4 ms·

After seeing a popular indie game developer connect directly to MySQL from his game [1] - nothing surprises me anymore. [1] http://forums.somethingawful.com/sh

by nadams 11y ago

After seeing a popular indie game developer connect directly to MySQL from his game [1] - nothing surprises me anymore. [1] http://forums.somethingawful.com/showthread.php?noseen=0&threadid=2803713&pagenumber=258#post398884189 http://forums.somethingawful.com/showthread.php?noseen=0&thr...

sp332 11y ago
Sorry, you must be a registered forums member to view this page.
- _yy 11y ago
  https://webcache.googleusercontent.com/search?sourceid=chrome-psyapi2&ion=1&espv=2&es_th=1&ie=UTF-8&q=cache%3Ahttp%3A%2F%2Fforums.somethingawful.com%2Fshowthread.php%3Fnoseen%3D0%26threadid%3D2803713%26pagenumber%3D258%23post398884189&oq=cache%3Ahttp%3A%2F%2Fforums.somethingawful.com%2Fshowthread.php%3Fnoseen%3D0%26threadid%3D2803713%26pagenumber%3D258%23post398884189 https://webcache.googleusercontent.com/search?sourceid=chrom...
- coldpie 11y ago
  The short version: Super Meat Boy for PC connected directly to a MySQL database to upload levels created in the level editor. The DB address, username, and password were all stored in plaintext in the binary. The DB user had UPDATE and INSERT permissions, but not DELETE, so the game author figured there was no harm to make that user public. Contemporary HN thread about it: https://news.ycombinator.com/item?id=3387628 https://news.ycombinator.com/item?id=3387628
  - MichaelGG 11y ago
    I've seen a serious multitenant business app that manages financial info do this. Except the credentials were root. And also valid for SSH. Users would run a Java applet, which would SELECT from users (after connecting as root) to determine if their login was successful. 7-8 figures per install and this was a "known issue".
- nadams 11y ago
  I've noticed it does that - I wonder if it locks down a thread after it gets so much traffic?
  - feld 11y ago
    Yes, it does. I like to think of it as the the Kyanka Money Printing Algorithm.
  - plorkyeran 11y ago
    It's not thread-specific. Individual boards periodically switch from freely viewable to requiring registration to "encourage" people who have been reading for a while to pay up.

by nadams 11y ago

sp332 11y ago

Sorry, you must be a registered forums member to view this page.

_yy 11y ago
https://webcache.googleusercontent.com/search?sourceid=chrome-psyapi2&ion=1&espv=2&es_th=1&ie=UTF-8&q=cache%3Ahttp%3A%2F%2Fforums.somethingawful.com%2Fshowthread.php%3Fnoseen%3D0%26threadid%3D2803713%26pagenumber%3D258%23post398884189&oq=cache%3Ahttp%3A%2F%2Fforums.somethingawful.com%2Fshowthread.php%3Fnoseen%3D0%26threadid%3D2803713%26pagenumber%3D258%23post398884189 https://webcache.googleusercontent.com/search?sourceid=chrom...
coldpie 11y ago
The short version: Super Meat Boy for PC connected directly to a MySQL database to upload levels created in the level editor. The DB address, username, and password were all stored in plaintext in the binary. The DB user had UPDATE and INSERT permissions, but not DELETE, so the game author figured there was no harm to make that user public. Contemporary HN thread about it: https://news.ycombinator.com/item?id=3387628 https://news.ycombinator.com/item?id=3387628
- MichaelGG 11y ago
  I've seen a serious multitenant business app that manages financial info do this. Except the credentials were root. And also valid for SSH. Users would run a Java applet, which would SELECT from users (after connecting as root) to determine if their login was successful. 7-8 figures per install and this was a "known issue".
nadams 11y ago
I've noticed it does that - I wonder if it locks down a thread after it gets so much traffic?
- feld 11y ago
  Yes, it does. I like to think of it as the the Kyanka Money Printing Algorithm.
- plorkyeran 11y ago
  It's not thread-specific. Individual boards periodically switch from freely viewable to requiring registration to "encourage" people who have been reading for a while to pay up.