Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Meat Boy leaves database wide open

forums.somethingawful.com

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Super Meat Boy leaves database wide open

#91

Post by decompiled »

rmc wrote: post #69
zyb09 wrote: post #30

Earlier quoted context omitted.

In good tradition the most critical comment is the top voted on HN. Yada Yada indie life is hard, but no one with a right mind would think of connecting the client directly to the remote master database. This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all.

This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all. When I started working in Industry™/The Real World™ I learned a lot of important lessons in How Things Are Actually Done™. One of them was how much software was just held together with duct-tape and string. So yes, you can produce a good game and think that this sort of DB access is a good ide…

You must be popular and attractive because these kind of mistakes get normal people fired. This thread makes my stomach hurt thinking I might work with some of you.

Re: Super Meat Boy leaves database wide open

#92

Post by richardeid »

dandelany wrote: post #87
richardeid wrote: post #46

Hi, I registered because I had read this story earlier today and decided to contact Team Meat's developer and ask him a question. His response prompted me to post this here. My question is of a political nature, but you can ignore that part. The part that struck me as odd, and the part that matters for this conversation, was where he claimed nothing happened. https://lh5.googleusercontent.com/-kc0f6ZQZebY/TvWDhFSHYEI…

"My question is of a political nature, but you can ignore that part." No, your question was of a rude nature, which is pretty hard to ignore. It's not surprising that he responded curtly.

I was trying not to focus on that aspect of the conversation, but this is what my comment was based on:

https://twitter.com/#!/SuperMeatBoy/status/14761253025520435...

In my opinion, this isn't the sort of behavior that should be advocated. If people pirate the software produced by these companies that support SOPA, then that just validates SOPA. Additionally, he doesn't exactly give his games away for free so it's a strange stance to take in my eyes.

Anyway, my thoughts and feelings on copyright infringement weren't relevant discussion for this thread. I instead chose to focus on him acting as if nothing had happened, when the rest of the Internet proved otherwise.

Re: Super Meat Boy leaves database wide open

#93

Post by Legion »

socksy wrote: post #33
zyb09 wrote: post #30

Earlier quoted context omitted.

In good tradition the most critical comment is the top voted on HN. Yada Yada indie life is hard, but no one with a right mind would think of connecting the client directly to the remote master database. This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all.

Yes, it seems obvious to web developers and developers that are used to working with databases and CRUD apps, but that's one set of skills over a particular domain. Game development tends to emphasise a whole different set of skills — those of efficient graphic rendering, for example. A points table is no doubt a last minute add on in a field that certainly wouldn't be the expertise of a small indie developer (no-one…

Not knowing is one thing.

Not knowing, being informed about it, and arrogantly blowing off that information is inexcusable, unprofessional, and deserving of all that scorn.

It would have been very easy to say, "Thanks for bringing this up, we will look into it", instead of being condescending and ending up looking like an ignorant jackass.

Re: Super Meat Boy leaves database wide open

#94

Post by LiveTheDream »

eropple wrote: post #79
jiggy2011 wrote: post #78

Earlier quoted context omitted.

This is true, whilst you might not expect them build a beautifully layered J2EE or RoR solution with full transactional integrity, a few hours with some basic PHP tutorials would not have gone amiss. This is especially spooky since MySQL contains a few scary features like System() not to mention that anybody could connect and write a script to do massive crossjoins (as indicated in the original thread) I'm sure any d…

> I doubt that Notch would have made such a schoolboy error :) He made an equivalent one: he wrote his own database[1], in the age of SQLite being dumb-as-dirt-simple to use and MySQL almost a no-brainer. [1] - http://notch.tumblr.com/post/1166302589/this-is-what-im-doin...

Well, he made the error and immediately corrected it when it became an issue.

Re: Super Meat Boy leaves database wide open

#95

Post by jarrett »

z92 wrote: post #49
jarrett wrote: post #16

Earlier quoted context omitted.

Fair question. A web service would indeed be a better solution. With a web service, you have a server-side application layer, and all database reading and writing is done by that layer. Sure, you might be able to authenticate and send bogus info to the web service. Even that can be made very difficult, e.g. by cryptographically signing requests or encrypting the data on the wire. So if you do that, worst case scenari…

There is a misunderstanding. Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run and only on those database and tables where the admin has granted him access. Not too different from a web service. Also no amount of encryption will secure the system because it's not about man in the middle attack. It's about decompi…

Generally, an app would need select, update, and delete on most or all tables. Therefore, simple MySQL permissions would not be sufficient to prevent an attacker from corrupting huge amounts of data belonging to other people's accounts.

"Well web services has to run insert/update/delete queries too based on user input --- where the attacker modifies the source code that generates the input." -- If you sanitize your inputs on the server side, no attacker will ever be able to run arbitrary SQL. This is crucial.

"One can validate input using MySQL trigger/SP too" -- I certainly wouldn't look forward to writing a trigger that, for example, prevents user A from editing records belonging to user B. This is so much easier to do in the application layer.

"Basically MySQL is also a service that you can control, but it doesn't run on port 80." -- You should use the right tool for the job. Sure, you could, for some applications, make an open MySQL server secure. But this is picking the wrong tool for the job. An application layer is far, far better suited to this task than a MySQL server all by itself. This is because your application layer can be written in the language and framework of your choice, giving you much richer ways to express business logic than MySQL can offer.

Re: Super Meat Boy leaves database wide open

#96

Post by rmc »

decompiled wrote: post #91
rmc wrote: post #69

Earlier quoted context omitted.

This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all. When I started working in Industry™/The Real World™ I learned a lot of important lessons in How Things Are Actually Done™. One of them was how much software was just held together with duct-tape and string. So yes, you can produce a good game and think that this sort of DB access is a good ide…

You must be popular and attractive because these kind of mistakes get normal people fired. This thread makes my stomach hurt thinking I might work with some of you.

Oh I'm not saying it's ethical or the right way to do things, just that it's common.

For example, there are loads of companies with very poor backup policies in place, or with all their eggs in one basket. There are loads of companies without any real 24/7 'on call' system.

For every person who is fired for doing some quick hack like this, there is someone who will be fired if they don't "Get it working today" (i.e. they'll get fired if they don't do the quick hack)

Re: Super Meat Boy leaves database wide open

#97

Post by eropple »

LiveTheDream wrote: post #94
eropple wrote: post #79

Earlier quoted context omitted.

> I doubt that Notch would have made such a schoolboy error :) He made an equivalent one: he wrote his own database[1], in the age of SQLite being dumb-as-dirt-simple to use and MySQL almost a no-brainer. [1] - http://notch.tumblr.com/post/1166302589/this-is-what-im-doin...

Well, he made the error and immediately corrected it when it became an issue.

No, he corrected it after it had been an issue for some time and was negatively impacting his customers' enjoyment of what they had purchased.

Throughout Minecraft's development, "barely good enough, and sometimes not even then" has been the externally visible modus operandi. That so many players put up with customer abuse is unfortunate, not least because others will consider Notch's slipshod development practices and infantile product management goals to which one might aspire.

Re: Super Meat Boy leaves database wide open

#98

Post by DoctorBaconite »

decompiled wrote: post #91
rmc wrote: post #69

Earlier quoted context omitted.

This is just so WTF on so many levels, you can't help but wonder how they even managed to produce such a good game after all. When I started working in Industry™/The Real World™ I learned a lot of important lessons in How Things Are Actually Done™. One of them was how much software was just held together with duct-tape and string. So yes, you can produce a good game and think that this sort of DB access is a good ide…

You must be popular and attractive because these kind of mistakes get normal people fired. This thread makes my stomach hurt thinking I might work with some of you.

I'm about halfway through my first android app, and all the research I did said the same thing; never, ever connect directly to your MySQL database. I just wrote my own PHP script to deliver the results via JSON, it took me a few days to figure out but it wasn't that difficult.

Re: Super Meat Boy leaves database wide open

#99

Post by Total_Meltdown »

socksy wrote: post #72
radiac wrote: post #65

Earlier quoted context omitted.

Well, it's fair to say that programmers specialise, but presumably you're only working on the website, and the game developers are only working on the game. TillE was right - if you are going to implement this stuff, you should know what you're doing, or at least seek advice from people who do. Regardless, the super meat boy developer made a pretty basic mistake, which you could perhaps defend with your argument, but…

Game development especially has a lot of well meaning customers who haven't got a clue what they're talking about (a lot of kids). Whilst he probably should have listened, it's understandable why he may have dismissed a random on twitter.

The guy took a stack trace of a segfault. If a guy comes up to me, tells me I have a glaring security flaw, and shows me a stack trace of my own code to prove it, I'd be an idiot /not/ to give him at least a few minutes of my time, no matter what community he comes from.
Post reply on HN