Ah I'm stuck in an infinite death loop in the dodgeball room
Edit: it somehow fixed itself and gave me a skateboard
Manyland
61–70 of 110 posts
Re: Manyland
#62Earlier quoted context omitted.
Great! It's html5/ canvas/ JavaScript/ ImpactJS/ websockets, on server nodejs and mongodb.
Really good job guys. How many hours have you spent on this? Is this an open-source project?
ImpactJS is not open source, but it is awesome.
It's also not closed in the sense that you cannot hack the hell out of it once you buy a license. The closed part is just so that Dom gets his 99$ license fees (IMO a steal).
Re: Manyland
#63Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators.
I wanted to notify you guys though of some security flaws within the game.
Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing a variable within the player object to modify things like player speed, mountable craft speed, etc.
For instance, while you obfuscated the name of the player object within the ig.game object, it was easily found by checking for modifications to the health variable, where another function listed it as ig.game.O1376. This name for this player object is also static for every game instance, so it's easily referred to every time.
Once the player object was found, it's easy to modify the variables and the world (server side) accepts it. It was also easy, for the most part, to identify what certain variables did as they were in plain text. To change player jump height for example, all it would take is this piece of JavaScript:
window.ig.game.O1376.altJumpReducedGravityFactor = 0.1;
Now the player can super jump and the server is fine with it (verified by numerous 'holy sh!' and 'wtf!?' comments from other players).
The second thing I see is just obfuscating the code more.
I would suggest first and foremost to do the server side checks. Even if you left all your code in plain text, any modification someone tried to make from the client would be seen, verified, and handled accordingly by the server. Second I would try obfuscating all variable names that you can, especially the class definitions like EntityPlayer. To go further on it, I would have it produce the obfuscated names randomly on each load of the game script so they're not easily referred to.
Just wanted to bring the issue up to you guys after finding it.
Re: Manyland
#64Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I wanted to notify you guys though of some security flaws within the game. Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing…
Maybe send a private message instead of posting publicly before notifying the owners?
Re: Manyland
#65This is an infinite browser-based mmo universe where everything can be drawn and placed into the world, wiki-style... give us a shout if you need anything! You can also script blocks to have interaction or influence the environment (for instance, here's an adventure: http://manyland.com/newpolis ).
See the game security exploits posted upthread.
Re: Manyland
#66Is there a reason why we often have shitty nondescriptive titles like this? I almost always have to click on every link on the frontpage because it is impossible to predict if I might be interested in the article/webpage behind the title or not :(
Back in "the day" the rules said you couldn't go crazy with editorializing the title, but could improve it so it made sense. That rule disappeared from the guidelines about a year ago(?) and HN seemed to go to a strict "title must be verbatim" approach for a bit. Now it seems the approach is that mods/people who run HN are the ones who usually improve titles, which I think is a good idea (Techmeme does this), althoug…
We need hnify.com, a service to let a user give a title and brief summary for a website, and autocreate a web page with that title/info, for submission to HN.
Re: Manyland
#67Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I wanted to notify you guys though of some security flaws within the game. Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing…
What's PH?
Re: Manyland
#68Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I wanted to notify you guys though of some security flaws within the game. Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing…
What's PH?
Product Hunt
Re: Manyland
#69Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I wanted to notify you guys though of some security flaws within the game. Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing…
Thanks for these details! We added a client-side scripting option to specifically increase your jumps, so if you want you can create an Interacting for that. We also added flying mountables, triple jump wearables, parachutes, insta-teleporting, a 100% invincibility armor, and everything one might want to do. When you have a need, we try if possible to make it a feature, by integrating it in the Interacting language. At rank 2, try creating an Interacting block to see some of the things you can do. (If people find someone doing something which somehow ruins things for them, they may flag report a person though.)
Now as far as tweaking things which are harmful to others go, we try to base it on friendship -- so e.g. if you pick up a weapon you can only harm people who friended you (if your friends disagree with being killed, they can unfriend, and unfriended people aren't affected by one's bullets) -- but if you find anything that harms others even when not friended, please give us some time to fix it and disclose it privately to: we@manyland.com (we do have server-side checks for such things, so if something is not working there, we'd really appreciate the tip) We aren't perfect and private disclosure is very much appreciated.
Thanks again! Please let us know via email please if you find anything!
Re: Manyland
#70Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I wanted to notify you guys though of some security flaws within the game. Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing…
Thanks for these details! We added a client-side scripting option to specifically increase your jumps, so if you want you can create an Interacting for that. We also added flying mountables, triple jump wearables, parachutes, insta-teleporting, a 100% invincibility armor, and everything one might want to do. When you have a need, we try if possible to make it a feature, by integrating it in the Interacting language.…
No problem, and yeah I only tested simple player vars like jumping, nothing harm wise that would affect other players. Doing the server side check on that is perfect though, so it's obv you guys are aware of it (thought as much given the level of code).
I'll definitely let you know if I find anything else, was just messing with it for an hour or so today :) I apologize too if you don't want this up here and let me know if you want me to delete it.