
A bug I wish I hadn't caught - fagnerbrack
https://roganmurley.com/2019/06/08/the-bug.html
======
striking
See also: A bug so cool that the development team was reluctant to fix it
([https://devblogs.microsoft.com/oldnewthing/20190603-00/?p=10...](https://devblogs.microsoft.com/oldnewthing/20190603-00/?p=102534))

~~~
Unknoob
Reminds me of the old Dota2 Fountain hook glitch. A Valve employee commented
that they deemed it "Too hilarious to fix"[1]

They eventually patched it after a pro player abused it to turn a game around
at the International 3[2]

It's a shame because 6 years later it's still one of the best moments I ever
witnessed in the game.

[1]:
[https://dev.dota2.com/showthread.php?t=2989&p=11512&viewfull...](https://dev.dota2.com/showthread.php?t=2989&p=11512&viewfull=1#post11512)

[2][https://www.youtube.com/watch?v=oB0tUrfDz6A](https://www.youtube.com/watch?v=oB0tUrfDz6A)

~~~
hokumguru
I was really quite disappointed about fountain hooks being removed - they were
an extremely high skill, high risk high reward maneuver. It was also
ridiculously fun to watch NaVi pull it off game after game in TI3 - part of
what made that my favorite year for the spectator aspect of the tournament.

------
nbulka
I am a DM. For this campaign, your character choices are limited to:

[CPU, Guest, Anonymous, Player 1, Player 2, User, Random, "", undefined]

~~~
TremendousJudge
Relevant xkcd: [https://xkcd.com/1963/](https://xkcd.com/1963/)

~~~
aeorgnoieang
Whatever could he mean by the mouseover text ...

~~~
lucb1e
Maybe "xkcd"? Not sure.

~~~
mod
Parent was making a joke about their own name.

------
LeonM
So... the backend of this game queries the database even if the user name is
NULL? And the CPU user uses a magic name 'cpu', which is not a reserved name?
And apparently the backend is totally okay with a user name that doesn't exist
in the database?

Either this story is just an ad, or this game has been really badly build and
some h4x0r is going to have a field day with this.

~~~
jiberwarrior
>And apparently the backend is totally okay with a user name that doesn't
exist in the database?

What do you think happens when a previously unregistered user creates an
account

------
jayventura
This is literally that NULL license plate problem! I wonder how many other
systems this bug may exist in.

([https://news.ycombinator.com/item?id=20676904](https://news.ycombinator.com/item?id=20676904))

------
eridius
Please don't use the username as your primary key for a user!

Usernames change. If your username can't change, you designed your system
wrong.

Systems that are heavily persisted-comment-based at least have the excuse
where changing a username would invalidate old comments referencing that user,
but even GitHub still lets you change your username (if you link @-references
to users, please store the user's ID in the backend text and only convert it
back to a username when displaying; GitHub doesn't take this step but it
should).

P.S. Hacker News, I'm looking at you.

~~~
logicallee
Come on, user names don't change. Whether it's Hacker News (as you mention), a
reddit username, a skype ID, or your gmail address, nobody expects the
"username" to change, it is unique and can't be used if already taken, and
everybody uses it as a unique ID on millions of websites without any issue.

In fact, I can't name a single service I've ever used (ever!) that lets me
change my username.

~~~
scrollaway
> _In fact, I can 't name a single service I've ever used (ever!) that lets me
> change my username._

Facebook? Twitter? Instagram? Any of the phone-number-based social apps (which
have a poorer UX because of it, but still all allow changing usernames seeing
as phone numbers change)? Also I believe Skype does allow changing usernames.

~~~
zaphirplane
Hotmail Gmail Seriously why can’t people change their email and keep the
mailbox. It’s not uncommon to pick a cute or funny email when you are a teen
and want To change when you’ve all grown up

~~~
im3w1l
With an imap client you should be able to download emails from the old
accounts and upload them on the new one.

------
crimsonalucard
This bug is a design smell.

They have a "Player" module that can likely be controlled by a human or by an
"AI" module. This is good design.

The problem here is likely that IO is tightly integrated with Player and every
other module as a dependency. This is what can cause the bug to occur.

Proper design is for the "Player" module to never depend on IO as a
dependency...

1\. the player module should be able to output the next gamestate of a game
given the action and previous gamestate.

2\. The AI should calculate the action when given a gamestate.

3\. IO should be a function that when given gamestate, it displays it on the
screen, or saves it to the DB.

4\. All modules should be unaware of the other modules.

No dependencies.

Likely the fix that the poster is doing doesn't involve separating the
"Player" module from all knowledge of IO, but the fix he is doing is making AI
a special case in the "Player" module. This speaks to all kinds of wrong.

Following these design patterns over a long period of time leads to code that
is "tech debt" heavy and messy. It's an inevitable consequence for programmers
who don't know how to design things. Also note that this is normal. I would
say 99% of programmers don't know this and are likely doing some garbage like
using dependency injection to make every module in the system depend on IO.

------
debaserab2
Apparently there's still a few more bugs left to catch - the game's sign up
screen briefly flashes a form then simply goes blank for me.

~~~
nathanvanfleet
That's the bug he wished he had caught. All those people from hacker news
clicking through to the site but no new signups!

------
sucrose
Calling this a "bug" is a stretch. Similar to saying `1 == 2` is a bug.
Could've been prevented by using distinct ID's in your tables and query
criteria. When assigning experience, authenticating, selecting user data,
etc., use the user ID.

Usernames are just localized, vanity UUID's for client-side pleasure.

------
franze
[http://lalo.li/lsd/](http://lalo.li/lsd/) is full of bugs. i made a version
without glitches. it was only half as fun.

------
lucb1e
But... if you really regret taking this out, why not leave it? I don't see how
it can do harm. I can imagine players linking the account's profiles to
friends going "hah, look at this" and creating more publicity, and people
being for either Guest or CPU and talking about it... fun for the players, and
good for publicity. Why take this out?

And then the post ends there and suggests I should go play the game. But a lot
of people already commented that it sounds like an ad.

------
Insanity
There have been bugs I wish I hadn't caught for entirely different reasons.
Mostly if you find them on Friday before a Monday release and have to crunch
to fix it lol

------
aloknnikhil
I find it odd there's no user ID instead of the username. But what I find even
more concerning is it's not sanitizing the username to protect against SQL
injection.

~~~
debaserab2
How can you know that there's no sanitization just from this blog post?

~~~
MichaelApproved
I think OP is getting the wrong idea from the screen shot in the article.
There's a pic of an SQL query being run from a terminal. They might be
thinking that it's a screen shot from the actual code.

~~~
aloknnikhil
It's open source. [https://github.com/RoganMurley/Ring-of-
Worlds/blob/master/se...](https://github.com/RoganMurley/Ring-of-
Worlds/blob/master/server/src/User.hs)

~~~
anyfoo
This looks perfectly fine? Are you referring to the fact that they don't
escape special characters like ' in the string? With the proper interfaces,
like using prepared statements (which this likely uses in the backend, if this
is an actual SQL db), instead of putting queries together just by
concatenating strings, escaping strings is not only unnecessary but actively
harmful.

------
tshanmu
this is just an ad?

~~~
geoah
It was a nice anekdote, all development will be linked to a project anyway,
linking to it just makes sense. Doesn't seem this was targeting a wider
audience than devs, and I don't think the main market of the game is devs
anyway.

~~~
deckar01
The post is lacking any interesting technical information. It is a bland
fantasy about how a poorly implemented scoreboard could be exploited. Based on
the dramatic title I expected a deep dive into a large corporation's code that
resulted in dark secrets of the highest order. Instead I got an API that
doesn't have validation...

~~~
ralphstodomingo
Cut the guy some slack. You can get your fill of conspiracy theories
elsewhere. I for one enjoy random bouts of small, shallow experiences like
these.

------
hyperpallium
ugh, vapourbug

------
vvpan
The point of the story being...?

