Live data from Hacker News

Winning at Candy Crush

stavros.io

101–110 of 148 posts

Re: Winning at Candy Crush

#101
post #7

Awesome! I once wrote a boggle solver to beat my friends at Bogglific on Facebook. It was loads of fun until I was banned from the game. http://www.hung-truong.com/blog/2007/11/07/banished-from-bog...

Do you have the code for it? I didn't see the code on your blog? I would be interested to see how it worked.

I just checked my old archive folders and it looks like the code was lost when Dreamhost borked up my home directory a few years back. I assure you it was pretty gross :)

Re: Winning at Candy Crush

#102

Maybe I'm overly cautious, but in today's world, where even simple URL manipulation can be regarded as hacking, I would be very reluctant to post exploits like this. It's crazy, but this can be construed as wire fraud or computer crime: 18 U.S.C. § 1030(a)(4) Whoever— (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such condu…

When you say "today's world" I think you mean "today's U.S.A"... The rest of the world, doesn't seem to have as crazy anti-hacking laws, as the US.

Re: Winning at Candy Crush

#104
post #85
post #45

Earlier quoted context omitted.

Nice! I did the same: https://github.com/bouk/rumble-solver

Also, my solution can easily do boards up to 30*30 or so

Heh, I was mainly out to beat my co-workers, though if one of my co-workers was a fellow programmer I'd probably have had to improve on my algorithm.

Re: Winning at Candy Crush

#105
post #104
post #85

Earlier quoted context omitted.

Also, my solution can easily do boards up to 30*30 or so

Heh, I was mainly out to beat my co-workers, though if one of my co-workers was a fellow programmer I'd probably have had to improve on my algorithm.

Yeah it's kind of unneccesary, I just wanted to see how fast I could get it :)

Re: Winning at Candy Crush

#106
post #16

What's the best solution for this, managing game state server-side? Did they do it this way to offload storage and processing for scalability reasons?

For FarmVille we sent the actions back to the server and then validated against game state there. It's the only real way to protect against cheating. However, if I were building the game again today, I'd just do what King does and have the client manage the state. It turns out that the set of people that would do this and the set of users that would convert into paying users has very little overlap. The overhead of managing state on the server is that you'd have to write your game logic twice (once in your client-side language and once server-side, though with a scripting language you may be able to avoid this). Second, we benchmarked this approach and found that you can handle 10x the number of players with the same hardware by not doing any server-side logic/validation and just having the server be a dumb pipe to store player state.

Here's a talk I gave on the FarmVille approach: http://www.slideshare.net/amittmahajan/rapidly-building-farm...

and one on the king approach that we're using at my current company: http://www.slideshare.net/amittmahajan/gdc-2013-ditching-the...

Re: Winning at Candy Crush

#107

Back in the day I would log onto yahoo chess and beat everyone by simultaneously playing expert mode in windows chess and just mimicking the expert modes moves on yahoo as mine. Good times, never lost.

I hate you. I'm sure I played people like you. I like long games but people cheating forced me to play speed which I really hate.

Isn't the rating system supposed to solve this problem?

Unless people intentionally griefed by creating new low-rating accounts to cheat at.

Re: Winning at Candy Crush

#108

I had a somewhat similar story a few years ago with Bejeweled 2 (except that I didn't seek a way to cheat, just came across it). I wrote it up here: http://timotheeboucher.com/on-writing-laconic-error-messages... but the gist of it was that their score submission endpoint required a checksum, but the error message if the checksum was wrong was: Yes, the `int_csm` value is the checksum the server expected instead of t…

Hmm, if that was me (as the server programmer) I'd return a purposely different checksum[1] in the error message and then (internally) flag anything that was then submitted with that 'incorrect' checksum.

What you do with these flagged entries is up to you:-

a) Delete the scores after an hour or so (giving the chance for the user to check things)

b) Only display those scores to the user that logged in

c) Flag the entire account as 'cheat' and ban it after a few dodgy submissions

etc...

1. i.e. expected hash is hash(real_salt+data), supposed expected hash (returned to client in error message) is hash(cheat_salt+data). You obviously never return the real expected hash.

Re: Winning at Candy Crush

#110

I had a somewhat similar story a few years ago with Bejeweled 2 (except that I didn't seek a way to cheat, just came across it). I wrote it up here: http://timotheeboucher.com/on-writing-laconic-error-messages... but the gist of it was that their score submission endpoint required a checksum, but the error message if the checksum was wrong was: Yes, the `int_csm` value is the checksum the server expected instead of t…

Hmm, if that was me (as the server programmer) I'd return a purposely different checksum[1] in the error message and then (internally) flag anything that was then submitted with that 'incorrect' checksum. What you do with these flagged entries is up to you:- a) Delete the scores after an hour or so (giving the chance for the user to check things) b) Only display those scores to the user that logged in c) Flag the ent…

d) Send the user to your careers website...
Post reply on HN