Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Permission, Has Yet To Pay

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by __del__ on Sunday December 23, 2012 @05:59AM (#4959192)

>Pirates is way too heavy a term here.

Yes, please reserve such defamatory language for nine year olds who download music, and not innocent corporations run by billionaires who distribute copyrighted material for profit without compensating its owners.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by mgkimsal on Sunday December 23, 2012 @02:05PM (#4960270)

Don't forget 75 year old grandmothers who forget to lock down their home wifi router.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @07:57AM (#4959362)

Pirates is way too heavy a term here.

This is for-profit and closer to true piracy than file sharing is. It could be unintentional, but if they've already been contacted about it they really should be quicker to resolve the situation.

They're also shooting themselves in the foot,

No surprise there, see http://img820.imageshack.us/img820/1641/itsfinetrustme.png for an example of the judgment they've shown.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by phoboslab on Sunday December 23, 2012 @10:59AM (#4959727)

Tommy Refenes has stated in an interview[1] that he said "it's fine" just because at the time he couldn't do anything about it. The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

For us web devs it pretty obvious that anything that can be exploited will be exploited. Tommy was naive about it. Imho, his "it's fine" comment made it worse - what he should have said is "thanks, but I can't fix it right now".

[1] http://www.youtube.com/watch?feature=player_detailpage&v...

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by incision on Sunday December 23, 2012 @05:53PM (#4961014)

>The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

There's simply no way he actually believed that. It reads as a way to further shift blame to the exploiter by painting him as someone who hasn't just exploited an indie game darling, but has taken advantage of their altruism.

>In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

I really wonder if Mr. Hacker would have gone ahead and done that if Tommy hadn't been so smug about blowing the guy off. If "it's fine" was asking for trouble, "I've done this for a while now" was positively begging for it.

I vaguely recall this incident from when it happened, but having recently watched Indie Game The Movie puts a new perspective on it.

That chain of events fits the personalities demonstrated in the documentary like a glove.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by chris_wot on Monday December 24, 2012 @03:37AM (#4962293)

That, my friend, is called spin. I don't believe for one moment that the response "I've done this for years" doesn't smack of eye rolling and dismissiveness.

The right answer would have been "DM me", but that was done by the other side.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by raverbashing on Sunday December 23, 2012 @08:29AM (#4959409)

Here's a lesson, never trust user input!

This is not the first time, and not the last time either.

(I'm waiting for the posts saying they should be using PostgreSQL)

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @08:40AM (#4959422)

(I'm waiting for the posts saying they should be using PostgreSQL)

I'm not that guy, but I've always liked Postgres.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by rcgs on Sunday December 23, 2012 @10:10PM (#4961693)

As someone who likes to understand potential security issues, and who has just embarked upon a project which is using PostgreSQL, what is the subtext of your comment?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by hdra on Sunday December 23, 2012 @08:16AM (#4959389)

what was that? an exploit in the SMB game?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by lutze on Sunday December 23, 2012 @08:44AM (#4959425)

From what I recall of the story, the login for SMB's level database was stored in plaintext in the exe.

That picture is the guy who found it telling the devs, and the devs not understanding why it's a problem.

Cue their database being "hacked" a short while later... and another internet meme is born!

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @08:37AM (#4959414)

Yep. MySQL credentials in the binary.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by vially on Sunday December 23, 2012 @11:53AM (#4959879)

Honest question: how could they have avoided that?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by benwerd on Sunday December 23, 2012 @12:09PM (#4959924)

One obvious, safe way: set up an API on their servers, abstracting away the need to send actual MySQL calls over the Internet.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Sunday December 23, 2012 @03:18PM (#4960503)

While this case is particularly egregious, you are still accepting data from an untrusted remote client.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by xsmasher on Sunday December 23, 2012 @07:11PM (#4961232)

Every public web site on the planet is "accepting data from an untrusted remote client" - but allowing public db access is something else entirely.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Sunday December 23, 2012 @08:37PM (#4961451)

Not every public web site enforces its business logic in client-side JavaScript and just accepts as valid the data that's submitted to a server. Every game that wants to submit a score to a central scoreboard has this problem, and it's a little absurd to debate the exact protocol by which an insecure-by-design architecture gets exploited.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by rictic on Sunday December 23, 2012 @11:06PM (#4961813)

You can submit the input sequence used along with the high score. You've then transformed the problem for the attacker from simply sending up an artificial score to writing a program to solve the game, which is harder and was an existing vulnerability already.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Monday December 24, 2012 @05:54AM (#4962499)

I thought this was my exact point. I was responding to a comment that replacing the database connection with an API would solve the problem. It wouldn't. Accepting a score from the client is insecure by design.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by makomk on Monday December 24, 2012 @03:58AM (#4962319)

Every game basically has to trust the scores submitted by users. That doesn't mean it should trust users to mess with other users' scores, and it certainly doesn't mean it should trust users to mess with levels that other users have designed.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by uxp on Sunday December 23, 2012 @03:53PM (#4960630)

Yes, but you can fine grain permissions so a unique client can alter a high score that they previously held, but not alter everyone's scores, which is difficult if not completely impossible in MySQL directly, as well as sanitize data to reject wildly incoherent submissions.

The possibilities of pre-formatting data are endless with an API. Not so much with an INSERT statement.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Zash on Sunday December 23, 2012 @04:17PM (#4960708)

It is entirely possible to build this kind of API in a SQL server with constraints and stored procedures.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by jlgreco on Sunday December 23, 2012 @07:40PM (#4961300)

It's also entirely possible to write a webserver in bash.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by sk5t on Sunday December 23, 2012 @12:56PM (#4960069)

If one must directly access the database from a client application, the right way is to make sure each user has an unique, secure database credential with only the minimal permissions necessary. However, direct database access is still a terrible idea in most cases, as it is a lot of work to prevent a resource starvation attack.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by charonn0 on Sunday December 23, 2012 @05:23AM (#4959151)

If they're selling software which they don't have the right to sell, and not sharing the profits with the rightful owner until and unless confronted, that fact should be communicated far and wide. It is a serious breach of ethics if intentional, a show-stopping flaw in Canonical's Software Center system if not, and illegal in any case.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by linuxguysmb on Sunday December 23, 2012 @10:39AM (#4959676)

The SMB guys hold the Linux/FOSS community in pretty low regard: http://www.reddit.com/r/linux/comments/g072l/super_meat_boy_... [1]

So, I would take their current claim with a large grain of salt.

---

[1] What's even sadder is Tommy (the programmer of the SMB team) clearly shows he knows nothing of Linux, the community, licensing, or even good programming for that matter. Here's a couple of examples:

1. There's a screenshot above of the lack of security with the high-score servers

2. Complete lack of portability. Humble Bundle of SMB (Linux port) doesn't even run.

3. Bugs. On Windows, you start the game and for some odd reason the game mutes itself.

The games great, but for such a buggy product, I'd keep programming opinions to myself.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by jiggy2011 on Sunday December 23, 2012 @01:52PM (#4960231)

The SMB linux port of SMB was done by a third party developer, not the original team.

If you ran into the same issue I did (blank screen but sound) there's a fix here:

http://askubuntu.com/questions/151567/super-meat-boy-gives-b...

I have a feeling the issue might be at least partly caused with issues on OpenGL/SDL/X11 or something like that. I've had no end of issues with fullscreen games under Linux.

To be charitable here, we're talking about a 2 man team (who shipped a successful product on their own) rather than a large AAA dev with an actual QA dept. Tommy might not be the greatest programmer (I remember reading something he wrote where he had some strange views on threading) but I think criticism has to be offset against that.

And at the end of the day they shipped a Linux game before Steam on Linux was even announced, apart from that one issue it seems to work flawlessly (for me at least) under Ubuntu including actually recognising an Xbox360 pad which Braid didn't.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by biot on Sunday December 23, 2012 @06:32AM (#4959240)

As shardling pointed out[0], the use of "pirates" was editorializing of the title by new user kotakufanb who apparently didn't observe the guidelines ("... please use the original title, unless it is misleading or linkbait") as the word "pirate" appears nowhere on the article.

[0] https://news.ycombinator.com/item?id=4959153

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Fargren on Sunday December 23, 2012 @09:23AM (#4959512)

It was not just that they sold his game without paying him (I understand there's more than enough reason to believe this was a regrettable mistake), it's that they claim that he declined to sell his games when in reality they declined to accept them. That makes him look like he's somewhy opposed to Ubuntu, and it is rather bad PR for him. I understand that he tried to get them to stop doing that, and chose to reply to what he saw as PR attack with bad PR instead of legal action (which probably would have made him look even worse). I don't think it was a very level headed decision, but I don't think what he's doing is wrong.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Juha on Sunday December 23, 2012 @05:25AM (#4959154)

It seems they just wanted some exposure on what Canonical did (aka media justice). They weren't going to sue them or go after them in other ways.

Quote from Ed (http://www.formspring.me/EdmundM/q/406960226210700795): "its not a huge deal, i just dont like being made to look like an asshole so i made my reasons public."

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Maro on Sunday December 23, 2012 @06:08AM (#4959200)

Actually it's worse.

Canonical made pirates of their customers, too.

They downloaded and used a piece of software which they didn't have a license for.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by slowpoke on Sunday December 23, 2012 @11:21AM (#4959783)

>a serious crime

You keep using that word, I don't think it means what you think it means.

Piracy is not a crime, much less a serious one. Murder, for example, is a serious crime. Please don't spout nonsense. Copyright infringement is a civil offense, not even a felony.

That is not to say that what Canonical did - if the accusations are justified - is ethically sound. But please don't spread the bullshit propaganda of certain industry representatives.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by nitrogen on Sunday December 23, 2012 @11:36AM (#4959827)

At least in the US, some forms of copyright infringement are crimes, as demonstrated by the Ninjavideo, TVshack, and Megaupload cases.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by nisse72 on Sunday December 23, 2012 @01:33PM (#4960168)

At least in the case of Megaupload, that remains to be seen.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by chris_wot on Sunday December 23, 2012 @04:56AM (#4959098)

??? I'd hardly call "sold someone else's game without permission or royalties for a year" a "mistake".

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by jacquesm on Sunday December 23, 2012 @05:01AM (#4959106)

I don't see any proof of that in the article. Again, if that's exactly what happened then they should sue them, this kind of trial-by-media isn't the way to resolve this. Canonical may be in the wrong, they may be not with just one side telling their story it could be just a silly communications issue or it could be that canonical's left hand doesn't now what it's right hand is doing. That isn't unusual at all. I'm pretty sure if they had sent Canonical a C&D they would have received an adequate response.

Of course blog posts are cheaper than lawyers but the end result is that they've now made themselves toxic and no distro will touch them from here.

Keep your dirty laundry out of sight until you've exhausted all other avenues seems to be a good rule of business. Once you go down the name calling road there is no turning back.

Mistakes happen, but this blogpost was not a mistake. The intent here is to inflict damage and it will likely be dealt with accordingly.

edit: and it looks like Canonical already paid.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by citricsquid on Sunday December 23, 2012 @04:58AM (#4959101)

seems to be more complex than that, they (Team Meat) wanted SMB in the store but never signed contracts, but canonical put it in the store anyway, so it isn't as if they just saw the game and decided they wanted it... it was a deal being discussed that wasn't completed. Negligent, but not malicious...

http://www.formspring.me/EdmundM/q/406960226210700795

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by raverbashing on Sunday December 23, 2012 @05:02AM (#4959109)

If the deal is not done then you DON'T put it in the Ubuntu Store, period

Sign the papers first

Of course, since Canonical did that, they should try an amicable solution.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by shardling on Sunday December 23, 2012 @05:37AM (#4959167)

No, it's still more complicated than that.

From Ed's posts, it was originally placed in the store as a promotion related to a Humble Indie Bundle.

http://www.formspring.me/EdmundM/q/406960226210700795

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by raverbashing on Sunday December 23, 2012 @05:53AM (#4959189)

I had read this, it seems to all depend on what that "blanket statement" was

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by makomk on Monday December 24, 2012 @04:13AM (#4962340)

For context, this is the Humble Indie Bundle's announcement that all HIB5 games, including Super Meat Boy, would be available for download from the Ubuntu Software Center for HIB owners: http://blog.humblebundle.com/post/24981005928/humble-indie-b...

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by hdra on Sunday December 23, 2012 @06:53AM (#4959273)

Well, miscommunication happens very often. I can't think of any reason Canonical would do this on purpose.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by megablast on Sunday December 23, 2012 @08:38AM (#4959416)

Really? What is someone else pretended to have created the game, and uploaded it to the store?

Would Canonical have made a mistake then?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Tichy on Sunday December 23, 2012 @09:43AM (#4959550)

And Canonical did it because they desperately needed the money, or just because they are plain evil?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by frujka on Sunday December 23, 2012 @10:00AM (#4959585)

Pirates is wrongly re appropriated term, but it certainly fits better to a company selling something belong to someone else without an agreement and keeping all the money than say someone downloading an audio track to preview it before buying if it's good enough (and available enough at a reasonable price).

Anyways there's no mention of piracy in the original statement. It was not intended publicity, it's not as if they made a press release or something, it's just the answer to a question asked to the guy on a website that got picked up.

Here are the original posts: http://www.formspring.me/EdmundM/q/406941407635331564 http://www.formspring.me/EdmundM/q/406945771976419136 http://www.formspring.me/EdmundM/q/406960226210700795

These depicts a whole different situation than the one you seem to have grasped from the kotaku sensationalism.

[ Parent | on HN ]