11 ms·
A bug I wish I hadn't caught
- sucrose 7y agoCalling this a "bug" is a stretch. Similar to saying `1 == 2` is a bug. Could've been prevented by using distinct ID's in your tables and query criteria. When assigning experience, authenticating, selecting user data, etc., use the user ID. Usernames are just localized, vanity UUID's for client-side pleasure.
- nbulka 7y agoI am a DM. For this campaign, your character choices are limited to: [CPU, Guest, Anonymous, Player 1, Player 2, User, Random, "", undefined]
- Endy 7y agoI fight for the Users!
- TremendousJudge 7y agoRelevant xkcd: https://xkcd.com/1963/ https://xkcd.com/1963/
- aeorgnoieang 7y agoWhatever could he mean by the mouseover text ...
- tshanmu 7y agothis is just an ad?
- geoah 7y agoIt was a nice anekdote, all development will be linked to a project anyway, linking to it just makes sense. Doesn't seem this was targeting a wider audience than devs, and I don't think the main market of the game is devs anyway.
- deckar01 7y agoThe post is lacking any interesting technical information. It is a bland fantasy about how a poorly implemented scoreboard could be exploited. Based on the dramatic title I expected a deep dive into a large corporation's code that resulted in dark secrets of the highest order. Instead I got an API that doesn't have validation...
- ralphstodomingo 7y agoCut the guy some slack. You can get your fill of conspiracy theories elsewhere. I for one enjoy random bouts of small, shallow experiences like these.
- hombre_fatal 7y agoYet it has 145+ net upvotes. Not really the guy's problem that you don't like his post. Your beef is with fellow HN users who upvoted it, but what a waste of time and energy on your part. Relax and enjoy your day as you clock a little bit closer to death.
- digitalni 7y agoPretty much.
- Tomte 7y agoAlmost every article anybody writes is an ad for one thing or another, and be it the person itself. It's a nice story, and maybe you could just not grudge him a few thousand eyeballs.
- aloknnikhil 7y agoI find it odd there's no user ID instead of the username. But what I find even more concerning is it's not sanitizing the username to protect against SQL injection.
- debaserab2 7y agoHow can you know that there's no sanitization just from this blog post?
- MichaelApproved 7y agoI think OP is getting the wrong idea from the screen shot in the article. There's a pic of an SQL query being run from a terminal. They might be thinking that it's a screen shot from the actual code.
- aloknnikhil 7y agoIt's open source. https://github.com/RoganMurley/Ring-of-Worlds/blob/master/server/src/User.hs https://github.com/RoganMurley/Ring-of-Worlds/blob/master/se...
- anyfoo 7y agoThis looks perfectly fine? Are you referring to the fact that they don't escape special characters like ' in the string? With the proper interfaces, like using prepared statements (which this likely uses in the backend, if this is an actual SQL db), instead of putting queries together just by concatenating strings, escaping strings is not only unnecessary but actively harmful.
- deleted 7y ago[deleted]
- aloknnikhil 7y agohttps://github.com/RoganMurley/Ring-of-Worlds/blob/master/server/src/User.hs https://github.com/RoganMurley/Ring-of-Worlds/blob/master/se... It's all open source
- debaserab2 7y agoApparently there's still a few more bugs left to catch - the game's sign up screen briefly flashes a form then simply goes blank for me.
- nathanvanfleet 7y agoThat's the bug he wished he had caught. All those people from hacker news clicking through to the site but no new signups!
- striking 7y agoSee also: A bug so cool that the development team was reluctant to fix it (https://devblogs.microsoft.com/oldnewthing/20190603-00/?p=102534 https://devblogs.microsoft.com/oldnewthing/20190603-00/?p=10...)
- rxhernandez 7y agoI wonder why they didn't just decide to have a more finite "history" so that they could keep the "parlor trick."
- munificent 7y agoThe parlor trick isn't a useful feature in practice. If a user drags a Note around a bunch, drops it, and then selects undo, what they really want is to undo all the way back to its location at the beginning of the drag. They don't want to rewind the entire drag procedure one pixel at a time. I've dealt with this issue in various tools and level editors a few times. It can be annoying. The fundamental problem is that if your tool has undo (which it should), the cleanest way to architect it is such that every state change goes through undoable operations. But that means that even in the "middle" of an operation like dragging something, or painting a long meandering line, you need to be creating and processing individual undoable steps so that the user can see the operation as it proceeds. But once the operation completes, if they undo, they (usually) want to undo the whole batch of them, not each tiny step. A closer-to-home example of this for most programmers is their text editor. Type a sentence quickly and then hit undo. You don't want that to just undo literally the last character. There are two ways I know to handle this: 1. If memory is less of a concern, I keep the series of individual undoable steps and then wrap them up in a single "multi-step" undoable operation. Then, in the main undo queue, replace them with that wrapper so that they are all processed as a single operation. When you undo the wrapper, it just undoes all of its child steps in reverse order. 2. If memory is more of a concern, I add support for collapsing a series of undoable operations into a new larger one that can represent the entire aggregate change more efficiently. This is more work because you need to write separate code for each kind of operation that can be batched this way.
- 7y ago
- luzjh 7y agoGRID?
- deleted 7y ago[deleted]
- jayventura 7y agoThis is literally that NULL license plate problem! I wonder how many other systems this bug may exist in. (https://news.ycombinator.com/item?id=20676904 https://news.ycombinator.com/item?id=20676904)
- vvpan 7y agoThe point of the story being...?
- LeonM 7y agoSo... the backend of this game queries the database even if the user name is NULL? And the CPU user uses a magic name 'cpu', which is not a reserved name? And apparently the backend is totally okay with a user name that doesn't exist in the database? Either this story is just an ad, or this game has been really badly build and some h4x0r is going to have a field day with this.
- hnModsRDanger 7y agoI believe that is exactly what op is documenting. Don't make the same mistake. For the devs that are older, reminder that this exists.
- jiberwarrior 7y ago>And apparently the backend is totally okay with a user name that doesn't exist in the database? What do you think happens when a previously unregistered user creates an account
- FakeComments 7y agoI think the implication was that the AI player should be a database entity — rather than the system having two concepts of players, such that when an AI player joins, it doesn’t check the DB. An unregistered player can create a DB entry, but the question is about the system supporting unregistered players joining a game — which seems odd to me too.
- newnewpdro 7y agos/or/and/ I got the impression it's both an ad and a poorly implemented game.
- deleted 7y ago[deleted]
- p1necone 7y agoDo you never write bugs?
- hyperpallium 7y agough, vapourbug
- Insanity 7y agoThere have been bugs I wish I hadn't caught for entirely different reasons. Mostly if you find them on Friday before a Monday release and have to crunch to fix it lol
- franze 7y agohttp://lalo.li/lsd/ http://lalo.li/lsd/ is full of bugs. i made a version without glitches. it was only half as fun.
- crimsonalucard 7y agoThis bug is a design smell. They have a "Player" module that can likely be controlled by a human or by an "AI" module. This is good design. The problem here is likely that IO is tightly integrated with Player and every other module as a dependency. This is what can cause the bug to occur. Proper design is for the "Player" module to never depend on IO as a dependency... 1. the player module should be able to output the next gamestate of a game given the action and previous gamestate. 2. The AI should calculate the action when given a gamestate. 3. IO should be a function that when given gamestate, it displays it on the screen, or saves it to the DB. 4. All modules should be unaware of the other modules. No dependencies. Likely the fix that the poster is doing doesn't involve separating the "Player" module from all knowledge of IO, but the fix he is doing is making AI a special case in the "Player" module. This speaks to all kinds of wrong. Following these design patterns over a long period of time leads to code that is "tech debt" heavy and messy. It's an inevitable consequence for programmers who don't know how to design things. Also note that this is normal. I would say 99% of programmers don't know this and are likely doing some garbage like using dependency injection to make every module in the system depend on IO.
- eridius 7y agoPlease don't use the username as your primary key for a user! Usernames change. If your username can't change, you designed your system wrong. Systems that are heavily persisted-comment-based at least have the excuse where changing a username would invalidate old comments referencing that user, but even GitHub still lets you change your username (if you link @-references to users, please store the user's ID in the backend text and only convert it back to a username when displaying; GitHub doesn't take this step but it should). P.S. Hacker News, I'm looking at you.
- Topgamer7 7y agoIf you have strong foreign key constraints you should be able to update the record and let the changes cascade to each affected table.
- logicallee 7y agoCome on, user names don't change. Whether it's Hacker News (as you mention), a reddit username, a skype ID, or your gmail address, nobody expects the "username" to change, it is unique and can't be used if already taken, and everybody uses it as a unique ID on millions of websites without any issue. In fact, I can't name a single service I've ever used (ever!) that lets me change my username.
- scrollaway 7y ago> In fact, I can't name a single service I've ever used (ever!) that lets me change my username. Facebook? Twitter? Instagram? Any of the phone-number-based social apps (which have a poorer UX because of it, but still all allow changing usernames seeing as phone numbers change)? Also I believe Skype does allow changing usernames.
- logicallee 7y agoyou mention Facebook but isn't it just your display name that you can change? your username (the page listed under "username" if you tap your face in the Messenger app, or on the desktop web app, the page you're at if you click your icon with your name next to the search bar) doesn't change, does it? (maybe I'm wrong and it does.)
- lucb1e 7y agoBut... if you really regret taking this out, why not leave it? I don't see how it can do harm. I can imagine players linking the account's profiles to friends going "hah, look at this" and creating more publicity, and people being for either Guest or CPU and talking about it... fun for the players, and good for publicity. Why take this out? And then the post ends there and suggests I should go play the game. But a lot of people already commented that it sounds like an ad.