Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firebase 404

firebase.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Firebase 404

#11

Post by jaredsohn »

AsymetricCom wrote: post #9
jaredsohn wrote: post #2

The 404 page now shows MMO Asteroids. After the game came out last year, I forked it to create MMO Spacewar ( http://www.mmospacewar.com ) where the rules were adjusted to be more like the iconic game (user now has a single life but also an energy bar, new warp command, and movement, shooting and getting hit costs energy but you regain energy over time) and additional improvements were made (you cannot get killed rig…

The leaderboard is already hacked.

It wouldn't surprise me if it was since it is so easy to do, but I don't think it has been (yet).

I think the leaderboard might have been generated during development when I was playing 'single player' spawning asteroids and spaceships and shooting them. (Hold down 'o' or 'p' a bunch to get some easy targets.) It is much easier to get a high score that way, although I just noticed that you don't get points for that any more.

Since you cannot trust other peoples' scores, I think apps like this should just show you your own high score (which you can note yourself when you die for now).

Edit: (1 hour later) pwned

Re: Firebase 404

#13

Post by CaveTech »

emiliobumachar wrote: post #10
ngoel36 wrote: post #6

It's probably not a good thing that your 404 page features _multiple other_ users that are also experiencing some sort of error at the exact same time

It's probably fellow HN'ers following the link.

Whoosh? Yes, in this context. But in the wild having several users viewing 404 pages at the same time probably means you're handling your URL's wrong.

Re: Firebase 404

#15

Post by autotravis »

CaveTech wrote: post #13
emiliobumachar wrote: post #10

Earlier quoted context omitted.

It's probably fellow HN'ers following the link.

Whoosh? Yes, in this context. But in the wild having several users viewing 404 pages at the same time probably means you're handling your URL's wrong.

But it sure does sooth my 404-induced anger.

Re: Firebase 404

#16

Post by fidz »

For me this is bad UX. Look at the small 404 message above. For some non-techie people, they won't read the top 404 message and they think "Oh this is the page i am looking for. But, my friend said that i would see a cat; why now i am seeing this multiplayer game?"

Re: Firebase 404

#17

Post by Rhapso »

AsymetricCom wrote: post #9
jaredsohn wrote: post #2

The 404 page now shows MMO Asteroids. After the game came out last year, I forked it to create MMO Spacewar ( http://www.mmospacewar.com ) where the rules were adjusted to be more like the iconic game (user now has a single life but also an energy bar, new warp command, and movement, shooting and getting hit costs energy but you regain energy over time) and additional improvements were made (you cannot get killed rig…

The leaderboard is already hacked.

Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable?

edit* I left a message in the high score box for anybody looking for something proofy

Re: Firebase 404

#18

Post by mischanix »

I may have sorta kinda broke it completely.

  Game.score = [];
  for (var i = 0; i
One of those random characters needs to be escaped in the javascript returned by firebase, but isn't.

Re: Firebase 404

#19

Post by Kiro »

Rhapso wrote: post #17
AsymetricCom wrote: post #9

Earlier quoted context omitted.

The leaderboard is already hacked.

Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable? edit* I left a message in the high score box for anybody looking for something proofy

I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?

Re: Firebase 404

#20

Post by Rhapso »

Kiro wrote: post #19
Rhapso wrote: post #17

Earlier quoted context omitted.

Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable? edit* I left a message in the high score box for anybody looking for something proofy

I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?

well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
Post reply on HN