Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Meat Boy leaves database wide open

forums.somethingawful.com

Post reply on HN
Print view View original

81–90 of 99 posts

Re: Super Meat Boy leaves database wide open

#81

Post by toyg »

z92 wrote: post #63
toyg wrote: post #56

Earlier quoted context omitted.

I'd honestly like to know how you can "safely copy files" with Explorer. You know a lot of viruses, you don't know all the viruses. How can you discount the possibility that, one day, the USB interface itself will be subverted to spread viruses ?

> the USB interface itself will be subverted to spread viruses ? It can. But then I would know about it as soon the AV companies know. And I can take the precaution accordingly. If that is a zero day [remote] exploit, then I am toast, with or without anti virus. The point is: anti-viruses would probably make me 10% more secure over what I already am. Therefore it's not worth it when one considers its cons.

If you really can enjoy the same level of semi-instantaneous knowledge of "virusdom" as AV companies, then you're the 0.00001% of the population. Your solution simply doesn't scale in the real world.

Re: Super Meat Boy leaves database wide open

#82

Post by jiggy2011 »

z92 wrote: post #13

So what would be the solution? He used a password protected database connection and put the password compiled in binary. If I was doing it I would have probably done the same. How else can it be done? Use web service? That would still look "open" to someone digging inside the compiled binary and getting the keys.

Perhaps generate individual keys using some secure random process. Then you can check your logs now and again and if a few particular keys are submitting obviously bogus data you can just remove them from your records and block them in future.

As has been mentioned elsewhere there are other risks by the fact that your allowing people to enter data into your system using an actual language (SQL) as opposed to a few POST vars (assuming your webservice sanitizes input properly).

There are just many more possible attack vectors with mysql , one of which would be sending massive crossjoins or similar to the DB to crash it.

Re: Super Meat Boy leaves database wide open

#83

Post by benologist »

FuzzyDunlop wrote: post #77
simonw wrote: post #48

Earlier quoted context omitted.

I'd strongly suggest looking in to Redis - it's fantastic for stats collection and very easy to work with.

The sorted sets make leaderboards pretty trivial to implement, too. I've got one set up in MySQL and I'm pretty scared of how it'll cope if we get a surge in usage, and that's with Memcache sat in front of it.

On our platform the only problem has been having to perform count operations, the way we do it scores can be listed in unpredictable fashions and MongoDB is inherently bad at counts.

Aside from that the read:write ratio massively favors reading for us and caching makes that a negligible operation most of the time, and (unless like in our case you're providing leaderboards for games you don't control) MySQL and Memcache should carry you fine.

Re: Super Meat Boy leaves database wide open

#84

Post by speleding »

z92 wrote: post #49
jarrett wrote: post #16

Earlier quoted context omitted.

Fair question. A web service would indeed be a better solution. With a web service, you have a server-side application layer, and all database reading and writing is done by that layer. Sure, you might be able to authenticate and send bogus info to the web service. Even that can be made very difficult, e.g. by cryptographically signing requests or encrypting the data on the wire. So if you do that, worst case scenari…

There is a misunderstanding. Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run and only on those database and tables where the admin has granted him access. Not too different from a web service. Also no amount of encryption will secure the system because it's not about man in the middle attack. It's about decompi…

You would design a web service to only allow updates to rows created by that same user ID. That's a critical difference with setting MySQL permissions which would allow you to update an entire table, potentially destroying the scores and levels of others.

Re: Super Meat Boy leaves database wide open

#85

Post by starwed »

MBCook wrote: post #75

Unfortunately this doesn't surprise me too much. I'm a Mac user and eagerly awaited the Mac release, only to find it had terrible performance and game breakage bugs. I emailed the developers and received two replies. Tommy, the developer quoted here, started his email implying my complaint was faked, then saying they couldn't reproduce the issue of the game crashing every time you entered a warp zone, although they s…

Hmm, Super Meat Boy seems to be totally fine on my mac. (2010 Air 11").

However, Binding of Isaac is pretty lagtastic. (But, quite possibly the most fun I've had with a game this year.)

Re: Super Meat Boy leaves database wide open

#86

Post by dasil003 »

benologist wrote: post #83
FuzzyDunlop wrote: post #77

Earlier quoted context omitted.

The sorted sets make leaderboards pretty trivial to implement, too. I've got one set up in MySQL and I'm pretty scared of how it'll cope if we get a surge in usage, and that's with Memcache sat in front of it.

On our platform the only problem has been having to perform count operations, the way we do it scores can be listed in unpredictable fashions and MongoDB is inherently bad at counts. Aside from that the read:write ratio massively favors reading for us and caching makes that a negligible operation most of the time, and (unless like in our case you're providing leaderboards for games you don't control) MySQL and Memcac…

Yes, but redis is just so nice for certain applications that can be a pain in a RDBMS. Not that it can't be done, but the simplicity and performance of redis atomic counter increment/decrement is often enough for magical vertical scaling sauce. Redis is chock full of these little use cases, even when you're just using it as a "cache".

Re: Super Meat Boy leaves database wide open

#87

Post by dandelany »

richardeid wrote: post #46

Hi, I registered because I had read this story earlier today and decided to contact Team Meat's developer and ask him a question. His response prompted me to post this here. My question is of a political nature, but you can ignore that part. The part that struck me as odd, and the part that matters for this conversation, was where he claimed nothing happened. https://lh5.googleusercontent.com/-kc0f6ZQZebY/TvWDhFSHYEI…

"My question is of a political nature, but you can ignore that part."

No, your question was of a rude nature, which is pretty hard to ignore. It's not surprising that he responded curtly.

Re: Super Meat Boy leaves database wide open

#88

Post by MBCook »

starwed wrote: post #85
MBCook wrote: post #75

Unfortunately this doesn't surprise me too much. I'm a Mac user and eagerly awaited the Mac release, only to find it had terrible performance and game breakage bugs. I emailed the developers and received two replies. Tommy, the developer quoted here, started his email implying my complaint was faked, then saying they couldn't reproduce the issue of the game crashing every time you entered a warp zone, although they s…

Hmm, Super Meat Boy seems to be totally fine on my mac. (2010 Air 11"). However, Binding of Isaac is pretty lagtastic. (But, quite possibly the most fun I've had with a game this year.)

I considered buying it on XBLA a few times, but I wanted to support a developer for supporting the Mac, and I didn't want to have to boot my XBox to play it.

The individual levels are generally quite fluid, unless you die an awful lot of times. But the map screens and some of the bosses are slower (ESPECIALLY the one in World 4/Hell). I wonder if it's the extra visual effects (like the fire in Hell).

I wish I had bought it on XBLA. Microsoft's quality control meant it would have been a much better experience. I was actually disappointed with Steam, which is the first time that happened. I guess I assumed they ran strong QC, which they must not.

PS: MacBook Pro, early 2010, 2.53 GHz, 8 GB. Graphics card (integrated vs nVidia) never seemed to make a difference.

Re: Super Meat Boy leaves database wide open

#89

Post by soult »

toyg wrote: post #58
soult wrote: post #9

Earlier quoted context omitted.

> The only smart way to give clients access to a database is through some sort of frontend entirely under your control which prevents them from having the user/pass and sanitizes the queries. MySQL maybe, but enterprise DBs (think Oracle, DB2, Postgres) support a very fine-grained access model.

I'd argue that even then, they are less hardened against network-layer exploits than your average webserver. Network security is bread & butter for a webserver, not for your enterprise DB running in safe intranets with only cursory penetration testing.

I agree, though if you hardcode username and password into your application there's no need for fancy exploits.

Re: Super Meat Boy leaves database wide open

#90

Post by ido »

MBCook wrote: post #75

Unfortunately this doesn't surprise me too much. I'm a Mac user and eagerly awaited the Mac release, only to find it had terrible performance and game breakage bugs. I emailed the developers and received two replies. Tommy, the developer quoted here, started his email implying my complaint was faked, then saying they couldn't reproduce the issue of the game crashing every time you entered a warp zone, although they s…

BoI is Edmund's game, Tommy wasn't on it.
Post reply on HN