Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Permission, Has Yet To Pay

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @07:57AM (#4959362)

Pirates is way too heavy a term here.

This is for-profit and closer to true piracy than file sharing is. It could be unintentional, but if they've already been contacted about it they really should be quicker to resolve the situation.

They're also shooting themselves in the foot,

No surprise there, see http://img820.imageshack.us/img820/1641/itsfinetrustme.png for an example of the judgment they've shown.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by phoboslab on Sunday December 23, 2012 @10:59AM (#4959727)

Tommy Refenes has stated in an interview[1] that he said "it's fine" just because at the time he couldn't do anything about it. The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

For us web devs it pretty obvious that anything that can be exploited will be exploited. Tommy was naive about it. Imho, his "it's fine" comment made it worse - what he should have said is "thanks, but I can't fix it right now".

[1] http://www.youtube.com/watch?feature=player_detailpage&v...

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by incision on Sunday December 23, 2012 @05:53PM (#4961014)

>The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

There's simply no way he actually believed that. It reads as a way to further shift blame to the exploiter by painting him as someone who hasn't just exploited an indie game darling, but has taken advantage of their altruism.

>In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

I really wonder if Mr. Hacker would have gone ahead and done that if Tommy hadn't been so smug about blowing the guy off. If "it's fine" was asking for trouble, "I've done this for a while now" was positively begging for it.

I vaguely recall this incident from when it happened, but having recently watched Indie Game The Movie puts a new perspective on it.

That chain of events fits the personalities demonstrated in the documentary like a glove.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by chris_wot on Monday December 24, 2012 @03:37AM (#4962293)

That, my friend, is called spin. I don't believe for one moment that the response "I've done this for years" doesn't smack of eye rolling and dismissiveness.

The right answer would have been "DM me", but that was done by the other side.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by raverbashing on Sunday December 23, 2012 @08:29AM (#4959409)

Here's a lesson, never trust user input!

This is not the first time, and not the last time either.

(I'm waiting for the posts saying they should be using PostgreSQL)

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @08:40AM (#4959422)

(I'm waiting for the posts saying they should be using PostgreSQL)

I'm not that guy, but I've always liked Postgres.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by rcgs on Sunday December 23, 2012 @10:10PM (#4961693)

As someone who likes to understand potential security issues, and who has just embarked upon a project which is using PostgreSQL, what is the subtext of your comment?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by hdra on Sunday December 23, 2012 @08:16AM (#4959389)

what was that? an exploit in the SMB game?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by lutze on Sunday December 23, 2012 @08:44AM (#4959425)

From what I recall of the story, the login for SMB's level database was stored in plaintext in the exe.

That picture is the guy who found it telling the devs, and the devs not understanding why it's a problem.

Cue their database being "hacked" a short while later... and another internet meme is born!

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by smosher on Sunday December 23, 2012 @08:37AM (#4959414)

Yep. MySQL credentials in the binary.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by vially on Sunday December 23, 2012 @11:53AM (#4959879)

Honest question: how could they have avoided that?

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by benwerd on Sunday December 23, 2012 @12:09PM (#4959924)

One obvious, safe way: set up an API on their servers, abstracting away the need to send actual MySQL calls over the Internet.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Sunday December 23, 2012 @03:18PM (#4960503)

While this case is particularly egregious, you are still accepting data from an untrusted remote client.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by xsmasher on Sunday December 23, 2012 @07:11PM (#4961232)

Every public web site on the planet is "accepting data from an untrusted remote client" - but allowing public db access is something else entirely.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Sunday December 23, 2012 @08:37PM (#4961451)

Not every public web site enforces its business logic in client-side JavaScript and just accepts as valid the data that's submitted to a server. Every game that wants to submit a score to a central scoreboard has this problem, and it's a little absurd to debate the exact protocol by which an insecure-by-design architecture gets exploited.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by rictic on Sunday December 23, 2012 @11:06PM (#4961813)

You can submit the input sequence used along with the high score. You've then transformed the problem for the attacker from simply sending up an artificial score to writing a program to solve the game, which is harder and was an existing vulnerability already.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by thom on Monday December 24, 2012 @05:54AM (#4962499)

I thought this was my exact point. I was responding to a comment that replacing the database connection with an API would solve the problem. It wouldn't. Accepting a score from the client is insecure by design.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by makomk on Monday December 24, 2012 @03:58AM (#4962319)

Every game basically has to trust the scores submitted by users. That doesn't mean it should trust users to mess with other users' scores, and it certainly doesn't mean it should trust users to mess with levels that other users have designed.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by uxp on Sunday December 23, 2012 @03:53PM (#4960630)

Yes, but you can fine grain permissions so a unique client can alter a high score that they previously held, but not alter everyone's scores, which is difficult if not completely impossible in MySQL directly, as well as sanitize data to reject wildly incoherent submissions.

The possibilities of pre-formatting data are endless with an API. Not so much with an INSERT statement.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by Zash on Sunday December 23, 2012 @04:17PM (#4960708)

It is entirely possible to build this kind of API in a SQL server with constraints and stored procedures.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by jlgreco on Sunday December 23, 2012 @07:40PM (#4961300)

It's also entirely possible to write a webserver in bash.

[ Parent | on HN ]

Re:Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Per... by sk5t on Sunday December 23, 2012 @12:56PM (#4960069)

If one must directly access the database from a client application, the right way is to make sure each user has an unique, secure database credential with only the minimal permissions necessary. However, direct database access is still a terrible idea in most cases, as it is a lot of work to prevent a resource starvation attack.

[ Parent | on HN ]