Bob's Game

Bob's Game
en.wikipedia.org

I particularly liked the Ulillillia and Nasubi videos

I read the book Blood, Sweat, and Pixels [0] last year and it includes the story of the guy who created Stardew Valley. He also spent five years on it, working alone. He also was self taught and did the graphics himself. It was even kind of a similar type of game. I actually think Bob could've made Stardew Valley. It sounds like mental illness got in the way. One question we have to ask ourselves is what came first—the mental illness or the game development. Did the whole experience of the isolated game development actually lead to the mental illness?

By the way, I don't recommend Blood, Sweat, and Pixels as a whole, but I do recommend the chapter on Stardew Valley. It's inspirational (or fatiguing because that guy worked so hard with no clear reward coming) for indie developers.

[0]: https://amzn.to/3ya9Y6A

Edit Addition: I feel bad for writing about the developer in the past tense. There is no reason he couldn't still be successful in life.

I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?!

Anyhow, within a few seconds of reading the source you'll find that the first thing the binary does is call home to download and extract a newer .zip file from the bobsgame.com website.

It does this over HTTP and without any kind of signature/signing of the binary.

Before it actually downloads the .zip file it actually tries to grab a version number from a PHP script on the website that doesn't exist. The website instead renders some HTML. The C++ casts this HTML to a number and gets 0, so it always assumes that the website does not have a newer version of the game to download.

This means if someone on the local network can DNS spoof the website it will dutifully talk over unauthenticated HTTP, the attacker can actually provide a PHP script that responds with a high version number and then deliver the payload over a .zip file.

It's a fascinating tale!

EDIT: It does appear the author has been removing things =( His GitHub has been wiped clean https://github.com/robertpelloni

If anyone is curious here is a fork of the repository I was trying to link: https://github.com/mpavlinsky/bobsgame