Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

minimaxir.com

Post reply on HN
Print view View original

31–40 of 112 posts

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#31

Post by [deleted] »

Negitivefrags wrote: post #23
ams6110 wrote: post #10

Earlier quoted context omitted.

It really isn't as easy as it sounds, is it? A better approach might be to UPDATE promo_codes SET used = 1 WHERE ... AND used = 0 , and then check that one update occurred. Or if your db supports it, SELECT ... FOR UPDATE OF ... and then update if the code is not yet used. You want the check and the update to occur atomically. And this varies depending on databases, for example in Oracle even if you explicitly begin…

I actually wasn't personally involved in the solution, but I believe that we went with something involving SELECT FOR UPDATE.

[deleted]

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#32

Post by spuz »

tantalor wrote: post #29

IANAL, but it's possible that these users are now liable to pay for the extra games. They knew that the code was only usable once, yet used it multiple times. EA might ask for the games back or charge the users. (I'm not taking EA's side, I'm just pointing out some possible consequences.)

Can you imagine how much worse EA's image would get if they did that? I'm hoping the PR department will override the legal department in this case.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#33

Post by romaniv »

I think this is the best possible example of why you should always develop websites using progressive enhancement. First, write the app without using any JavaScript. Test it. Make sure the core logic works as intended. Then add JavaScript to make it faster, pretties, simpler to use. That will most likely prevent fuckups such as this, and it will also result in better structured, easier to reason about architecture.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#34

Post by aero142 »

I don't know what this is going to cost EA, but this may end up being a good thing. People hate Origin but more importantly, all their games are already on Steam, so they just continue to buy from Valve. This might get a few people to keep Origin installed on their computer and help the Origin network effect out. Up until now, EAs only strategy has been to make their big name franchises Origin exclusive. This will probably work better and may not end up costing them much.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#35

Post by SquareWheel »

This article missed the earlier Reddit thread where a separate exploit was discovered, that the coupon applied to every item in the basket. $20 off of everything. Coupled with a coupon from a different forum you could add tens or maybe hundreds of games to your account for free in one large bundle.

I'm really curious to see EA's response.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#36

Post by NoPiece »

minimaxir wrote: post #2

(I apologize in advance for linking to my own blog, but I had not seen this issue reported on any tech blog nor appeared in the "new" queue on HN, so I wrote a quick post this morning on the issue, as it's technically interesting.)

I don't think you have characterized the problem accurately (or at least completely). The coupon allowed you to add dozens of games to your cart, then applied the $20 off to each individual item instead of just one, or against the total. It was a logic problem in applying the coupon on the server side.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#37

Post by nvmc »

Negitivefrags wrote: post #21
nvmc wrote: post #12

Earlier quoted context omitted.

Just out of interest, what is your game?

Here is our site: http://www.pathofexile.com/

Ah, I bought a beta key a while ago. Nice to see local developers making a mark. Certainly the best hack/slash game out right now.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#39

Post by rabidsnail »

tantalor wrote: post #29

IANAL, but it's possible that these users are now liable to pay for the extra games. They knew that the code was only usable once, yet used it multiple times. EA might ask for the games back or charge the users. (I'm not taking EA's side, I'm just pointing out some possible consequences.)

If they did try to charge for the games they would get enough chargebacks that they would have a hard time processing credit card payments for a while. And with chargeback penalties they might actually lose money.

The only sensible options are a) do nothing or b) revoke games purchased with these codes. If I were them I would do nothing and treat it as an unplanned pricing experiment. Since a lot of these games have an online component (network effects!) the "giveaways" might increase real sales overall.

Post reply on HN