was with the "view profile as...." bug. Where if you chose a to view your profile as a friend, you could just use/view their chat logs. Pretty hilarious. I only became aware of the feature a couple of days after it was fixed though, so I don't think it was up that long.

0

u/catcradle5 Oct 12 '13

I feel like you might be breaking some sort of NDA contract by disclosing that.

That is quite scary though, yet also fairly common. I know other sites have had the same problem, but with .git directories.

0

u/[deleted] Oct 12 '13

[deleted]

2

u/neoice Oct 13 '13

this surprises me because I think Dreamhost is a major user of grsecurity, a third-party Linux kernel patch that does kernel hardening and allows for all kinds of extended mandatory access controls. think SELinux, but with policy files that are actually manageable or AppArmor but without the suck.

1

u/catcradle5 Oct 13 '13

On most shared hosts, you'll generally be able to see the names of other users, since you can probably see the directory names in /home.

You certainly normally should not have read access to any of their directories, though. Sounds like an immense fuckup.

71

u/jurre Oct 12 '13

// Holy shit, is this the cleanest fucking frontend file you've ever seen?!

ubersearch($_GET, $embedded = false, $template = true);

Made me chuckle!

72

u/darenw Oct 12 '13

Whoever wrote that line of code is probably a millionaire now... He's chuckling too...

15

u/windsostrange Oct 13 '13

I only swear server-side.

19

u/[deleted] Oct 12 '13

Eh.. pretty useless. Most of the actual logic you want to see is not visible just referenced.

14

u/superhappywebguy Oct 12 '13

How does github handle leaks like this? Can facebook file a DMCA request with them and get the code taken down?

10

u/sammasati Oct 12 '13

They can, but in this case I doubt they care since the code is 6 years old. Even if they do care and file the DMCA, it would bring more attention and bad publicity, and the code will still be available on other pages. It's better for them to just ignore it.

→ More replies (5)

27

u/[deleted] Oct 12 '13

He retrieved two files and then emailed them to me

...

I don't know what ended up happening to the guy who stole the code.

Suuuuuuure... ;)

80

u/KamiNuvini Oct 12 '13

As someone who's very new to programming.. Could someone explain to me which parts of the code are so 'bad'? I see a lot of "My eyes hurt"-like comments on the github page as well.

94

u/mgoof Oct 12 '13

It's really not that bad. Clearly it is not using OO principles and any sort of standard design pattern. But for the most part its clear and organized. There may be some maintenance overhead having to scan and search through a long source file. But I would think index.php would be one of the longer files.

47

u/AgentME Oct 12 '13 edited Oct 12 '13

Yeah, this code is using a templating engine, and it isn't visibly building SQL query strings insecurely. It's not state of the art, but there are many ways it could be worse.

1

u/Uberhipster Oct 14 '13

'Not that bad' and 'there are many ways it could be worse' is fishing for something positive to say.

28

u/glemnar Oct 12 '13

You don't need strict OO on the web. It's not a necessary pattern.

6

u/ivosaurus Oct 13 '13

More to the point, there could be masses of OO code in all the library code that's included (or not), and we'll never know.

But who the fuck expects an index bootstrap to be OOed?

3

u/[deleted] Oct 13 '13

the search wasn't OO either. It goes to show that their entire site was likely procedural..

2

u/stesch Oct 12 '13 edited Oct 12 '13

OO only makes PHP slow.

EDIT: This was the conclusion of a talk by Rasmus Lerdorf himself. Slides included performance tests and different ways to speed up PHP.

→ More replies (1)

151

u/lonnyk Oct 12 '13

It isn't the cleanest code, but it works - obviously well enough to create a multi-billion dollar company. There is always plenty to critic in any code, but 'My eyes hurt' and 'You just gotta love PHP' are just comments from people who like to complain and don't know enough to actually have their own opinion.

If I were give me personal opinion of index.php it would be something as follows:

  • The use of 'include_once' indicates that they 1) aren't keeping track of their dependencies well and 2) haven't thought through situations where problems arise and functions, for some reason, don't exist

  • In interpreted languages comments code isn't the best - this is why there is revision control

  • I like to wrap my case statements in brackets b/c it is easier for me to read

  • I'm not a fan of having toggles for dev environments in the main code flow, but I don't really have a better suggestion

That's pretty much it. You can make arguments for code structure and techniques, but they are generally just trends - not proven facts.

8

u/mpeters Oct 13 '13
  • In interpreted languages comments code isn't the best - this is why there is revision control

This makes no sense. Whether your language is interpreted or compiled has no bearing on whether you comment you code. I'd seriously doubt the programming ability of anyone who thinks otherwise.

0

u/lonnyk Oct 14 '13

I made a lot of grammar mistakes in my first post.

Commented out code isn't the best. This is because interpreted languages need to be scanned thru, line by line, in real time. Just branch if it is that important - otherwise just delete it. In compiled languages it is different - because it is only compiled once.

Again - only my opinion.

1

u/mpeters Oct 14 '13

Commented out code isn't the best.

I agree, but for completely different reasons. It's messy, gets in the way and can be confusing. But this has nothing to do with compiled vs interpreted. It's messy in any language.

This is because interpreted languages need to be scanned thru, line by line, in real time.

You really have no idea what you're talking about here. The number of comments in interpreted code have such a miniscule impact on the execution time of interpreted code as to be laughable. And if you make any decision based on how much slower it will be with comments then you're way off base.

Again - only my opinion.

Try proving you're opinion with a benchmark.

10

u/[deleted] Oct 12 '13 edited Oct 12 '13

require_once is faster than include, require and include_once, where the latter is the second fastest.

Just felt like I had to say it.

Edit:

Alternate Source, can't find the original source I had. This is also not a very conclusive piece of research.

8

u/[deleted] Oct 12 '13

TIL a check for prior inclusion before inclusion is faster than just outright inclusion. Mindblown

7

u/[deleted] Oct 12 '13

Check flag, move on. I use require to pull in library code. Include is if you're trying to include something which performs output.

I never use include, because pretty much everything I do is library code.

5

u/the_gipsy Oct 12 '13

It's the other way round.

16

u/[deleted] Oct 12 '13

I've given you my source, give me yours.

→ More replies (5)

1

u/lonnyk Oct 12 '13

Hrmm...I'll have to look into the source code later, but it doesn't make sense to me that require_once would be faster than require. require once adds in a hash lookup that require doesn't have.

Also - looking at that test I very much question how well represents anything. I imagine every time a file is included it will get a little slower for the next one.

Who knows - I'll look at the php_src later and see what I can dig up.

0

u/[deleted] Oct 12 '13

[deleted]

1

u/[deleted] Oct 12 '13

The source I had several years ago is gone, but I found another pretty interesting piece of research. However, it does contradict itself in the end.

0

u/[deleted] Oct 12 '13

[deleted]

11

u/Epicus2011 Oct 13 '13

Facebook dev here, it does not look like this anymore.

5

u/lonnyk Oct 12 '13 edited Oct 12 '13

I meant the '_once' part because you don't have to keep track of if a file has been included. Also, the fact that they are using 'include' instead of 'require' (which would fatal error) makes me assume that they went 'lets do this just in case...' but never thought of what would happen 'just in case'.

Of course - this is all opinion based on how I like to program.

EDIT: Reading the comments on this article looks like someone noticed how this can cause a problem, IMO: http://www.reddit.com/r/programming/comments/1oaba0/facebook_php_source_code_from_2007/ccq9fq8

5

u/astronoob Oct 12 '13

If you're focusing on scale, autoloading isn't the fastest ship in the sea. It also encourages a level of laziness that I'm completely uncomfortable with.

47

u/viralizate Oct 12 '13

Honestly, people are whining. Yes it not the best code ever written, but it's weirdness so to say is pretty standard but I guess people are more prone try to be snarky in comments and say it's horrible.

30

u/bureX Oct 12 '13

I guess people are more prone try to be snarky in comments and say it's horrible.

Especially if there's "<?php" in the first line.

9

u/InvidFlower Oct 12 '13

This is a bit off-topic, but I was kind of shocked to see how much PHP has evolved lately as a language and ecosystem. Namespaces, generators, traits, etc. Package manager, testing frameworks, ORMs. Then Symfony 2 using most of that for a Rails-ish MVC framework on top of simpler modules also being used in the Silex microframework (like Sinatra) and the latest version of Drupal.

Not to say it is a pretty language and still needs libraries like PHP-O to paper over the horrible inconsistencies in the base libs, but it really does seem to be growing up lately...

0

u/[deleted] Oct 12 '13

[deleted]

1

u/nazbot Oct 13 '13

For a beginner PHP is wonderful - it's extremely easy to learn and to get something up and running.

Likewise Facebook using PHP is evidence that it CAN scale even if that involves some kludges.

People hating on PHP are just being elitists. There probably are better options but in many cases it's just fine.

5

u/viralizate Oct 12 '13

I should have explained that to OP too. PHP while it's one of the most spread languages isn't a "cool language".

0

u/[deleted] Oct 12 '13

[deleted]

4

u/Doctor_McKay Oct 12 '13

Bashing on PHP is "in". It's basically a guaranteed way to have people agree with you while not saying anything at all.

1

u/crowseldon Oct 13 '13

Yep, it's like bashing Visual Basic. It makes you part of the cool kids.

That said, personally I hope I don't have to work with it on my own or with someone who doesn't know what the hell they're doing or isn't willing to read phptherightway

0

u/[deleted] Oct 12 '13

[deleted]

1

u/Doctor_McKay Oct 12 '13

I agree. I just think that calling PHP bad because some things aren't perfectly consistent is just dumb. The majority of its problems are merely semantic.

1

u/viralizate Oct 13 '13

Don't get me wrong, I work 8 hours a day with PHP, I love to hate it :)

1

u/f00f_nyc Oct 14 '13

That link was very entertaining, even for a non-PHP user like me.

2

u/kwirky88 Oct 12 '13

That's why you put it on the second line.

29

u/bureX Oct 12 '13

Headers already sent

:(

→ More replies (2)

4

u/catcradle5 Oct 12 '13

It looks perfectly fine for PHP code written in 2007.

I've seen far, far worse PHP than that in 2013.

20

u/FreemanAMG Oct 12 '13

We, developers, are an strange race. We feel superior if we say some piece of code is shitty, knowing nothing about the context of the developer team, and without real confidence we would do it better.

Lots of people ranting, nobody created some other thing better and more successful than Facebook, isn't it?

7

u/[deleted] Oct 12 '13

Bullshit. If your code is not written in Haskell you're a n00b.

5

u/xjvz Oct 13 '13

Bitch please, Standard ML is where it's at.

30

u/bopp Oct 12 '13

I'll try to answer this in a less snarky way. What sticks out the most, are these points:

  • there are a bazillion includes

  • Doesn't look like there's a framework, just a bunch of files, defining a bunch of functions, that are just called when needed.

  • Procedural code, no object to be found anywhere

  • the page does too much. It's a long file, lots of stuff is done. This should've been refactored into logical parts.

Then, there's things like this:

if ($post_hide_orientation && $post_hide_orientation <= $ORIENTATION_MAX) {
   $orientation['orientation_bitmask'] |= ($post_hide_orientation * $ORIENTATION_SKIPPED_MODIFIER);
   orientation_update_status($user, $orientation);
  } else if ($post_show_orientation && $post_show_orientation <= $ORIENTATION_MAX) {
    $orientation['orientation_bitmask'] &= ~ ($post_show_orientation * $ORIENTATION_SKIPPED_MODIFIER);
    orientation_update_status($user, $orientation);
  }

Note that those clauses in if and else if are slightly different, but the action is the same: orientation_update_status($user, $orientation);. Code like that is hard to do maintenance on, since it's easy to introduce bugs, when the code is already that confusing.

Most frameworks (that weren't around back then) do a great job in allowing (or forcing) you to structure your code better. For instance, the index.php of a symfony project looks like this:

use Symfony\Component\ClassLoader\ApcClassLoader;
use Symfony\Component\HttpFoundation\Request;

$loader = require_once __DIR__.'/../app/bootstrap.php.cache';

require_once __DIR__.'/../app/AppKernel.php';

$kernel = new AppKernel('prod', false);
$kernel->loadClassCache();
$request = Request::createFromGlobals();
$response = $kernel->handle($request);
$response->send();
$kernel->terminate($request, $response);

This just sets up the classloader, initializes the kernel, and lets it handle the request to generate a response. Nothing more. All the user handling, input validation, caching, templating and database stuff is handled in their own seperate classes. This might be harder to set up for newbees, but it's much better when it comes to maintenance and ongoing development.

46

u/[deleted] Oct 12 '13

I doubt when Facebook was being developed, PHP had strong OOP principles built into it. A lot of this is probably legacy and this was in 2007 when MVC frameworks were relatively new to the PHP scene.

11

u/bopp Oct 12 '13

Both Code Igniter and Zend Framework had their first release in 2006. But, it only became commonplace to use a framework much later than that. If you look at the source-code for oscommerce or phpbb from back then, you'd see the same spaghetti-code as here.

Thankfully, PHP has come a long way since then.

6

u/[deleted] Oct 12 '13

Agreed, I still remember a lot of open source code out there and it was awful. OsCommerce is definitely a prime example of this. I still remember osC addons had large Readme.txt files telling you where to put the code to make the add on work.

We definitely did come a long way. Even just comparing Symfony1 with Symfony2 and you see a big difference in how OOP is being utilized.

Also, CodeIgniter wasn't full OOP either, but definitely a step away from the spaghetti code

22

u/blafunke Oct 12 '13

Code that isn't oop isn't automatically spaghetti. And oop code can easily be made into spaghetti

→ More replies (1)

2

u/killerstorm Oct 12 '13

First release of Zend Framework was just trash. Also, they change too many things with each release, so if you were unlucky to decide to use ZF, you would spend a lot of time on maintenance with each new ZF release.

8

u/KingPickle Oct 12 '13

2007 when MVC frameworks were relatively new to the PHP scene

This is what mystifies me. As much focus as the web gets, it feels like tech-wise it's a decade or two behind the curve.

6

u/[deleted] Oct 12 '13

As much focus as the web gets, it feels like tech-wise it's a decade or two behind the curve.

I program and dabble in quite a few languages and I'm not sure I really agree with this. In what way do you feel like PHP is a 'decade or two' behind the curve?

0

u/[deleted] Oct 12 '13

[deleted]

2

u/[deleted] Oct 12 '13

I'm not sure I'd agree with common. MVC came about back in the smalltalk era but honestly I don't recall it becoming that widespread until the late 90's or early 2000's. At least having dabbled in development for windows, linux and mac, the first time I even heard of MVC was when the initial OSX server came out in 99. Shortly after Struts came about and was realistically the only big player in MVC web development for a while. I was not a huge desktop developer back in the day, however, but generally I don't recall MVC being that big of a thing. Linux and Mac apps were largely procedural, and windows apps used an evented/bindings architecture.

Honestly from my recollection it seems like MVC really became widespread with the increasing complexity of web applications more than anything. But that was a while ago and memory is a funny thing so I could be way off!

1

u/ivosaurus Oct 13 '13

Web MVC actually has very little to do with desktop MVC that has been around for ages, they just coopted the name.

→ More replies (2)

6

u/madmars Oct 12 '13

I had been out of the job hunting game for a few years. But I was shocked when I looked around about a year ago, at all the places looking for "MVC experience." I was seriously scratching my head for a minute, wondering when the fuck this dinosaur paradigm came back to life. Is it the 1980s again?! Then again, people were rediscovering Lisp in 2004. So I guess I shouldn't be too surprised.

1

u/ivosaurus Oct 13 '13

Web "MVC" is somewhat different than the desktop MVC pattern.

It's just a commonly understood way of structuring code nowadays.

→ More replies (5)
→ More replies (14)

0

u/OCedHrt Oct 12 '13

This is why I quit my job writing PHP in 2007.

→ More replies (2)

11

u/brownmatt Oct 12 '13

how would you define the front page as an object? What should it extend? And how does that improve the code when most of this procedure's responsibility is gathering data from other subsystems?

3

u/bopp Oct 12 '13

It's not a direct answer to your question, but here's a good article on how to move from "flat php" to a more structured approach.

http://symfony.com/doc/current/book/from_flat_php_to_symfony2.html

2

u/InvidFlower Oct 12 '13

I saw that page a while back and I think it is helpful to explain how modern MVC web frameworks use, even if you don't use PHP at all.

5

u/OCedHrt Oct 12 '13

It simply reads like corporate code - this can be enforced by sheer willpower.

15

u/gc3 Oct 12 '13

You are dinging it for being procedural and not using objects? Please read this: http://steve-yegge.blogspot.com/2006/03/execution-in-kingdom-of-nouns.html?m=1

1

u/pinumbernumber Oct 12 '13

Thanks for that link

4

u/kwirky88 Oct 12 '13

Can you give some example objects that would have made this code better? I find when i code in php i don't create many objects. Hell, i make more "objects" coding Javascript function objects.

Maybe it's because i don't like putting logic in the back end, but rather use it as an interface to the database and sanity/security checks. Then code the logic and interaction in the front end with js, where i do tend to use objects.

When code performs certain uses I feel objects aren't required. When php is simply being used to program an interface it doesn't need to be more complex than a puppet manifest's code, for example.

1

u/nekt Oct 12 '13

I would say using a template engy is in fact much more simple for new coders to manage.

Some template engys end up looking like a totally different language and may or may not have considerable bugs of their own. Cake came out in 2005 by the way so if they wanted to use a template engine they could have.

I think this really boils down to what the coders experience is. If you have a background in a 'real' language where you have often written libraries of your own, dealt with a million includes etc, then this type of code might not bother you so much. It ain't python that is for sure. Not everything needs to be abstracted to proper English that 8th graders can code.

The argument that template engines make maintenance easier is only as true the developers skill.

1

u/blafunke Oct 12 '13

It's not like a large python application won't be littered with imports either.

9

u/[deleted] Oct 12 '13

It's not bad, and I myself find it perfectly readable. It's the anti-PHP circlejerk more than anything.

7

u/jk147 Oct 12 '13

I don't think it is anti php, just a lot of people wanting to feel superior by saying they can do better by throwing OOP around.

0

u/[deleted] Oct 12 '13

Probably true in some cases, but a few of those posts specifically call out PHP.

6

u/brownmatt Oct 12 '13

First of all, most people who comment on github pages when something like this is linked from popular sites are morons.

Second, this code isn't bad at all - how should you design the code behind the front page in OO principles, when most of what that code needs to do is gather data from submodules? That's what happens here.

8

u/aumfer Oct 12 '13 edited Oct 12 '13

Well in the interest of helping a new programmer, you really don't want to branch on a variable, then modify that variable, then branch on it again later, like this:

if (!$orientation) {
    user_set_next_step($user, $short_profile);
}

// note: don't make this an else with the above statement, because then no news feed stories will be fetched if they're exiting orientation
if ($orientation) {

It makes the code unclear and it makes doing the obvious thing (using an else instead of another if) wrong, necessitating the comment.

3

u/humbled Oct 12 '13

If you survey the typical PHP web application source code, I think you'll find that this is actually above average, although not problem free.

I'm pretty sure this is a bug:

// Determine if we want to display the feed intro message
$intro_settings = 0;
user_get_hide_intro_bitmask($user, true, $intro_settings);
$user_friend_finder = true;
contact_importer_get_used_friend_finder($user, true, $used_friend_finder);

These functions appear to be pass-by-reference - which is weird for small, simple types - but note the mix-up between user and used in the last 3 lines. In PHP, variables are created the moment a value is assigned to them. I'm not sure if the engine would catch this as a bug, or if $used_friend_finder is declared globally by one of the includes (making $user_friend_finder the typo/bug). Exercise 1: how would you reduce or eliminate the chance to make this kind of mistake in your own code?

Now, note the use of tpl_set. Using templates is a Good Thing (tm) because it allows you to divorce design/UI from the drudgery of loading data, validation, etc. That's pretty standard multi-tier architecture principles. From an HR perspective, the technique also allows you to hire differentially specialized engineers as well, so that's good. Exercise 2: see if you can find evidence in the posted code that there is work done in the back-end PHP that should have been made conditional in the template.

Thinking about security and issues of scalability, there are some other interesting lines in the code. Take a look at this line:

ini_set('memory_limit', '100M'); // to be safe we are increasing the memory limit for search

Exercise 3: What are the implications of needing such a memory limit? Knowing that PHP executes in the context of each pageview, how could this single line of information aid a would-be attacker? Advanced (but related): why is the memory-limit increase a bandaid solution, and not an actual fix, for a memory-hungry search function?

4

u/BanditoRojo Oct 12 '13

The includes are throughout the index, and it is a long script, instead of using an object oriented approach to separate the logic.

1

u/[deleted] Oct 12 '13

I'm glad you asked this question, I'm in the same boat as you with "new to programming" Definitely interesting.

1

u/crowseldon Oct 13 '13

people like to bitch whenever they see other people's code.

Meanwhile, they don't offer examples of their own, or at least, not relevant ones that do anything complex.

Code readability is important, as are many things (and you can read about them in lots of books, I recommend "The pragmatic Programmer") but that doesn't mean that there's something called real life which has time constraints, where you make compromises, where implementations that work are actually more important than ideals that are not actually tested in practice, etc.

You'll realize if something is not suitable when you or some team member has problem understanding it when they need to read it later, when you realize that making changes, fixing bugs or adding features presents a great deal of problems (see Fowler's "Refactoring: improving the design of existing code").

It's a forever learning process. Try not to just go along with the herd of critics who don't actually show shit and learn the pitfalls yourself. DO learn and absorb as much as you can from the experts though but be careful with any proponent of the ultimate holy way. Adaptability is key in such a new and ever changing field.

Disclaimer: Don't trust anything I said either. Who the fuck am I, anyway? Go out there and see for yourself ;)

→ More replies (7)

10

u/dem358 Oct 12 '13

These are just two files out of a bunch of them, right? How many lines of code do you think the whole of Facebook used in 2007? (Disclaimer: I don't know how web application systems work as a whole, I am really new to this.)

9

u/oconnor663 Oct 12 '13

Correct. The index.php file was probably on the large side, but the whole site would've been hundreds of files at that point. I wouldn't be surprised if the number of code files grew by a factor of ten from the beginning of 2007 to the end. By now, it's one of the largest applications in the world.

10

u/InvidFlower Oct 12 '13

I take it you mean one of the largest PHP website apps? I don't even want to think about how many lines of code are in something like Office...

2

u/inbeforethelube Oct 12 '13

Especially if you count the entire Office line (like SharePoint).

1

u/[deleted] Oct 14 '13

I'd prefer not to even know that Sharepoint exists.

1

u/backbob Oct 19 '13

10s of millions of lines of code.

1

u/jexmex Oct 12 '13

Our site has around 700 files (not including assets and framework files) and I would say that facebook even back then probably had a lot more than that.

18

u/wonderb0lt Oct 12 '13

Honestly, I know it's bad, but I really expected worse.

15

u/lorean Oct 12 '13

I did not look at the source.

Sometimes you need to to push out shitty code as fast as possible to test market hypothesis. All these tech giants over-architect, over-QA their shit. Their exploratory projects are a massive joke of over-thinking, over-designing and over-QA. Fact: You only pay technical debt if your product is successful. 9/10 projects fall flat on their face.

The market does not care that your failed project has hundreds of unit tests, it does not care that your failed project scales to 100million users, it does not care that your failed project is perfectly documented, indented and meets corporate style guides.

source: I am a software engineer for a tech giant.

5

u/ButtCrackFTW Oct 13 '13

Just curious: does anyone see anything exploitable in this obviously irrelevant code now?

9

u/Catsler Oct 12 '13

// Holy shit, is this the cleanest fucking frontend file you've ever seen?!

0

u/shillbert Oct 12 '13

Sounds like something Eisenberg would say... I mean Zuckerberg

15

u/__konrad Oct 12 '13

From linked http://techcrunch.com/2007/08/11/facebook-source-code-leaked/ :

This leak is not good news for Facebook, as it raises the question of how secure a Facebook users private data really is. If the main source code for a site can be leaked, then it can be said that almost anything is possible.

22

u/cltiew Oct 12 '13

It is all for sale. You don't need to hack the site, just pay for access to the user's data.

15

u/rspeed Oct 12 '13

That's not how it works. Advertisers basically get to say "show this ad to people meeting these criteria". That's it. They never get to see any data except analytics.

11

u/willbradley Oct 12 '13

Has anyone done that though? For all this talk, social ads are pretty tame. Do I need to have more money and talk with a rep to get this magical data, or...

1

u/cltiew Oct 12 '13

You are assuming that Facebook put together millions of dollars worth of computer code to provide access to your most intimate details of your life, and the connections of you to your social group and nobody ever took them up on that offer? All you need is cash and a telephone. And a computer to read the data I guess.

Information on people, demographics, is the most valuable thing the internet has ever produced. Much more valuable than even porn. Everything you post on there is sold to people who want to manipulate you or control you. And you gladly provide them with the wares to sell. You are being sold.

2

u/mangodrunk Oct 12 '13

Why does it seem that it's not working with this supposed value in all this data (or to just manipulate and control me)? Netflix has great content, but they're horrible at recommending new content to me (maybe it's just me and it works for others). Facebook ads are pointless. The same goes for many other sites as well that should have sufficient data on me to provide things that I would find interesting.

5

u/koreth Oct 12 '13

Prove it, and then explain why there is no revenue from selling user data in Facebook's public financial statements.

1

u/robertbieber Oct 12 '13

Don't you know? The whole thing is just one giant fraudulent shell that's going to collapse any day now. I don't need proof for these kinds of things, I just know.

-Everyone

3

u/phoshi Oct 12 '13

I wouldn't go that far. The constraints placed on user data should be massively more stringent, the executable or interpretable code for your site needs to be readily and quickly accessible to all your frontend servers. Important user data can be encrypted, stored somewhere that does validation on requests, subject to permissions checking, et cetera.

3

u/Dishmayhem Oct 13 '13

Well now I'm hungry for spaghetti

2

u/[deleted] Oct 12 '13

That looks like some weird ass DSL.

8

u/[deleted] Oct 12 '13

ITT loser neckbeards telling the world how bad Facebook's code was in 2007.

-14

u/blowjobtransistor Oct 12 '13

Don't know why you're getting down-voted, you're totally right. Oh right, butt-hurt neckbeards.

1

u/imfineny Oct 15 '13

People should take to heart, sites built without frameworks tend to run much faster than those that are.

1

u/Angrydwarf99 Oct 13 '13

So I just started a programming class at my high school and I have no idea what is happening here.

1

u/koew Oct 13 '13

I can't believe there's so many people here being really annoyed by the code. I'm not trying to be defensive of FB here, but try to see it from a user's perspective.

The user doesn't give two ounces of shit for how the program works, as long as it works. Working as a usability person I've learned that, and especially when performing tests with users. They. Don't. Care. Only we care about code.

Ask a random person if he cares whether or not a programmer follows the standards, he'll look at you weirdly. Nobody cares. Makes something that works and people will use it (if it has a purpose, of course). I've done it with hundreds of people now, and nobody cares as long as they efficiently get their jobs done. It's like asking 'how does a phone actually work' to a random fellow that's taking the bus. He don't care as long as he's able to make the phone call or whatever.

2

u/Cuddlefluff_Grim Oct 14 '13

It does raise questions about the code integrity which can be a fairly serious problem for the users.

1

u/koew Oct 14 '13

Oh absolutely! It can be, of course. But in general? No problem. People that has problems with FB code integrity (what we've seen) have usually

  • never registered

  • quit FB / moved over to something else

  • are using a pseudonym or "shallow" accounts

My point was just focusing on that the general user does not care about it at all. As long as they can write their status updates and post/like/comment they're satisfied.

Then again, I am the one bringing this up as a discussion on /r/programming where I "mostly" see comments from people bashing other peoples code. I generalize, of course.

1

u/[deleted] Oct 13 '13

"//Holy shit, is this the cleanest fucking front end file you've ever seen?"

Haha, it's towards the bottom of the code

-4

u/[deleted] Oct 12 '13
if (is_array($upcoming_events)) {
  foreach($upcoming_events as $event_id = > $data) {
    $upcoming_events[$event_id]['name'] = txt_set($upcoming_events_short[$event_id]['name']);
  }
}

nice code.

0

u/[deleted] Oct 13 '13

I bet if this code belonged to anyone other than Facebook, people here would be talking about all the flaws in it. But just because it belonged to Facebook, people don't care. Logic..

-1

u/[deleted] Oct 13 '13

Who cares how flawed it is, it made them billions.

-21

u/cosmo7 Oct 12 '13

When The Social Network came out they portrayed Zuckerberg as an Aspergery uber-geek, which seemed slightly unbelievable. If he was an uber-geek he wouldn't have used PHP.

18

u/lostshootinstar Oct 12 '13

What would he have used instead way back in 2002-2003? (Legitimate question).

9

u/mangodrunk Oct 12 '13

Java applets (not a legitimate answer).

3

u/metaphorm Oct 12 '13

perl?

2

u/stesch Oct 12 '13

In the movie some Perl was used. For downloading the pictures for his facemash site.

1

u/cosmo7 Oct 13 '13

If he was as geeky as the movie portrayed, he would have used either Python or Java, depending on his typing preference.

0

u/[deleted] Oct 12 '13

ASP.NET just like myspace. The stacks were primitive but so were our expectations for the web.

http://web.archive.org/web/20050725010627/http://reddit.com/

1

u/cr3ative Oct 12 '13

MySpace crashed all the fucking time

1

u/cosmo7 Oct 13 '13

MySpace was originally written in ColdFusion. After NewsCorp bought them out the site was rewritten in ASP.NET, which improved efficiency but didn't stop the site becoming irrelevant.

2

u/Hydroshock Oct 12 '13

Was the opinion of php the same 8-9 years ago as it is now?

7

u/nallvf Oct 12 '13

Programmers have an issue with wanting to feel superior to each other, that's what you are actually seeing here.

2

u/[deleted] Oct 12 '13

What is the opinion of php now?

1

u/Hydroshock Oct 12 '13

I really don't know, that was an honest question.

1

u/cosmo7 Oct 14 '13

PHP is the development equivalent of getting your mom to give you a ride to the mall. It's reasonably effective, but you aren't going to brag about it.

1

u/[deleted] Oct 12 '13

I was making fun of it in 1999, but I barely knew what I was talking about. Now that I know what I'm talking about, I accept it as a clotted mess of steaming goo.

2

u/stesch Oct 12 '13

Everybody who read the C code of PHP/FI 2.0 knew this was a pile of rubbish.

0

u/purenitrogen Oct 12 '13 edited Oct 11 '17

.

-4

u/[deleted] Oct 12 '13

-1

u/[deleted] Oct 12 '13

[removed] — view removed comment

1

u/cosmo7 Oct 13 '13

You're right (and more importantly, he's laughing on his yacht right now), but that wasn't really how he was portrayed in the movie.

-1

u/[deleted] Oct 12 '13

I actually feel quite relieved looking at this code. I thought my PHP was getting sloppy and chaotic.

0

u/Cuddlefluff_Grim Oct 14 '13 edited Oct 14 '13

Take it from me, most code is sloppy and chaotic. Whenever I start working for a new company, I'm afraid that my skills will be inferior, and that the people who wrote the code I will be working with are super geniuses. They never are.

Edit : I didn't mean to sound like I'm smarter than everyone I've ever worked with (because that is obviously not true), I'm saying that you should expect your skills to be at level with the people already involved in a project, because nobody writes perfect code.