Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by nadams | Hacker News Reader

Parent Full thread

nadams·

After seeing a popular indie game developer connect directly to MySQL from his game [1] - nothing surprises me anymore.

[1] http://forums.somethingawful.com/showthread.php?noseen=0&thr...

View on HN

Sorry, you must be a registered forums member to view this page.

The short version: Super Meat Boy for PC connected directly to a MySQL database to upload levels created in the level editor. The DB address, username, and password were all stored in plaintext in the binary. The DB user had UPDATE and INSERT permissions, but not DELETE, so the game author figured there was no harm to make that user public.

Contemporary HN thread about it: https://news.ycombinator.com/item?id=3387628

I've seen a serious multitenant business app that manages financial info do this. Except the credentials were root. And also valid for SSH. Users would run a Java applet, which would SELECT from users (after connecting as root) to determine if their login was successful. 7-8 figures per install and this was a "known issue".

https://webcache.googleusercontent.com/search?sourceid=chrom...

I've noticed it does that - I wonder if it locks down a thread after it gets so much traffic?

It's not thread-specific. Individual boards periodically switch from freely viewable to requiring registration to "encourage" people who have been reading for a while to pay up.

Yes, it does. I like to think of it as the the Kyanka Money Printing Algorithm.

Reply on news.ycombinator.com