Heisting $20M of Magic: The Gathering Cards in a Single Request
mayer.cool
mayer.cool
This is exceedingly sensible. By including the expected price, the client is saying "the user has agreed to purchase a, b, and c for tootal cost X." That price was the one being displayed to the user, and it was being calculated live on the client as the user fiddled with quantities and whatnot. The actual cost might be totally different if a card's price changes or a sale ends or who knows what, and charging a user a different value than what was displayed is totally unacceptable. It's a sanity check, or alternately a form of optimistic locking. It prevents a whole class of nasty billing bugs.
- explicitly version every change to the store catalogue and require the version to be passed with a purchase, disallowing purchases from old catalogues
- make an expiring signed piece of data (like JWT) for each offer in the store catalogue and require it to be passed back with a purchase, accepting old prices briefly
- make the purchase API two-phase, locking in the price on the first phase and letting the client notice that it changed and potentially neglect to go through with the second phase
And tbh, I think they are okay with 10 hackers are ruining the game, as long as 1 thousand mothers are putting their credit card to pay for gems.
The same concerns apply for a typical shopping cart design. The price can change in between the time when you sent the price to the client, and the time when the user actually decides to buy.
There is a TTL on the shopping cart itself. However, that meant for a period of time you had a frozen cost per-line-item in a shopping cart.
https://twitter.com/dan__mayer/status/1641669864460009472
As others have pointed out there are many games where the items _are_ easily converted back to dollars. Welcome to the beautiful world of game hacking! There are some really great talks about game hacking out there that you should check out, people make bank (and have a lot of fun) with it:
1) https://www.youtube.com/watch?v=ZAUf_ygqsDo 2) https://www.youtube.com/watch?v=QoNdhlLPX-g
It is not all fun and games though, game companies crack down on hackers profiting off of item duping and botting HARD. A bit related is the hacker who sold hardware to help play pirated games for the switch who has to pay Nintendo a third of his salary for eternity:
https://www.videogameschronicle.com/news/switch-hacker-gary-...
So be careful out there. Hack the planet!
Honestly this reads as "how do you do, fellow kids?"
You found a cool bug, then immediately reported it. That's not what the movie is about at all. Please don't corporatize hacker culture.
Disagree with what the poster is saying if you want, but he is accurate that the quote is being misused IMO
The punishment is egregious (esp. jail time), should've been something like 3x his profits, but the guy definitely sold ROMs (and other people's circumvention software!) (which apparently they added their own switch-bricking anti-circumvention to!) for profit.
> The official charges are "Conspiracy to Circumvent Technological Measures and to Traffic in Circumvention Devices" and "Trafficking in Circumvention Devices", both of which are federal felonies in the United States.
Perfectly reasonable to assume the worst about the guy, but given that Nintendo is involved I will assume that anything the government couldn't prove is false.
> this left me stumped as to why the client-side calculation even exists
I suspect it is to validate that the price they showed you in the client was the same price they actually charged you. It seems reasonable enough anyway.
E.g. he starts an LLC, profits stay in the company, company provides meals, vehicle, and phone+plan for the execs, plus travel expenses, and he gets a low salary from which I guess he still has to pay his rent.
Or just plain rent it and sublet it to the CEO for peanuts.
(This is all fun speculation, but Nintendo lawyers aren't idiots - the actual settlement likely covers LLCs, startups, benefits, and all other obvious workarounds. Hell, it probably makes Nintendo entitled to the 30% of unreported cash income and proceeds from crime as well.)
It's unclear from the article what the nature of the payment is. It's described as a "fine" rather than "damages" but also mentions an "agreement with Nintendo".
He might be one tick better if someone else owned the LLC?
I thought the reason for delaying selling of stocks is to avoid capital gains tax, not income tax.
I did a quick google, and most sources seem to support that taxes are due at RSU vesting time, e.g.
> With RSUs, you are taxed when the shares are delivered, which is almost always at vesting. Your taxable income is the market value of the shares at vesting.
https://www.schwab.com/public/eac/resources/articles/rsu_fac...
Why would this be different for the salaries of rich people? Isn't it more that they usually get large amounts of stocks at low prices if they stick with the company for a long time?
> ISO – no tax liability for exercising the option. You pay capital gains tax when you sell your contract or sell the stocks in your option.
> As you can see, there are tax benefits to going with the ISO – you don’t pay any ordinary income tax at any point.
ISO = Incentive Stock Option
https://www.vectorvest.com/blog/options/how-are-stock-option...
The second you convert it to actual money by selling, you get hit with taxes (or Nintendo standing behind your shoulder), and you pay off your responsibilities using a chunk of money you've just received.
I agree.
> Until you sell the contract or the shares from exercising the options, you don't have any actual money
There are other ways of converting them into money, like lending against them. And that is what billionaires are often doing, as it is financially much more attractive. With how things currently are, it would be stupid not to.
That is what I am trying to get across: If we managed to invert the incentives, billionaires might actually sell their stocks, and get taxed on that, rather than finding creative workarounds.
Then the state could profit, instead of banks.
Isn't that essentially the same as reverse-mortgaging a part of your equity in your house (i.e., borrowing money against a chunk of ownership of your house) to get some liquid cash and then paying that off over time (which would make any income used towards paying off that loan also untaxed)? I was under an assumption that this was something that non-billionaire normal people do as well fairly often (disclaimer: i don't own any property myself, so I am not speaking from my own experience with it).
Of course you need to own a property to make use of that, so that would exclude plenty of people (i.e., non-homeowners), but it can be literally any property you own in any location (from California to Oklahoma to wherever else in the US). And the number of homeowners in the US is significantly larger and is more accessible than just billionaires and other megarich people.
Note: my comment talks about this in the context of the US-only, since that's what the rest of the comment chain is discussing + you can probably write a thick book if you tried answering it comprehensively in the context of all countries in the world.
Depends on the details.
For founders and early employees, the 83(b) election[1] can make a huge difference. Basically, you have the option to pay taxes on the value of the stock portion of your compensation at the time of granting, rather than when it vests. For an early stage company, that's basically $0.
I'm not 100% clear on the details, so if you're interested that's 1 good place to look.
---
(They might have if they were over the $12.02m lifetime gift limit but they probably weren’t if they had $12.02m to give away).
Some people clearly like consumption. Many are probably like me where income has gone up reasonably career progression but largely live the same lifestyle as where comfortable many years back. Any increasing excess goes onto the mortgage and savings type deal.
For me I'm happy wearing whatever clothes vs designer and actually like driving an older/cheaper car for zero care factor type thing and have few things I wish to splurge on.
At the same time money really matters as I never want to think about it. Once over a threshold it's low on my motivation and I'd generally choose more interesting work. Below the threshold I will become very motivated with it.
no. communism, wherever introduced, has never worked
By the way, can you think of a country in which taxation is so high that work is disincentivized?
Denmark, this is a very common topic here with many people like doctors saying so
I'm not so sure if we can classify a whole country into one stereotype, and to do so would most definitely be small and close-minded thinking.
I am also curious to hear of any real-world countries where people choose not to work because taxes are too high.
My wife is a teacher, and pay is a huge concern for every single one, except for the handful that are rich, and just doing it for the fun of it.
I would highly recommend “basic economics” by Thomas Sowell. Will explain how profit motivation leads to people producing more with fewer resources. (efficiency) vs anything else that leads to less efficient use of resources.
You're introducing an interesting counterpoint but I feel that it's not the question I was attempting to respond to. I was commenting on the matter of huge taxes demotivating everyone from creating anything.
I am assuming that any more or less reasonable taxation would either decrease the revenue of everyone or decrease the revenue of most of the members of the wealthier N% of the population (as usual, the richest will somehow manage to avoid most taxes). Do you believe that such a scheme would make your wife leave her career for something less creative/generally useful?
> I would highly recommend “basic economics” by Thomas Sowell.
Adding to my looong list of books to read, thanks!
https://kotaku.com/mtg-aftermath-leaks-pinkertons-wotc-magic...
https://old.reddit.com/r/MagicArena/comments/1385b90/heistin...
Your math is wrong. Instead of
(200 * 21474837) % 0xFFFFFFFF
(200 * 21474837) % 0x100000000
I assume it's to detect stale data. What if the price changes while they're looking at the screen? At the very least, you want to make sure the player sees how much they're paying for something if the price changes out from under them.
Another alternative is to honor the price they saw, but that can be more complicated. It's easier to do a price check on the server side, reject the wrong price, then have the client refresh with the correct pricing.
For certain e-commerce sites that would be a big loss. This is largely a solved distributed systems problem and I don’t see how passing the cursor back to the server is any more complex than calculating prices.
There are two M:tG online games, and Arena is the one with no way to transfer currency, cosmetics, or cards between accounts. The other one, M:tG Online, does allow for the ability to trade digital goods between accounts or redeem physical cards and, like grinding/botting on WoW or RuneScape, it's a way to earn reasonable money in South American countries (Brazil and Venezuela are the two I've heard about specifically).
But yeah, integer overflow and not buffer overflow.
One league takes about 1.5-2 hours to play, a challenge 5-8 hours depending on amount of players. 1 tix = $0.90, so you can see how hard it is to make a living.
I think there's only like 3-4,000 of us that play mtgo still, so the level of play is much higher than Arena (or even your average local FNM)
You only make money if you are winning, and in a pool of decent players winning consistently is hard. It is not a classic grinding opportunity
I thought blizzard would find it easy to crack down on gold selling but I guess not, every once in a while he'd dump these massive amounts of gold to some random player he'd never interacted with and wouldn't get banned for it.
These days the way it works is he'd basically be a stringer for some big gold farming site. He'd farm, dump some big chunk to one of their sock accounts, and then they'd take that into bigger blobs of gold that would get banked or eventually parceled off into whatever amount a customer wanted.
The per hour price for his labor was pretty shit, better than in Venezuela of course but if I remember correctly not close to USA's 7$ or whatever it was at the time. It gave him access to USD though which was important, as USD can be used to buy more critical goods than venezuelan cash. Like computer components for example. And it's easily turned into local currency. So any time he could get his hands on usd he was keen.
It seemed like the better money was in levelling, where he'd log in onto your account and just level your character. In wow classic this was worth it cause the leveling gets insanely tedious around 48 to 58 (level cap 60). If you think it's silly to pay someone to play a game for you you're mostly right, but retail wow (the non classic redo) iirc sells level up potions, and so does guild wars 2, so presumably people buy them. Some people are more interested in end game than levelling.
Anyway for level up work he'd have to find a client through personal relationships, so harder to do, but more money cause no middleman. Plus he's just playing the game then which is more fun than grinding for gold.
Right now it sounds like the gold market is bereft, he's saying he can't find buyers right now, not sure what's happening there, but he hasn't grinded gold in months last I checked.
I now hire him on when I can for admin assist work, which I highly recommend doing even if you think you don't need an admin assist. I read Tim Ferris' "4 hour workweek" ages ago and remember him mentioning how an admin assist can save you time in ways you don't realize until you hire one on.
So far for me he's done asset placement in a tile map generator with data entry for a game dev contract we had, some project management related cleanup and admin work, photo editing of RAWs in Darktable (a skill he picked up in about 3 hours and became remarkably good at within two sets of photos), basic accounting and cleanup with data entry, and research with compilation. All for between 10-20usd/hour depending on what he feels comfortable charging (he wanted to charge less than 10 which is just too low for me to be comfortable with). Tldr I highly recommend exploring this sometime, I can recommend my buddy personally of course but there's also agencies and the like. Actually side note, incredibly, his venezuelan bank lets me make payments from my credit card. I have no idea what's happening in that country. I used to have to pay him in eth.
It's really remarkable the ingenuity folks in places like Venezuela have to have to make any kind of money. My buddy will be sniffing out these online working opportunities I'd never have dreamed of.
A good related book is Neal Stephenson's "Reamde," plot of which somewhat revolves around the transfer of digital games currency to real currency.
Makes me think that each HN submission should have two title fields: one for the exact title of the article or blog post or whatever, and one for an accurate consensus driven title!
Or if somehow content creators could be rewarded for accuracy in their headlines.
That is 76 characters too long for HN’s submit form.
>Except not, because I reported this vulnerability to them and it has been patched. Shoutout to the WotC security and engineering teams for being lovely to work with and patching this bug in a timely manner!
A fun writeup on a bug they properly reported. I hope WotC reimbursed them in some way though.
[0] - https://reddit.com/r/MagicArena/comments/1385b90/_/jiwp6jk/?...
There may be something else more complete out there since I last worked on this, no idea.
If you did the same thing in MTGO, where you can actually trade those cards for event tickets, then sell those event tickets to a 3rd party for real money...well, then a bug like this has the potential to mess up that whole economy.
Discloser: former game hacker.
purchaseV2Req.currencyQty = client_PurchaseOption.IntegerCost * quantity;
In C#, this might actually be secure. There is a compiler option that enables overflow checking for all math in your code (but not in your dependencies). But I suppose the decompiler would have put a checked() around the operation in that case.
https://learn.microsoft.com/en-us/dotnet/csharp/language-ref... https://learn.microsoft.com/en-us/dotnet/csharp/language-ref...
That really is an interesting conclusion, because when I think about security, my mind is always like "don’t bother looking, surely there are no low-hanging fruit".
And then an article like this pops up and proves the opposite.
Well done and a nice read.
With all that said though, there's a certain trainer scene that has disappeared. From what I've seen, many have transitioned to the paid/freemium model (see things like WeMod and similar) and thus have to deal with somehow monetizing cheating; that tends to lead to some dark patterns and not so savoury behaviours. It was never the cleanest of scenes, but it feels particularly slimy these days.
I do miss the keygen and trainer chiptunes though.
I'm not so old that I would refer to myself as an 'old fart' in anything but jest, but I remember those times as well. I think it speaks to a broader issue that you almost _need_ to try to make a buck off everything to enjoy some comforts and luxuries.
It's a common practice.
Somewhere between a chuckle and a facepalm.