Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Meat Boy leaves database wide open

forums.somethingawful.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Super Meat Boy leaves database wide open

#61

Post by maxdj »

z92 wrote: post #53
funkah wrote: post #26

Earlier quoted context omitted.

I can't believe how many people here think this is okay. YES, a web service! Please never apply to a company that I am working for!

The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…

In fact this was one of the propagation methods of Stuxnet. It exploited a vulnerability in MS's .lnk file to achieve code execution when removable USB storage was inserted. See p. 29 of http://www.symantec.com/content/en/us/enterprise/media/secur...

Re: Super Meat Boy leaves database wide open

#62

Post by z92 »

0x0 wrote: post #60
z92 wrote: post #53

Earlier quoted context omitted.

The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…

Yeah, so if you had an USB stick with one of those WMF exploits before the patch was out you'd be toast.

I turn off all media preview on my Windows machine.

Re: Super Meat Boy leaves database wide open

#63

Post by z92 »

toyg wrote: post #56
z92 wrote: post #53

Earlier quoted context omitted.

The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…

I'd honestly like to know how you can "safely copy files" with Explorer. You know a lot of viruses, you don't know all the viruses. How can you discount the possibility that, one day, the USB interface itself will be subverted to spread viruses ?

> the USB interface itself will be subverted to spread viruses ?

It can. But then I would know about it as soon the AV companies know. And I can take the precaution accordingly. If that is a zero day [remote] exploit, then I am toast, with or without anti virus.

The point is: anti-viruses would probably make me 10% more secure over what I already am. Therefore it's not worth it when one considers its cons.

Re: Super Meat Boy leaves database wide open

#64

Post by z92 »

maxdj wrote: post #61
z92 wrote: post #53

Earlier quoted context omitted.

The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…

In fact this was one of the propagation methods of Stuxnet. It exploited a vulnerability in MS's .lnk file to achieve code execution when removable USB storage was inserted. See p. 29 of http://www.symantec.com/content/en/us/enterprise/media/secur...

I have a command file on my desktop, double clicking on which deletes all .pif .lnk .inf .com and -shr attributed files in USB drive [plus other things].

Re: Super Meat Boy leaves database wide open

#65

Post by radiac »

HalibetLector wrote: post #45
TillE wrote: post #43

Earlier quoted context omitted.

I can't imagine anyone specializing to such an extreme. If you want to make multiplayer games, for example, you have to know this stuff. Every competent programmer should be familiar with basic security principles. It's then your responsibility to educate yourself about how to apply those principles in a given situation.

No, you don't. I work for one of the top social gaming companies around right now and programmers do specialize to a ridiculous degree. The programmers who write code for the actual game are rarely web developers. It's simply a different domain. I can confidently say this because I'm a web developer in a studio of game developers and most of them don't even know how to run mysql locally. They aren't stupid, they coul…

Well, it's fair to say that programmers specialise, but presumably you're only working on the website, and the game developers are only working on the game. TillE was right - if you are going to implement this stuff, you should know what you're doing, or at least seek advice from people who do.

Regardless, the super meat boy developer made a pretty basic mistake, which you could perhaps defend with your argument, but he then refused to engage with someone who was reporting a vulnerability and trying to help. To me, that's pretty astounding.

Re: Super Meat Boy leaves database wide open

#66

Post by mey »

zyb09 wrote: post #30
dangero wrote: post #22

I'm going to dangle myself on a limb here. If you consider the constraint that the indie programmer may have had incomplete skills to set up a proper service, saw this method as faster for any number of other reasons, or didn't want to maintain a proper web service, I think this could very well have been the right approach at the time. Judging from how much money this game has made, I think that's hard to argue with…

In good tradition the most critical comment is the top voted on HN. Yada Yada indie life is hard, but no one with a right mind would think of connecting the client directly to the remote master database. This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all.

If you read Edmund McMillen's formspring page, you'll see that there are several disconnects from a development perspective about super meat boy. Such as them not being able to reproduce builds from source.

http://www.formspring.me/EdmundM

Conversely, I love me some Binding of Issac

Re: Super Meat Boy leaves database wide open

#67

Post by JS_startup »

the_mitsuhiko wrote: post #54
drewblaisdell wrote: post #52

Earlier quoted context omitted.

It isn't a GPL violation because the game is just interfacing with a master MySQL database, not using one to store local content.

libmysql is GPL licensed as well.

MySQL's own licensing page states that a license is needed for software that has MySQL distributed as a part of it.

Even if they DID need a license you are out of line to suggest they are automatically infringing and didn't just purchase the commercial license.

Re: Super Meat Boy leaves database wide open

#69

Post by rmc »

zyb09 wrote: post #30
dangero wrote: post #22

I'm going to dangle myself on a limb here. If you consider the constraint that the indie programmer may have had incomplete skills to set up a proper service, saw this method as faster for any number of other reasons, or didn't want to maintain a proper web service, I think this could very well have been the right approach at the time. Judging from how much money this game has made, I think that's hard to argue with…

In good tradition the most critical comment is the top voted on HN. Yada Yada indie life is hard, but no one with a right mind would think of connecting the client directly to the remote master database. This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all.

This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all.

When I started working in Industry™/The Real World™ I learned a lot of important lessons in How Things Are Actually Done™. One of them was how much software was just held together with duct-tape and string.

So yes, you can produce a good game and think that this sort of DB access is a good idea.

Re: Super Meat Boy leaves database wide open

#70

Post by rmc »

z92 wrote: post #49
jarrett wrote: post #16

Earlier quoted context omitted.

Fair question. A web service would indeed be a better solution. With a web service, you have a server-side application layer, and all database reading and writing is done by that layer. Sure, you might be able to authenticate and send bogus info to the web service. Even that can be made very difficult, e.g. by cryptographically signing requests or encrypting the data on the wire. So if you do that, worst case scenari…

There is a misunderstanding. Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run and only on those database and tables where the admin has granted him access. Not too different from a web service. Also no amount of encryption will secure the system because it's not about man in the middle attack. It's about decompi…

Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run and only on those database and tables where the admin has granted him access.

Yes that is true in theory. However in practice, the kind of person who thinks direct access to the database is a good idea is probably not the kind of person who knows about/knows how to restrict the database access to only certain queries/tables.

Post reply on HN