Comment by bitbasher
8 hours ago
So-- if PHP's sourcecode was unavailable (closed source), would this ever have been found? Probably not. Maybe it is safer to be closed source.
8 hours ago
So-- if PHP's sourcecode was unavailable (closed source), would this ever have been found? Probably not. Maybe it is safer to be closed source.
Know how recompilers are porting video games from one platform to another these days? That exact trick works just as well for finding vulnerabilities. Broadly.
1. Hey LLM, turn this binary into source code.
2. Hey LLM, see any glaring security issues with this source code?
You can only do that if you have access to the binary. Which, in a web service, you shouldn't be able to access!
But all the people deploying that binary to their webservers would have access to do that.
So how is PHP being distributed in your funny world? Because I can tell you, even if you put it behind “register with your work email,” whoever seeks the binary will find it.
> Know how recompilers are porting video games from one platform to another these days?
They actually aren't. Most of the claimed cases of "recompilation" are just an emulator packaged into the same binary as the game so you can't tell it's an emulator, or are for projects that already had their source code available (in which case "porting" to WASM is trivial because all of the hard work is done by the people who write your-language-to-WASM compilers, and you just need to do a little bit of work to adjust your toolchain to use it). Everyone just takes slopshit at face value and shares clickbait without actually checking any of the work done. It's infuriating how empowering this software is for liars, honestly.