Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Meat Boy leaves database wide open

forums.somethingawful.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Super Meat Boy leaves database wide open

#71

Post by seagaia »

http://www.formspring.me/EdmundM/q/274876035885957785

I find it disturbing that people would go through and even attempt deleting levels and altering things en masse. It's okay to point out the bug, and maybe change one thing to display this fact...but the people changing everything? It's a selfish thing to do this to thousands of creative works (the user-created levels), in the motivation of just showing one developer something he did wrong. Thankfully, there were backups.

Parts of this thread, the somewhat arrogant reaction of the Team Meat programmer, and the motives and subsequent actions of some of the people modifying the database, made me a little sick. If anything it's a showing (on both sides) of the lack of maturity of some programmers.

Look, I know that this could be justified in saying "well, someone would have done it sooner or later." In that case, I suppose whether or not this was okay is left up to whether Tommy (the programmer - Edmund did design) would have patched it. And with his defensive response, I'm sure he knew and was going to do so, but probably didn't want to admit it (from interviews he seems to have bit of a bitter ego)

Re: Super Meat Boy leaves database wide open

#72

Post by socksy »

radiac wrote: post #65
HalibetLector wrote: post #45

Earlier quoted context omitted.

No, you don't. I work for one of the top social gaming companies around right now and programmers do specialize to a ridiculous degree. The programmers who write code for the actual game are rarely web developers. It's simply a different domain. I can confidently say this because I'm a web developer in a studio of game developers and most of them don't even know how to run mysql locally. They aren't stupid, they coul…

Well, it's fair to say that programmers specialise, but presumably you're only working on the website, and the game developers are only working on the game. TillE was right - if you are going to implement this stuff, you should know what you're doing, or at least seek advice from people who do. Regardless, the super meat boy developer made a pretty basic mistake, which you could perhaps defend with your argument, but…

Game development especially has a lot of well meaning customers who haven't got a clue what they're talking about (a lot of kids). Whilst he probably should have listened, it's understandable why he may have dismissed a random on twitter.

Re: Super Meat Boy leaves database wide open

#73

Post by samlev »

RKearney wrote: post #17

SELECT * FROM smb_editor_author CROSS JOIN smb_editor_leveldata This query is taking forever to finish...

You should try locking the tables first. Maybe other people connecting is slowing it down, so a full table lock would be a good idea.

Remember to keep the lock alive after the query finishes, just in case you need to query it again...

Re: Super Meat Boy leaves database wide open

#74

Post by ojbyrne »

pferde wrote: post #42
ojbyrne wrote: post #12

So it could be that they create a mysql "database" for each user, and give them all the privileges needed there, and no privileges anywhere else. And conceivably you could have some kind of proxy that looked like mysql but actually sanitized/logged/whatever any queries, before passing them on to the real server.

Since that would take more effort and time than simply doing it right, I call Occam's razor.

I wasn't trying to argue that it would be the correct approach, just a possible explanation.

Re: Super Meat Boy leaves database wide open

#75

Post by MBCook »

Unfortunately this doesn't surprise me too much. I'm a Mac user and eagerly awaited the Mac release, only to find it had terrible performance and game breakage bugs. I emailed the developers and received two replies.

Tommy, the developer quoted here, started his email implying my complaint was faked, then saying they couldn't reproduce the issue of the game crashing every time you entered a warp zone, although they said they were working on it. His response made me quite a bit madder.

Edmund, the other developer, replied separately. He was apologetic and mentioned that the person they had originally paid to port the game fell through so it had to be done very fast. This was the kind of email I was expecting. It wasn't confrontational at all.

They later released a patch that fixed the crashing issues, but performance is still a major problem. The Windows system requirements are listed as a 1.4 GHz P4 with 768 MB of RAM. On the official blog, they list a dual core 2.6 GHz machine with 2 GB of RAM as the minimum requirements for the Mac. The game is officially supposed to support the 360 gamepad, but a note was left on the Steam forum that despite the promise it's not possible to support it correctly on the Mac, so the problem won't be fixed.

I thought the binding of Isaac looked interesting, and it has been getting good reviews. But after my experience I'm not going to play it. Super Meat Boy was a lot of fun (even though it didn't perform well on my Mac), but after my experience seeing the response to this issue doesn't surprise me.

Re: Super Meat Boy leaves database wide open

#76

Post by the_mitsuhiko »

JS_startup wrote: post #67
the_mitsuhiko wrote: post #54

Earlier quoted context omitted.

libmysql is GPL licensed as well.

MySQL's own licensing page states that a license is needed for software that has MySQL distributed as a part of it. Even if they DID need a license you are out of line to suggest they are automatically infringing and didn't just purchase the commercial license.

> Even if they DID need a license you are out of line to suggest they are automatically infringing and didn't just purchase the commercial license.

Well. You do need a license. No question about that. I did not say they are infringing the license, I was saying that unless they bought a commercial license for it they would be. Maybe bad wording on my part but when I read that article the security implications did not nearly strike me as much as the fact that the game has to ship libmysql.

I find that much more surprising than the fact that it uses a world writable MySQL database for the editor support.

Re: Super Meat Boy leaves database wide open

#77

Post by FuzzyDunlop »

simonw wrote: post #48
forrestthewoods wrote: post #18

Earlier quoted context omitted.

I know next to nothing about this kind of stuff. If I wanted to create a stats + user generated level database system akin to Super Meat Boy (and I do) do you have any recommended resources to read?

I'd strongly suggest looking in to Redis - it's fantastic for stats collection and very easy to work with.

The sorted sets make leaderboards pretty trivial to implement, too.

I've got one set up in MySQL and I'm pretty scared of how it'll cope if we get a surge in usage, and that's with Memcache sat in front of it.

Re: Super Meat Boy leaves database wide open

#78

Post by jiggy2011 »

radiac wrote: post #65
HalibetLector wrote: post #45

Earlier quoted context omitted.

No, you don't. I work for one of the top social gaming companies around right now and programmers do specialize to a ridiculous degree. The programmers who write code for the actual game are rarely web developers. It's simply a different domain. I can confidently say this because I'm a web developer in a studio of game developers and most of them don't even know how to run mysql locally. They aren't stupid, they coul…

Well, it's fair to say that programmers specialise, but presumably you're only working on the website, and the game developers are only working on the game. TillE was right - if you are going to implement this stuff, you should know what you're doing, or at least seek advice from people who do. Regardless, the super meat boy developer made a pretty basic mistake, which you could perhaps defend with your argument, but…

This is true, whilst you might not expect them build a beautifully layered J2EE or RoR solution with full transactional integrity, a few hours with some basic PHP tutorials would not have gone amiss.

This is especially spooky since MySQL contains a few scary features like System() not to mention that anybody could connect and write a script to do massive crossjoins (as indicated in the original thread) I'm sure any decent game developer would understand the implications of O(n!) but they were probably blissfully unaware that these features even exist.

I doubt that Notch would have made such a schoolboy error :)

Re: Super Meat Boy leaves database wide open

#79

Post by eropple »

jiggy2011 wrote: post #78
radiac wrote: post #65

Earlier quoted context omitted.

Well, it's fair to say that programmers specialise, but presumably you're only working on the website, and the game developers are only working on the game. TillE was right - if you are going to implement this stuff, you should know what you're doing, or at least seek advice from people who do. Regardless, the super meat boy developer made a pretty basic mistake, which you could perhaps defend with your argument, but…

This is true, whilst you might not expect them build a beautifully layered J2EE or RoR solution with full transactional integrity, a few hours with some basic PHP tutorials would not have gone amiss. This is especially spooky since MySQL contains a few scary features like System() not to mention that anybody could connect and write a script to do massive crossjoins (as indicated in the original thread) I'm sure any d…

> I doubt that Notch would have made such a schoolboy error :)

He made an equivalent one: he wrote his own database[1], in the age of SQLite being dumb-as-dirt-simple to use and MySQL almost a no-brainer.

[1] - http://notch.tumblr.com/post/1166302589/this-is-what-im-doin...

Post reply on HN