4 ms·

Good catch! We haven't been checking yet for tampering with functions, but we probably should. Don't think of it as a bug so much as a cheatcode you discovered

by alnis 13y ago

Good catch! We haven't been checking yet for tampering with functions, but we probably should. Don't think of it as a bug so much as a cheatcode you discovered :-)

gizmo686 13y ago
Aww, I thought that was to easy. That trick works for basically any level. Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race?
- lawl 13y ago
  Don't use the functions from the map object, but keep a separate function reference for validation? I mean if you want to cheat you always can. But that's not the point. Right now you can cheat using official apis. Just use map._blah() for internal use By the way: Same trick works for keys.
- demallien 13y ago
  Object.defineProperty with 'writable' = false?
  - yuchi 13y ago
    Object.freeze?
- TeMPOraL 13y ago
  > Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race? Let's hope for an arms race - it will be far more fun and educating at the same time.
  - skrebbel 13y ago
    hmm a multi player javascript API tampering arms race game would be pretty awesome too.
- alnis 13y ago
  I just added a feature to the game that watches certain functions and compares them to what they were at the start of the game (during the level validation phase). I'm sure this can still be gamed though.
zenojevski 13y ago
First of all, this is absolutely impressive in concept. Yes, it's too easy that way: map.pO = map.placeObject; map.placeObject = function(x, y, w){ return map.pO(x, y, w=='block'?'empty':w); } Does not even need call. But while you cannot protect from `Function['p'+'rototype']['c'+'all']`, I think using `defineProperty` to stop mucking with the code would go a long way into preventing blatant cheating at little cost. That or enclosed reference funcs. Btw, you trust the level increment counter before succeeding in loading the level. Right now calls are 503ing, so basically I'm [gisting bogus solutions](https://gist.github.com/anonymous/f1b06d63848d6d013e26 https://gist.github.com/anonymous/f1b06d63848d6d013e26) but it's also saving those bogus level ups in localstorage...
ihaveqvestion 13y ago
I did a similar thing for level 6: http://pastebin.com/aScFtgK8 http://pastebin.com/aScFtgK8

by alnis 13y ago

Good catch! We haven't been checking yet for tampering with functions, but we probably should. Don't think of it as a bug so much as a cheatcode you discovered :-)

gizmo686 13y ago

Aww, I thought that was to easy. That trick works for basically any level. Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race?

lawl 13y ago
Don't use the functions from the map object, but keep a separate function reference for validation? I mean if you want to cheat you always can. But that's not the point. Right now you can cheat using official apis. Just use map._blah() for internal use By the way: Same trick works for keys.
demallien 13y ago
Object.defineProperty with 'writable' = false?
- yuchi 13y ago
  Object.freeze?
TeMPOraL 13y ago
> Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race? Let's hope for an arms race - it will be far more fun and educating at the same time.
- skrebbel 13y ago
  hmm a multi player javascript API tampering arms race game would be pretty awesome too.
alnis 13y ago
I just added a feature to the game that watches certain functions and compares them to what they were at the start of the game (during the level validation phase). I'm sure this can still be gamed though.

zenojevski 13y ago

First of all, this is absolutely impressive in concept. Yes, it's too easy that way: map.pO = map.placeObject; map.placeObject = function(x, y, w){ return map.pO(x, y, w=='block'?'empty':w); } Does not even need call. But while you cannot protect from `Function['p'+'rototype']['c'+'all']`, I think using `defineProperty` to stop mucking with the code would go a long way into preventing blatant cheating at little cost. That or enclosed reference funcs. Btw, you trust the level increment counter before succeeding in loading the level. Right now calls are 503ing, so basically I'm [gisting bogus solutions](https://gist.github.com/anonymous/f1b06d63848d6d013e26 https://gist.github.com/anonymous/f1b06d63848d6d013e26) but it's also saving those bogus level ups in localstorage...

ihaveqvestion 13y ago

I did a similar thing for level 6: http://pastebin.com/aScFtgK8 http://pastebin.com/aScFtgK8