EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
1–10 of 112 posts
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#2(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#3(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
Sorry to comment off of the content of the post, but when I load the page the Like button flickers shown/not shown a bunch of times causing annoying visual jitter. I'm on Chrome 22 if that is relevant.
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#4(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
Sorry to comment off of the content of the post, but when I load the page the Like button flickers shown/not shown a bunch of times causing annoying visual jitter. I'm on Chrome 22 if that is relevant.
From what I can tell, that's on Facebook's end, as all the Facebook plugins seems to flicker occasionally as well. I'll look into it, although there's nothing unusual with my front-end code that should be causing unusual behavior...maybe CloudFlare caching issues?
Thanks for letting me know btw. :)
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#5(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
Is there a problem with linking to your own blog?
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#6(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
That's okay. You did a better job than what any of the popular tech blogs would have done.
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#7(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
Is there a problem with linking to your own blog?
Self promotion [of your own blog/site] is frowned upon I believe. We have SHOW HN: for when you want to show something off that you have done.
I think it's mainly to stop reporters at Gawker from linking to all their articles though ;)
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#8(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go.
Be very careful here, it's not as simple as it looks. If you don't do the correct locking it is very easy to have timing attacks which allow keys to be used twice.
We learned this the hard way after posting a one use key for our game on 4chan. A thousand people rushed to try the key and around 100 people managed to get in using it.
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#9Earlier quoted context omitted.
Is there a problem with linking to your own blog?
Self promotion [of your own blog/site] is frowned upon I believe. We have SHOW HN: for when you want to show something off that you have done. I think it's mainly to stop reporters at Gawker from linking to all their articles though ;)
Self promotion is not frowned upon. As long as the content is good it doesn't matter who submits it.
Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
#10(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)
> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go. Be very careful here, it's not as simple as it looks. If you don't do…
It really isn't as easy as it sounds, is it? A better approach might be to UPDATE promo_codes SET used = 1 WHERE ... AND used = 0, and then check that one update occurred. Or if your db supports it, SELECT ... FOR UPDATE OF ... and then update if the code is not yet used. You want the check and the update to occur atomically. And this varies depending on databases, for example in Oracle even if you explicitly begin a transaction, a select does not lock the row (unless you specify FOR UPDATE OF) so if you do the check and the update in separate statements, you still have a race condition).